1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
6 Copyright (C) 2010 Google Inc.
7 Copyright (C) 2011 ProFUSION Embedded Systems
8 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
9
10 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth L2CAP core. */
27
28 #include <linux/module.h>
29
30 #include <linux/debugfs.h>
31 #include <linux/crc16.h>
32 #include <linux/filter.h>
33
34 #include <net/bluetooth/bluetooth.h>
35 #include <net/bluetooth/hci_core.h>
36 #include <net/bluetooth/l2cap.h>
37
38 #include "smp.h"
39
40 #define LE_FLOWCTL_MAX_CREDITS 65535
41
42 bool disable_ertm;
43 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED);
44
45 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
46
47 static LIST_HEAD(chan_list);
48 static DEFINE_RWLOCK(chan_list_lock);
49
50 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
51 u8 code, u8 ident, u16 dlen, void *data);
52 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
53 void *data);
54 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
55 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
56
57 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
58 struct sk_buff_head *skbs, u8 event);
59 static void l2cap_retrans_timeout(struct work_struct *work);
60 static void l2cap_monitor_timeout(struct work_struct *work);
61 static void l2cap_ack_timeout(struct work_struct *work);
62
bdaddr_type(u8 link_type,u8 bdaddr_type)63 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
64 {
65 if (link_type == LE_LINK) {
66 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
67 return BDADDR_LE_PUBLIC;
68 else
69 return BDADDR_LE_RANDOM;
70 }
71
72 return BDADDR_BREDR;
73 }
74
bdaddr_src_type(struct hci_conn * hcon)75 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
76 {
77 return bdaddr_type(hcon->type, hcon->src_type);
78 }
79
bdaddr_dst_type(struct hci_conn * hcon)80 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
81 {
82 return bdaddr_type(hcon->type, hcon->dst_type);
83 }
84
85 /* ---- L2CAP channels ---- */
86
__l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)87 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
88 u16 cid)
89 {
90 struct l2cap_chan *c;
91
92 list_for_each_entry(c, &conn->chan_l, list) {
93 if (c->dcid == cid)
94 return c;
95 }
96 return NULL;
97 }
98
__l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)99 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
100 u16 cid)
101 {
102 struct l2cap_chan *c;
103
104 list_for_each_entry(c, &conn->chan_l, list) {
105 if (c->scid == cid)
106 return c;
107 }
108 return NULL;
109 }
110
111 /* Find channel with given SCID.
112 * Returns a reference locked channel.
113 */
l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)114 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
115 u16 cid)
116 {
117 struct l2cap_chan *c;
118
119 c = __l2cap_get_chan_by_scid(conn, cid);
120 if (c) {
121 /* Only lock if chan reference is not 0 */
122 c = l2cap_chan_hold_unless_zero(c);
123 if (c)
124 l2cap_chan_lock(c);
125 }
126
127 return c;
128 }
129
130 /* Find channel with given DCID.
131 * Returns a reference locked channel.
132 */
l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)133 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
134 u16 cid)
135 {
136 struct l2cap_chan *c;
137
138 c = __l2cap_get_chan_by_dcid(conn, cid);
139 if (c) {
140 /* Only lock if chan reference is not 0 */
141 c = l2cap_chan_hold_unless_zero(c);
142 if (c)
143 l2cap_chan_lock(c);
144 }
145
146 return c;
147 }
148
__l2cap_get_chan_by_ident(struct l2cap_conn * conn,u8 ident)149 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
150 u8 ident)
151 {
152 struct l2cap_chan *c;
153
154 list_for_each_entry(c, &conn->chan_l, list) {
155 if (c->ident == ident)
156 return c;
157 }
158 return NULL;
159 }
160
__l2cap_global_chan_by_addr(__le16 psm,bdaddr_t * src,u8 src_type)161 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
162 u8 src_type)
163 {
164 struct l2cap_chan *c;
165
166 list_for_each_entry(c, &chan_list, global_l) {
167 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
168 continue;
169
170 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
171 continue;
172
173 if (c->sport == psm && !bacmp(&c->src, src))
174 return c;
175 }
176 return NULL;
177 }
178
l2cap_add_psm(struct l2cap_chan * chan,bdaddr_t * src,__le16 psm)179 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
180 {
181 int err;
182
183 write_lock(&chan_list_lock);
184
185 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
186 err = -EADDRINUSE;
187 goto done;
188 }
189
190 if (psm) {
191 chan->psm = psm;
192 chan->sport = psm;
193 err = 0;
194 } else {
195 u16 p, start, end, incr;
196
197 if (chan->src_type == BDADDR_BREDR) {
198 start = L2CAP_PSM_DYN_START;
199 end = L2CAP_PSM_AUTO_END;
200 incr = 2;
201 } else {
202 start = L2CAP_PSM_LE_DYN_START;
203 end = L2CAP_PSM_LE_DYN_END;
204 incr = 1;
205 }
206
207 err = -EINVAL;
208 for (p = start; p <= end; p += incr)
209 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
210 chan->src_type)) {
211 chan->psm = cpu_to_le16(p);
212 chan->sport = cpu_to_le16(p);
213 err = 0;
214 break;
215 }
216 }
217
218 done:
219 write_unlock(&chan_list_lock);
220 return err;
221 }
222 EXPORT_SYMBOL_GPL(l2cap_add_psm);
223
l2cap_add_scid(struct l2cap_chan * chan,__u16 scid)224 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
225 {
226 write_lock(&chan_list_lock);
227
228 /* Override the defaults (which are for conn-oriented) */
229 chan->omtu = L2CAP_DEFAULT_MTU;
230 chan->chan_type = L2CAP_CHAN_FIXED;
231
232 chan->scid = scid;
233
234 write_unlock(&chan_list_lock);
235
236 return 0;
237 }
238
l2cap_alloc_cid(struct l2cap_conn * conn)239 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
240 {
241 u16 cid, dyn_end;
242
243 if (conn->hcon->type == LE_LINK)
244 dyn_end = L2CAP_CID_LE_DYN_END;
245 else
246 dyn_end = L2CAP_CID_DYN_END;
247
248 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
249 if (!__l2cap_get_chan_by_scid(conn, cid))
250 return cid;
251 }
252
253 return 0;
254 }
255
l2cap_state_change(struct l2cap_chan * chan,int state)256 static void l2cap_state_change(struct l2cap_chan *chan, int state)
257 {
258 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
259 state_to_string(state));
260
261 chan->state = state;
262 chan->ops->state_change(chan, state, 0);
263 }
264
l2cap_state_change_and_error(struct l2cap_chan * chan,int state,int err)265 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
266 int state, int err)
267 {
268 chan->state = state;
269 chan->ops->state_change(chan, chan->state, err);
270 }
271
l2cap_chan_set_err(struct l2cap_chan * chan,int err)272 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
273 {
274 chan->ops->state_change(chan, chan->state, err);
275 }
276
__set_retrans_timer(struct l2cap_chan * chan)277 static void __set_retrans_timer(struct l2cap_chan *chan)
278 {
279 if (!delayed_work_pending(&chan->monitor_timer) &&
280 chan->retrans_timeout) {
281 l2cap_set_timer(chan, &chan->retrans_timer,
282 msecs_to_jiffies(chan->retrans_timeout));
283 }
284 }
285
__set_monitor_timer(struct l2cap_chan * chan)286 static void __set_monitor_timer(struct l2cap_chan *chan)
287 {
288 __clear_retrans_timer(chan);
289 if (chan->monitor_timeout) {
290 l2cap_set_timer(chan, &chan->monitor_timer,
291 msecs_to_jiffies(chan->monitor_timeout));
292 }
293 }
294
l2cap_ertm_seq_in_queue(struct sk_buff_head * head,u16 seq)295 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
296 u16 seq)
297 {
298 struct sk_buff *skb;
299
300 skb_queue_walk(head, skb) {
301 if (bt_cb(skb)->l2cap.txseq == seq)
302 return skb;
303 }
304
305 return NULL;
306 }
307
308 /* ---- L2CAP sequence number lists ---- */
309
310 /* For ERTM, ordered lists of sequence numbers must be tracked for
311 * SREJ requests that are received and for frames that are to be
312 * retransmitted. These seq_list functions implement a singly-linked
313 * list in an array, where membership in the list can also be checked
314 * in constant time. Items can also be added to the tail of the list
315 * and removed from the head in constant time, without further memory
316 * allocs or frees.
317 */
318
l2cap_seq_list_init(struct l2cap_seq_list * seq_list,u16 size)319 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
320 {
321 size_t alloc_size, i;
322
323 /* Allocated size is a power of 2 to map sequence numbers
324 * (which may be up to 14 bits) in to a smaller array that is
325 * sized for the negotiated ERTM transmit windows.
326 */
327 alloc_size = roundup_pow_of_two(size);
328
329 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
330 if (!seq_list->list)
331 return -ENOMEM;
332
333 seq_list->mask = alloc_size - 1;
334 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
335 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
336 for (i = 0; i < alloc_size; i++)
337 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
338
339 return 0;
340 }
341
l2cap_seq_list_free(struct l2cap_seq_list * seq_list)342 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
343 {
344 kfree(seq_list->list);
345 }
346
l2cap_seq_list_contains(struct l2cap_seq_list * seq_list,u16 seq)347 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
348 u16 seq)
349 {
350 /* Constant-time check for list membership */
351 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
352 }
353
l2cap_seq_list_pop(struct l2cap_seq_list * seq_list)354 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
355 {
356 u16 seq = seq_list->head;
357 u16 mask = seq_list->mask;
358
359 seq_list->head = seq_list->list[seq & mask];
360 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
361
362 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
363 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
364 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
365 }
366
367 return seq;
368 }
369
l2cap_seq_list_clear(struct l2cap_seq_list * seq_list)370 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
371 {
372 u16 i;
373
374 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
375 return;
376
377 for (i = 0; i <= seq_list->mask; i++)
378 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
379
380 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
381 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
382 }
383
l2cap_seq_list_append(struct l2cap_seq_list * seq_list,u16 seq)384 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
385 {
386 u16 mask = seq_list->mask;
387
388 /* All appends happen in constant time */
389
390 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
391 return;
392
393 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
394 seq_list->head = seq;
395 else
396 seq_list->list[seq_list->tail & mask] = seq;
397
398 seq_list->tail = seq;
399 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
400 }
401
l2cap_chan_timeout(struct work_struct * work)402 static void l2cap_chan_timeout(struct work_struct *work)
403 {
404 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
405 chan_timer.work);
406 struct l2cap_conn *conn = chan->conn;
407 int reason;
408
409 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
410
411 if (test_bit(FLAG_DEL, &chan->flags)) {
412 l2cap_chan_put(chan);
413 return;
414 }
415
416 mutex_lock(&conn->lock);
417 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
418 * this work. No need to call l2cap_chan_hold(chan) here again.
419 */
420 l2cap_chan_lock(chan);
421
422 if (test_bit(FLAG_DEL, &chan->flags))
423 goto unlock;
424
425 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
426 reason = ECONNREFUSED;
427 else if (chan->state == BT_CONNECT &&
428 chan->sec_level != BT_SECURITY_SDP)
429 reason = ECONNREFUSED;
430 else
431 reason = ETIMEDOUT;
432
433 l2cap_chan_close(chan, reason);
434
435 chan->ops->close(chan);
436
437 unlock:
438 l2cap_chan_unlock(chan);
439 mutex_unlock(&conn->lock);
440 l2cap_chan_put(chan);
441 }
442
l2cap_chan_create(void)443 struct l2cap_chan *l2cap_chan_create(void)
444 {
445 struct l2cap_chan *chan;
446
447 chan = kzalloc_obj(*chan, GFP_ATOMIC);
448 if (!chan)
449 return NULL;
450
451 skb_queue_head_init(&chan->tx_q);
452 skb_queue_head_init(&chan->srej_q);
453 mutex_init(&chan->lock);
454
455 /* Set default lock nesting level */
456 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
457
458 /* Available receive buffer space is initially unknown */
459 chan->rx_avail = -1;
460
461 write_lock(&chan_list_lock);
462 list_add(&chan->global_l, &chan_list);
463 write_unlock(&chan_list_lock);
464
465 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
466 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
467 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
468 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
469
470 chan->state = BT_OPEN;
471
472 kref_init(&chan->kref);
473
474 /* This flag is cleared in l2cap_chan_ready() */
475 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
476
477 BT_DBG("chan %p", chan);
478
479 return chan;
480 }
481 EXPORT_SYMBOL_GPL(l2cap_chan_create);
482
l2cap_chan_destroy(struct kref * kref)483 static void l2cap_chan_destroy(struct kref *kref)
484 {
485 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
486
487 BT_DBG("chan %p", chan);
488
489 write_lock(&chan_list_lock);
490 list_del(&chan->global_l);
491 write_unlock(&chan_list_lock);
492
493 if (chan->conn)
494 l2cap_conn_put(chan->conn);
495
496 kfree(chan);
497 }
498
l2cap_chan_hold(struct l2cap_chan * c)499 void l2cap_chan_hold(struct l2cap_chan *c)
500 {
501 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
502
503 kref_get(&c->kref);
504 }
505 EXPORT_SYMBOL_GPL(l2cap_chan_hold);
506
l2cap_chan_hold_unless_zero(struct l2cap_chan * c)507 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
508 {
509 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
510
511 if (!kref_get_unless_zero(&c->kref))
512 return NULL;
513
514 return c;
515 }
516
l2cap_chan_put(struct l2cap_chan * c)517 void l2cap_chan_put(struct l2cap_chan *c)
518 {
519 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
520
521 kref_put(&c->kref, l2cap_chan_destroy);
522 }
523 EXPORT_SYMBOL_GPL(l2cap_chan_put);
524
525 /* Initialise @chan with default values, inheriting from the parent channel
526 * @pchan when it is given.
527 */
l2cap_chan_set_defaults(struct l2cap_chan * chan,struct l2cap_chan * pchan)528 void l2cap_chan_set_defaults(struct l2cap_chan *chan, struct l2cap_chan *pchan)
529 {
530 chan->fcs = L2CAP_FCS_CRC16;
531 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
532 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
533 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
534 chan->remote_max_tx = chan->max_tx;
535 chan->remote_tx_win = chan->tx_win;
536 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
537 chan->sec_level = BT_SECURITY_LOW;
538 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
539 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
540 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
541
542 if (pchan) {
543 BT_DBG("chan %p pchan %p", chan, pchan);
544
545 chan->chan_type = pchan->chan_type;
546 chan->imtu = pchan->imtu;
547 chan->omtu = pchan->omtu;
548 chan->mode = pchan->mode;
549 chan->fcs = pchan->fcs;
550 chan->max_tx = pchan->max_tx;
551 chan->tx_win = pchan->tx_win;
552 chan->tx_win_max = pchan->tx_win_max;
553 chan->sec_level = pchan->sec_level;
554 chan->conf_state = pchan->conf_state;
555 chan->flags = pchan->flags;
556 chan->tx_credits = pchan->tx_credits;
557 chan->rx_credits = pchan->rx_credits;
558
559 if (chan->chan_type == L2CAP_CHAN_FIXED) {
560 chan->scid = pchan->scid;
561 chan->dcid = pchan->scid;
562 }
563
564 return;
565 }
566
567 chan->conf_state = 0;
568 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
569
570 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
571 }
572 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
573
l2cap_le_rx_credits(struct l2cap_chan * chan)574 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan)
575 {
576 size_t sdu_len = chan->sdu ? chan->sdu->len : 0;
577
578 if (chan->mps == 0)
579 return 0;
580
581 /* If we don't know the available space in the receiver buffer, give
582 * enough credits for a full packet.
583 */
584 if (chan->rx_avail == -1)
585 return (chan->imtu / chan->mps) + 1;
586
587 /* If we know how much space is available in the receive buffer, give
588 * out as many credits as would fill the buffer.
589 */
590 if (chan->rx_avail <= sdu_len)
591 return 0;
592
593 return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps);
594 }
595
l2cap_le_flowctl_init(struct l2cap_chan * chan,u16 tx_credits)596 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
597 {
598 chan->sdu = NULL;
599 chan->sdu_last_frag = NULL;
600 chan->sdu_len = 0;
601 chan->tx_credits = tx_credits;
602 /* Derive MPS from connection MTU to stop HCI fragmentation */
603 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
604 chan->rx_credits = l2cap_le_rx_credits(chan);
605
606 skb_queue_head_init(&chan->tx_q);
607 }
608
l2cap_ecred_init(struct l2cap_chan * chan,u16 tx_credits)609 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
610 {
611 l2cap_le_flowctl_init(chan, tx_credits);
612
613 /* L2CAP implementations shall support a minimum MPS of 64 octets */
614 if (chan->mps < L2CAP_ECRED_MIN_MPS) {
615 chan->mps = L2CAP_ECRED_MIN_MPS;
616 chan->rx_credits = l2cap_le_rx_credits(chan);
617 }
618 }
619
__l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)620 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
621 {
622 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
623 __le16_to_cpu(chan->psm), chan->dcid);
624
625 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
626
627 chan->conn = l2cap_conn_get(conn);
628
629 switch (chan->chan_type) {
630 case L2CAP_CHAN_CONN_ORIENTED:
631 /* Alloc CID for connection-oriented socket */
632 chan->scid = l2cap_alloc_cid(conn);
633 if (conn->hcon->type == ACL_LINK)
634 chan->omtu = L2CAP_DEFAULT_MTU;
635 break;
636
637 case L2CAP_CHAN_CONN_LESS:
638 /* Connectionless socket */
639 chan->scid = L2CAP_CID_CONN_LESS;
640 chan->dcid = L2CAP_CID_CONN_LESS;
641 chan->omtu = L2CAP_DEFAULT_MTU;
642 break;
643
644 case L2CAP_CHAN_FIXED:
645 /* Caller will set CID and CID specific MTU values */
646 break;
647
648 default:
649 /* Raw socket can send/recv signalling messages only */
650 chan->scid = L2CAP_CID_SIGNALING;
651 chan->dcid = L2CAP_CID_SIGNALING;
652 chan->omtu = L2CAP_DEFAULT_MTU;
653 }
654
655 chan->local_id = L2CAP_BESTEFFORT_ID;
656 chan->local_stype = L2CAP_SERV_BESTEFFORT;
657 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
658 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
659 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
660 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
661
662 l2cap_chan_hold(chan);
663
664 /* Only keep a reference for fixed channels if they requested it */
665 if (chan->chan_type != L2CAP_CHAN_FIXED ||
666 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
667 hci_conn_hold(conn->hcon);
668
669 /* Append to the list since the order matters for ECRED */
670 list_add_tail(&chan->list, &conn->chan_l);
671 }
672
l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)673 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
674 {
675 mutex_lock(&conn->lock);
676 __l2cap_chan_add(conn, chan);
677 mutex_unlock(&conn->lock);
678 }
679
l2cap_chan_del(struct l2cap_chan * chan,int err)680 void l2cap_chan_del(struct l2cap_chan *chan, int err)
681 {
682 __clear_chan_timer(chan);
683
684 BT_DBG("chan %p, err %d, state %s", chan, err,
685 state_to_string(chan->state));
686
687 chan->ops->teardown(chan, err);
688
689 if (!test_and_set_bit(FLAG_DEL, &chan->flags)) {
690 /* Delete from channel list */
691 list_del(&chan->list);
692
693 l2cap_chan_put(chan);
694
695 /* Reference was only held for non-fixed channels or
696 * fixed channels that explicitly requested it using the
697 * FLAG_HOLD_HCI_CONN flag.
698 */
699 if (chan->chan_type != L2CAP_CHAN_FIXED ||
700 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
701 hci_conn_drop(chan->conn->hcon);
702 }
703
704 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
705 return;
706
707 switch (chan->mode) {
708 case L2CAP_MODE_BASIC:
709 break;
710
711 case L2CAP_MODE_LE_FLOWCTL:
712 case L2CAP_MODE_EXT_FLOWCTL:
713 skb_queue_purge(&chan->tx_q);
714 break;
715
716 case L2CAP_MODE_ERTM:
717 __clear_retrans_timer(chan);
718 __clear_monitor_timer(chan);
719 __clear_ack_timer(chan);
720
721 skb_queue_purge(&chan->srej_q);
722
723 l2cap_seq_list_free(&chan->srej_list);
724 l2cap_seq_list_free(&chan->retrans_list);
725 fallthrough;
726
727 case L2CAP_MODE_STREAMING:
728 skb_queue_purge(&chan->tx_q);
729 break;
730 }
731 }
732 EXPORT_SYMBOL_GPL(l2cap_chan_del);
733
__l2cap_chan_list_id(struct l2cap_conn * conn,u16 id,l2cap_chan_func_t func,void * data)734 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
735 l2cap_chan_func_t func, void *data)
736 {
737 struct l2cap_chan *chan, *l;
738
739 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
740 if (chan->ident == id)
741 func(chan, data);
742 }
743 }
744
__l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)745 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
746 void *data)
747 {
748 struct l2cap_chan *chan;
749
750 list_for_each_entry(chan, &conn->chan_l, list) {
751 func(chan, data);
752 }
753 }
754
l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)755 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
756 void *data)
757 {
758 if (!conn)
759 return;
760
761 mutex_lock(&conn->lock);
762 __l2cap_chan_list(conn, func, data);
763 mutex_unlock(&conn->lock);
764 }
765
766 EXPORT_SYMBOL_GPL(l2cap_chan_list);
767
l2cap_conn_update_id_addr(struct work_struct * work)768 static void l2cap_conn_update_id_addr(struct work_struct *work)
769 {
770 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
771 id_addr_timer.work);
772 struct hci_conn *hcon = conn->hcon;
773 struct l2cap_chan *chan;
774
775 mutex_lock(&conn->lock);
776
777 list_for_each_entry(chan, &conn->chan_l, list) {
778 l2cap_chan_lock(chan);
779 bacpy(&chan->dst, &hcon->dst);
780 chan->dst_type = bdaddr_dst_type(hcon);
781 l2cap_chan_unlock(chan);
782 }
783
784 mutex_unlock(&conn->lock);
785 }
786
l2cap_chan_le_connect_reject(struct l2cap_chan * chan)787 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
788 {
789 struct l2cap_conn *conn = chan->conn;
790 struct l2cap_le_conn_rsp rsp;
791 u16 result;
792
793 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
794 result = L2CAP_CR_LE_AUTHORIZATION;
795 else
796 result = L2CAP_CR_LE_BAD_PSM;
797
798 l2cap_state_change(chan, BT_DISCONN);
799
800 rsp.dcid = cpu_to_le16(chan->scid);
801 rsp.mtu = cpu_to_le16(chan->imtu);
802 rsp.mps = cpu_to_le16(chan->mps);
803 rsp.credits = cpu_to_le16(chan->rx_credits);
804 rsp.result = cpu_to_le16(result);
805
806 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
807 &rsp);
808 }
809
l2cap_chan_ecred_connect_reject(struct l2cap_chan * chan)810 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
811 {
812 l2cap_state_change(chan, BT_DISCONN);
813
814 __l2cap_ecred_conn_rsp_defer(chan);
815 }
816
l2cap_chan_connect_reject(struct l2cap_chan * chan)817 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
818 {
819 struct l2cap_conn *conn = chan->conn;
820 struct l2cap_conn_rsp rsp;
821 u16 result;
822
823 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
824 result = L2CAP_CR_SEC_BLOCK;
825 else
826 result = L2CAP_CR_BAD_PSM;
827
828 l2cap_state_change(chan, BT_DISCONN);
829
830 rsp.scid = cpu_to_le16(chan->dcid);
831 rsp.dcid = cpu_to_le16(chan->scid);
832 rsp.result = cpu_to_le16(result);
833 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
834
835 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
836 }
837
l2cap_chan_close(struct l2cap_chan * chan,int reason)838 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
839 {
840 struct l2cap_conn *conn = chan->conn;
841
842 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
843
844 switch (chan->state) {
845 case BT_LISTEN:
846 chan->ops->teardown(chan, 0);
847 break;
848
849 case BT_CONNECTED:
850 case BT_CONFIG:
851 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
852 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
853 l2cap_send_disconn_req(chan, reason);
854 } else
855 l2cap_chan_del(chan, reason);
856 break;
857
858 case BT_CONNECT2:
859 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
860 if (conn->hcon->type == ACL_LINK)
861 l2cap_chan_connect_reject(chan);
862 else if (conn->hcon->type == LE_LINK) {
863 switch (chan->mode) {
864 case L2CAP_MODE_LE_FLOWCTL:
865 l2cap_chan_le_connect_reject(chan);
866 break;
867 case L2CAP_MODE_EXT_FLOWCTL:
868 l2cap_chan_ecred_connect_reject(chan);
869 return;
870 }
871 }
872 }
873
874 l2cap_chan_del(chan, reason);
875 break;
876
877 case BT_CONNECT:
878 case BT_DISCONN:
879 l2cap_chan_del(chan, reason);
880 break;
881
882 default:
883 chan->ops->teardown(chan, 0);
884 break;
885 }
886 }
887 EXPORT_SYMBOL(l2cap_chan_close);
888
l2cap_get_auth_type(struct l2cap_chan * chan)889 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
890 {
891 switch (chan->chan_type) {
892 case L2CAP_CHAN_RAW:
893 switch (chan->sec_level) {
894 case BT_SECURITY_HIGH:
895 case BT_SECURITY_FIPS:
896 return HCI_AT_DEDICATED_BONDING_MITM;
897 case BT_SECURITY_MEDIUM:
898 return HCI_AT_DEDICATED_BONDING;
899 default:
900 return HCI_AT_NO_BONDING;
901 }
902 break;
903 case L2CAP_CHAN_CONN_LESS:
904 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
905 if (chan->sec_level == BT_SECURITY_LOW)
906 chan->sec_level = BT_SECURITY_SDP;
907 }
908 if (chan->sec_level == BT_SECURITY_HIGH ||
909 chan->sec_level == BT_SECURITY_FIPS)
910 return HCI_AT_NO_BONDING_MITM;
911 else
912 return HCI_AT_NO_BONDING;
913 break;
914 case L2CAP_CHAN_CONN_ORIENTED:
915 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
916 if (chan->sec_level == BT_SECURITY_LOW)
917 chan->sec_level = BT_SECURITY_SDP;
918
919 if (chan->sec_level == BT_SECURITY_HIGH ||
920 chan->sec_level == BT_SECURITY_FIPS)
921 return HCI_AT_NO_BONDING_MITM;
922 else
923 return HCI_AT_NO_BONDING;
924 }
925 fallthrough;
926
927 default:
928 switch (chan->sec_level) {
929 case BT_SECURITY_HIGH:
930 case BT_SECURITY_FIPS:
931 return HCI_AT_GENERAL_BONDING_MITM;
932 case BT_SECURITY_MEDIUM:
933 return HCI_AT_GENERAL_BONDING;
934 default:
935 return HCI_AT_NO_BONDING;
936 }
937 break;
938 }
939 }
940
941 /* Service level security */
l2cap_chan_check_security(struct l2cap_chan * chan,bool initiator)942 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
943 {
944 struct l2cap_conn *conn = chan->conn;
945 __u8 auth_type;
946
947 if (conn->hcon->type == LE_LINK)
948 return smp_conn_security(conn->hcon, chan->sec_level);
949
950 auth_type = l2cap_get_auth_type(chan);
951
952 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
953 initiator);
954 }
955
l2cap_get_ident(struct l2cap_conn * conn)956 static int l2cap_get_ident(struct l2cap_conn *conn)
957 {
958 u8 max;
959 int ident;
960
961 /* LE link does not support tools like l2ping so use the full range */
962 if (conn->hcon->type == LE_LINK)
963 max = 255;
964 /* Get next available identificator.
965 * 1 - 128 are used by kernel.
966 * 129 - 199 are reserved.
967 * 200 - 254 are used by utilities like l2ping, etc.
968 */
969 else
970 max = 128;
971
972 /* Allocate ident using min as last used + 1 (cyclic) */
973 ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1,
974 max, GFP_ATOMIC);
975 /* Force min 1 to start over */
976 if (ident <= 0) {
977 ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
978 if (ident <= 0) {
979 /* If all idents are in use, log an error, this is
980 * extremely unlikely to happen and would indicate a bug
981 * in the code that idents are not being freed properly.
982 */
983 BT_ERR("Unable to allocate ident: %d", ident);
984 return 0;
985 }
986 }
987
988 WRITE_ONCE(conn->tx_ident, ident);
989
990 return ident;
991 }
992
l2cap_send_acl(struct l2cap_conn * conn,struct sk_buff * skb,u8 flags)993 static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb,
994 u8 flags)
995 {
996 /* Check if the hcon still valid before attempting to send */
997 if (hci_conn_valid(conn->hcon->hdev, conn->hcon))
998 hci_send_acl(conn->hchan, skb, flags);
999 else
1000 kfree_skb(skb);
1001 }
1002
l2cap_send_cmd(struct l2cap_conn * conn,u8 ident,u8 code,u16 len,void * data)1003 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
1004 void *data)
1005 {
1006 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
1007 u8 flags;
1008
1009 BT_DBG("code 0x%2.2x", code);
1010
1011 if (!skb)
1012 return;
1013
1014 /* Use NO_FLUSH if supported or we have an LE link (which does
1015 * not support auto-flushing packets) */
1016 if (lmp_no_flush_capable(conn->hcon->hdev) ||
1017 conn->hcon->type == LE_LINK)
1018 flags = ACL_START_NO_FLUSH;
1019 else
1020 flags = ACL_START;
1021
1022 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
1023 skb->priority = HCI_PRIO_MAX;
1024
1025 l2cap_send_acl(conn, skb, flags);
1026 }
1027
l2cap_do_send(struct l2cap_chan * chan,struct sk_buff * skb)1028 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
1029 {
1030 struct hci_conn *hcon = chan->conn->hcon;
1031 u16 flags;
1032
1033 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
1034 skb->priority);
1035
1036 /* Use NO_FLUSH for LE links (where this is the only option) or
1037 * if the BR/EDR link supports it and flushing has not been
1038 * explicitly requested (through FLAG_FLUSHABLE).
1039 */
1040 if (hcon->type == LE_LINK ||
1041 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
1042 lmp_no_flush_capable(hcon->hdev)))
1043 flags = ACL_START_NO_FLUSH;
1044 else
1045 flags = ACL_START;
1046
1047 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1048 hci_send_acl(chan->conn->hchan, skb, flags);
1049 }
1050
__unpack_enhanced_control(u16 enh,struct l2cap_ctrl * control)1051 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
1052 {
1053 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
1054 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
1055
1056 if (enh & L2CAP_CTRL_FRAME_TYPE) {
1057 /* S-Frame */
1058 control->sframe = 1;
1059 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1060 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1061
1062 control->sar = 0;
1063 control->txseq = 0;
1064 } else {
1065 /* I-Frame */
1066 control->sframe = 0;
1067 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1068 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1069
1070 control->poll = 0;
1071 control->super = 0;
1072 }
1073 }
1074
__unpack_extended_control(u32 ext,struct l2cap_ctrl * control)1075 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1076 {
1077 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1078 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1079
1080 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1081 /* S-Frame */
1082 control->sframe = 1;
1083 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1084 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1085
1086 control->sar = 0;
1087 control->txseq = 0;
1088 } else {
1089 /* I-Frame */
1090 control->sframe = 0;
1091 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1092 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1093
1094 control->poll = 0;
1095 control->super = 0;
1096 }
1097 }
1098
__unpack_control(struct l2cap_chan * chan,struct sk_buff * skb)1099 static inline void __unpack_control(struct l2cap_chan *chan,
1100 struct sk_buff *skb)
1101 {
1102 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1103 __unpack_extended_control(get_unaligned_le32(skb->data),
1104 &bt_cb(skb)->l2cap);
1105 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1106 } else {
1107 __unpack_enhanced_control(get_unaligned_le16(skb->data),
1108 &bt_cb(skb)->l2cap);
1109 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1110 }
1111 }
1112
__pack_extended_control(struct l2cap_ctrl * control)1113 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1114 {
1115 u32 packed;
1116
1117 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1118 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1119
1120 if (control->sframe) {
1121 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1122 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1123 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1124 } else {
1125 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1126 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1127 }
1128
1129 return packed;
1130 }
1131
__pack_enhanced_control(struct l2cap_ctrl * control)1132 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1133 {
1134 u16 packed;
1135
1136 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1137 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1138
1139 if (control->sframe) {
1140 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1141 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1142 packed |= L2CAP_CTRL_FRAME_TYPE;
1143 } else {
1144 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1145 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1146 }
1147
1148 return packed;
1149 }
1150
__pack_control(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)1151 static inline void __pack_control(struct l2cap_chan *chan,
1152 struct l2cap_ctrl *control,
1153 struct sk_buff *skb)
1154 {
1155 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1156 put_unaligned_le32(__pack_extended_control(control),
1157 skb->data + L2CAP_HDR_SIZE);
1158 } else {
1159 put_unaligned_le16(__pack_enhanced_control(control),
1160 skb->data + L2CAP_HDR_SIZE);
1161 }
1162 }
1163
__ertm_hdr_size(struct l2cap_chan * chan)1164 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1165 {
1166 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1167 return L2CAP_EXT_HDR_SIZE;
1168 else
1169 return L2CAP_ENH_HDR_SIZE;
1170 }
1171
l2cap_create_sframe_pdu(struct l2cap_chan * chan,u32 control)1172 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1173 u32 control)
1174 {
1175 struct sk_buff *skb;
1176 struct l2cap_hdr *lh;
1177 int hlen = __ertm_hdr_size(chan);
1178
1179 if (chan->fcs == L2CAP_FCS_CRC16)
1180 hlen += L2CAP_FCS_SIZE;
1181
1182 skb = bt_skb_alloc(hlen, GFP_KERNEL);
1183
1184 if (!skb)
1185 return ERR_PTR(-ENOMEM);
1186
1187 lh = skb_put(skb, L2CAP_HDR_SIZE);
1188 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1189 lh->cid = cpu_to_le16(chan->dcid);
1190
1191 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1192 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1193 else
1194 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1195
1196 if (chan->fcs == L2CAP_FCS_CRC16) {
1197 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1198 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1199 }
1200
1201 skb->priority = HCI_PRIO_MAX;
1202 return skb;
1203 }
1204
l2cap_send_sframe(struct l2cap_chan * chan,struct l2cap_ctrl * control)1205 static void l2cap_send_sframe(struct l2cap_chan *chan,
1206 struct l2cap_ctrl *control)
1207 {
1208 struct sk_buff *skb;
1209 u32 control_field;
1210
1211 BT_DBG("chan %p, control %p", chan, control);
1212
1213 if (!control->sframe)
1214 return;
1215
1216 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1217 !control->poll)
1218 control->final = 1;
1219
1220 if (control->super == L2CAP_SUPER_RR)
1221 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1222 else if (control->super == L2CAP_SUPER_RNR)
1223 set_bit(CONN_RNR_SENT, &chan->conn_state);
1224
1225 if (control->super != L2CAP_SUPER_SREJ) {
1226 chan->last_acked_seq = control->reqseq;
1227 __clear_ack_timer(chan);
1228 }
1229
1230 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1231 control->final, control->poll, control->super);
1232
1233 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1234 control_field = __pack_extended_control(control);
1235 else
1236 control_field = __pack_enhanced_control(control);
1237
1238 skb = l2cap_create_sframe_pdu(chan, control_field);
1239 if (!IS_ERR(skb))
1240 l2cap_do_send(chan, skb);
1241 }
1242
l2cap_send_rr_or_rnr(struct l2cap_chan * chan,bool poll)1243 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1244 {
1245 struct l2cap_ctrl control;
1246
1247 BT_DBG("chan %p, poll %d", chan, poll);
1248
1249 memset(&control, 0, sizeof(control));
1250 control.sframe = 1;
1251 control.poll = poll;
1252
1253 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1254 control.super = L2CAP_SUPER_RNR;
1255 else
1256 control.super = L2CAP_SUPER_RR;
1257
1258 control.reqseq = chan->buffer_seq;
1259 l2cap_send_sframe(chan, &control);
1260 }
1261
__l2cap_no_conn_pending(struct l2cap_chan * chan)1262 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1263 {
1264 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1265 return true;
1266
1267 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1268 }
1269
l2cap_send_conn_req(struct l2cap_chan * chan)1270 void l2cap_send_conn_req(struct l2cap_chan *chan)
1271 {
1272 struct l2cap_conn *conn = chan->conn;
1273 struct l2cap_conn_req req;
1274
1275 req.scid = cpu_to_le16(chan->scid);
1276 req.psm = chan->psm;
1277
1278 chan->ident = l2cap_get_ident(conn);
1279
1280 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1281
1282 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1283 }
1284
l2cap_chan_ready(struct l2cap_chan * chan)1285 static void l2cap_chan_ready(struct l2cap_chan *chan)
1286 {
1287 /* The channel may have already been flagged as connected in
1288 * case of receiving data before the L2CAP info req/rsp
1289 * procedure is complete.
1290 */
1291 if (chan->state == BT_CONNECTED)
1292 return;
1293
1294 /* This clears all conf flags, including CONF_NOT_COMPLETE */
1295 chan->conf_state = 0;
1296 __clear_chan_timer(chan);
1297
1298 switch (chan->mode) {
1299 case L2CAP_MODE_LE_FLOWCTL:
1300 case L2CAP_MODE_EXT_FLOWCTL:
1301 if (!chan->tx_credits)
1302 chan->ops->suspend(chan);
1303 break;
1304 }
1305
1306 chan->state = BT_CONNECTED;
1307
1308 chan->ops->ready(chan);
1309 }
1310
l2cap_le_connect(struct l2cap_chan * chan)1311 static void l2cap_le_connect(struct l2cap_chan *chan)
1312 {
1313 struct l2cap_conn *conn = chan->conn;
1314 struct l2cap_le_conn_req req;
1315
1316 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1317 return;
1318
1319 if (!chan->imtu)
1320 chan->imtu = chan->conn->mtu;
1321
1322 l2cap_le_flowctl_init(chan, 0);
1323
1324 memset(&req, 0, sizeof(req));
1325 req.psm = chan->psm;
1326 req.scid = cpu_to_le16(chan->scid);
1327 req.mtu = cpu_to_le16(chan->imtu);
1328 req.mps = cpu_to_le16(chan->mps);
1329 req.credits = cpu_to_le16(chan->rx_credits);
1330
1331 chan->ident = l2cap_get_ident(conn);
1332
1333 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1334 sizeof(req), &req);
1335 }
1336
1337 struct l2cap_ecred_conn_data {
1338 struct {
1339 struct l2cap_ecred_conn_req_hdr req;
1340 __le16 scid[5];
1341 } __packed pdu;
1342 struct l2cap_chan *chan;
1343 struct pid *pid;
1344 int count;
1345 };
1346
l2cap_ecred_defer_connect(struct l2cap_chan * chan,void * data)1347 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1348 {
1349 struct l2cap_ecred_conn_data *conn = data;
1350 struct pid *pid;
1351
1352 if (chan == conn->chan)
1353 return;
1354
1355 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1356 return;
1357
1358 pid = chan->ops->get_peer_pid(chan);
1359
1360 /* Only add deferred channels with the same PID/PSM */
1361 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1362 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1363 return;
1364
1365 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1366 return;
1367
1368 l2cap_ecred_init(chan, 0);
1369
1370 /* Set the same ident so we can match on the rsp */
1371 chan->ident = conn->chan->ident;
1372
1373 /* Include all channels deferred */
1374 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1375
1376 conn->count++;
1377 }
1378
l2cap_ecred_connect(struct l2cap_chan * chan)1379 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1380 {
1381 struct l2cap_conn *conn = chan->conn;
1382 struct l2cap_ecred_conn_data data;
1383
1384 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1385 return;
1386
1387 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1388 return;
1389
1390 l2cap_ecred_init(chan, 0);
1391
1392 memset(&data, 0, sizeof(data));
1393 data.pdu.req.psm = chan->psm;
1394 data.pdu.req.mtu = cpu_to_le16(chan->imtu);
1395 data.pdu.req.mps = cpu_to_le16(chan->mps);
1396 data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1397 data.pdu.scid[0] = cpu_to_le16(chan->scid);
1398
1399 chan->ident = l2cap_get_ident(conn);
1400
1401 data.count = 1;
1402 data.chan = chan;
1403 data.pid = chan->ops->get_peer_pid(chan);
1404
1405 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1406
1407 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1408 sizeof(data.pdu.req) + data.count * sizeof(__le16),
1409 &data.pdu);
1410 }
1411
l2cap_le_start(struct l2cap_chan * chan)1412 static void l2cap_le_start(struct l2cap_chan *chan)
1413 {
1414 struct l2cap_conn *conn = chan->conn;
1415
1416 if (!smp_conn_security(conn->hcon, chan->sec_level))
1417 return;
1418
1419 if (!chan->psm) {
1420 l2cap_chan_ready(chan);
1421 return;
1422 }
1423
1424 if (chan->state == BT_CONNECT) {
1425 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1426 l2cap_ecred_connect(chan);
1427 else
1428 l2cap_le_connect(chan);
1429 }
1430 }
1431
l2cap_start_connection(struct l2cap_chan * chan)1432 static void l2cap_start_connection(struct l2cap_chan *chan)
1433 {
1434 if (chan->conn->hcon->type == LE_LINK) {
1435 l2cap_le_start(chan);
1436 } else {
1437 l2cap_send_conn_req(chan);
1438 }
1439 }
1440
l2cap_request_info(struct l2cap_conn * conn)1441 static void l2cap_request_info(struct l2cap_conn *conn)
1442 {
1443 struct l2cap_info_req req;
1444
1445 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1446 return;
1447
1448 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1449
1450 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1451 conn->info_ident = l2cap_get_ident(conn);
1452
1453 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1454
1455 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1456 sizeof(req), &req);
1457 }
1458
l2cap_check_enc_key_size(struct hci_conn * hcon,struct l2cap_chan * chan)1459 static bool l2cap_check_enc_key_size(struct hci_conn *hcon,
1460 struct l2cap_chan *chan)
1461 {
1462 /* The minimum encryption key size needs to be enforced by the
1463 * host stack before establishing any L2CAP connections. The
1464 * specification in theory allows a minimum of 1, but to align
1465 * BR/EDR and LE transports, a minimum of 7 is chosen.
1466 *
1467 * This check might also be called for unencrypted connections
1468 * that have no key size requirements. Ensure that the link is
1469 * actually encrypted before enforcing a key size.
1470 */
1471 int min_key_size = hcon->hdev->min_enc_key_size;
1472
1473 /* On FIPS security level, key size must be 16 bytes */
1474 if (chan->sec_level == BT_SECURITY_FIPS)
1475 min_key_size = 16;
1476
1477 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1478 hcon->enc_key_size >= min_key_size);
1479 }
1480
l2cap_do_start(struct l2cap_chan * chan)1481 static void l2cap_do_start(struct l2cap_chan *chan)
1482 {
1483 struct l2cap_conn *conn = chan->conn;
1484
1485 if (conn->hcon->type == LE_LINK) {
1486 l2cap_le_start(chan);
1487 return;
1488 }
1489
1490 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1491 l2cap_request_info(conn);
1492 return;
1493 }
1494
1495 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1496 return;
1497
1498 if (!l2cap_chan_check_security(chan, true) ||
1499 !__l2cap_no_conn_pending(chan))
1500 return;
1501
1502 if (l2cap_check_enc_key_size(conn->hcon, chan))
1503 l2cap_start_connection(chan);
1504 else
1505 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1506 }
1507
l2cap_mode_supported(__u8 mode,__u32 feat_mask)1508 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1509 {
1510 u32 local_feat_mask = l2cap_feat_mask;
1511 if (!disable_ertm)
1512 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1513
1514 switch (mode) {
1515 case L2CAP_MODE_ERTM:
1516 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1517 case L2CAP_MODE_STREAMING:
1518 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1519 default:
1520 return 0x00;
1521 }
1522 }
1523
l2cap_send_disconn_req(struct l2cap_chan * chan,int err)1524 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1525 {
1526 struct l2cap_conn *conn = chan->conn;
1527 struct l2cap_disconn_req req;
1528
1529 if (!conn)
1530 return;
1531
1532 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1533 __clear_retrans_timer(chan);
1534 __clear_monitor_timer(chan);
1535 __clear_ack_timer(chan);
1536 }
1537
1538 req.dcid = cpu_to_le16(chan->dcid);
1539 req.scid = cpu_to_le16(chan->scid);
1540 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1541 sizeof(req), &req);
1542
1543 l2cap_state_change_and_error(chan, BT_DISCONN, err);
1544 }
1545
1546 /* ---- L2CAP connections ---- */
l2cap_conn_start(struct l2cap_conn * conn)1547 static void l2cap_conn_start(struct l2cap_conn *conn)
1548 {
1549 struct l2cap_chan *chan, *tmp;
1550
1551 BT_DBG("conn %p", conn);
1552
1553 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1554 l2cap_chan_lock(chan);
1555
1556 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1557 l2cap_chan_ready(chan);
1558 l2cap_chan_unlock(chan);
1559 continue;
1560 }
1561
1562 if (chan->state == BT_CONNECT) {
1563 if (!l2cap_chan_check_security(chan, true) ||
1564 !__l2cap_no_conn_pending(chan)) {
1565 l2cap_chan_unlock(chan);
1566 continue;
1567 }
1568
1569 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1570 && test_bit(CONF_STATE2_DEVICE,
1571 &chan->conf_state)) {
1572 l2cap_chan_close(chan, ECONNRESET);
1573 l2cap_chan_unlock(chan);
1574 continue;
1575 }
1576
1577 if (l2cap_check_enc_key_size(conn->hcon, chan))
1578 l2cap_start_connection(chan);
1579 else
1580 l2cap_chan_close(chan, ECONNREFUSED);
1581
1582 } else if (chan->state == BT_CONNECT2) {
1583 struct l2cap_conn_rsp rsp;
1584 char buf[128];
1585 rsp.scid = cpu_to_le16(chan->dcid);
1586 rsp.dcid = cpu_to_le16(chan->scid);
1587
1588 if (l2cap_chan_check_security(chan, false)) {
1589 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1590 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1591 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1592 chan->ops->defer(chan);
1593
1594 } else {
1595 l2cap_state_change(chan, BT_CONFIG);
1596 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1597 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1598 }
1599 } else {
1600 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1601 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1602 }
1603
1604 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1605 sizeof(rsp), &rsp);
1606
1607 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1608 rsp.result != L2CAP_CR_SUCCESS) {
1609 l2cap_chan_unlock(chan);
1610 continue;
1611 }
1612
1613 set_bit(CONF_REQ_SENT, &chan->conf_state);
1614 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1615 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1616 chan->num_conf_req++;
1617 }
1618
1619 l2cap_chan_unlock(chan);
1620 }
1621 }
1622
l2cap_le_conn_ready(struct l2cap_conn * conn)1623 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1624 {
1625 struct hci_conn *hcon = conn->hcon;
1626 struct hci_dev *hdev = hcon->hdev;
1627
1628 BT_DBG("%s conn %p", hdev->name, conn);
1629
1630 /* For outgoing pairing which doesn't necessarily have an
1631 * associated socket (e.g. mgmt_pair_device).
1632 */
1633 if (hcon->out)
1634 smp_conn_security(hcon, hcon->pending_sec_level);
1635
1636 /* For LE peripheral connections, make sure the connection interval
1637 * is in the range of the minimum and maximum interval that has
1638 * been configured for this connection. If not, then trigger
1639 * the connection update procedure.
1640 */
1641 if (hcon->role == HCI_ROLE_SLAVE &&
1642 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1643 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1644 struct l2cap_conn_param_update_req req;
1645
1646 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1647 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1648 req.latency = cpu_to_le16(hcon->le_conn_latency);
1649 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1650
1651 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1652 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1653 }
1654 }
1655
l2cap_conn_ready(struct l2cap_conn * conn)1656 static void l2cap_conn_ready(struct l2cap_conn *conn)
1657 {
1658 struct l2cap_chan *chan;
1659 struct hci_conn *hcon = conn->hcon;
1660
1661 BT_DBG("conn %p", conn);
1662
1663 if (hcon->type == ACL_LINK)
1664 l2cap_request_info(conn);
1665
1666 mutex_lock(&conn->lock);
1667
1668 list_for_each_entry(chan, &conn->chan_l, list) {
1669
1670 l2cap_chan_lock(chan);
1671
1672 if (hcon->type == LE_LINK) {
1673 l2cap_le_start(chan);
1674 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1675 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1676 l2cap_chan_ready(chan);
1677 } else if (chan->state == BT_CONNECT) {
1678 l2cap_do_start(chan);
1679 }
1680
1681 l2cap_chan_unlock(chan);
1682 }
1683
1684 mutex_unlock(&conn->lock);
1685
1686 if (hcon->type == LE_LINK)
1687 l2cap_le_conn_ready(conn);
1688
1689 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1690 }
1691
1692 /* Notify sockets that we cannot guaranty reliability anymore */
l2cap_conn_unreliable(struct l2cap_conn * conn,int err)1693 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1694 {
1695 struct l2cap_chan *chan;
1696
1697 BT_DBG("conn %p", conn);
1698
1699 list_for_each_entry(chan, &conn->chan_l, list) {
1700 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1701 l2cap_chan_set_err(chan, err);
1702 }
1703 }
1704
l2cap_info_timeout(struct work_struct * work)1705 static void l2cap_info_timeout(struct work_struct *work)
1706 {
1707 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1708 info_timer.work);
1709
1710 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1711 conn->info_ident = 0;
1712
1713 mutex_lock(&conn->lock);
1714 l2cap_conn_start(conn);
1715 mutex_unlock(&conn->lock);
1716 }
1717
1718 /*
1719 * l2cap_user
1720 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1721 * callback is called during registration. The ->remove callback is called
1722 * during unregistration.
1723 * An l2cap_user object can either be explicitly unregistered or when the
1724 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1725 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1726 * External modules must own a reference to the l2cap_conn object if they intend
1727 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1728 * any time if they don't.
1729 */
1730
l2cap_register_user(struct l2cap_conn * conn,struct l2cap_user * user)1731 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1732 {
1733 int ret;
1734
1735 /* We need to check whether l2cap_conn is registered. If it is not, we
1736 * must not register the l2cap_user. l2cap_conn_del() unregisters
1737 * l2cap_conn objects under conn->lock, and we use the same lock here
1738 * to protect access to conn->users and conn->hchan.
1739 */
1740
1741 mutex_lock(&conn->lock);
1742
1743 if (!list_empty(&user->list)) {
1744 ret = -EINVAL;
1745 goto out_unlock;
1746 }
1747
1748 /* conn->hchan is NULL after l2cap_conn_del() was called */
1749 if (!conn->hchan) {
1750 ret = -ENODEV;
1751 goto out_unlock;
1752 }
1753
1754 ret = user->probe(conn, user);
1755 if (ret)
1756 goto out_unlock;
1757
1758 list_add(&user->list, &conn->users);
1759 ret = 0;
1760
1761 out_unlock:
1762 mutex_unlock(&conn->lock);
1763 return ret;
1764 }
1765 EXPORT_SYMBOL(l2cap_register_user);
1766
l2cap_unregister_user(struct l2cap_conn * conn,struct l2cap_user * user)1767 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1768 {
1769 mutex_lock(&conn->lock);
1770
1771 if (list_empty(&user->list))
1772 goto out_unlock;
1773
1774 list_del_init(&user->list);
1775 user->remove(conn, user);
1776
1777 out_unlock:
1778 mutex_unlock(&conn->lock);
1779 }
1780 EXPORT_SYMBOL(l2cap_unregister_user);
1781
l2cap_unregister_all_users(struct l2cap_conn * conn)1782 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1783 {
1784 struct l2cap_user *user;
1785
1786 while (!list_empty(&conn->users)) {
1787 user = list_first_entry(&conn->users, struct l2cap_user, list);
1788 list_del_init(&user->list);
1789 user->remove(conn, user);
1790 }
1791 }
1792
l2cap_conn_del(struct hci_conn * hcon,int err)1793 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1794 __must_hold(&hcon->hdev->lock)
1795 {
1796 struct l2cap_conn *conn = hcon->l2cap_data;
1797 struct l2cap_chan *chan, *l;
1798
1799 if (!conn)
1800 return;
1801
1802 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1803
1804 disable_delayed_work_sync(&conn->info_timer);
1805 disable_delayed_work_sync(&conn->id_addr_timer);
1806
1807 cancel_work_sync(&conn->pending_rx_work);
1808
1809 mutex_lock(&conn->lock);
1810
1811 kfree_skb(conn->rx_skb);
1812
1813 skb_queue_purge(&conn->pending_rx);
1814 ida_destroy(&conn->tx_ida);
1815
1816 l2cap_unregister_all_users(conn);
1817
1818 /* Force the connection to be immediately dropped */
1819 hcon->disc_timeout = 0;
1820
1821 /* Kill channels */
1822 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1823 l2cap_chan_hold(chan);
1824 l2cap_chan_lock(chan);
1825
1826 l2cap_chan_del(chan, err);
1827
1828 chan->ops->close(chan);
1829
1830 l2cap_chan_unlock(chan);
1831 l2cap_chan_put(chan);
1832 }
1833
1834 hci_chan_del(conn->hchan);
1835 conn->hchan = NULL;
1836
1837 spin_lock(&hcon->proto_lock);
1838 hcon->l2cap_data = NULL;
1839 spin_unlock(&hcon->proto_lock);
1840
1841 mutex_unlock(&conn->lock);
1842 l2cap_conn_put(conn);
1843 }
1844
l2cap_conn_free(struct kref * ref)1845 static void l2cap_conn_free(struct kref *ref)
1846 {
1847 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1848
1849 hci_conn_put(conn->hcon);
1850 kfree(conn);
1851 }
1852
l2cap_conn_get(struct l2cap_conn * conn)1853 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1854 {
1855 kref_get(&conn->ref);
1856 return conn;
1857 }
1858 EXPORT_SYMBOL(l2cap_conn_get);
1859
l2cap_conn_put(struct l2cap_conn * conn)1860 void l2cap_conn_put(struct l2cap_conn *conn)
1861 {
1862 kref_put(&conn->ref, l2cap_conn_free);
1863 }
1864 EXPORT_SYMBOL(l2cap_conn_put);
1865
1866 /* ---- Socket interface ---- */
1867
1868 /* Find socket with psm and source / destination bdaddr.
1869 * Returns closest match.
1870 */
l2cap_global_chan_by_psm(int state,__le16 psm,bdaddr_t * src,bdaddr_t * dst,u8 link_type)1871 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1872 bdaddr_t *src,
1873 bdaddr_t *dst,
1874 u8 link_type)
1875 {
1876 struct l2cap_chan *c, *tmp, *c1 = NULL;
1877
1878 read_lock(&chan_list_lock);
1879
1880 list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1881 if (state && c->state != state)
1882 continue;
1883
1884 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1885 continue;
1886
1887 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1888 continue;
1889
1890 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
1891 int src_match, dst_match;
1892 int src_any, dst_any;
1893
1894 /* Exact match. */
1895 src_match = !bacmp(&c->src, src);
1896 dst_match = !bacmp(&c->dst, dst);
1897 if (src_match && dst_match) {
1898 if (!l2cap_chan_hold_unless_zero(c))
1899 continue;
1900
1901 read_unlock(&chan_list_lock);
1902 return c;
1903 }
1904
1905 /* Closest match */
1906 src_any = !bacmp(&c->src, BDADDR_ANY);
1907 dst_any = !bacmp(&c->dst, BDADDR_ANY);
1908 if ((src_match && dst_any) || (src_any && dst_match) ||
1909 (src_any && dst_any))
1910 c1 = c;
1911 }
1912 }
1913
1914 if (c1)
1915 c1 = l2cap_chan_hold_unless_zero(c1);
1916
1917 read_unlock(&chan_list_lock);
1918
1919 return c1;
1920 }
1921
l2cap_monitor_timeout(struct work_struct * work)1922 static void l2cap_monitor_timeout(struct work_struct *work)
1923 {
1924 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1925 monitor_timer.work);
1926
1927 BT_DBG("chan %p", chan);
1928
1929 l2cap_chan_lock(chan);
1930
1931 if (test_bit(FLAG_DEL, &chan->flags)) {
1932 l2cap_chan_unlock(chan);
1933 l2cap_chan_put(chan);
1934 return;
1935 }
1936
1937 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1938
1939 l2cap_chan_unlock(chan);
1940 l2cap_chan_put(chan);
1941 }
1942
l2cap_retrans_timeout(struct work_struct * work)1943 static void l2cap_retrans_timeout(struct work_struct *work)
1944 {
1945 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1946 retrans_timer.work);
1947
1948 BT_DBG("chan %p", chan);
1949
1950 l2cap_chan_lock(chan);
1951
1952 if (test_bit(FLAG_DEL, &chan->flags)) {
1953 l2cap_chan_unlock(chan);
1954 l2cap_chan_put(chan);
1955 return;
1956 }
1957
1958 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1959 l2cap_chan_unlock(chan);
1960 l2cap_chan_put(chan);
1961 }
1962
l2cap_streaming_send(struct l2cap_chan * chan,struct sk_buff_head * skbs)1963 static void l2cap_streaming_send(struct l2cap_chan *chan,
1964 struct sk_buff_head *skbs)
1965 {
1966 struct sk_buff *skb;
1967 struct l2cap_ctrl *control;
1968
1969 BT_DBG("chan %p, skbs %p", chan, skbs);
1970
1971 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1972
1973 while (!skb_queue_empty(&chan->tx_q)) {
1974
1975 skb = skb_dequeue(&chan->tx_q);
1976
1977 bt_cb(skb)->l2cap.retries = 1;
1978 control = &bt_cb(skb)->l2cap;
1979
1980 control->reqseq = 0;
1981 control->txseq = chan->next_tx_seq;
1982
1983 __pack_control(chan, control, skb);
1984
1985 if (chan->fcs == L2CAP_FCS_CRC16) {
1986 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1987 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1988 }
1989
1990 l2cap_do_send(chan, skb);
1991
1992 BT_DBG("Sent txseq %u", control->txseq);
1993
1994 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1995 chan->frames_sent++;
1996 }
1997 }
1998
l2cap_ertm_send(struct l2cap_chan * chan)1999 static int l2cap_ertm_send(struct l2cap_chan *chan)
2000 {
2001 struct sk_buff *skb, *tx_skb;
2002 struct l2cap_ctrl *control;
2003 int sent = 0;
2004
2005 BT_DBG("chan %p", chan);
2006
2007 if (chan->state != BT_CONNECTED)
2008 return -ENOTCONN;
2009
2010 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2011 return 0;
2012
2013 while (chan->tx_send_head &&
2014 chan->unacked_frames < chan->remote_tx_win &&
2015 chan->tx_state == L2CAP_TX_STATE_XMIT) {
2016
2017 skb = chan->tx_send_head;
2018
2019 bt_cb(skb)->l2cap.retries = 1;
2020 control = &bt_cb(skb)->l2cap;
2021
2022 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2023 control->final = 1;
2024
2025 control->reqseq = chan->buffer_seq;
2026 chan->last_acked_seq = chan->buffer_seq;
2027 control->txseq = chan->next_tx_seq;
2028
2029 __pack_control(chan, control, skb);
2030
2031 if (chan->fcs == L2CAP_FCS_CRC16) {
2032 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2033 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
2034 }
2035
2036 /* Clone after data has been modified. Data is assumed to be
2037 read-only (for locking purposes) on cloned sk_buffs.
2038 */
2039 tx_skb = skb_clone(skb, GFP_KERNEL);
2040
2041 if (!tx_skb)
2042 break;
2043
2044 __set_retrans_timer(chan);
2045
2046 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2047 chan->unacked_frames++;
2048 chan->frames_sent++;
2049 sent++;
2050
2051 if (skb_queue_is_last(&chan->tx_q, skb))
2052 chan->tx_send_head = NULL;
2053 else
2054 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2055
2056 l2cap_do_send(chan, tx_skb);
2057 BT_DBG("Sent txseq %u", control->txseq);
2058 }
2059
2060 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2061 chan->unacked_frames, skb_queue_len(&chan->tx_q));
2062
2063 return sent;
2064 }
2065
l2cap_ertm_resend(struct l2cap_chan * chan)2066 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2067 {
2068 struct l2cap_ctrl control;
2069 struct sk_buff *skb;
2070 struct sk_buff *tx_skb;
2071 u16 seq;
2072
2073 BT_DBG("chan %p", chan);
2074
2075 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2076 return;
2077
2078 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2079 seq = l2cap_seq_list_pop(&chan->retrans_list);
2080
2081 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2082 if (!skb) {
2083 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2084 seq);
2085 continue;
2086 }
2087
2088 bt_cb(skb)->l2cap.retries++;
2089 control = bt_cb(skb)->l2cap;
2090
2091 if (chan->max_tx != 0 &&
2092 bt_cb(skb)->l2cap.retries > chan->max_tx) {
2093 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2094 l2cap_send_disconn_req(chan, ECONNRESET);
2095 l2cap_seq_list_clear(&chan->retrans_list);
2096 break;
2097 }
2098
2099 control.reqseq = chan->buffer_seq;
2100 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2101 control.final = 1;
2102 else
2103 control.final = 0;
2104
2105 if (skb_cloned(skb)) {
2106 /* Cloned sk_buffs are read-only, so we need a
2107 * writeable copy
2108 */
2109 tx_skb = skb_copy(skb, GFP_KERNEL);
2110 } else {
2111 tx_skb = skb_clone(skb, GFP_KERNEL);
2112 }
2113
2114 if (!tx_skb) {
2115 l2cap_seq_list_clear(&chan->retrans_list);
2116 break;
2117 }
2118
2119 /* Update skb contents */
2120 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2121 put_unaligned_le32(__pack_extended_control(&control),
2122 tx_skb->data + L2CAP_HDR_SIZE);
2123 } else {
2124 put_unaligned_le16(__pack_enhanced_control(&control),
2125 tx_skb->data + L2CAP_HDR_SIZE);
2126 }
2127
2128 /* Update FCS */
2129 if (chan->fcs == L2CAP_FCS_CRC16) {
2130 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2131 tx_skb->len - L2CAP_FCS_SIZE);
2132 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2133 L2CAP_FCS_SIZE);
2134 }
2135
2136 l2cap_do_send(chan, tx_skb);
2137
2138 BT_DBG("Resent txseq %d", control.txseq);
2139
2140 chan->last_acked_seq = chan->buffer_seq;
2141 }
2142 }
2143
l2cap_retransmit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2144 static void l2cap_retransmit(struct l2cap_chan *chan,
2145 struct l2cap_ctrl *control)
2146 {
2147 BT_DBG("chan %p, control %p", chan, control);
2148
2149 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2150 l2cap_ertm_resend(chan);
2151 }
2152
l2cap_retransmit_all(struct l2cap_chan * chan,struct l2cap_ctrl * control)2153 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2154 struct l2cap_ctrl *control)
2155 {
2156 struct sk_buff *skb;
2157
2158 BT_DBG("chan %p, control %p", chan, control);
2159
2160 if (control->poll)
2161 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2162
2163 l2cap_seq_list_clear(&chan->retrans_list);
2164
2165 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2166 return;
2167
2168 if (chan->unacked_frames) {
2169 skb_queue_walk(&chan->tx_q, skb) {
2170 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2171 skb == chan->tx_send_head)
2172 break;
2173 }
2174
2175 skb_queue_walk_from(&chan->tx_q, skb) {
2176 if (skb == chan->tx_send_head)
2177 break;
2178
2179 l2cap_seq_list_append(&chan->retrans_list,
2180 bt_cb(skb)->l2cap.txseq);
2181 }
2182
2183 l2cap_ertm_resend(chan);
2184 }
2185 }
2186
l2cap_send_ack(struct l2cap_chan * chan)2187 static void l2cap_send_ack(struct l2cap_chan *chan)
2188 {
2189 struct l2cap_ctrl control;
2190 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2191 chan->last_acked_seq);
2192 int threshold;
2193
2194 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2195 chan, chan->last_acked_seq, chan->buffer_seq);
2196
2197 memset(&control, 0, sizeof(control));
2198 control.sframe = 1;
2199
2200 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2201 chan->rx_state == L2CAP_RX_STATE_RECV) {
2202 __clear_ack_timer(chan);
2203 control.super = L2CAP_SUPER_RNR;
2204 control.reqseq = chan->buffer_seq;
2205 l2cap_send_sframe(chan, &control);
2206 } else {
2207 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2208 l2cap_ertm_send(chan);
2209 /* If any i-frames were sent, they included an ack */
2210 if (chan->buffer_seq == chan->last_acked_seq)
2211 frames_to_ack = 0;
2212 }
2213
2214 /* Ack now if the window is 3/4ths full.
2215 * Calculate without mul or div
2216 */
2217 threshold = chan->ack_win;
2218 threshold += threshold << 1;
2219 threshold >>= 2;
2220
2221 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2222 threshold);
2223
2224 if (frames_to_ack >= threshold) {
2225 __clear_ack_timer(chan);
2226 control.super = L2CAP_SUPER_RR;
2227 control.reqseq = chan->buffer_seq;
2228 l2cap_send_sframe(chan, &control);
2229 frames_to_ack = 0;
2230 }
2231
2232 if (frames_to_ack)
2233 __set_ack_timer(chan);
2234 }
2235 }
2236
l2cap_skbuff_fromiovec(struct l2cap_chan * chan,struct msghdr * msg,int len,int count,struct sk_buff * skb)2237 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2238 struct msghdr *msg, int len,
2239 int count, struct sk_buff *skb)
2240 {
2241 struct l2cap_conn *conn = chan->conn;
2242 struct sk_buff **frag;
2243 int sent = 0;
2244
2245 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2246 return -EFAULT;
2247
2248 sent += count;
2249 len -= count;
2250
2251 /* Continuation fragments (no L2CAP header) */
2252 frag = &skb_shinfo(skb)->frag_list;
2253 while (len) {
2254 struct sk_buff *tmp;
2255
2256 count = min_t(unsigned int, conn->mtu, len);
2257
2258 tmp = chan->ops->alloc_skb(chan, 0, count,
2259 msg->msg_flags & MSG_DONTWAIT);
2260 if (IS_ERR(tmp))
2261 return PTR_ERR(tmp);
2262
2263 *frag = tmp;
2264
2265 if (!copy_from_iter_full(skb_put(*frag, count), count,
2266 &msg->msg_iter))
2267 return -EFAULT;
2268
2269 sent += count;
2270 len -= count;
2271
2272 skb->len += (*frag)->len;
2273 skb->data_len += (*frag)->len;
2274
2275 frag = &(*frag)->next;
2276 }
2277
2278 return sent;
2279 }
2280
l2cap_create_connless_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2281 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2282 struct msghdr *msg, size_t len)
2283 {
2284 struct l2cap_conn *conn = chan->conn;
2285 struct sk_buff *skb;
2286 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2287 struct l2cap_hdr *lh;
2288
2289 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2290 __le16_to_cpu(chan->psm), len);
2291
2292 count = min_t(unsigned int, (conn->mtu - hlen), len);
2293
2294 skb = chan->ops->alloc_skb(chan, hlen, count,
2295 msg->msg_flags & MSG_DONTWAIT);
2296 if (IS_ERR(skb))
2297 return skb;
2298
2299 /* Create L2CAP header */
2300 lh = skb_put(skb, L2CAP_HDR_SIZE);
2301 lh->cid = cpu_to_le16(chan->dcid);
2302 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2303 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2304
2305 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2306 if (unlikely(err < 0)) {
2307 kfree_skb(skb);
2308 return ERR_PTR(err);
2309 }
2310 return skb;
2311 }
2312
l2cap_create_basic_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2313 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2314 struct msghdr *msg, size_t len)
2315 {
2316 struct l2cap_conn *conn = chan->conn;
2317 struct sk_buff *skb;
2318 int err, count;
2319 struct l2cap_hdr *lh;
2320
2321 BT_DBG("chan %p len %zu", chan, len);
2322
2323 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2324
2325 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2326 msg->msg_flags & MSG_DONTWAIT);
2327 if (IS_ERR(skb))
2328 return skb;
2329
2330 /* Create L2CAP header */
2331 lh = skb_put(skb, L2CAP_HDR_SIZE);
2332 lh->cid = cpu_to_le16(chan->dcid);
2333 lh->len = cpu_to_le16(len);
2334
2335 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2336 if (unlikely(err < 0)) {
2337 kfree_skb(skb);
2338 return ERR_PTR(err);
2339 }
2340 return skb;
2341 }
2342
l2cap_create_iframe_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2343 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2344 struct msghdr *msg, size_t len,
2345 u16 sdulen)
2346 {
2347 struct l2cap_conn *conn = chan->conn;
2348 struct sk_buff *skb;
2349 int err, count, hlen;
2350 struct l2cap_hdr *lh;
2351
2352 BT_DBG("chan %p len %zu", chan, len);
2353
2354 if (!conn)
2355 return ERR_PTR(-ENOTCONN);
2356
2357 hlen = __ertm_hdr_size(chan);
2358
2359 if (sdulen)
2360 hlen += L2CAP_SDULEN_SIZE;
2361
2362 if (chan->fcs == L2CAP_FCS_CRC16)
2363 hlen += L2CAP_FCS_SIZE;
2364
2365 count = min_t(unsigned int, (conn->mtu - hlen), len);
2366
2367 skb = chan->ops->alloc_skb(chan, hlen, count,
2368 msg->msg_flags & MSG_DONTWAIT);
2369 if (IS_ERR(skb))
2370 return skb;
2371
2372 /* Create L2CAP header */
2373 lh = skb_put(skb, L2CAP_HDR_SIZE);
2374 lh->cid = cpu_to_le16(chan->dcid);
2375 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2376
2377 /* Control header is populated later */
2378 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2379 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2380 else
2381 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2382
2383 if (sdulen)
2384 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2385
2386 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2387 if (unlikely(err < 0)) {
2388 kfree_skb(skb);
2389 return ERR_PTR(err);
2390 }
2391
2392 bt_cb(skb)->l2cap.fcs = chan->fcs;
2393 bt_cb(skb)->l2cap.retries = 0;
2394 return skb;
2395 }
2396
l2cap_segment_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2397 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2398 struct sk_buff_head *seg_queue,
2399 struct msghdr *msg, size_t len)
2400 {
2401 struct sk_buff *skb;
2402 u16 sdu_len;
2403 size_t pdu_len;
2404 u8 sar;
2405
2406 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2407
2408 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2409 * so fragmented skbs are not used. The HCI layer's handling
2410 * of fragmented skbs is not compatible with ERTM's queueing.
2411 */
2412
2413 /* PDU size is derived from the HCI MTU */
2414 pdu_len = chan->conn->mtu;
2415
2416 /* Constrain PDU size for BR/EDR connections */
2417 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2418
2419 /* Adjust for largest possible L2CAP overhead. */
2420 if (chan->fcs)
2421 pdu_len -= L2CAP_FCS_SIZE;
2422
2423 pdu_len -= __ertm_hdr_size(chan);
2424
2425 /* Remote device may have requested smaller PDUs */
2426 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2427
2428 if (!pdu_len)
2429 return -EINVAL;
2430
2431 if (len <= pdu_len) {
2432 sar = L2CAP_SAR_UNSEGMENTED;
2433 sdu_len = 0;
2434 pdu_len = len;
2435 } else {
2436 sar = L2CAP_SAR_START;
2437 sdu_len = len;
2438 }
2439
2440 while (len > 0) {
2441 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2442
2443 if (IS_ERR(skb)) {
2444 __skb_queue_purge(seg_queue);
2445 return PTR_ERR(skb);
2446 }
2447
2448 bt_cb(skb)->l2cap.sar = sar;
2449 __skb_queue_tail(seg_queue, skb);
2450
2451 len -= pdu_len;
2452 if (sdu_len)
2453 sdu_len = 0;
2454
2455 if (len <= pdu_len) {
2456 sar = L2CAP_SAR_END;
2457 pdu_len = len;
2458 } else {
2459 sar = L2CAP_SAR_CONTINUE;
2460 }
2461 }
2462
2463 return 0;
2464 }
2465
l2cap_create_le_flowctl_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2466 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2467 struct msghdr *msg,
2468 size_t len, u16 sdulen)
2469 {
2470 struct l2cap_conn *conn = chan->conn;
2471 struct sk_buff *skb;
2472 int err, count, hlen;
2473 struct l2cap_hdr *lh;
2474
2475 BT_DBG("chan %p len %zu", chan, len);
2476
2477 if (!conn)
2478 return ERR_PTR(-ENOTCONN);
2479
2480 hlen = L2CAP_HDR_SIZE;
2481
2482 if (sdulen)
2483 hlen += L2CAP_SDULEN_SIZE;
2484
2485 count = min_t(unsigned int, (conn->mtu - hlen), len);
2486
2487 skb = chan->ops->alloc_skb(chan, hlen, count,
2488 msg->msg_flags & MSG_DONTWAIT);
2489 if (IS_ERR(skb))
2490 return skb;
2491
2492 /* Create L2CAP header */
2493 lh = skb_put(skb, L2CAP_HDR_SIZE);
2494 lh->cid = cpu_to_le16(chan->dcid);
2495 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2496
2497 if (sdulen)
2498 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2499
2500 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2501 if (unlikely(err < 0)) {
2502 kfree_skb(skb);
2503 return ERR_PTR(err);
2504 }
2505
2506 return skb;
2507 }
2508
l2cap_segment_le_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2509 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2510 struct sk_buff_head *seg_queue,
2511 struct msghdr *msg, size_t len)
2512 {
2513 struct sk_buff *skb;
2514 size_t pdu_len;
2515 u16 sdu_len;
2516
2517 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2518
2519 sdu_len = len;
2520 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2521
2522 while (len > 0) {
2523 if (len <= pdu_len)
2524 pdu_len = len;
2525
2526 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2527 if (IS_ERR(skb)) {
2528 __skb_queue_purge(seg_queue);
2529 return PTR_ERR(skb);
2530 }
2531
2532 __skb_queue_tail(seg_queue, skb);
2533
2534 len -= pdu_len;
2535
2536 if (sdu_len) {
2537 sdu_len = 0;
2538 pdu_len += L2CAP_SDULEN_SIZE;
2539 }
2540 }
2541
2542 return 0;
2543 }
2544
l2cap_le_flowctl_send(struct l2cap_chan * chan)2545 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2546 {
2547 int sent = 0;
2548
2549 BT_DBG("chan %p", chan);
2550
2551 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2552 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2553 chan->tx_credits--;
2554 sent++;
2555 }
2556
2557 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2558 skb_queue_len(&chan->tx_q));
2559 }
2560
l2cap_tx_timestamp(struct sk_buff * skb,const struct sockcm_cookie * sockc,size_t len)2561 static void l2cap_tx_timestamp(struct sk_buff *skb,
2562 const struct sockcm_cookie *sockc,
2563 size_t len)
2564 {
2565 struct sock *sk = skb ? skb->sk : NULL;
2566
2567 if (sk && sk->sk_type == SOCK_STREAM)
2568 hci_setup_tx_timestamp(skb, len, sockc);
2569 else
2570 hci_setup_tx_timestamp(skb, 1, sockc);
2571 }
2572
l2cap_tx_timestamp_seg(struct sk_buff_head * queue,const struct sockcm_cookie * sockc,size_t len)2573 static void l2cap_tx_timestamp_seg(struct sk_buff_head *queue,
2574 const struct sockcm_cookie *sockc,
2575 size_t len)
2576 {
2577 struct sk_buff *skb = skb_peek(queue);
2578 struct sock *sk = skb ? skb->sk : NULL;
2579
2580 if (sk && sk->sk_type == SOCK_STREAM)
2581 l2cap_tx_timestamp(skb_peek_tail(queue), sockc, len);
2582 else
2583 l2cap_tx_timestamp(skb, sockc, len);
2584 }
2585
l2cap_chan_send(struct l2cap_chan * chan,struct msghdr * msg,size_t len,const struct sockcm_cookie * sockc)2586 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2587 const struct sockcm_cookie *sockc)
2588 {
2589 struct sk_buff *skb;
2590 int err;
2591 struct sk_buff_head seg_queue;
2592
2593 if (test_bit(FLAG_DEL, &chan->flags))
2594 return -ENOTCONN;
2595
2596 /* Connectionless channel */
2597 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2598 skb = l2cap_create_connless_pdu(chan, msg, len);
2599 if (IS_ERR(skb))
2600 return PTR_ERR(skb);
2601
2602 l2cap_tx_timestamp(skb, sockc, len);
2603
2604 l2cap_do_send(chan, skb);
2605 return len;
2606 }
2607
2608 switch (chan->mode) {
2609 case L2CAP_MODE_LE_FLOWCTL:
2610 case L2CAP_MODE_EXT_FLOWCTL:
2611 /* Check outgoing MTU */
2612 if (len > chan->omtu)
2613 return -EMSGSIZE;
2614
2615 __skb_queue_head_init(&seg_queue);
2616
2617 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2618
2619 if (chan->state != BT_CONNECTED) {
2620 __skb_queue_purge(&seg_queue);
2621 err = -ENOTCONN;
2622 }
2623
2624 if (err)
2625 return err;
2626
2627 l2cap_tx_timestamp_seg(&seg_queue, sockc, len);
2628
2629 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2630
2631 l2cap_le_flowctl_send(chan);
2632
2633 if (!chan->tx_credits)
2634 chan->ops->suspend(chan);
2635
2636 err = len;
2637
2638 break;
2639
2640 case L2CAP_MODE_BASIC:
2641 /* Check outgoing MTU */
2642 if (len > chan->omtu)
2643 return -EMSGSIZE;
2644
2645 /* Create a basic PDU */
2646 skb = l2cap_create_basic_pdu(chan, msg, len);
2647 if (IS_ERR(skb))
2648 return PTR_ERR(skb);
2649
2650 l2cap_tx_timestamp(skb, sockc, len);
2651
2652 l2cap_do_send(chan, skb);
2653 err = len;
2654 break;
2655
2656 case L2CAP_MODE_ERTM:
2657 case L2CAP_MODE_STREAMING:
2658 /* Check outgoing MTU */
2659 if (len > chan->omtu) {
2660 err = -EMSGSIZE;
2661 break;
2662 }
2663
2664 __skb_queue_head_init(&seg_queue);
2665
2666 /* Do segmentation before calling in to the state machine,
2667 * since it's possible to block while waiting for memory
2668 * allocation.
2669 */
2670 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2671
2672 if (err)
2673 break;
2674
2675 if (chan->mode == L2CAP_MODE_ERTM) {
2676 /* TODO: ERTM mode timestamping */
2677 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2678 } else {
2679 l2cap_tx_timestamp_seg(&seg_queue, sockc, len);
2680 l2cap_streaming_send(chan, &seg_queue);
2681 }
2682
2683 err = len;
2684
2685 /* If the skbs were not queued for sending, they'll still be in
2686 * seg_queue and need to be purged.
2687 */
2688 __skb_queue_purge(&seg_queue);
2689 break;
2690
2691 default:
2692 BT_DBG("bad state %1.1x", chan->mode);
2693 err = -EBADFD;
2694 }
2695
2696 return err;
2697 }
2698 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2699
l2cap_send_srej(struct l2cap_chan * chan,u16 txseq)2700 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2701 {
2702 struct l2cap_ctrl control;
2703 u16 seq;
2704
2705 BT_DBG("chan %p, txseq %u", chan, txseq);
2706
2707 memset(&control, 0, sizeof(control));
2708 control.sframe = 1;
2709 control.super = L2CAP_SUPER_SREJ;
2710
2711 for (seq = chan->expected_tx_seq; seq != txseq;
2712 seq = __next_seq(chan, seq)) {
2713 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2714 control.reqseq = seq;
2715 l2cap_send_sframe(chan, &control);
2716 l2cap_seq_list_append(&chan->srej_list, seq);
2717 }
2718 }
2719
2720 chan->expected_tx_seq = __next_seq(chan, txseq);
2721 }
2722
l2cap_send_srej_tail(struct l2cap_chan * chan)2723 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2724 {
2725 struct l2cap_ctrl control;
2726
2727 BT_DBG("chan %p", chan);
2728
2729 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2730 return;
2731
2732 memset(&control, 0, sizeof(control));
2733 control.sframe = 1;
2734 control.super = L2CAP_SUPER_SREJ;
2735 control.reqseq = chan->srej_list.tail;
2736 l2cap_send_sframe(chan, &control);
2737 }
2738
l2cap_send_srej_list(struct l2cap_chan * chan,u16 txseq)2739 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2740 {
2741 struct l2cap_ctrl control;
2742 u16 initial_head;
2743 u16 seq;
2744
2745 BT_DBG("chan %p, txseq %u", chan, txseq);
2746
2747 memset(&control, 0, sizeof(control));
2748 control.sframe = 1;
2749 control.super = L2CAP_SUPER_SREJ;
2750
2751 /* Capture initial list head to allow only one pass through the list. */
2752 initial_head = chan->srej_list.head;
2753
2754 do {
2755 seq = l2cap_seq_list_pop(&chan->srej_list);
2756 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2757 break;
2758
2759 control.reqseq = seq;
2760 l2cap_send_sframe(chan, &control);
2761 l2cap_seq_list_append(&chan->srej_list, seq);
2762 } while (chan->srej_list.head != initial_head);
2763 }
2764
l2cap_process_reqseq(struct l2cap_chan * chan,u16 reqseq)2765 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2766 {
2767 struct sk_buff *acked_skb;
2768 u16 ackseq;
2769
2770 BT_DBG("chan %p, reqseq %u", chan, reqseq);
2771
2772 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2773 return;
2774
2775 BT_DBG("expected_ack_seq %u, unacked_frames %u",
2776 chan->expected_ack_seq, chan->unacked_frames);
2777
2778 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2779 ackseq = __next_seq(chan, ackseq)) {
2780
2781 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2782 if (acked_skb) {
2783 skb_unlink(acked_skb, &chan->tx_q);
2784 kfree_skb(acked_skb);
2785 chan->unacked_frames--;
2786 }
2787 }
2788
2789 chan->expected_ack_seq = reqseq;
2790
2791 if (chan->unacked_frames == 0)
2792 __clear_retrans_timer(chan);
2793
2794 BT_DBG("unacked_frames %u", chan->unacked_frames);
2795 }
2796
l2cap_abort_rx_srej_sent(struct l2cap_chan * chan)2797 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2798 {
2799 BT_DBG("chan %p", chan);
2800
2801 chan->expected_tx_seq = chan->buffer_seq;
2802 l2cap_seq_list_clear(&chan->srej_list);
2803 skb_queue_purge(&chan->srej_q);
2804 chan->rx_state = L2CAP_RX_STATE_RECV;
2805 }
2806
l2cap_tx_state_xmit(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2807 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2808 struct l2cap_ctrl *control,
2809 struct sk_buff_head *skbs, u8 event)
2810 {
2811 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2812 event);
2813
2814 switch (event) {
2815 case L2CAP_EV_DATA_REQUEST:
2816 if (chan->tx_send_head == NULL)
2817 chan->tx_send_head = skb_peek(skbs);
2818
2819 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2820 l2cap_ertm_send(chan);
2821 break;
2822 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2823 BT_DBG("Enter LOCAL_BUSY");
2824 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2825
2826 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2827 /* The SREJ_SENT state must be aborted if we are to
2828 * enter the LOCAL_BUSY state.
2829 */
2830 l2cap_abort_rx_srej_sent(chan);
2831 }
2832
2833 l2cap_send_ack(chan);
2834
2835 break;
2836 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2837 BT_DBG("Exit LOCAL_BUSY");
2838 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2839
2840 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2841 struct l2cap_ctrl local_control;
2842
2843 memset(&local_control, 0, sizeof(local_control));
2844 local_control.sframe = 1;
2845 local_control.super = L2CAP_SUPER_RR;
2846 local_control.poll = 1;
2847 local_control.reqseq = chan->buffer_seq;
2848 l2cap_send_sframe(chan, &local_control);
2849
2850 chan->retry_count = 1;
2851 __set_monitor_timer(chan);
2852 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2853 }
2854 break;
2855 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2856 l2cap_process_reqseq(chan, control->reqseq);
2857 break;
2858 case L2CAP_EV_EXPLICIT_POLL:
2859 l2cap_send_rr_or_rnr(chan, 1);
2860 chan->retry_count = 1;
2861 __set_monitor_timer(chan);
2862 __clear_ack_timer(chan);
2863 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2864 break;
2865 case L2CAP_EV_RETRANS_TO:
2866 l2cap_send_rr_or_rnr(chan, 1);
2867 chan->retry_count = 1;
2868 __set_monitor_timer(chan);
2869 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2870 break;
2871 case L2CAP_EV_RECV_FBIT:
2872 /* Nothing to process */
2873 break;
2874 default:
2875 break;
2876 }
2877 }
2878
l2cap_tx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2879 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2880 struct l2cap_ctrl *control,
2881 struct sk_buff_head *skbs, u8 event)
2882 {
2883 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2884 event);
2885
2886 switch (event) {
2887 case L2CAP_EV_DATA_REQUEST:
2888 if (chan->tx_send_head == NULL)
2889 chan->tx_send_head = skb_peek(skbs);
2890 /* Queue data, but don't send. */
2891 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2892 break;
2893 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2894 BT_DBG("Enter LOCAL_BUSY");
2895 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2896
2897 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2898 /* The SREJ_SENT state must be aborted if we are to
2899 * enter the LOCAL_BUSY state.
2900 */
2901 l2cap_abort_rx_srej_sent(chan);
2902 }
2903
2904 l2cap_send_ack(chan);
2905
2906 break;
2907 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2908 BT_DBG("Exit LOCAL_BUSY");
2909 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2910
2911 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2912 struct l2cap_ctrl local_control;
2913 memset(&local_control, 0, sizeof(local_control));
2914 local_control.sframe = 1;
2915 local_control.super = L2CAP_SUPER_RR;
2916 local_control.poll = 1;
2917 local_control.reqseq = chan->buffer_seq;
2918 l2cap_send_sframe(chan, &local_control);
2919
2920 chan->retry_count = 1;
2921 __set_monitor_timer(chan);
2922 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2923 }
2924 break;
2925 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2926 l2cap_process_reqseq(chan, control->reqseq);
2927 fallthrough;
2928
2929 case L2CAP_EV_RECV_FBIT:
2930 if (control && control->final) {
2931 __clear_monitor_timer(chan);
2932 if (chan->unacked_frames > 0)
2933 __set_retrans_timer(chan);
2934 chan->retry_count = 0;
2935 chan->tx_state = L2CAP_TX_STATE_XMIT;
2936 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2937 }
2938 break;
2939 case L2CAP_EV_EXPLICIT_POLL:
2940 /* Ignore */
2941 break;
2942 case L2CAP_EV_MONITOR_TO:
2943 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2944 l2cap_send_rr_or_rnr(chan, 1);
2945 __set_monitor_timer(chan);
2946 chan->retry_count++;
2947 } else {
2948 l2cap_send_disconn_req(chan, ECONNABORTED);
2949 }
2950 break;
2951 default:
2952 break;
2953 }
2954 }
2955
l2cap_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2956 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2957 struct sk_buff_head *skbs, u8 event)
2958 {
2959 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2960 chan, control, skbs, event, chan->tx_state);
2961
2962 switch (chan->tx_state) {
2963 case L2CAP_TX_STATE_XMIT:
2964 l2cap_tx_state_xmit(chan, control, skbs, event);
2965 break;
2966 case L2CAP_TX_STATE_WAIT_F:
2967 l2cap_tx_state_wait_f(chan, control, skbs, event);
2968 break;
2969 default:
2970 /* Ignore event */
2971 break;
2972 }
2973 }
2974
l2cap_pass_to_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control)2975 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2976 struct l2cap_ctrl *control)
2977 {
2978 BT_DBG("chan %p, control %p", chan, control);
2979 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2980 }
2981
l2cap_pass_to_tx_fbit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2982 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2983 struct l2cap_ctrl *control)
2984 {
2985 BT_DBG("chan %p, control %p", chan, control);
2986 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2987 }
2988
2989 /* Copy frame to all raw sockets on that connection */
l2cap_raw_recv(struct l2cap_conn * conn,struct sk_buff * skb)2990 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2991 {
2992 struct sk_buff *nskb;
2993 struct l2cap_chan *chan;
2994
2995 BT_DBG("conn %p", conn);
2996
2997 list_for_each_entry(chan, &conn->chan_l, list) {
2998 if (chan->chan_type != L2CAP_CHAN_RAW)
2999 continue;
3000
3001 /* Don't send frame to the channel it came from */
3002 if (bt_cb(skb)->l2cap.chan == chan)
3003 continue;
3004
3005 nskb = skb_clone(skb, GFP_KERNEL);
3006 if (!nskb)
3007 continue;
3008 if (chan->ops->recv(chan, nskb))
3009 kfree_skb(nskb);
3010 }
3011 }
3012
3013 /* ---- L2CAP signalling commands ---- */
l2cap_build_cmd(struct l2cap_conn * conn,u8 code,u8 ident,u16 dlen,void * data)3014 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
3015 u8 ident, u16 dlen, void *data)
3016 {
3017 struct sk_buff *skb, **frag;
3018 struct l2cap_cmd_hdr *cmd;
3019 struct l2cap_hdr *lh;
3020 int len, count;
3021
3022 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
3023 conn, code, ident, dlen);
3024
3025 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
3026 return NULL;
3027
3028 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
3029 count = min_t(unsigned int, conn->mtu, len);
3030
3031 skb = bt_skb_alloc(count, GFP_KERNEL);
3032 if (!skb)
3033 return NULL;
3034
3035 lh = skb_put(skb, L2CAP_HDR_SIZE);
3036 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3037
3038 if (conn->hcon->type == LE_LINK)
3039 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3040 else
3041 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
3042
3043 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
3044 cmd->code = code;
3045 cmd->ident = ident;
3046 cmd->len = cpu_to_le16(dlen);
3047
3048 if (dlen) {
3049 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
3050 skb_put_data(skb, data, count);
3051 data += count;
3052 }
3053
3054 len -= skb->len;
3055
3056 /* Continuation fragments (no L2CAP header) */
3057 frag = &skb_shinfo(skb)->frag_list;
3058 while (len) {
3059 count = min_t(unsigned int, conn->mtu, len);
3060
3061 *frag = bt_skb_alloc(count, GFP_KERNEL);
3062 if (!*frag)
3063 goto fail;
3064
3065 skb_put_data(*frag, data, count);
3066
3067 len -= count;
3068 data += count;
3069
3070 frag = &(*frag)->next;
3071 }
3072
3073 return skb;
3074
3075 fail:
3076 kfree_skb(skb);
3077 return NULL;
3078 }
3079
l2cap_get_conf_opt(void ** ptr,void * end,int * type,int * olen,unsigned long * val)3080 static inline int l2cap_get_conf_opt(void **ptr, void *end, int *type,
3081 int *olen, unsigned long *val)
3082 {
3083 struct l2cap_conf_opt *opt = *ptr;
3084 int len;
3085
3086 /* opt->len is attacker-controlled. Validate that the full option
3087 * (header + value) actually fits in the buffer before touching
3088 * opt->val, otherwise the switch below reads past the end of the
3089 * caller's buffer.
3090 */
3091 if (end - *ptr < L2CAP_CONF_OPT_SIZE)
3092 return -EINVAL;
3093
3094 len = L2CAP_CONF_OPT_SIZE + opt->len;
3095 if (end - *ptr < len)
3096 return -EINVAL;
3097
3098 *ptr += len;
3099
3100 *type = opt->type;
3101 *olen = opt->len;
3102
3103 switch (opt->len) {
3104 case 1:
3105 *val = *((u8 *) opt->val);
3106 break;
3107
3108 case 2:
3109 *val = get_unaligned_le16(opt->val);
3110 break;
3111
3112 case 4:
3113 *val = get_unaligned_le32(opt->val);
3114 break;
3115
3116 default:
3117 *val = (unsigned long) opt->val;
3118 break;
3119 }
3120
3121 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3122 return len;
3123 }
3124
l2cap_add_conf_opt(void ** ptr,u8 type,u8 len,unsigned long val,size_t size)3125 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3126 {
3127 struct l2cap_conf_opt *opt = *ptr;
3128
3129 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3130
3131 if (size < L2CAP_CONF_OPT_SIZE + len)
3132 return;
3133
3134 opt->type = type;
3135 opt->len = len;
3136
3137 switch (len) {
3138 case 1:
3139 *((u8 *) opt->val) = val;
3140 break;
3141
3142 case 2:
3143 put_unaligned_le16(val, opt->val);
3144 break;
3145
3146 case 4:
3147 put_unaligned_le32(val, opt->val);
3148 break;
3149
3150 default:
3151 memcpy(opt->val, (void *) val, len);
3152 break;
3153 }
3154
3155 *ptr += L2CAP_CONF_OPT_SIZE + len;
3156 }
3157
l2cap_add_opt_efs(void ** ptr,struct l2cap_chan * chan,size_t size)3158 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3159 {
3160 struct l2cap_conf_efs efs;
3161
3162 switch (chan->mode) {
3163 case L2CAP_MODE_ERTM:
3164 efs.id = chan->local_id;
3165 efs.stype = chan->local_stype;
3166 efs.msdu = cpu_to_le16(chan->local_msdu);
3167 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3168 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3169 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3170 break;
3171
3172 case L2CAP_MODE_STREAMING:
3173 efs.id = 1;
3174 efs.stype = L2CAP_SERV_BESTEFFORT;
3175 efs.msdu = cpu_to_le16(chan->local_msdu);
3176 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3177 efs.acc_lat = 0;
3178 efs.flush_to = 0;
3179 break;
3180
3181 default:
3182 return;
3183 }
3184
3185 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3186 (unsigned long) &efs, size);
3187 }
3188
l2cap_ack_timeout(struct work_struct * work)3189 static void l2cap_ack_timeout(struct work_struct *work)
3190 {
3191 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3192 ack_timer.work);
3193 u16 frames_to_ack;
3194
3195 BT_DBG("chan %p", chan);
3196
3197 l2cap_chan_lock(chan);
3198
3199 if (test_bit(FLAG_DEL, &chan->flags))
3200 goto unlock;
3201
3202 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3203 chan->last_acked_seq);
3204
3205 if (frames_to_ack)
3206 l2cap_send_rr_or_rnr(chan, 0);
3207
3208 unlock:
3209 l2cap_chan_unlock(chan);
3210 l2cap_chan_put(chan);
3211 }
3212
l2cap_ertm_init(struct l2cap_chan * chan)3213 int l2cap_ertm_init(struct l2cap_chan *chan)
3214 {
3215 int err;
3216
3217 chan->next_tx_seq = 0;
3218 chan->expected_tx_seq = 0;
3219 chan->expected_ack_seq = 0;
3220 chan->unacked_frames = 0;
3221 chan->buffer_seq = 0;
3222 chan->frames_sent = 0;
3223 chan->last_acked_seq = 0;
3224 chan->sdu = NULL;
3225 chan->sdu_last_frag = NULL;
3226 chan->sdu_len = 0;
3227
3228 skb_queue_head_init(&chan->tx_q);
3229
3230 if (chan->mode != L2CAP_MODE_ERTM)
3231 return 0;
3232
3233 chan->rx_state = L2CAP_RX_STATE_RECV;
3234 chan->tx_state = L2CAP_TX_STATE_XMIT;
3235
3236 skb_queue_head_init(&chan->srej_q);
3237
3238 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3239 if (err < 0)
3240 return err;
3241
3242 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3243 if (err < 0)
3244 l2cap_seq_list_free(&chan->srej_list);
3245
3246 return err;
3247 }
3248
l2cap_select_mode(__u8 mode,__u16 remote_feat_mask)3249 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3250 {
3251 switch (mode) {
3252 case L2CAP_MODE_STREAMING:
3253 case L2CAP_MODE_ERTM:
3254 if (l2cap_mode_supported(mode, remote_feat_mask))
3255 return mode;
3256 fallthrough;
3257 default:
3258 return L2CAP_MODE_BASIC;
3259 }
3260 }
3261
__l2cap_ews_supported(struct l2cap_conn * conn)3262 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3263 {
3264 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
3265 }
3266
__l2cap_efs_supported(struct l2cap_conn * conn)3267 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3268 {
3269 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
3270 }
3271
__l2cap_set_ertm_timeouts(struct l2cap_chan * chan,struct l2cap_conf_rfc * rfc)3272 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3273 struct l2cap_conf_rfc *rfc)
3274 {
3275 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3276 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3277 }
3278
l2cap_txwin_setup(struct l2cap_chan * chan)3279 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3280 {
3281 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3282 __l2cap_ews_supported(chan->conn)) {
3283 /* use extended control field */
3284 set_bit(FLAG_EXT_CTRL, &chan->flags);
3285 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3286 } else {
3287 chan->tx_win = min_t(u16, chan->tx_win,
3288 L2CAP_DEFAULT_TX_WINDOW);
3289 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3290 }
3291 chan->ack_win = chan->tx_win;
3292 }
3293
l2cap_mtu_auto(struct l2cap_chan * chan)3294 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3295 {
3296 struct hci_conn *conn = chan->conn->hcon;
3297
3298 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3299
3300 /* The 2-DH1 packet has between 2 and 56 information bytes
3301 * (including the 2-byte payload header)
3302 */
3303 if (!(conn->pkt_type & HCI_2DH1))
3304 chan->imtu = 54;
3305
3306 /* The 3-DH1 packet has between 2 and 85 information bytes
3307 * (including the 2-byte payload header)
3308 */
3309 if (!(conn->pkt_type & HCI_3DH1))
3310 chan->imtu = 83;
3311
3312 /* The 2-DH3 packet has between 2 and 369 information bytes
3313 * (including the 2-byte payload header)
3314 */
3315 if (!(conn->pkt_type & HCI_2DH3))
3316 chan->imtu = 367;
3317
3318 /* The 3-DH3 packet has between 2 and 554 information bytes
3319 * (including the 2-byte payload header)
3320 */
3321 if (!(conn->pkt_type & HCI_3DH3))
3322 chan->imtu = 552;
3323
3324 /* The 2-DH5 packet has between 2 and 681 information bytes
3325 * (including the 2-byte payload header)
3326 */
3327 if (!(conn->pkt_type & HCI_2DH5))
3328 chan->imtu = 679;
3329
3330 /* The 3-DH5 packet has between 2 and 1023 information bytes
3331 * (including the 2-byte payload header)
3332 */
3333 if (!(conn->pkt_type & HCI_3DH5))
3334 chan->imtu = 1021;
3335 }
3336
l2cap_build_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3337 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3338 {
3339 struct l2cap_conf_req *req = data;
3340 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3341 void *ptr = req->data;
3342 void *endptr = data + data_size;
3343 u16 size;
3344
3345 BT_DBG("chan %p", chan);
3346
3347 if (chan->num_conf_req || chan->num_conf_rsp)
3348 goto done;
3349
3350 switch (chan->mode) {
3351 case L2CAP_MODE_STREAMING:
3352 case L2CAP_MODE_ERTM:
3353 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3354 break;
3355
3356 if (__l2cap_efs_supported(chan->conn))
3357 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3358
3359 fallthrough;
3360 default:
3361 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3362 break;
3363 }
3364
3365 done:
3366 if (chan->imtu != L2CAP_DEFAULT_MTU) {
3367 if (!chan->imtu)
3368 l2cap_mtu_auto(chan);
3369 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3370 endptr - ptr);
3371 }
3372
3373 switch (chan->mode) {
3374 case L2CAP_MODE_BASIC:
3375 if (disable_ertm)
3376 break;
3377
3378 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3379 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3380 break;
3381
3382 rfc.mode = L2CAP_MODE_BASIC;
3383 rfc.txwin_size = 0;
3384 rfc.max_transmit = 0;
3385 rfc.retrans_timeout = 0;
3386 rfc.monitor_timeout = 0;
3387 rfc.max_pdu_size = 0;
3388
3389 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3390 (unsigned long) &rfc, endptr - ptr);
3391 break;
3392
3393 case L2CAP_MODE_ERTM:
3394 rfc.mode = L2CAP_MODE_ERTM;
3395 rfc.max_transmit = chan->max_tx;
3396
3397 __l2cap_set_ertm_timeouts(chan, &rfc);
3398
3399 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3400 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3401 L2CAP_FCS_SIZE);
3402 rfc.max_pdu_size = cpu_to_le16(size);
3403
3404 l2cap_txwin_setup(chan);
3405
3406 rfc.txwin_size = min_t(u16, chan->tx_win,
3407 L2CAP_DEFAULT_TX_WINDOW);
3408
3409 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3410 (unsigned long) &rfc, endptr - ptr);
3411
3412 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3413 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3414
3415 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3416 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3417 chan->tx_win, endptr - ptr);
3418
3419 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3420 if (chan->fcs == L2CAP_FCS_NONE ||
3421 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3422 chan->fcs = L2CAP_FCS_NONE;
3423 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3424 chan->fcs, endptr - ptr);
3425 }
3426 break;
3427
3428 case L2CAP_MODE_STREAMING:
3429 l2cap_txwin_setup(chan);
3430 rfc.mode = L2CAP_MODE_STREAMING;
3431 rfc.txwin_size = 0;
3432 rfc.max_transmit = 0;
3433 rfc.retrans_timeout = 0;
3434 rfc.monitor_timeout = 0;
3435
3436 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3437 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3438 L2CAP_FCS_SIZE);
3439 rfc.max_pdu_size = cpu_to_le16(size);
3440
3441 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3442 (unsigned long) &rfc, endptr - ptr);
3443
3444 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3445 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3446
3447 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3448 if (chan->fcs == L2CAP_FCS_NONE ||
3449 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3450 chan->fcs = L2CAP_FCS_NONE;
3451 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3452 chan->fcs, endptr - ptr);
3453 }
3454 break;
3455 }
3456
3457 req->dcid = cpu_to_le16(chan->dcid);
3458 req->flags = cpu_to_le16(0);
3459
3460 return ptr - data;
3461 }
3462
l2cap_parse_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3463 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3464 {
3465 struct l2cap_conf_rsp *rsp = data;
3466 void *ptr = rsp->data;
3467 void *endptr = data + data_size;
3468 void *req = chan->conf_req;
3469 void *req_end = req + chan->conf_len;
3470 int len = chan->conf_len;
3471 int type, hint, olen;
3472 unsigned long val;
3473 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3474 struct l2cap_conf_efs efs;
3475 u8 remote_efs = 0;
3476 u16 mtu = 0;
3477 u16 result = L2CAP_CONF_SUCCESS;
3478 u16 size;
3479
3480 BT_DBG("chan %p", chan);
3481
3482 while (len >= L2CAP_CONF_OPT_SIZE) {
3483 int ret = l2cap_get_conf_opt(&req, req_end, &type, &olen, &val);
3484
3485 if (ret < 0)
3486 break;
3487 len -= ret;
3488
3489 hint = type & L2CAP_CONF_HINT;
3490 type &= L2CAP_CONF_MASK;
3491
3492 switch (type) {
3493 case L2CAP_CONF_MTU:
3494 if (olen != 2)
3495 break;
3496 mtu = val;
3497 break;
3498
3499 case L2CAP_CONF_FLUSH_TO:
3500 if (olen != 2)
3501 break;
3502 chan->flush_to = val;
3503 break;
3504
3505 case L2CAP_CONF_QOS:
3506 break;
3507
3508 case L2CAP_CONF_RFC:
3509 if (olen != sizeof(rfc))
3510 break;
3511 memcpy(&rfc, (void *) val, olen);
3512 break;
3513
3514 case L2CAP_CONF_FCS:
3515 if (olen != 1)
3516 break;
3517 if (val == L2CAP_FCS_NONE)
3518 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3519 break;
3520
3521 case L2CAP_CONF_EFS:
3522 if (olen != sizeof(efs))
3523 break;
3524 remote_efs = 1;
3525 memcpy(&efs, (void *) val, olen);
3526 break;
3527
3528 case L2CAP_CONF_EWS:
3529 if (olen != 2)
3530 break;
3531 return -ECONNREFUSED;
3532
3533 default:
3534 if (hint)
3535 break;
3536 result = L2CAP_CONF_UNKNOWN;
3537 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3538 break;
3539 }
3540 }
3541
3542 if (chan->num_conf_rsp || chan->num_conf_req > 1)
3543 goto done;
3544
3545 switch (chan->mode) {
3546 case L2CAP_MODE_STREAMING:
3547 case L2CAP_MODE_ERTM:
3548 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3549 chan->mode = l2cap_select_mode(rfc.mode,
3550 chan->conn->feat_mask);
3551 break;
3552 }
3553
3554 if (remote_efs) {
3555 if (__l2cap_efs_supported(chan->conn))
3556 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3557 else
3558 return -ECONNREFUSED;
3559 }
3560
3561 if (chan->mode != rfc.mode)
3562 return -ECONNREFUSED;
3563
3564 break;
3565 }
3566
3567 done:
3568 if (chan->mode != rfc.mode) {
3569 result = L2CAP_CONF_UNACCEPT;
3570 rfc.mode = chan->mode;
3571
3572 if (chan->num_conf_rsp == 1)
3573 return -ECONNREFUSED;
3574
3575 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3576 (unsigned long) &rfc, endptr - ptr);
3577 }
3578
3579 if (result == L2CAP_CONF_SUCCESS) {
3580 /* Configure output options and let the other side know
3581 * which ones we don't like. */
3582
3583 /* If MTU is not provided in configure request, try adjusting it
3584 * to the current output MTU if it has been set
3585 *
3586 * Bluetooth Core 6.1, Vol 3, Part A, Section 4.5
3587 *
3588 * Each configuration parameter value (if any is present) in an
3589 * L2CAP_CONFIGURATION_RSP packet reflects an ‘adjustment’ to a
3590 * configuration parameter value that has been sent (or, in case
3591 * of default values, implied) in the corresponding
3592 * L2CAP_CONFIGURATION_REQ packet.
3593 */
3594 if (!mtu) {
3595 /* Only adjust for ERTM channels as for older modes the
3596 * remote stack may not be able to detect that the
3597 * adjustment causing it to silently drop packets.
3598 */
3599 if (chan->mode == L2CAP_MODE_ERTM &&
3600 chan->omtu && chan->omtu != L2CAP_DEFAULT_MTU)
3601 mtu = chan->omtu;
3602 else
3603 mtu = L2CAP_DEFAULT_MTU;
3604 }
3605
3606 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3607 result = L2CAP_CONF_UNACCEPT;
3608 else {
3609 chan->omtu = mtu;
3610 set_bit(CONF_MTU_DONE, &chan->conf_state);
3611 }
3612 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3613
3614 if (remote_efs) {
3615 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3616 efs.stype != L2CAP_SERV_NOTRAFIC &&
3617 efs.stype != chan->local_stype) {
3618
3619 result = L2CAP_CONF_UNACCEPT;
3620
3621 if (chan->num_conf_req >= 1)
3622 return -ECONNREFUSED;
3623
3624 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3625 sizeof(efs),
3626 (unsigned long) &efs, endptr - ptr);
3627 } else {
3628 /* Send PENDING Conf Rsp */
3629 result = L2CAP_CONF_PENDING;
3630 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3631 }
3632 }
3633
3634 switch (rfc.mode) {
3635 case L2CAP_MODE_BASIC:
3636 chan->fcs = L2CAP_FCS_NONE;
3637 set_bit(CONF_MODE_DONE, &chan->conf_state);
3638 break;
3639
3640 case L2CAP_MODE_ERTM:
3641 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3642 chan->remote_tx_win = rfc.txwin_size;
3643 else
3644 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3645
3646 chan->remote_max_tx = rfc.max_transmit;
3647
3648 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3649 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3650 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3651 rfc.max_pdu_size = cpu_to_le16(size);
3652 chan->remote_mps = size;
3653
3654 __l2cap_set_ertm_timeouts(chan, &rfc);
3655
3656 set_bit(CONF_MODE_DONE, &chan->conf_state);
3657
3658 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3659 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3660
3661 if (remote_efs &&
3662 test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3663 chan->remote_id = efs.id;
3664 chan->remote_stype = efs.stype;
3665 chan->remote_msdu = le16_to_cpu(efs.msdu);
3666 chan->remote_flush_to =
3667 le32_to_cpu(efs.flush_to);
3668 chan->remote_acc_lat =
3669 le32_to_cpu(efs.acc_lat);
3670 chan->remote_sdu_itime =
3671 le32_to_cpu(efs.sdu_itime);
3672 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3673 sizeof(efs),
3674 (unsigned long) &efs, endptr - ptr);
3675 }
3676 break;
3677
3678 case L2CAP_MODE_STREAMING:
3679 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3680 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3681 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3682 rfc.max_pdu_size = cpu_to_le16(size);
3683 chan->remote_mps = size;
3684
3685 set_bit(CONF_MODE_DONE, &chan->conf_state);
3686
3687 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3688 (unsigned long) &rfc, endptr - ptr);
3689
3690 break;
3691
3692 default:
3693 result = L2CAP_CONF_UNACCEPT;
3694
3695 memset(&rfc, 0, sizeof(rfc));
3696 rfc.mode = chan->mode;
3697 }
3698
3699 if (result == L2CAP_CONF_SUCCESS)
3700 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3701 }
3702 rsp->scid = cpu_to_le16(chan->dcid);
3703 rsp->result = cpu_to_le16(result);
3704 rsp->flags = cpu_to_le16(0);
3705
3706 return ptr - data;
3707 }
3708
l2cap_parse_conf_rsp(struct l2cap_chan * chan,void * rsp,int len,void * data,size_t size,u16 * result)3709 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3710 void *data, size_t size, u16 *result)
3711 {
3712 struct l2cap_conf_req *req = data;
3713 void *ptr = req->data;
3714 void *endptr = data + size;
3715 void *rsp_end = rsp + len;
3716 int type, olen;
3717 unsigned long val;
3718 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3719 struct l2cap_conf_efs efs;
3720
3721 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3722
3723 while (len >= L2CAP_CONF_OPT_SIZE) {
3724 int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val);
3725
3726 if (ret < 0)
3727 break;
3728 len -= ret;
3729
3730 switch (type) {
3731 case L2CAP_CONF_MTU:
3732 if (olen != 2)
3733 break;
3734 if (val < L2CAP_DEFAULT_MIN_MTU) {
3735 *result = L2CAP_CONF_UNACCEPT;
3736 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3737 } else
3738 chan->imtu = val;
3739 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3740 endptr - ptr);
3741 break;
3742
3743 case L2CAP_CONF_FLUSH_TO:
3744 if (olen != 2)
3745 break;
3746 chan->flush_to = val;
3747 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3748 chan->flush_to, endptr - ptr);
3749 break;
3750
3751 case L2CAP_CONF_RFC:
3752 if (olen != sizeof(rfc))
3753 break;
3754 memcpy(&rfc, (void *)val, olen);
3755 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3756 rfc.mode != chan->mode)
3757 return -ECONNREFUSED;
3758 chan->fcs = 0;
3759 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3760 (unsigned long) &rfc, endptr - ptr);
3761 break;
3762
3763 case L2CAP_CONF_EWS:
3764 if (olen != 2)
3765 break;
3766 chan->ack_win = min_t(u16, val, chan->ack_win);
3767 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3768 chan->tx_win, endptr - ptr);
3769 break;
3770
3771 case L2CAP_CONF_EFS:
3772 if (olen != sizeof(efs))
3773 break;
3774 memcpy(&efs, (void *)val, olen);
3775 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3776 efs.stype != L2CAP_SERV_NOTRAFIC &&
3777 efs.stype != chan->local_stype)
3778 return -ECONNREFUSED;
3779 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3780 (unsigned long) &efs, endptr - ptr);
3781 break;
3782
3783 case L2CAP_CONF_FCS:
3784 if (olen != 1)
3785 break;
3786 if (*result == L2CAP_CONF_PENDING)
3787 if (val == L2CAP_FCS_NONE)
3788 set_bit(CONF_RECV_NO_FCS,
3789 &chan->conf_state);
3790 break;
3791 }
3792 }
3793
3794 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3795 return -ECONNREFUSED;
3796
3797 chan->mode = rfc.mode;
3798
3799 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3800 switch (rfc.mode) {
3801 case L2CAP_MODE_ERTM:
3802 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3803 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3804 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3805 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3806 chan->ack_win = min_t(u16, chan->ack_win,
3807 rfc.txwin_size);
3808
3809 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3810 chan->local_msdu = le16_to_cpu(efs.msdu);
3811 chan->local_sdu_itime =
3812 le32_to_cpu(efs.sdu_itime);
3813 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3814 chan->local_flush_to =
3815 le32_to_cpu(efs.flush_to);
3816 }
3817 break;
3818
3819 case L2CAP_MODE_STREAMING:
3820 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3821 }
3822 }
3823
3824 req->dcid = cpu_to_le16(chan->dcid);
3825 req->flags = cpu_to_le16(0);
3826
3827 return ptr - data;
3828 }
3829
l2cap_build_conf_rsp(struct l2cap_chan * chan,void * data,u16 result,u16 flags)3830 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3831 u16 result, u16 flags)
3832 {
3833 struct l2cap_conf_rsp *rsp = data;
3834 void *ptr = rsp->data;
3835
3836 BT_DBG("chan %p", chan);
3837
3838 rsp->scid = cpu_to_le16(chan->dcid);
3839 rsp->result = cpu_to_le16(result);
3840 rsp->flags = cpu_to_le16(flags);
3841
3842 return ptr - data;
3843 }
3844
__l2cap_le_connect_rsp_defer(struct l2cap_chan * chan)3845 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3846 {
3847 struct l2cap_le_conn_rsp rsp;
3848 struct l2cap_conn *conn = chan->conn;
3849
3850 BT_DBG("chan %p", chan);
3851
3852 rsp.dcid = cpu_to_le16(chan->scid);
3853 rsp.mtu = cpu_to_le16(chan->imtu);
3854 rsp.mps = cpu_to_le16(chan->mps);
3855 rsp.credits = cpu_to_le16(chan->rx_credits);
3856 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3857
3858 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3859 &rsp);
3860 }
3861
l2cap_ecred_list_defer(struct l2cap_chan * chan,void * data)3862 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
3863 {
3864 int *result = data;
3865
3866 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3867 return;
3868
3869 switch (chan->state) {
3870 case BT_CONNECT2:
3871 /* If channel still pending accept add to result */
3872 (*result)++;
3873 return;
3874 case BT_CONNECTED:
3875 return;
3876 default:
3877 /* If not connected or pending accept it has been refused */
3878 *result = -ECONNREFUSED;
3879 return;
3880 }
3881 }
3882
3883 struct l2cap_ecred_rsp_data {
3884 struct {
3885 struct l2cap_ecred_conn_rsp_hdr rsp;
3886 __le16 scid[L2CAP_ECRED_MAX_CID];
3887 } __packed pdu;
3888 int count;
3889 };
3890
l2cap_ecred_rsp_defer(struct l2cap_chan * chan,void * data)3891 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
3892 {
3893 struct l2cap_ecred_rsp_data *rsp = data;
3894 struct l2cap_ecred_conn_rsp *rsp_flex =
3895 container_of(&rsp->pdu.rsp, struct l2cap_ecred_conn_rsp, hdr);
3896
3897 /* Check if channel for outgoing connection or if it wasn't deferred
3898 * since in those cases it must be skipped.
3899 */
3900 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags) ||
3901 !test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
3902 return;
3903
3904 /* Reset ident so only one response is sent */
3905 chan->ident = 0;
3906
3907 /* Include all channels pending with the same ident */
3908 if (!rsp->pdu.rsp.result)
3909 rsp_flex->dcid[rsp->count++] = cpu_to_le16(chan->scid);
3910 else
3911 l2cap_chan_del(chan, ECONNRESET);
3912 }
3913
__l2cap_ecred_conn_rsp_defer(struct l2cap_chan * chan)3914 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3915 {
3916 struct l2cap_conn *conn = chan->conn;
3917 struct l2cap_ecred_rsp_data data;
3918 u16 id = chan->ident;
3919 int result = 0;
3920
3921 if (!id)
3922 return;
3923
3924 BT_DBG("chan %p id %d", chan, id);
3925
3926 memset(&data, 0, sizeof(data));
3927
3928 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu);
3929 data.pdu.rsp.mps = cpu_to_le16(chan->mps);
3930 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3931 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3932
3933 /* Verify that all channels are ready */
3934 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
3935
3936 if (result > 0)
3937 return;
3938
3939 if (result < 0)
3940 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
3941
3942 /* Build response */
3943 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
3944
3945 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
3946 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
3947 &data.pdu);
3948 }
3949
__l2cap_connect_rsp_defer(struct l2cap_chan * chan)3950 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3951 {
3952 struct l2cap_conn_rsp rsp;
3953 struct l2cap_conn *conn = chan->conn;
3954 u8 buf[128];
3955 u8 rsp_code;
3956
3957 rsp.scid = cpu_to_le16(chan->dcid);
3958 rsp.dcid = cpu_to_le16(chan->scid);
3959 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3960 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3961 rsp_code = L2CAP_CONN_RSP;
3962
3963 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3964
3965 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3966
3967 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3968 return;
3969
3970 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3971 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
3972 chan->num_conf_req++;
3973 }
3974
l2cap_conf_rfc_get(struct l2cap_chan * chan,void * rsp,int len)3975 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3976 {
3977 int type, olen;
3978 unsigned long val;
3979 void *rsp_end = rsp + len;
3980 /* Use sane default values in case a misbehaving remote device
3981 * did not send an RFC or extended window size option.
3982 */
3983 u16 txwin_ext = chan->ack_win;
3984 struct l2cap_conf_rfc rfc = {
3985 .mode = chan->mode,
3986 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3987 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3988 .max_pdu_size = cpu_to_le16(chan->imtu),
3989 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3990 };
3991
3992 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3993
3994 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3995 return;
3996
3997 while (len >= L2CAP_CONF_OPT_SIZE) {
3998 int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val);
3999
4000 if (ret < 0)
4001 break;
4002 len -= ret;
4003
4004 switch (type) {
4005 case L2CAP_CONF_RFC:
4006 if (olen != sizeof(rfc))
4007 break;
4008 memcpy(&rfc, (void *)val, olen);
4009 break;
4010 case L2CAP_CONF_EWS:
4011 if (olen != 2)
4012 break;
4013 txwin_ext = val;
4014 break;
4015 }
4016 }
4017
4018 switch (rfc.mode) {
4019 case L2CAP_MODE_ERTM:
4020 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
4021 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
4022 chan->mps = le16_to_cpu(rfc.max_pdu_size);
4023 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
4024 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
4025 else
4026 chan->ack_win = min_t(u16, chan->ack_win,
4027 rfc.txwin_size);
4028 break;
4029 case L2CAP_MODE_STREAMING:
4030 chan->mps = le16_to_cpu(rfc.max_pdu_size);
4031 }
4032 }
4033
l2cap_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4034 static inline int l2cap_command_rej(struct l2cap_conn *conn,
4035 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4036 u8 *data)
4037 {
4038 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4039
4040 if (cmd_len < sizeof(*rej))
4041 return -EPROTO;
4042
4043 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4044 return 0;
4045
4046 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
4047 cmd->ident == conn->info_ident) {
4048 cancel_delayed_work(&conn->info_timer);
4049
4050 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4051 conn->info_ident = 0;
4052
4053 l2cap_conn_start(conn);
4054 }
4055
4056 return 0;
4057 }
4058
4059 /* Allocate and initialise a channel for an incoming connection.
4060 *
4061 * The channel inherits its configuration from @pchan and is linked into @conn
4062 * before ->new_connection() runs, so the conn list reference keeps it alive if
4063 * the callback exposes it (e.g. via the socket accept queue) before this
4064 * returns. The l2cap_chan_create() reference is taken over by the subsystem on
4065 * success and dropped here on failure.
4066 */
l2cap_new_connection(struct l2cap_conn * conn,struct l2cap_chan * pchan)4067 static struct l2cap_chan *l2cap_new_connection(struct l2cap_conn *conn,
4068 struct l2cap_chan *pchan)
4069 {
4070 struct l2cap_chan *chan;
4071
4072 chan = l2cap_chan_create();
4073 if (!chan)
4074 return NULL;
4075
4076 l2cap_chan_set_defaults(chan, pchan);
4077 chan->ops = pchan->ops;
4078
4079 __l2cap_chan_add(conn, chan);
4080
4081 if (pchan->ops->new_connection &&
4082 pchan->ops->new_connection(pchan, chan) < 0) {
4083 l2cap_chan_del(chan, 0);
4084 l2cap_chan_put(chan);
4085 return NULL;
4086 }
4087
4088 return chan;
4089 }
4090
l2cap_connect(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u8 * data,u8 rsp_code)4091 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
4092 u8 *data, u8 rsp_code)
4093 {
4094 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
4095 struct l2cap_conn_rsp rsp;
4096 struct l2cap_chan *chan = NULL, *pchan = NULL;
4097 int result, status = L2CAP_CS_NO_INFO;
4098
4099 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
4100 __le16 psm = req->psm;
4101
4102 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
4103
4104 /* Check if we have socket listening on psm */
4105 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4106 &conn->hcon->dst, ACL_LINK);
4107 if (!pchan) {
4108 result = L2CAP_CR_BAD_PSM;
4109 goto response;
4110 }
4111
4112 l2cap_chan_lock(pchan);
4113
4114 /* Check if the ACL is secure enough (if not SDP) */
4115 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
4116 (!hci_conn_check_link_mode(conn->hcon) ||
4117 !l2cap_check_enc_key_size(conn->hcon, pchan))) {
4118 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
4119 result = L2CAP_CR_SEC_BLOCK;
4120 goto response;
4121 }
4122
4123 result = L2CAP_CR_NO_MEM;
4124
4125 /* Check for valid dynamic CID range (as per Erratum 3253) */
4126 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
4127 result = L2CAP_CR_INVALID_SCID;
4128 goto response;
4129 }
4130
4131 /* Check if we already have channel with that dcid */
4132 if (__l2cap_get_chan_by_dcid(conn, scid)) {
4133 result = L2CAP_CR_SCID_IN_USE;
4134 goto response;
4135 }
4136
4137 chan = l2cap_new_connection(conn, pchan);
4138 if (!chan)
4139 goto response;
4140
4141 /* For certain devices (ex: HID mouse), support for authentication,
4142 * pairing and bonding is optional. For such devices, inorder to avoid
4143 * the ACL alive for too long after L2CAP disconnection, reset the ACL
4144 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
4145 */
4146 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4147
4148 bacpy(&chan->src, &conn->hcon->src);
4149 bacpy(&chan->dst, &conn->hcon->dst);
4150 chan->src_type = bdaddr_src_type(conn->hcon);
4151 chan->dst_type = bdaddr_dst_type(conn->hcon);
4152 chan->psm = psm;
4153 chan->dcid = scid;
4154
4155 dcid = chan->scid;
4156
4157 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4158
4159 chan->ident = cmd->ident;
4160
4161 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4162 if (l2cap_chan_check_security(chan, false)) {
4163 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4164 l2cap_state_change(chan, BT_CONNECT2);
4165 result = L2CAP_CR_PEND;
4166 status = L2CAP_CS_AUTHOR_PEND;
4167 chan->ops->defer(chan);
4168 } else {
4169 l2cap_state_change(chan, BT_CONFIG);
4170 result = L2CAP_CR_SUCCESS;
4171 status = L2CAP_CS_NO_INFO;
4172 }
4173 } else {
4174 l2cap_state_change(chan, BT_CONNECT2);
4175 result = L2CAP_CR_PEND;
4176 status = L2CAP_CS_AUTHEN_PEND;
4177 }
4178 } else {
4179 l2cap_state_change(chan, BT_CONNECT2);
4180 result = L2CAP_CR_PEND;
4181 status = L2CAP_CS_NO_INFO;
4182 }
4183
4184 response:
4185 rsp.scid = cpu_to_le16(scid);
4186 rsp.dcid = cpu_to_le16(dcid);
4187 rsp.result = cpu_to_le16(result);
4188 rsp.status = cpu_to_le16(status);
4189 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4190
4191 if (!pchan)
4192 return;
4193
4194 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4195 struct l2cap_info_req info;
4196 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4197
4198 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4199 conn->info_ident = l2cap_get_ident(conn);
4200
4201 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4202
4203 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4204 sizeof(info), &info);
4205 }
4206
4207 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4208 result == L2CAP_CR_SUCCESS) {
4209 u8 buf[128];
4210 set_bit(CONF_REQ_SENT, &chan->conf_state);
4211 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4212 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4213 chan->num_conf_req++;
4214 }
4215
4216 l2cap_chan_unlock(pchan);
4217 l2cap_chan_put(pchan);
4218 }
4219
l2cap_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4220 static int l2cap_connect_req(struct l2cap_conn *conn,
4221 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4222 {
4223 if (cmd_len < sizeof(struct l2cap_conn_req))
4224 return -EPROTO;
4225
4226 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
4227 return 0;
4228 }
4229
l2cap_connect_create_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4230 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4231 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4232 u8 *data)
4233 {
4234 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4235 u16 scid, dcid, result, status;
4236 struct l2cap_chan *chan;
4237 u8 req[128];
4238 int err;
4239
4240 if (cmd_len < sizeof(*rsp))
4241 return -EPROTO;
4242
4243 scid = __le16_to_cpu(rsp->scid);
4244 dcid = __le16_to_cpu(rsp->dcid);
4245 result = __le16_to_cpu(rsp->result);
4246 status = __le16_to_cpu(rsp->status);
4247
4248 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
4249 dcid > L2CAP_CID_DYN_END))
4250 return -EPROTO;
4251
4252 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4253 dcid, scid, result, status);
4254
4255 if (scid) {
4256 chan = __l2cap_get_chan_by_scid(conn, scid);
4257 if (!chan)
4258 return -EBADSLT;
4259 } else {
4260 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4261 if (!chan)
4262 return -EBADSLT;
4263 }
4264
4265 chan = l2cap_chan_hold_unless_zero(chan);
4266 if (!chan)
4267 return -EBADSLT;
4268
4269 err = 0;
4270
4271 l2cap_chan_lock(chan);
4272
4273 switch (result) {
4274 case L2CAP_CR_SUCCESS:
4275 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4276 err = -EBADSLT;
4277 break;
4278 }
4279
4280 l2cap_state_change(chan, BT_CONFIG);
4281 chan->ident = 0;
4282 chan->dcid = dcid;
4283 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4284
4285 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4286 break;
4287
4288 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4289 l2cap_build_conf_req(chan, req, sizeof(req)), req);
4290 chan->num_conf_req++;
4291 break;
4292
4293 case L2CAP_CR_PEND:
4294 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4295 break;
4296
4297 default:
4298 l2cap_chan_del(chan, ECONNREFUSED);
4299 break;
4300 }
4301
4302 l2cap_chan_unlock(chan);
4303 l2cap_chan_put(chan);
4304
4305 return err;
4306 }
4307
set_default_fcs(struct l2cap_chan * chan)4308 static inline void set_default_fcs(struct l2cap_chan *chan)
4309 {
4310 /* FCS is enabled only in ERTM or streaming mode, if one or both
4311 * sides request it.
4312 */
4313 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4314 chan->fcs = L2CAP_FCS_NONE;
4315 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4316 chan->fcs = L2CAP_FCS_CRC16;
4317 }
4318
l2cap_send_efs_conf_rsp(struct l2cap_chan * chan,void * data,u8 ident,u16 flags)4319 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4320 u8 ident, u16 flags)
4321 {
4322 struct l2cap_conn *conn = chan->conn;
4323
4324 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4325 flags);
4326
4327 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4328 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4329
4330 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4331 l2cap_build_conf_rsp(chan, data,
4332 L2CAP_CONF_SUCCESS, flags), data);
4333 }
4334
cmd_reject_invalid_cid(struct l2cap_conn * conn,u8 ident,u16 scid,u16 dcid)4335 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4336 u16 scid, u16 dcid)
4337 {
4338 struct l2cap_cmd_rej_cid rej;
4339
4340 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4341 rej.scid = __cpu_to_le16(scid);
4342 rej.dcid = __cpu_to_le16(dcid);
4343
4344 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4345 }
4346
l2cap_config_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4347 static inline int l2cap_config_req(struct l2cap_conn *conn,
4348 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4349 u8 *data)
4350 {
4351 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4352 u16 dcid, flags;
4353 u8 rsp[64];
4354 struct l2cap_chan *chan;
4355 int len, err = 0;
4356
4357 if (cmd_len < sizeof(*req))
4358 return -EPROTO;
4359
4360 dcid = __le16_to_cpu(req->dcid);
4361 flags = __le16_to_cpu(req->flags);
4362
4363 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4364
4365 chan = l2cap_get_chan_by_scid(conn, dcid);
4366 if (!chan) {
4367 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4368 return 0;
4369 }
4370
4371 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4372 chan->state != BT_CONNECTED) {
4373 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4374 chan->dcid);
4375 goto unlock;
4376 }
4377
4378 /* Reject if config buffer is too small. */
4379 len = cmd_len - sizeof(*req);
4380 if (chan->conf_len + len > sizeof(chan->conf_req)) {
4381 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4382 l2cap_build_conf_rsp(chan, rsp,
4383 L2CAP_CONF_REJECT, flags), rsp);
4384 goto unlock;
4385 }
4386
4387 /* Store config. */
4388 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4389 chan->conf_len += len;
4390
4391 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4392 /* Incomplete config. Send empty response. */
4393 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4394 l2cap_build_conf_rsp(chan, rsp,
4395 L2CAP_CONF_SUCCESS, flags), rsp);
4396 goto unlock;
4397 }
4398
4399 /* Complete config. */
4400 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4401 if (len < 0) {
4402 l2cap_send_disconn_req(chan, ECONNRESET);
4403 goto unlock;
4404 }
4405
4406 chan->ident = cmd->ident;
4407 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4408 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4409 chan->num_conf_rsp++;
4410
4411 /* Reset config buffer. */
4412 chan->conf_len = 0;
4413
4414 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4415 goto unlock;
4416
4417 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4418 set_default_fcs(chan);
4419
4420 if (chan->state != BT_CONNECTED) {
4421 if (chan->mode == L2CAP_MODE_ERTM ||
4422 chan->mode == L2CAP_MODE_STREAMING)
4423 err = l2cap_ertm_init(chan);
4424
4425 if (err < 0)
4426 l2cap_send_disconn_req(chan, -err);
4427 else
4428 l2cap_chan_ready(chan);
4429 }
4430
4431 goto unlock;
4432 }
4433
4434 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4435 u8 buf[64];
4436 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4437 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4438 chan->num_conf_req++;
4439 }
4440
4441 /* Got Conf Rsp PENDING from remote side and assume we sent
4442 Conf Rsp PENDING in the code above */
4443 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4444 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4445
4446 /* check compatibility */
4447
4448 /* Send rsp for BR/EDR channel */
4449 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4450 }
4451
4452 unlock:
4453 l2cap_chan_unlock(chan);
4454 l2cap_chan_put(chan);
4455 return err;
4456 }
4457
l2cap_config_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4458 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4459 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4460 u8 *data)
4461 {
4462 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4463 u16 scid, flags, result;
4464 struct l2cap_chan *chan;
4465 int len = cmd_len - sizeof(*rsp);
4466 int err = 0;
4467
4468 if (cmd_len < sizeof(*rsp))
4469 return -EPROTO;
4470
4471 scid = __le16_to_cpu(rsp->scid);
4472 flags = __le16_to_cpu(rsp->flags);
4473 result = __le16_to_cpu(rsp->result);
4474
4475 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4476 result, len);
4477
4478 chan = l2cap_get_chan_by_scid(conn, scid);
4479 if (!chan)
4480 return 0;
4481
4482 switch (result) {
4483 case L2CAP_CONF_SUCCESS:
4484 l2cap_conf_rfc_get(chan, rsp->data, len);
4485 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4486 break;
4487
4488 case L2CAP_CONF_PENDING:
4489 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4490
4491 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4492 char buf[64];
4493
4494 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4495 buf, sizeof(buf), &result);
4496 if (len < 0) {
4497 l2cap_send_disconn_req(chan, ECONNRESET);
4498 goto done;
4499 }
4500
4501 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
4502 }
4503 goto done;
4504
4505 case L2CAP_CONF_UNKNOWN:
4506 case L2CAP_CONF_UNACCEPT:
4507 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4508 char req[64];
4509
4510 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4511 l2cap_send_disconn_req(chan, ECONNRESET);
4512 goto done;
4513 }
4514
4515 /* throw out any old stored conf requests */
4516 result = L2CAP_CONF_SUCCESS;
4517 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4518 req, sizeof(req), &result);
4519 if (len < 0) {
4520 l2cap_send_disconn_req(chan, ECONNRESET);
4521 goto done;
4522 }
4523
4524 l2cap_send_cmd(conn, l2cap_get_ident(conn),
4525 L2CAP_CONF_REQ, len, req);
4526 chan->num_conf_req++;
4527 if (result != L2CAP_CONF_SUCCESS)
4528 goto done;
4529 break;
4530 }
4531 fallthrough;
4532
4533 default:
4534 l2cap_chan_set_err(chan, ECONNRESET);
4535
4536 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4537 l2cap_send_disconn_req(chan, ECONNRESET);
4538 goto done;
4539 }
4540
4541 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4542 goto done;
4543
4544 set_bit(CONF_INPUT_DONE, &chan->conf_state);
4545
4546 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4547 set_default_fcs(chan);
4548
4549 if (chan->mode == L2CAP_MODE_ERTM ||
4550 chan->mode == L2CAP_MODE_STREAMING)
4551 err = l2cap_ertm_init(chan);
4552
4553 if (err < 0)
4554 l2cap_send_disconn_req(chan, -err);
4555 else
4556 l2cap_chan_ready(chan);
4557 }
4558
4559 done:
4560 l2cap_chan_unlock(chan);
4561 l2cap_chan_put(chan);
4562 return err;
4563 }
4564
l2cap_disconnect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4565 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4566 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4567 u8 *data)
4568 {
4569 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4570 struct l2cap_disconn_rsp rsp;
4571 u16 dcid, scid;
4572 struct l2cap_chan *chan;
4573
4574 if (cmd_len != sizeof(*req))
4575 return -EPROTO;
4576
4577 scid = __le16_to_cpu(req->scid);
4578 dcid = __le16_to_cpu(req->dcid);
4579
4580 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4581
4582 chan = l2cap_get_chan_by_scid(conn, dcid);
4583 if (!chan) {
4584 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4585 return 0;
4586 }
4587
4588 rsp.dcid = cpu_to_le16(chan->scid);
4589 rsp.scid = cpu_to_le16(chan->dcid);
4590 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4591
4592 chan->ops->set_shutdown(chan);
4593
4594 l2cap_chan_del(chan, ECONNRESET);
4595
4596 chan->ops->close(chan);
4597
4598 l2cap_chan_unlock(chan);
4599 l2cap_chan_put(chan);
4600
4601 return 0;
4602 }
4603
l2cap_disconnect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4604 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4605 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4606 u8 *data)
4607 {
4608 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4609 u16 dcid, scid;
4610 struct l2cap_chan *chan;
4611
4612 if (cmd_len != sizeof(*rsp))
4613 return -EPROTO;
4614
4615 scid = __le16_to_cpu(rsp->scid);
4616 dcid = __le16_to_cpu(rsp->dcid);
4617
4618 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4619
4620 chan = l2cap_get_chan_by_scid(conn, scid);
4621 if (!chan) {
4622 return 0;
4623 }
4624
4625 if (chan->state != BT_DISCONN) {
4626 l2cap_chan_unlock(chan);
4627 l2cap_chan_put(chan);
4628 return 0;
4629 }
4630
4631 l2cap_chan_del(chan, 0);
4632
4633 chan->ops->close(chan);
4634
4635 l2cap_chan_unlock(chan);
4636 l2cap_chan_put(chan);
4637
4638 return 0;
4639 }
4640
l2cap_information_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4641 static inline int l2cap_information_req(struct l2cap_conn *conn,
4642 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4643 u8 *data)
4644 {
4645 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4646 u16 type;
4647
4648 if (cmd_len != sizeof(*req))
4649 return -EPROTO;
4650
4651 type = __le16_to_cpu(req->type);
4652
4653 BT_DBG("type 0x%4.4x", type);
4654
4655 if (type == L2CAP_IT_FEAT_MASK) {
4656 u8 buf[8];
4657 u32 feat_mask = l2cap_feat_mask;
4658 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4659 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4660 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4661 if (!disable_ertm)
4662 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4663 | L2CAP_FEAT_FCS;
4664
4665 put_unaligned_le32(feat_mask, rsp->data);
4666 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4667 buf);
4668 } else if (type == L2CAP_IT_FIXED_CHAN) {
4669 u8 buf[12];
4670 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4671
4672 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4673 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4674 rsp->data[0] = conn->local_fixed_chan;
4675 memset(rsp->data + 1, 0, 7);
4676 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4677 buf);
4678 } else {
4679 struct l2cap_info_rsp rsp;
4680 rsp.type = cpu_to_le16(type);
4681 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4682 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4683 &rsp);
4684 }
4685
4686 return 0;
4687 }
4688
l2cap_information_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4689 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4690 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4691 u8 *data)
4692 {
4693 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4694 u16 type, result;
4695
4696 if (cmd_len < sizeof(*rsp))
4697 return -EPROTO;
4698
4699 type = __le16_to_cpu(rsp->type);
4700 result = __le16_to_cpu(rsp->result);
4701
4702 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4703
4704 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4705 if (cmd->ident != conn->info_ident ||
4706 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4707 return 0;
4708
4709 cancel_delayed_work(&conn->info_timer);
4710
4711 if (result != L2CAP_IR_SUCCESS) {
4712 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4713 conn->info_ident = 0;
4714
4715 l2cap_conn_start(conn);
4716
4717 return 0;
4718 }
4719
4720 switch (type) {
4721 case L2CAP_IT_FEAT_MASK:
4722 if (cmd_len >= sizeof(*rsp) + sizeof(u32))
4723 conn->feat_mask = get_unaligned_le32(rsp->data);
4724
4725 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4726 struct l2cap_info_req req;
4727 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4728
4729 conn->info_ident = l2cap_get_ident(conn);
4730
4731 l2cap_send_cmd(conn, conn->info_ident,
4732 L2CAP_INFO_REQ, sizeof(req), &req);
4733 } else {
4734 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4735 conn->info_ident = 0;
4736
4737 l2cap_conn_start(conn);
4738 }
4739 break;
4740
4741 case L2CAP_IT_FIXED_CHAN:
4742 if (cmd_len >= sizeof(*rsp) + sizeof(rsp->data[0]))
4743 conn->remote_fixed_chan = rsp->data[0];
4744 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4745 conn->info_ident = 0;
4746
4747 l2cap_conn_start(conn);
4748 break;
4749 }
4750
4751 return 0;
4752 }
4753
l2cap_conn_param_update_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4754 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4755 struct l2cap_cmd_hdr *cmd,
4756 u16 cmd_len, u8 *data)
4757 {
4758 struct hci_conn *hcon = conn->hcon;
4759 struct l2cap_conn_param_update_req *req;
4760 struct l2cap_conn_param_update_rsp rsp;
4761 u16 min, max, latency, to_multiplier;
4762 int err;
4763
4764 if (hcon->role != HCI_ROLE_MASTER)
4765 return -EINVAL;
4766
4767 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4768 return -EPROTO;
4769
4770 req = (struct l2cap_conn_param_update_req *) data;
4771 min = __le16_to_cpu(req->min);
4772 max = __le16_to_cpu(req->max);
4773 latency = __le16_to_cpu(req->latency);
4774 to_multiplier = __le16_to_cpu(req->to_multiplier);
4775
4776 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4777 min, max, latency, to_multiplier);
4778
4779 memset(&rsp, 0, sizeof(rsp));
4780
4781 err = hci_check_conn_params(min, max, latency, to_multiplier);
4782 if (err)
4783 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4784 else
4785 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4786
4787 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4788 sizeof(rsp), &rsp);
4789
4790 if (!err)
4791 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
4792
4793 return 0;
4794 }
4795
l2cap_le_connect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4796 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
4797 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4798 u8 *data)
4799 {
4800 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
4801 struct hci_conn *hcon = conn->hcon;
4802 u16 dcid, mtu, mps, credits, result;
4803 struct l2cap_chan *chan;
4804 int err, sec_level;
4805
4806 if (cmd_len < sizeof(*rsp))
4807 return -EPROTO;
4808
4809 dcid = __le16_to_cpu(rsp->dcid);
4810 mtu = __le16_to_cpu(rsp->mtu);
4811 mps = __le16_to_cpu(rsp->mps);
4812 credits = __le16_to_cpu(rsp->credits);
4813 result = __le16_to_cpu(rsp->result);
4814
4815 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
4816 dcid < L2CAP_CID_DYN_START ||
4817 dcid > L2CAP_CID_LE_DYN_END))
4818 return -EPROTO;
4819
4820 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4821 dcid, mtu, mps, credits, result);
4822
4823 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4824 if (!chan)
4825 return -EBADSLT;
4826
4827 chan = l2cap_chan_hold_unless_zero(chan);
4828 if (!chan)
4829 return -EBADSLT;
4830
4831 err = 0;
4832
4833 l2cap_chan_lock(chan);
4834
4835 switch (result) {
4836 case L2CAP_CR_LE_SUCCESS:
4837 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4838 err = -EBADSLT;
4839 break;
4840 }
4841
4842 chan->ident = 0;
4843 chan->dcid = dcid;
4844 chan->omtu = mtu;
4845 chan->remote_mps = mps;
4846 chan->tx_credits = credits;
4847 l2cap_chan_ready(chan);
4848 break;
4849
4850 case L2CAP_CR_LE_AUTHENTICATION:
4851 case L2CAP_CR_LE_ENCRYPTION:
4852 /* If we already have MITM protection we can't do
4853 * anything.
4854 */
4855 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
4856 l2cap_chan_del(chan, ECONNREFUSED);
4857 break;
4858 }
4859
4860 sec_level = hcon->sec_level + 1;
4861 if (chan->sec_level < sec_level)
4862 chan->sec_level = sec_level;
4863
4864 /* We'll need to send a new Connect Request */
4865 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
4866
4867 smp_conn_security(hcon, chan->sec_level);
4868 break;
4869
4870 default:
4871 l2cap_chan_del(chan, ECONNREFUSED);
4872 break;
4873 }
4874
4875 l2cap_chan_unlock(chan);
4876 l2cap_chan_put(chan);
4877
4878 return err;
4879 }
4880
l2cap_put_ident(struct l2cap_conn * conn,u8 code,u8 id)4881 static void l2cap_put_ident(struct l2cap_conn *conn, u8 code, u8 id)
4882 {
4883 switch (code) {
4884 case L2CAP_COMMAND_REJ:
4885 case L2CAP_CONN_RSP:
4886 case L2CAP_CONF_RSP:
4887 case L2CAP_DISCONN_RSP:
4888 case L2CAP_ECHO_RSP:
4889 case L2CAP_INFO_RSP:
4890 case L2CAP_CONN_PARAM_UPDATE_RSP:
4891 case L2CAP_LE_CONN_RSP:
4892 case L2CAP_ECRED_CONN_RSP:
4893 case L2CAP_ECRED_RECONF_RSP:
4894 /* First do a lookup since the remote may send bogus ids that
4895 * would make ida_free to generate warnings.
4896 */
4897 if (ida_find_first_range(&conn->tx_ida, id, id) >= 0)
4898 ida_free(&conn->tx_ida, id);
4899 }
4900 }
4901
l2cap_bredr_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4902 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4903 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4904 u8 *data)
4905 {
4906 int err = 0;
4907
4908 l2cap_put_ident(conn, cmd->code, cmd->ident);
4909
4910 switch (cmd->code) {
4911 case L2CAP_COMMAND_REJ:
4912 l2cap_command_rej(conn, cmd, cmd_len, data);
4913 break;
4914
4915 case L2CAP_CONN_REQ:
4916 err = l2cap_connect_req(conn, cmd, cmd_len, data);
4917 break;
4918
4919 case L2CAP_CONN_RSP:
4920 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
4921 break;
4922
4923 case L2CAP_CONF_REQ:
4924 err = l2cap_config_req(conn, cmd, cmd_len, data);
4925 break;
4926
4927 case L2CAP_CONF_RSP:
4928 l2cap_config_rsp(conn, cmd, cmd_len, data);
4929 break;
4930
4931 case L2CAP_DISCONN_REQ:
4932 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
4933 break;
4934
4935 case L2CAP_DISCONN_RSP:
4936 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
4937 break;
4938
4939 case L2CAP_ECHO_REQ:
4940 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4941 break;
4942
4943 case L2CAP_ECHO_RSP:
4944 break;
4945
4946 case L2CAP_INFO_REQ:
4947 err = l2cap_information_req(conn, cmd, cmd_len, data);
4948 break;
4949
4950 case L2CAP_INFO_RSP:
4951 l2cap_information_rsp(conn, cmd, cmd_len, data);
4952 break;
4953
4954 default:
4955 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4956 err = -EINVAL;
4957 break;
4958 }
4959
4960 return err;
4961 }
4962
l2cap_le_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4963 static int l2cap_le_connect_req(struct l2cap_conn *conn,
4964 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4965 u8 *data)
4966 {
4967 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
4968 struct l2cap_le_conn_rsp rsp;
4969 struct l2cap_chan *chan, *pchan;
4970 u16 dcid, scid, credits, mtu, mps;
4971 __le16 psm;
4972 u8 result;
4973
4974 if (cmd_len != sizeof(*req))
4975 return -EPROTO;
4976
4977 scid = __le16_to_cpu(req->scid);
4978 mtu = __le16_to_cpu(req->mtu);
4979 mps = __le16_to_cpu(req->mps);
4980 psm = req->psm;
4981 dcid = 0;
4982 credits = 0;
4983
4984 if (mtu < 23 || mps < 23)
4985 return -EPROTO;
4986
4987 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
4988 scid, mtu, mps);
4989
4990 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
4991 * page 1059:
4992 *
4993 * Valid range: 0x0001-0x00ff
4994 *
4995 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
4996 */
4997 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
4998 result = L2CAP_CR_LE_BAD_PSM;
4999 chan = NULL;
5000 goto response;
5001 }
5002
5003 /* Check if we have socket listening on psm */
5004 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5005 &conn->hcon->dst, LE_LINK);
5006 if (!pchan) {
5007 result = L2CAP_CR_LE_BAD_PSM;
5008 chan = NULL;
5009 goto response;
5010 }
5011
5012 l2cap_chan_lock(pchan);
5013
5014 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5015 SMP_ALLOW_STK)) {
5016 result = pchan->sec_level == BT_SECURITY_MEDIUM ?
5017 L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION;
5018 chan = NULL;
5019 goto response_unlock;
5020 }
5021
5022 /* Check if Key Size is sufficient for the security level */
5023 if (!l2cap_check_enc_key_size(conn->hcon, pchan)) {
5024 result = L2CAP_CR_LE_BAD_KEY_SIZE;
5025 chan = NULL;
5026 goto response_unlock;
5027 }
5028
5029 /* Check for valid dynamic CID range */
5030 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5031 result = L2CAP_CR_LE_INVALID_SCID;
5032 chan = NULL;
5033 goto response_unlock;
5034 }
5035
5036 /* Check if we already have channel with that dcid */
5037 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5038 result = L2CAP_CR_LE_SCID_IN_USE;
5039 chan = NULL;
5040 goto response_unlock;
5041 }
5042
5043 chan = l2cap_new_connection(conn, pchan);
5044 if (!chan) {
5045 result = L2CAP_CR_LE_NO_MEM;
5046 goto response_unlock;
5047 }
5048
5049 bacpy(&chan->src, &conn->hcon->src);
5050 bacpy(&chan->dst, &conn->hcon->dst);
5051 chan->src_type = bdaddr_src_type(conn->hcon);
5052 chan->dst_type = bdaddr_dst_type(conn->hcon);
5053 chan->psm = psm;
5054 chan->dcid = scid;
5055 chan->omtu = mtu;
5056 chan->remote_mps = mps;
5057
5058 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
5059
5060 dcid = chan->scid;
5061 credits = chan->rx_credits;
5062
5063 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5064
5065 chan->ident = cmd->ident;
5066
5067 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5068 l2cap_state_change(chan, BT_CONNECT2);
5069 /* The following result value is actually not defined
5070 * for LE CoC but we use it to let the function know
5071 * that it should bail out after doing its cleanup
5072 * instead of sending a response.
5073 */
5074 result = L2CAP_CR_PEND;
5075 chan->ops->defer(chan);
5076 } else {
5077 l2cap_chan_ready(chan);
5078 result = L2CAP_CR_LE_SUCCESS;
5079 }
5080
5081 response_unlock:
5082 l2cap_chan_unlock(pchan);
5083 l2cap_chan_put(pchan);
5084
5085 if (result == L2CAP_CR_PEND)
5086 return 0;
5087
5088 response:
5089 if (chan) {
5090 rsp.mtu = cpu_to_le16(chan->imtu);
5091 rsp.mps = cpu_to_le16(chan->mps);
5092 } else {
5093 rsp.mtu = 0;
5094 rsp.mps = 0;
5095 }
5096
5097 rsp.dcid = cpu_to_le16(dcid);
5098 rsp.credits = cpu_to_le16(credits);
5099 rsp.result = cpu_to_le16(result);
5100
5101 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5102
5103 return 0;
5104 }
5105
l2cap_le_credits(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5106 static inline int l2cap_le_credits(struct l2cap_conn *conn,
5107 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5108 u8 *data)
5109 {
5110 struct l2cap_le_credits *pkt;
5111 struct l2cap_chan *chan;
5112 u16 cid, credits, max_credits;
5113
5114 if (cmd_len != sizeof(*pkt))
5115 return -EPROTO;
5116
5117 pkt = (struct l2cap_le_credits *) data;
5118 cid = __le16_to_cpu(pkt->cid);
5119 credits = __le16_to_cpu(pkt->credits);
5120
5121 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5122
5123 chan = l2cap_get_chan_by_dcid(conn, cid);
5124 if (!chan)
5125 return -EBADSLT;
5126
5127 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5128 if (credits > max_credits) {
5129 BT_ERR("LE credits overflow");
5130 l2cap_send_disconn_req(chan, ECONNRESET);
5131
5132 /* Return 0 so that we don't trigger an unnecessary
5133 * command reject packet.
5134 */
5135 goto unlock;
5136 }
5137
5138 chan->tx_credits += credits;
5139
5140 /* Resume sending */
5141 l2cap_le_flowctl_send(chan);
5142
5143 if (chan->tx_credits)
5144 chan->ops->resume(chan);
5145
5146 unlock:
5147 l2cap_chan_unlock(chan);
5148 l2cap_chan_put(chan);
5149
5150 return 0;
5151 }
5152
l2cap_ecred_conn_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5153 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
5154 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5155 u8 *data)
5156 {
5157 struct l2cap_ecred_conn_req *req = (void *) data;
5158 DEFINE_RAW_FLEX(struct l2cap_ecred_conn_rsp, pdu, dcid, L2CAP_ECRED_MAX_CID);
5159 struct l2cap_chan *chan, *pchan;
5160 u16 mtu, mps;
5161 __le16 psm;
5162 u8 result, rsp_len = 0;
5163 int i, num_scid = 0;
5164 bool defer = false;
5165
5166 if (!enable_ecred)
5167 return -EINVAL;
5168
5169 memset(pdu, 0, sizeof(*pdu));
5170
5171 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5172 result = L2CAP_CR_LE_INVALID_PARAMS;
5173 goto response;
5174 }
5175
5176 /* Check if there are no pending channels with the same ident */
5177 __l2cap_chan_list_id(conn, cmd->ident, l2cap_ecred_list_defer,
5178 &num_scid);
5179 if (num_scid) {
5180 result = L2CAP_CR_LE_INVALID_PARAMS;
5181 goto response;
5182 }
5183
5184 cmd_len -= sizeof(*req);
5185 num_scid = cmd_len / sizeof(u16);
5186
5187 if (num_scid > L2CAP_ECRED_MAX_CID) {
5188 result = L2CAP_CR_LE_INVALID_PARAMS;
5189 goto response;
5190 }
5191
5192 /* Always respond with the same number of scids as in the request */
5193 rsp_len = cmd_len;
5194
5195 mtu = __le16_to_cpu(req->mtu);
5196 mps = __le16_to_cpu(req->mps);
5197
5198 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5199 result = L2CAP_CR_LE_INVALID_PARAMS;
5200 goto response;
5201 }
5202
5203 psm = req->psm;
5204
5205 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
5206 * page 1059:
5207 *
5208 * Valid range: 0x0001-0x00ff
5209 *
5210 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
5211 */
5212 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
5213 result = L2CAP_CR_LE_BAD_PSM;
5214 goto response;
5215 }
5216
5217 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5218
5219 /* Check if we have socket listening on psm */
5220 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5221 &conn->hcon->dst, LE_LINK);
5222 if (!pchan) {
5223 result = L2CAP_CR_LE_BAD_PSM;
5224 goto response;
5225 }
5226
5227 l2cap_chan_lock(pchan);
5228
5229 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5230 SMP_ALLOW_STK)) {
5231 result = pchan->sec_level == BT_SECURITY_MEDIUM ?
5232 L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION;
5233 goto unlock;
5234 }
5235
5236 /* Check if the listening channel has set an output MTU then the
5237 * requested MTU shall be less than or equal to that value.
5238 */
5239 if (pchan->omtu && mtu < pchan->omtu) {
5240 result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5241 goto unlock;
5242 }
5243
5244 result = L2CAP_CR_LE_SUCCESS;
5245
5246 for (i = 0; i < num_scid; i++) {
5247 u16 scid = __le16_to_cpu(req->scid[i]);
5248
5249 BT_DBG("scid[%d] 0x%4.4x", i, scid);
5250
5251 pdu->dcid[i] = 0x0000;
5252
5253 /* Check for valid dynamic CID range */
5254 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5255 result = L2CAP_CR_LE_INVALID_SCID;
5256 continue;
5257 }
5258
5259 /* Check if we already have channel with that dcid */
5260 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5261 result = L2CAP_CR_LE_SCID_IN_USE;
5262 continue;
5263 }
5264
5265 chan = l2cap_new_connection(conn, pchan);
5266 if (!chan) {
5267 result = L2CAP_CR_LE_NO_MEM;
5268 continue;
5269 }
5270
5271 bacpy(&chan->src, &conn->hcon->src);
5272 bacpy(&chan->dst, &conn->hcon->dst);
5273 chan->src_type = bdaddr_src_type(conn->hcon);
5274 chan->dst_type = bdaddr_dst_type(conn->hcon);
5275 chan->psm = psm;
5276 chan->dcid = scid;
5277 chan->omtu = mtu;
5278 chan->remote_mps = mps;
5279
5280 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
5281
5282 /* Init response */
5283 if (!pdu->credits) {
5284 pdu->mtu = cpu_to_le16(chan->imtu);
5285 pdu->mps = cpu_to_le16(chan->mps);
5286 pdu->credits = cpu_to_le16(chan->rx_credits);
5287 }
5288
5289 pdu->dcid[i] = cpu_to_le16(chan->scid);
5290
5291 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5292
5293 chan->ident = cmd->ident;
5294 chan->mode = L2CAP_MODE_EXT_FLOWCTL;
5295
5296 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5297 l2cap_state_change(chan, BT_CONNECT2);
5298 defer = true;
5299 chan->ops->defer(chan);
5300 } else {
5301 l2cap_chan_ready(chan);
5302 }
5303 }
5304
5305 unlock:
5306 l2cap_chan_unlock(pchan);
5307 l2cap_chan_put(pchan);
5308
5309 response:
5310 pdu->result = cpu_to_le16(result);
5311
5312 if (defer)
5313 return 0;
5314
5315 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
5316 sizeof(*pdu) + rsp_len, pdu);
5317
5318 return 0;
5319 }
5320
l2cap_ecred_conn_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5321 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
5322 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5323 u8 *data)
5324 {
5325 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5326 struct hci_conn *hcon = conn->hcon;
5327 u16 mtu, mps, credits, result;
5328 struct l2cap_chan *chan, *tmp;
5329 int err = 0, sec_level;
5330 int i = 0;
5331
5332 if (cmd_len < sizeof(*rsp))
5333 return -EPROTO;
5334
5335 mtu = __le16_to_cpu(rsp->mtu);
5336 mps = __le16_to_cpu(rsp->mps);
5337 credits = __le16_to_cpu(rsp->credits);
5338 result = __le16_to_cpu(rsp->result);
5339
5340 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5341 result);
5342
5343 cmd_len -= sizeof(*rsp);
5344
5345 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5346 struct l2cap_chan *orig;
5347 u16 dcid;
5348
5349 if (chan->ident != cmd->ident ||
5350 chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
5351 chan->state == BT_CONNECTED)
5352 continue;
5353
5354 l2cap_chan_lock(chan);
5355
5356 /* Check that there is a dcid for each pending channel */
5357 if (cmd_len < sizeof(dcid)) {
5358 l2cap_chan_del(chan, ECONNREFUSED);
5359 l2cap_chan_unlock(chan);
5360 continue;
5361 }
5362
5363 dcid = __le16_to_cpu(rsp->dcid[i++]);
5364 cmd_len -= sizeof(u16);
5365
5366 BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
5367
5368 orig = __l2cap_get_chan_by_dcid(conn, dcid);
5369
5370 /* Check if dcid is already in use */
5371 if (dcid && orig) {
5372 /* If a device receives a
5373 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
5374 * already-assigned Destination CID, then both the
5375 * original channel and the new channel shall be
5376 * immediately discarded and not used.
5377 */
5378 l2cap_chan_del(chan, ECONNREFUSED);
5379 l2cap_chan_unlock(chan);
5380
5381 /* Check that the dcid channel mode is
5382 * L2CAP_MODE_EXT_FLOWCTL since this procedure is only
5383 * valid for that mode and shouldn't disconnect a dcid
5384 * in other modes.
5385 */
5386 if (orig->mode == L2CAP_MODE_EXT_FLOWCTL) {
5387 l2cap_chan_lock(orig);
5388 /* Disconnect the original channel as it may be
5389 * considered connected since dcid has already
5390 * been assigned; don't call l2cap_chan_close
5391 * directly since that could lead to
5392 * l2cap_chan_del and then removing the channel
5393 * from the list while we're iterating over it.
5394 */
5395 __set_chan_timer(orig, 0);
5396 l2cap_chan_unlock(orig);
5397 }
5398 continue;
5399 }
5400
5401 switch (result) {
5402 case L2CAP_CR_LE_AUTHENTICATION:
5403 case L2CAP_CR_LE_ENCRYPTION:
5404 /* If we already have MITM protection we can't do
5405 * anything.
5406 */
5407 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5408 l2cap_chan_del(chan, ECONNREFUSED);
5409 break;
5410 }
5411
5412 sec_level = hcon->sec_level + 1;
5413 if (chan->sec_level < sec_level)
5414 chan->sec_level = sec_level;
5415
5416 /* We'll need to send a new Connect Request */
5417 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
5418
5419 smp_conn_security(hcon, chan->sec_level);
5420 break;
5421
5422 case L2CAP_CR_LE_BAD_PSM:
5423 l2cap_chan_del(chan, ECONNREFUSED);
5424 break;
5425
5426 default:
5427 /* If dcid was not set it means channels was refused */
5428 if (!dcid) {
5429 l2cap_chan_del(chan, ECONNREFUSED);
5430 break;
5431 }
5432
5433 chan->ident = 0;
5434 chan->dcid = dcid;
5435 chan->omtu = mtu;
5436 chan->remote_mps = mps;
5437 chan->tx_credits = credits;
5438 l2cap_chan_ready(chan);
5439 break;
5440 }
5441
5442 l2cap_chan_unlock(chan);
5443 }
5444
5445 return err;
5446 }
5447
l2cap_ecred_reconf_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5448 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
5449 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5450 u8 *data)
5451 {
5452 struct l2cap_ecred_reconf_req *req = (void *) data;
5453 struct l2cap_ecred_reconf_rsp rsp;
5454 u16 mtu, mps, result;
5455 struct l2cap_chan *chan[L2CAP_ECRED_MAX_CID] = {};
5456 int i, num_scid;
5457
5458 if (!enable_ecred)
5459 return -EINVAL;
5460
5461 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5462 result = L2CAP_RECONF_INVALID_CID;
5463 goto respond;
5464 }
5465
5466 mtu = __le16_to_cpu(req->mtu);
5467 mps = __le16_to_cpu(req->mps);
5468
5469 BT_DBG("mtu %u mps %u", mtu, mps);
5470
5471 if (mtu < L2CAP_ECRED_MIN_MTU) {
5472 result = L2CAP_RECONF_INVALID_PARAMS;
5473 goto respond;
5474 }
5475
5476 if (mps < L2CAP_ECRED_MIN_MPS) {
5477 result = L2CAP_RECONF_INVALID_PARAMS;
5478 goto respond;
5479 }
5480
5481 cmd_len -= sizeof(*req);
5482 num_scid = cmd_len / sizeof(u16);
5483
5484 if (num_scid > L2CAP_ECRED_MAX_CID) {
5485 result = L2CAP_RECONF_INVALID_PARAMS;
5486 goto respond;
5487 }
5488
5489 result = L2CAP_RECONF_SUCCESS;
5490
5491 /* Check if each SCID, MTU and MPS are valid */
5492 for (i = 0; i < num_scid; i++) {
5493 u16 scid;
5494
5495 scid = __le16_to_cpu(req->scid[i]);
5496 if (!scid) {
5497 result = L2CAP_RECONF_INVALID_CID;
5498 goto respond;
5499 }
5500
5501 chan[i] = __l2cap_get_chan_by_dcid(conn, scid);
5502 if (!chan[i]) {
5503 result = L2CAP_RECONF_INVALID_CID;
5504 goto respond;
5505 }
5506
5507 /* The MTU field shall be greater than or equal to the greatest
5508 * current MTU size of these channels.
5509 */
5510 if (chan[i]->omtu > mtu) {
5511 BT_ERR("chan %p decreased MTU %u -> %u", chan[i],
5512 chan[i]->omtu, mtu);
5513 result = L2CAP_RECONF_INVALID_MTU;
5514 goto respond;
5515 }
5516
5517 /* If more than one channel is being configured, the MPS field
5518 * shall be greater than or equal to the current MPS size of
5519 * each of these channels. If only one channel is being
5520 * configured, the MPS field may be less than the current MPS
5521 * of that channel.
5522 */
5523 if (chan[i]->remote_mps > mps && num_scid > 1) {
5524 BT_ERR("chan %p decreased MPS %u -> %u", chan[i],
5525 chan[i]->remote_mps, mps);
5526 result = L2CAP_RECONF_INVALID_MPS;
5527 goto respond;
5528 }
5529 }
5530
5531 /* Commit the new MTU and MPS values after checking they are valid */
5532 for (i = 0; i < num_scid; i++) {
5533 chan[i]->omtu = mtu;
5534 chan[i]->remote_mps = mps;
5535 }
5536
5537 respond:
5538 rsp.result = cpu_to_le16(result);
5539
5540 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
5541 &rsp);
5542
5543 return 0;
5544 }
5545
l2cap_ecred_reconf_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5546 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
5547 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5548 u8 *data)
5549 {
5550 struct l2cap_chan *chan, *tmp;
5551 struct l2cap_ecred_reconf_rsp *rsp = (void *)data;
5552 u16 result;
5553
5554 if (cmd_len < sizeof(*rsp))
5555 return -EPROTO;
5556
5557 result = __le16_to_cpu(rsp->result);
5558
5559 BT_DBG("result 0x%4.4x", result);
5560
5561 if (!result) {
5562 list_for_each_entry(chan, &conn->chan_l, list) {
5563 if (chan->ident == cmd->ident)
5564 chan->ident = 0;
5565 }
5566 return 0;
5567 }
5568
5569 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5570 if (chan->ident != cmd->ident)
5571 continue;
5572
5573 if (!l2cap_chan_hold_unless_zero(chan))
5574 continue;
5575 l2cap_chan_lock(chan);
5576
5577 l2cap_chan_del(chan, ECONNRESET);
5578
5579 l2cap_chan_unlock(chan);
5580 l2cap_chan_put(chan);
5581 }
5582
5583 return 0;
5584 }
5585
l2cap_le_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5586 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5587 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5588 u8 *data)
5589 {
5590 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5591 struct l2cap_chan *chan;
5592
5593 if (cmd_len < sizeof(*rej))
5594 return -EPROTO;
5595
5596 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5597 if (!chan)
5598 goto done;
5599
5600 chan = l2cap_chan_hold_unless_zero(chan);
5601 if (!chan)
5602 goto done;
5603
5604 l2cap_chan_lock(chan);
5605 l2cap_chan_del(chan, ECONNREFUSED);
5606 l2cap_chan_unlock(chan);
5607 l2cap_chan_put(chan);
5608
5609 done:
5610 return 0;
5611 }
5612
l2cap_le_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5613 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5614 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5615 u8 *data)
5616 {
5617 int err = 0;
5618
5619 l2cap_put_ident(conn, cmd->code, cmd->ident);
5620
5621 switch (cmd->code) {
5622 case L2CAP_COMMAND_REJ:
5623 l2cap_le_command_rej(conn, cmd, cmd_len, data);
5624 break;
5625
5626 case L2CAP_CONN_PARAM_UPDATE_REQ:
5627 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5628 break;
5629
5630 case L2CAP_CONN_PARAM_UPDATE_RSP:
5631 break;
5632
5633 case L2CAP_LE_CONN_RSP:
5634 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5635 break;
5636
5637 case L2CAP_LE_CONN_REQ:
5638 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5639 break;
5640
5641 case L2CAP_LE_CREDITS:
5642 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5643 break;
5644
5645 case L2CAP_ECRED_CONN_REQ:
5646 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
5647 break;
5648
5649 case L2CAP_ECRED_CONN_RSP:
5650 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
5651 break;
5652
5653 case L2CAP_ECRED_RECONF_REQ:
5654 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
5655 break;
5656
5657 case L2CAP_ECRED_RECONF_RSP:
5658 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
5659 break;
5660
5661 case L2CAP_DISCONN_REQ:
5662 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5663 break;
5664
5665 case L2CAP_DISCONN_RSP:
5666 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5667 break;
5668
5669 default:
5670 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5671 err = -EINVAL;
5672 break;
5673 }
5674
5675 return err;
5676 }
5677
l2cap_le_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5678 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5679 struct sk_buff *skb)
5680 {
5681 struct hci_conn *hcon = conn->hcon;
5682 struct l2cap_cmd_hdr *cmd;
5683 u16 len;
5684 int err;
5685
5686 if (hcon->type != LE_LINK)
5687 goto drop;
5688
5689 if (skb->len < L2CAP_CMD_HDR_SIZE)
5690 goto drop;
5691
5692 cmd = (void *) skb->data;
5693 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5694
5695 len = le16_to_cpu(cmd->len);
5696
5697 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5698
5699 if (len != skb->len || !cmd->ident) {
5700 BT_DBG("corrupted command");
5701 goto drop;
5702 }
5703
5704 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5705 if (err) {
5706 struct l2cap_cmd_rej_unk rej;
5707
5708 BT_ERR("Wrong link type (%d)", err);
5709
5710 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5711 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5712 sizeof(rej), &rej);
5713 }
5714
5715 drop:
5716 kfree_skb(skb);
5717 }
5718
l2cap_sig_send_rej(struct l2cap_conn * conn,u16 ident)5719 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
5720 {
5721 struct l2cap_cmd_rej_unk rej;
5722
5723 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5724 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5725 }
5726
l2cap_sig_send_mtu_rej(struct l2cap_conn * conn,u8 ident)5727 static inline void l2cap_sig_send_mtu_rej(struct l2cap_conn *conn, u8 ident)
5728 {
5729 struct l2cap_cmd_rej_mtu rej;
5730
5731 rej.reason = cpu_to_le16(L2CAP_REJ_MTU_EXCEEDED);
5732 rej.max_mtu = cpu_to_le16(L2CAP_SIG_MTU);
5733 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5734 }
5735
l2cap_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5736 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5737 struct sk_buff *skb)
5738 {
5739 struct hci_conn *hcon = conn->hcon;
5740 struct l2cap_cmd_hdr *cmd;
5741 int err;
5742
5743 l2cap_raw_recv(conn, skb);
5744
5745 if (hcon->type != ACL_LINK)
5746 goto drop;
5747
5748 /*
5749 * Bluetooth Core v5.4, Vol 3, Part A, Section 4: the BR/EDR
5750 * signaling channel has a fixed signaling MTU (MTUsig) whose
5751 * minimum and default is 48 octets. Section 4.1 says that on
5752 * an MTUExceeded command reject the identifier "shall match
5753 * the first request command in the L2CAP packet" and that
5754 * packets containing only response commands "shall be
5755 * silently discarded".
5756 *
5757 * Linux intentionally deviates from that prescription:
5758 *
5759 * 1. Silently discarding desynchronizes the peer. The
5760 * remote stack never learns its responses were dropped,
5761 * so any state machine waiting on a paired response
5762 * stalls until its own timer fires.
5763 *
5764 * 2. Locating "the first request command" requires walking
5765 * command headers past MTUsig, i.e. processing bytes
5766 * from a packet we have already decided is too large to
5767 * process.
5768 *
5769 * Reject every over-MTUsig signaling packet with one
5770 * L2CAP_REJ_MTU_EXCEEDED command reject. The reject's
5771 * reason field is what tells the peer that the whole packet
5772 * was discarded; the identifier value is informational, so
5773 * we use the identifier from the first command header, a
5774 * single fixed-offset byte read.
5775 */
5776 if (skb->len > L2CAP_SIG_MTU) {
5777 u8 ident = skb->data[1];
5778
5779 BT_DBG("signaling packet exceeds MTU: %u > %u",
5780 skb->len, L2CAP_SIG_MTU);
5781 l2cap_sig_send_mtu_rej(conn, ident);
5782 goto drop;
5783 }
5784
5785 while (skb->len >= L2CAP_CMD_HDR_SIZE) {
5786 u16 len;
5787
5788 cmd = (void *) skb->data;
5789 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5790
5791 len = le16_to_cpu(cmd->len);
5792
5793 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
5794 cmd->ident);
5795
5796 if (len > skb->len || !cmd->ident) {
5797 BT_DBG("corrupted command");
5798 l2cap_sig_send_rej(conn, cmd->ident);
5799 skb_pull(skb, len > skb->len ? skb->len : len);
5800 continue;
5801 }
5802
5803 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
5804 if (err) {
5805 BT_ERR("Wrong link type (%d)", err);
5806 l2cap_sig_send_rej(conn, cmd->ident);
5807 }
5808
5809 skb_pull(skb, len);
5810 }
5811
5812 if (skb->len > 0) {
5813 BT_DBG("corrupted command");
5814 l2cap_sig_send_rej(conn, 0);
5815 }
5816
5817 drop:
5818 kfree_skb(skb);
5819 }
5820
l2cap_check_fcs(struct l2cap_chan * chan,struct sk_buff * skb)5821 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
5822 {
5823 u16 our_fcs, rcv_fcs;
5824 int hdr_size;
5825
5826 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5827 hdr_size = L2CAP_EXT_HDR_SIZE;
5828 else
5829 hdr_size = L2CAP_ENH_HDR_SIZE;
5830
5831 if (chan->fcs == L2CAP_FCS_CRC16) {
5832 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5833 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5834 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5835
5836 if (our_fcs != rcv_fcs)
5837 return -EBADMSG;
5838 }
5839 return 0;
5840 }
5841
l2cap_send_i_or_rr_or_rnr(struct l2cap_chan * chan)5842 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5843 {
5844 struct l2cap_ctrl control;
5845
5846 BT_DBG("chan %p", chan);
5847
5848 memset(&control, 0, sizeof(control));
5849 control.sframe = 1;
5850 control.final = 1;
5851 control.reqseq = chan->buffer_seq;
5852 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5853
5854 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5855 control.super = L2CAP_SUPER_RNR;
5856 l2cap_send_sframe(chan, &control);
5857 }
5858
5859 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5860 chan->unacked_frames > 0)
5861 __set_retrans_timer(chan);
5862
5863 /* Send pending iframes */
5864 l2cap_ertm_send(chan);
5865
5866 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5867 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5868 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5869 * send it now.
5870 */
5871 control.super = L2CAP_SUPER_RR;
5872 l2cap_send_sframe(chan, &control);
5873 }
5874 }
5875
append_skb_frag(struct sk_buff * skb,struct sk_buff * new_frag,struct sk_buff ** last_frag)5876 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5877 struct sk_buff **last_frag)
5878 {
5879 /* skb->len reflects data in skb as well as all fragments
5880 * skb->data_len reflects only data in fragments
5881 */
5882 if (!skb_has_frag_list(skb))
5883 skb_shinfo(skb)->frag_list = new_frag;
5884
5885 new_frag->next = NULL;
5886
5887 (*last_frag)->next = new_frag;
5888 *last_frag = new_frag;
5889
5890 skb->len += new_frag->len;
5891 skb->data_len += new_frag->len;
5892 skb->truesize += new_frag->truesize;
5893 }
5894
l2cap_reassemble_sdu(struct l2cap_chan * chan,struct sk_buff * skb,struct l2cap_ctrl * control)5895 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5896 struct l2cap_ctrl *control)
5897 {
5898 int err = -EINVAL;
5899
5900 switch (control->sar) {
5901 case L2CAP_SAR_UNSEGMENTED:
5902 if (chan->sdu)
5903 break;
5904
5905 err = chan->ops->recv(chan, skb);
5906 break;
5907
5908 case L2CAP_SAR_START:
5909 if (chan->sdu)
5910 break;
5911
5912 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5913 break;
5914
5915 chan->sdu_len = get_unaligned_le16(skb->data);
5916 skb_pull(skb, L2CAP_SDULEN_SIZE);
5917
5918 if (chan->sdu_len > chan->imtu) {
5919 err = -EMSGSIZE;
5920 break;
5921 }
5922
5923 if (skb->len >= chan->sdu_len)
5924 break;
5925
5926 chan->sdu = skb;
5927 chan->sdu_last_frag = skb;
5928
5929 skb = NULL;
5930 err = 0;
5931 break;
5932
5933 case L2CAP_SAR_CONTINUE:
5934 if (!chan->sdu)
5935 break;
5936
5937 append_skb_frag(chan->sdu, skb,
5938 &chan->sdu_last_frag);
5939 skb = NULL;
5940
5941 if (chan->sdu->len >= chan->sdu_len)
5942 break;
5943
5944 err = 0;
5945 break;
5946
5947 case L2CAP_SAR_END:
5948 if (!chan->sdu)
5949 break;
5950
5951 append_skb_frag(chan->sdu, skb,
5952 &chan->sdu_last_frag);
5953 skb = NULL;
5954
5955 if (chan->sdu->len != chan->sdu_len)
5956 break;
5957
5958 err = chan->ops->recv(chan, chan->sdu);
5959
5960 if (!err) {
5961 /* Reassembly complete */
5962 chan->sdu = NULL;
5963 chan->sdu_last_frag = NULL;
5964 chan->sdu_len = 0;
5965 }
5966 break;
5967 }
5968
5969 if (err) {
5970 kfree_skb(skb);
5971 kfree_skb(chan->sdu);
5972 chan->sdu = NULL;
5973 chan->sdu_last_frag = NULL;
5974 chan->sdu_len = 0;
5975 }
5976
5977 return err;
5978 }
5979
l2cap_resegment(struct l2cap_chan * chan)5980 static int l2cap_resegment(struct l2cap_chan *chan)
5981 {
5982 /* Placeholder */
5983 return 0;
5984 }
5985
l2cap_chan_busy(struct l2cap_chan * chan,int busy)5986 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5987 {
5988 u8 event;
5989
5990 if (chan->mode != L2CAP_MODE_ERTM)
5991 return;
5992
5993 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5994 l2cap_tx(chan, NULL, NULL, event);
5995 }
5996
l2cap_rx_queued_iframes(struct l2cap_chan * chan)5997 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5998 {
5999 int err = 0;
6000 /* Pass sequential frames to l2cap_reassemble_sdu()
6001 * until a gap is encountered.
6002 */
6003
6004 BT_DBG("chan %p", chan);
6005
6006 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6007 struct sk_buff *skb;
6008 BT_DBG("Searching for skb with txseq %d (queue len %d)",
6009 chan->buffer_seq, skb_queue_len(&chan->srej_q));
6010
6011 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
6012
6013 if (!skb)
6014 break;
6015
6016 skb_unlink(skb, &chan->srej_q);
6017 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6018 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
6019 if (err)
6020 break;
6021 }
6022
6023 if (skb_queue_empty(&chan->srej_q)) {
6024 chan->rx_state = L2CAP_RX_STATE_RECV;
6025 l2cap_send_ack(chan);
6026 }
6027
6028 return err;
6029 }
6030
l2cap_handle_srej(struct l2cap_chan * chan,struct l2cap_ctrl * control)6031 static void l2cap_handle_srej(struct l2cap_chan *chan,
6032 struct l2cap_ctrl *control)
6033 {
6034 struct sk_buff *skb;
6035
6036 BT_DBG("chan %p, control %p", chan, control);
6037
6038 if (control->reqseq == chan->next_tx_seq) {
6039 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
6040 l2cap_send_disconn_req(chan, ECONNRESET);
6041 return;
6042 }
6043
6044 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6045
6046 if (skb == NULL) {
6047 BT_DBG("Seq %d not available for retransmission",
6048 control->reqseq);
6049 return;
6050 }
6051
6052 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
6053 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
6054 l2cap_send_disconn_req(chan, ECONNRESET);
6055 return;
6056 }
6057
6058 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6059
6060 if (control->poll) {
6061 l2cap_pass_to_tx(chan, control);
6062
6063 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6064 l2cap_retransmit(chan, control);
6065 l2cap_ertm_send(chan);
6066
6067 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6068 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6069 chan->srej_save_reqseq = control->reqseq;
6070 }
6071 } else {
6072 l2cap_pass_to_tx_fbit(chan, control);
6073
6074 if (control->final) {
6075 if (chan->srej_save_reqseq != control->reqseq ||
6076 !test_and_clear_bit(CONN_SREJ_ACT,
6077 &chan->conn_state))
6078 l2cap_retransmit(chan, control);
6079 } else {
6080 l2cap_retransmit(chan, control);
6081 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6082 set_bit(CONN_SREJ_ACT, &chan->conn_state);
6083 chan->srej_save_reqseq = control->reqseq;
6084 }
6085 }
6086 }
6087 }
6088
l2cap_handle_rej(struct l2cap_chan * chan,struct l2cap_ctrl * control)6089 static void l2cap_handle_rej(struct l2cap_chan *chan,
6090 struct l2cap_ctrl *control)
6091 {
6092 struct sk_buff *skb;
6093
6094 BT_DBG("chan %p, control %p", chan, control);
6095
6096 if (control->reqseq == chan->next_tx_seq) {
6097 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
6098 l2cap_send_disconn_req(chan, ECONNRESET);
6099 return;
6100 }
6101
6102 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6103
6104 if (chan->max_tx && skb &&
6105 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
6106 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
6107 l2cap_send_disconn_req(chan, ECONNRESET);
6108 return;
6109 }
6110
6111 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6112
6113 l2cap_pass_to_tx(chan, control);
6114
6115 if (control->final) {
6116 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
6117 l2cap_retransmit_all(chan, control);
6118 } else {
6119 l2cap_retransmit_all(chan, control);
6120 l2cap_ertm_send(chan);
6121 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
6122 set_bit(CONN_REJ_ACT, &chan->conn_state);
6123 }
6124 }
6125
l2cap_classify_txseq(struct l2cap_chan * chan,u16 txseq)6126 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
6127 {
6128 BT_DBG("chan %p, txseq %d", chan, txseq);
6129
6130 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
6131 chan->expected_tx_seq);
6132
6133 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
6134 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6135 chan->tx_win) {
6136 /* See notes below regarding "double poll" and
6137 * invalid packets.
6138 */
6139 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6140 BT_DBG("Invalid/Ignore - after SREJ");
6141 return L2CAP_TXSEQ_INVALID_IGNORE;
6142 } else {
6143 BT_DBG("Invalid - in window after SREJ sent");
6144 return L2CAP_TXSEQ_INVALID;
6145 }
6146 }
6147
6148 if (chan->srej_list.head == txseq) {
6149 BT_DBG("Expected SREJ");
6150 return L2CAP_TXSEQ_EXPECTED_SREJ;
6151 }
6152
6153 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
6154 BT_DBG("Duplicate SREJ - txseq already stored");
6155 return L2CAP_TXSEQ_DUPLICATE_SREJ;
6156 }
6157
6158 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6159 BT_DBG("Unexpected SREJ - not requested");
6160 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6161 }
6162 }
6163
6164 if (chan->expected_tx_seq == txseq) {
6165 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6166 chan->tx_win) {
6167 BT_DBG("Invalid - txseq outside tx window");
6168 return L2CAP_TXSEQ_INVALID;
6169 } else {
6170 BT_DBG("Expected");
6171 return L2CAP_TXSEQ_EXPECTED;
6172 }
6173 }
6174
6175 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
6176 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
6177 BT_DBG("Duplicate - expected_tx_seq later than txseq");
6178 return L2CAP_TXSEQ_DUPLICATE;
6179 }
6180
6181 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6182 /* A source of invalid packets is a "double poll" condition,
6183 * where delays cause us to send multiple poll packets. If
6184 * the remote stack receives and processes both polls,
6185 * sequence numbers can wrap around in such a way that a
6186 * resent frame has a sequence number that looks like new data
6187 * with a sequence gap. This would trigger an erroneous SREJ
6188 * request.
6189 *
6190 * Fortunately, this is impossible with a tx window that's
6191 * less than half of the maximum sequence number, which allows
6192 * invalid frames to be safely ignored.
6193 *
6194 * With tx window sizes greater than half of the tx window
6195 * maximum, the frame is invalid and cannot be ignored. This
6196 * causes a disconnect.
6197 */
6198
6199 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6200 BT_DBG("Invalid/Ignore - txseq outside tx window");
6201 return L2CAP_TXSEQ_INVALID_IGNORE;
6202 } else {
6203 BT_DBG("Invalid - txseq outside tx window");
6204 return L2CAP_TXSEQ_INVALID;
6205 }
6206 } else {
6207 BT_DBG("Unexpected - txseq indicates missing frames");
6208 return L2CAP_TXSEQ_UNEXPECTED;
6209 }
6210 }
6211
l2cap_rx_state_recv(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6212 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6213 struct l2cap_ctrl *control,
6214 struct sk_buff *skb, u8 event)
6215 {
6216 struct l2cap_ctrl local_control;
6217 int err = 0;
6218 bool skb_in_use = false;
6219
6220 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6221 event);
6222
6223 switch (event) {
6224 case L2CAP_EV_RECV_IFRAME:
6225 switch (l2cap_classify_txseq(chan, control->txseq)) {
6226 case L2CAP_TXSEQ_EXPECTED:
6227 l2cap_pass_to_tx(chan, control);
6228
6229 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6230 BT_DBG("Busy, discarding expected seq %d",
6231 control->txseq);
6232 break;
6233 }
6234
6235 chan->expected_tx_seq = __next_seq(chan,
6236 control->txseq);
6237
6238 chan->buffer_seq = chan->expected_tx_seq;
6239 skb_in_use = true;
6240
6241 /* l2cap_reassemble_sdu may free skb, hence invalidate
6242 * control, so make a copy in advance to use it after
6243 * l2cap_reassemble_sdu returns and to avoid the race
6244 * condition, for example:
6245 *
6246 * The current thread calls:
6247 * l2cap_reassemble_sdu
6248 * chan->ops->recv == l2cap_sock_recv_cb
6249 * __sock_queue_rcv_skb
6250 * Another thread calls:
6251 * bt_sock_recvmsg
6252 * skb_recv_datagram
6253 * skb_free_datagram
6254 * Then the current thread tries to access control, but
6255 * it was freed by skb_free_datagram.
6256 */
6257 local_control = *control;
6258 err = l2cap_reassemble_sdu(chan, skb, control);
6259 if (err)
6260 break;
6261
6262 if (local_control.final) {
6263 if (!test_and_clear_bit(CONN_REJ_ACT,
6264 &chan->conn_state)) {
6265 local_control.final = 0;
6266 l2cap_retransmit_all(chan, &local_control);
6267 l2cap_ertm_send(chan);
6268 }
6269 }
6270
6271 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6272 l2cap_send_ack(chan);
6273 break;
6274 case L2CAP_TXSEQ_UNEXPECTED:
6275 l2cap_pass_to_tx(chan, control);
6276
6277 /* Can't issue SREJ frames in the local busy state.
6278 * Drop this frame, it will be seen as missing
6279 * when local busy is exited.
6280 */
6281 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6282 BT_DBG("Busy, discarding unexpected seq %d",
6283 control->txseq);
6284 break;
6285 }
6286
6287 /* There was a gap in the sequence, so an SREJ
6288 * must be sent for each missing frame. The
6289 * current frame is stored for later use.
6290 */
6291 skb_queue_tail(&chan->srej_q, skb);
6292 skb_in_use = true;
6293 BT_DBG("Queued %p (queue len %d)", skb,
6294 skb_queue_len(&chan->srej_q));
6295
6296 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6297 l2cap_seq_list_clear(&chan->srej_list);
6298 l2cap_send_srej(chan, control->txseq);
6299
6300 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6301 break;
6302 case L2CAP_TXSEQ_DUPLICATE:
6303 l2cap_pass_to_tx(chan, control);
6304 break;
6305 case L2CAP_TXSEQ_INVALID_IGNORE:
6306 break;
6307 case L2CAP_TXSEQ_INVALID:
6308 default:
6309 l2cap_send_disconn_req(chan, ECONNRESET);
6310 break;
6311 }
6312 break;
6313 case L2CAP_EV_RECV_RR:
6314 l2cap_pass_to_tx(chan, control);
6315 if (control->final) {
6316 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6317
6318 if (!test_and_clear_bit(CONN_REJ_ACT,
6319 &chan->conn_state)) {
6320 control->final = 0;
6321 l2cap_retransmit_all(chan, control);
6322 }
6323
6324 l2cap_ertm_send(chan);
6325 } else if (control->poll) {
6326 l2cap_send_i_or_rr_or_rnr(chan);
6327 } else {
6328 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6329 &chan->conn_state) &&
6330 chan->unacked_frames)
6331 __set_retrans_timer(chan);
6332
6333 l2cap_ertm_send(chan);
6334 }
6335 break;
6336 case L2CAP_EV_RECV_RNR:
6337 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6338 l2cap_pass_to_tx(chan, control);
6339 if (control && control->poll) {
6340 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6341 l2cap_send_rr_or_rnr(chan, 0);
6342 }
6343 __clear_retrans_timer(chan);
6344 l2cap_seq_list_clear(&chan->retrans_list);
6345 break;
6346 case L2CAP_EV_RECV_REJ:
6347 l2cap_handle_rej(chan, control);
6348 break;
6349 case L2CAP_EV_RECV_SREJ:
6350 l2cap_handle_srej(chan, control);
6351 break;
6352 default:
6353 break;
6354 }
6355
6356 if (skb && !skb_in_use) {
6357 BT_DBG("Freeing %p", skb);
6358 kfree_skb(skb);
6359 }
6360
6361 return err;
6362 }
6363
l2cap_rx_state_srej_sent(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6364 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6365 struct l2cap_ctrl *control,
6366 struct sk_buff *skb, u8 event)
6367 {
6368 int err = 0;
6369 u16 txseq = control->txseq;
6370 bool skb_in_use = false;
6371
6372 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6373 event);
6374
6375 switch (event) {
6376 case L2CAP_EV_RECV_IFRAME:
6377 switch (l2cap_classify_txseq(chan, txseq)) {
6378 case L2CAP_TXSEQ_EXPECTED:
6379 /* Keep frame for reassembly later */
6380 l2cap_pass_to_tx(chan, control);
6381 skb_queue_tail(&chan->srej_q, skb);
6382 skb_in_use = true;
6383 BT_DBG("Queued %p (queue len %d)", skb,
6384 skb_queue_len(&chan->srej_q));
6385
6386 chan->expected_tx_seq = __next_seq(chan, txseq);
6387 break;
6388 case L2CAP_TXSEQ_EXPECTED_SREJ:
6389 l2cap_seq_list_pop(&chan->srej_list);
6390
6391 l2cap_pass_to_tx(chan, control);
6392 skb_queue_tail(&chan->srej_q, skb);
6393 skb_in_use = true;
6394 BT_DBG("Queued %p (queue len %d)", skb,
6395 skb_queue_len(&chan->srej_q));
6396
6397 err = l2cap_rx_queued_iframes(chan);
6398 if (err)
6399 break;
6400
6401 break;
6402 case L2CAP_TXSEQ_UNEXPECTED:
6403 /* Got a frame that can't be reassembled yet.
6404 * Save it for later, and send SREJs to cover
6405 * the missing frames.
6406 */
6407 skb_queue_tail(&chan->srej_q, skb);
6408 skb_in_use = true;
6409 BT_DBG("Queued %p (queue len %d)", skb,
6410 skb_queue_len(&chan->srej_q));
6411
6412 l2cap_pass_to_tx(chan, control);
6413 l2cap_send_srej(chan, control->txseq);
6414 break;
6415 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6416 /* This frame was requested with an SREJ, but
6417 * some expected retransmitted frames are
6418 * missing. Request retransmission of missing
6419 * SREJ'd frames.
6420 */
6421 skb_queue_tail(&chan->srej_q, skb);
6422 skb_in_use = true;
6423 BT_DBG("Queued %p (queue len %d)", skb,
6424 skb_queue_len(&chan->srej_q));
6425
6426 l2cap_pass_to_tx(chan, control);
6427 l2cap_send_srej_list(chan, control->txseq);
6428 break;
6429 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6430 /* We've already queued this frame. Drop this copy. */
6431 l2cap_pass_to_tx(chan, control);
6432 break;
6433 case L2CAP_TXSEQ_DUPLICATE:
6434 /* Expecting a later sequence number, so this frame
6435 * was already received. Ignore it completely.
6436 */
6437 break;
6438 case L2CAP_TXSEQ_INVALID_IGNORE:
6439 break;
6440 case L2CAP_TXSEQ_INVALID:
6441 default:
6442 l2cap_send_disconn_req(chan, ECONNRESET);
6443 break;
6444 }
6445 break;
6446 case L2CAP_EV_RECV_RR:
6447 l2cap_pass_to_tx(chan, control);
6448 if (control->final) {
6449 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6450
6451 if (!test_and_clear_bit(CONN_REJ_ACT,
6452 &chan->conn_state)) {
6453 control->final = 0;
6454 l2cap_retransmit_all(chan, control);
6455 }
6456
6457 l2cap_ertm_send(chan);
6458 } else if (control->poll) {
6459 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6460 &chan->conn_state) &&
6461 chan->unacked_frames) {
6462 __set_retrans_timer(chan);
6463 }
6464
6465 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6466 l2cap_send_srej_tail(chan);
6467 } else {
6468 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6469 &chan->conn_state) &&
6470 chan->unacked_frames)
6471 __set_retrans_timer(chan);
6472
6473 l2cap_send_ack(chan);
6474 }
6475 break;
6476 case L2CAP_EV_RECV_RNR:
6477 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6478 l2cap_pass_to_tx(chan, control);
6479 if (control->poll) {
6480 l2cap_send_srej_tail(chan);
6481 } else {
6482 struct l2cap_ctrl rr_control;
6483 memset(&rr_control, 0, sizeof(rr_control));
6484 rr_control.sframe = 1;
6485 rr_control.super = L2CAP_SUPER_RR;
6486 rr_control.reqseq = chan->buffer_seq;
6487 l2cap_send_sframe(chan, &rr_control);
6488 }
6489
6490 break;
6491 case L2CAP_EV_RECV_REJ:
6492 l2cap_handle_rej(chan, control);
6493 break;
6494 case L2CAP_EV_RECV_SREJ:
6495 l2cap_handle_srej(chan, control);
6496 break;
6497 }
6498
6499 if (skb && !skb_in_use) {
6500 BT_DBG("Freeing %p", skb);
6501 kfree_skb(skb);
6502 }
6503
6504 return err;
6505 }
6506
l2cap_finish_move(struct l2cap_chan * chan)6507 static int l2cap_finish_move(struct l2cap_chan *chan)
6508 {
6509 BT_DBG("chan %p", chan);
6510
6511 chan->rx_state = L2CAP_RX_STATE_RECV;
6512 chan->conn->mtu = chan->conn->hcon->mtu;
6513
6514 return l2cap_resegment(chan);
6515 }
6516
l2cap_rx_state_wait_p(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6517 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6518 struct l2cap_ctrl *control,
6519 struct sk_buff *skb, u8 event)
6520 {
6521 int err;
6522
6523 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6524 event);
6525
6526 if (!control->poll)
6527 return -EPROTO;
6528
6529 l2cap_process_reqseq(chan, control->reqseq);
6530
6531 if (!skb_queue_empty(&chan->tx_q))
6532 chan->tx_send_head = skb_peek(&chan->tx_q);
6533 else
6534 chan->tx_send_head = NULL;
6535
6536 /* Rewind next_tx_seq to the point expected
6537 * by the receiver.
6538 */
6539 chan->next_tx_seq = control->reqseq;
6540 chan->unacked_frames = 0;
6541
6542 err = l2cap_finish_move(chan);
6543 if (err)
6544 return err;
6545
6546 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6547 l2cap_send_i_or_rr_or_rnr(chan);
6548
6549 if (event == L2CAP_EV_RECV_IFRAME)
6550 return -EPROTO;
6551
6552 return l2cap_rx_state_recv(chan, control, NULL, event);
6553 }
6554
l2cap_rx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6555 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6556 struct l2cap_ctrl *control,
6557 struct sk_buff *skb, u8 event)
6558 {
6559 int err;
6560
6561 if (!control->final)
6562 return -EPROTO;
6563
6564 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6565
6566 chan->rx_state = L2CAP_RX_STATE_RECV;
6567 l2cap_process_reqseq(chan, control->reqseq);
6568
6569 if (!skb_queue_empty(&chan->tx_q))
6570 chan->tx_send_head = skb_peek(&chan->tx_q);
6571 else
6572 chan->tx_send_head = NULL;
6573
6574 /* Rewind next_tx_seq to the point expected
6575 * by the receiver.
6576 */
6577 chan->next_tx_seq = control->reqseq;
6578 chan->unacked_frames = 0;
6579 chan->conn->mtu = chan->conn->hcon->mtu;
6580
6581 err = l2cap_resegment(chan);
6582
6583 if (!err)
6584 err = l2cap_rx_state_recv(chan, control, skb, event);
6585
6586 return err;
6587 }
6588
__valid_reqseq(struct l2cap_chan * chan,u16 reqseq)6589 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6590 {
6591 /* Make sure reqseq is for a packet that has been sent but not acked */
6592 u16 unacked;
6593
6594 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6595 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6596 }
6597
l2cap_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6598 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6599 struct sk_buff *skb, u8 event)
6600 {
6601 int err = 0;
6602
6603 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6604 control, skb, event, chan->rx_state);
6605
6606 if (__valid_reqseq(chan, control->reqseq)) {
6607 switch (chan->rx_state) {
6608 case L2CAP_RX_STATE_RECV:
6609 err = l2cap_rx_state_recv(chan, control, skb, event);
6610 break;
6611 case L2CAP_RX_STATE_SREJ_SENT:
6612 err = l2cap_rx_state_srej_sent(chan, control, skb,
6613 event);
6614 break;
6615 case L2CAP_RX_STATE_WAIT_P:
6616 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6617 break;
6618 case L2CAP_RX_STATE_WAIT_F:
6619 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6620 break;
6621 default:
6622 /* shut it down */
6623 break;
6624 }
6625 } else {
6626 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6627 control->reqseq, chan->next_tx_seq,
6628 chan->expected_ack_seq);
6629 l2cap_send_disconn_req(chan, ECONNRESET);
6630 }
6631
6632 return err;
6633 }
6634
l2cap_stream_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)6635 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6636 struct sk_buff *skb)
6637 {
6638 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6639 * the txseq field in advance to use it after l2cap_reassemble_sdu
6640 * returns and to avoid the race condition, for example:
6641 *
6642 * The current thread calls:
6643 * l2cap_reassemble_sdu
6644 * chan->ops->recv == l2cap_sock_recv_cb
6645 * __sock_queue_rcv_skb
6646 * Another thread calls:
6647 * bt_sock_recvmsg
6648 * skb_recv_datagram
6649 * skb_free_datagram
6650 * Then the current thread tries to access control, but it was freed by
6651 * skb_free_datagram.
6652 */
6653 u16 txseq = control->txseq;
6654
6655 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6656 chan->rx_state);
6657
6658 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
6659 l2cap_pass_to_tx(chan, control);
6660
6661 BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
6662 __next_seq(chan, chan->buffer_seq));
6663
6664 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6665
6666 l2cap_reassemble_sdu(chan, skb, control);
6667 } else {
6668 if (chan->sdu) {
6669 kfree_skb(chan->sdu);
6670 chan->sdu = NULL;
6671 }
6672 chan->sdu_last_frag = NULL;
6673 chan->sdu_len = 0;
6674
6675 if (skb) {
6676 BT_DBG("Freeing %p", skb);
6677 kfree_skb(skb);
6678 }
6679 }
6680
6681 chan->last_acked_seq = txseq;
6682 chan->expected_tx_seq = __next_seq(chan, txseq);
6683
6684 return 0;
6685 }
6686
l2cap_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6687 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6688 {
6689 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6690 u16 len;
6691 u8 event;
6692
6693 __unpack_control(chan, skb);
6694
6695 len = skb->len;
6696
6697 /*
6698 * We can just drop the corrupted I-frame here.
6699 * Receiver will miss it and start proper recovery
6700 * procedures and ask for retransmission.
6701 */
6702 if (l2cap_check_fcs(chan, skb))
6703 goto drop;
6704
6705 if (!control->sframe && control->sar == L2CAP_SAR_START)
6706 len -= L2CAP_SDULEN_SIZE;
6707
6708 if (chan->fcs == L2CAP_FCS_CRC16)
6709 len -= L2CAP_FCS_SIZE;
6710
6711 if (len > chan->mps) {
6712 l2cap_send_disconn_req(chan, ECONNRESET);
6713 goto drop;
6714 }
6715
6716 if (chan->ops->filter) {
6717 if (chan->ops->filter(chan, skb))
6718 goto drop;
6719 }
6720
6721 if (!control->sframe) {
6722 int err;
6723
6724 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6725 control->sar, control->reqseq, control->final,
6726 control->txseq);
6727
6728 /* Validate F-bit - F=0 always valid, F=1 only
6729 * valid in TX WAIT_F
6730 */
6731 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6732 goto drop;
6733
6734 if (chan->mode != L2CAP_MODE_STREAMING) {
6735 event = L2CAP_EV_RECV_IFRAME;
6736 err = l2cap_rx(chan, control, skb, event);
6737 } else {
6738 err = l2cap_stream_rx(chan, control, skb);
6739 }
6740
6741 if (err)
6742 l2cap_send_disconn_req(chan, ECONNRESET);
6743 } else {
6744 const u8 rx_func_to_event[4] = {
6745 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6746 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6747 };
6748
6749 /* Only I-frames are expected in streaming mode */
6750 if (chan->mode == L2CAP_MODE_STREAMING)
6751 goto drop;
6752
6753 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6754 control->reqseq, control->final, control->poll,
6755 control->super);
6756
6757 if (len != 0) {
6758 BT_ERR("Trailing bytes: %d in sframe", len);
6759 l2cap_send_disconn_req(chan, ECONNRESET);
6760 goto drop;
6761 }
6762
6763 /* Validate F and P bits */
6764 if (control->final && (control->poll ||
6765 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6766 goto drop;
6767
6768 event = rx_func_to_event[control->super];
6769 if (l2cap_rx(chan, control, skb, event))
6770 l2cap_send_disconn_req(chan, ECONNRESET);
6771 }
6772
6773 return 0;
6774
6775 drop:
6776 kfree_skb(skb);
6777 return 0;
6778 }
6779
l2cap_chan_le_send_credits(struct l2cap_chan * chan)6780 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6781 {
6782 struct l2cap_conn *conn = chan->conn;
6783 struct l2cap_le_credits pkt;
6784 u16 return_credits = l2cap_le_rx_credits(chan);
6785 int ident;
6786
6787 if (chan->mode != L2CAP_MODE_LE_FLOWCTL &&
6788 chan->mode != L2CAP_MODE_EXT_FLOWCTL)
6789 return;
6790
6791 if (chan->rx_credits >= return_credits)
6792 return;
6793
6794 return_credits -= chan->rx_credits;
6795
6796 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6797
6798 chan->rx_credits += return_credits;
6799
6800 pkt.cid = cpu_to_le16(chan->scid);
6801 pkt.credits = cpu_to_le16(return_credits);
6802
6803 ident = l2cap_get_ident(conn);
6804
6805 l2cap_send_cmd(conn, ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6806
6807 /* L2CAP_LE_CREDITS has no response so the ident is never released by
6808 * l2cap_put_ident() - release it right away, otherwise the tx_ida
6809 * range is exhausted after 254 packets and from then on credits are
6810 * sent with the invalid ident 0, which some remote stacks ignore,
6811 * stalling the channel.
6812 */
6813 if (ident > 0)
6814 ida_free(&conn->tx_ida, ident);
6815 }
6816
l2cap_chan_rx_avail(struct l2cap_chan * chan,ssize_t rx_avail)6817 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
6818 {
6819 if (chan->rx_avail == rx_avail)
6820 return;
6821
6822 BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail);
6823
6824 chan->rx_avail = rx_avail;
6825
6826 if (chan->state == BT_CONNECTED)
6827 l2cap_chan_le_send_credits(chan);
6828 }
6829
l2cap_ecred_recv(struct l2cap_chan * chan,struct sk_buff * skb)6830 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
6831 {
6832 int err;
6833
6834 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
6835
6836 /* Wait recv to confirm reception before updating the credits */
6837 err = chan->ops->recv(chan, skb);
6838
6839 if (err < 0 && chan->rx_avail != -1) {
6840 BT_ERR("Queueing received LE L2CAP data failed");
6841 l2cap_send_disconn_req(chan, ECONNRESET);
6842 return err;
6843 }
6844
6845 /* Update credits whenever an SDU is received */
6846 l2cap_chan_le_send_credits(chan);
6847
6848 return err;
6849 }
6850
l2cap_ecred_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6851 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6852 {
6853 int err;
6854
6855 if (!chan->rx_credits) {
6856 BT_ERR("No credits to receive LE L2CAP data");
6857 l2cap_send_disconn_req(chan, ECONNRESET);
6858 return -ENOBUFS;
6859 }
6860
6861 if (skb->len > chan->imtu) {
6862 BT_ERR("Too big LE L2CAP PDU: len %u > %u", skb->len,
6863 chan->imtu);
6864 l2cap_send_disconn_req(chan, ECONNRESET);
6865 return -ENOBUFS;
6866 }
6867
6868 if (skb->len > chan->mps) {
6869 BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len,
6870 chan->mps);
6871 l2cap_send_disconn_req(chan, ECONNRESET);
6872 return -ENOBUFS;
6873 }
6874
6875 chan->rx_credits--;
6876 BT_DBG("chan %p: rx_credits %u -> %u",
6877 chan, chan->rx_credits + 1, chan->rx_credits);
6878
6879 /* Update if remote had run out of credits, this should only happens
6880 * if the remote is not using the entire MPS.
6881 */
6882 if (!chan->rx_credits)
6883 l2cap_chan_le_send_credits(chan);
6884
6885 err = 0;
6886
6887 if (!chan->sdu) {
6888 u16 sdu_len;
6889
6890 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {
6891 err = -EINVAL;
6892 goto failed;
6893 }
6894
6895 sdu_len = get_unaligned_le16(skb->data);
6896 skb_pull(skb, L2CAP_SDULEN_SIZE);
6897
6898 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6899 sdu_len, skb->len, chan->imtu);
6900
6901 if (sdu_len > chan->imtu) {
6902 BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
6903 sdu_len, chan->imtu);
6904 l2cap_send_disconn_req(chan, ECONNRESET);
6905 err = -EMSGSIZE;
6906 goto failed;
6907 }
6908
6909 if (skb->len > sdu_len) {
6910 BT_ERR("Too much LE L2CAP data received");
6911 err = -EINVAL;
6912 goto failed;
6913 }
6914
6915 if (skb->len == sdu_len)
6916 return l2cap_ecred_recv(chan, skb);
6917
6918 chan->sdu = skb;
6919 chan->sdu_len = sdu_len;
6920 chan->sdu_last_frag = skb;
6921
6922 /* Detect if remote is not able to use the selected MPS */
6923 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
6924 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
6925
6926 /* Adjust the number of credits */
6927 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
6928 chan->mps = mps_len;
6929 l2cap_chan_le_send_credits(chan);
6930 }
6931
6932 return 0;
6933 }
6934
6935 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6936 chan->sdu->len, skb->len, chan->sdu_len);
6937
6938 if (chan->sdu->len + skb->len > chan->sdu_len) {
6939 BT_ERR("Too much LE L2CAP data received");
6940 l2cap_send_disconn_req(chan, ECONNRESET);
6941 err = -EINVAL;
6942 goto failed;
6943 }
6944
6945 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6946 skb = NULL;
6947
6948 if (chan->sdu->len == chan->sdu_len) {
6949 err = l2cap_ecred_recv(chan, chan->sdu);
6950 if (!err) {
6951 chan->sdu = NULL;
6952 chan->sdu_last_frag = NULL;
6953 chan->sdu_len = 0;
6954 }
6955 }
6956
6957 failed:
6958 if (err) {
6959 kfree_skb(skb);
6960 kfree_skb(chan->sdu);
6961 chan->sdu = NULL;
6962 chan->sdu_last_frag = NULL;
6963 chan->sdu_len = 0;
6964 }
6965
6966 /* We can't return an error here since we took care of the skb
6967 * freeing internally. An error return would cause the caller to
6968 * do a double-free of the skb.
6969 */
6970 return 0;
6971 }
6972
l2cap_data_channel(struct l2cap_conn * conn,u16 cid,struct sk_buff * skb)6973 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6974 struct sk_buff *skb)
6975 {
6976 struct l2cap_chan *chan;
6977
6978 chan = l2cap_get_chan_by_scid(conn, cid);
6979 if (!chan) {
6980 BT_DBG("unknown cid 0x%4.4x", cid);
6981 /* Drop packet and return */
6982 kfree_skb(skb);
6983 return;
6984 }
6985
6986 BT_DBG("chan %p, len %d", chan, skb->len);
6987
6988 /* If we receive data on a fixed channel before the info req/rsp
6989 * procedure is done simply assume that the channel is supported
6990 * and mark it as ready.
6991 */
6992 if (chan->chan_type == L2CAP_CHAN_FIXED)
6993 l2cap_chan_ready(chan);
6994
6995 if (chan->state != BT_CONNECTED)
6996 goto drop;
6997
6998 switch (chan->mode) {
6999 case L2CAP_MODE_LE_FLOWCTL:
7000 case L2CAP_MODE_EXT_FLOWCTL:
7001 if (l2cap_ecred_data_rcv(chan, skb) < 0)
7002 goto drop;
7003
7004 goto done;
7005
7006 case L2CAP_MODE_BASIC:
7007 /* If socket recv buffers overflows we drop data here
7008 * which is *bad* because L2CAP has to be reliable.
7009 * But we don't have any other choice. L2CAP doesn't
7010 * provide flow control mechanism. */
7011
7012 if (chan->imtu < skb->len) {
7013 BT_ERR("Dropping L2CAP data: receive buffer overflow");
7014 goto drop;
7015 }
7016
7017 if (!chan->ops->recv(chan, skb))
7018 goto done;
7019 break;
7020
7021 case L2CAP_MODE_ERTM:
7022 case L2CAP_MODE_STREAMING:
7023 l2cap_data_rcv(chan, skb);
7024 goto done;
7025
7026 default:
7027 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
7028 break;
7029 }
7030
7031 drop:
7032 kfree_skb(skb);
7033
7034 done:
7035 l2cap_chan_unlock(chan);
7036 l2cap_chan_put(chan);
7037 }
7038
l2cap_conless_channel(struct l2cap_conn * conn,__le16 psm,struct sk_buff * skb)7039 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
7040 struct sk_buff *skb)
7041 {
7042 struct hci_conn *hcon = conn->hcon;
7043 struct l2cap_chan *chan;
7044
7045 if (hcon->type != ACL_LINK)
7046 goto free_skb;
7047
7048 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
7049 ACL_LINK);
7050 if (!chan)
7051 goto free_skb;
7052
7053 BT_DBG("chan %p, len %d", chan, skb->len);
7054
7055 l2cap_chan_lock(chan);
7056
7057 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
7058 goto drop;
7059
7060 if (chan->imtu < skb->len)
7061 goto drop;
7062
7063 /* Store remote BD_ADDR and PSM for msg_name */
7064 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
7065 bt_cb(skb)->l2cap.psm = psm;
7066
7067 if (!chan->ops->recv(chan, skb)) {
7068 l2cap_chan_unlock(chan);
7069 l2cap_chan_put(chan);
7070 return;
7071 }
7072
7073 drop:
7074 l2cap_chan_unlock(chan);
7075 l2cap_chan_put(chan);
7076 free_skb:
7077 kfree_skb(skb);
7078 }
7079
l2cap_recv_frame(struct l2cap_conn * conn,struct sk_buff * skb)7080 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
7081 {
7082 struct l2cap_hdr *lh = (void *) skb->data;
7083 struct hci_conn *hcon = conn->hcon;
7084 u16 cid, len;
7085 __le16 psm;
7086
7087 if (hcon->state != BT_CONNECTED) {
7088 BT_DBG("queueing pending rx skb");
7089 skb_queue_tail(&conn->pending_rx, skb);
7090 return;
7091 }
7092
7093 skb_pull(skb, L2CAP_HDR_SIZE);
7094 cid = __le16_to_cpu(lh->cid);
7095 len = __le16_to_cpu(lh->len);
7096
7097 if (len != skb->len) {
7098 kfree_skb(skb);
7099 return;
7100 }
7101
7102 /* Since we can't actively block incoming LE connections we must
7103 * at least ensure that we ignore incoming data from them.
7104 */
7105 if (hcon->type == LE_LINK &&
7106 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
7107 bdaddr_dst_type(hcon))) {
7108 kfree_skb(skb);
7109 return;
7110 }
7111
7112 BT_DBG("len %d, cid 0x%4.4x", len, cid);
7113
7114 switch (cid) {
7115 case L2CAP_CID_SIGNALING:
7116 l2cap_sig_channel(conn, skb);
7117 break;
7118
7119 case L2CAP_CID_CONN_LESS:
7120 if (skb->len < L2CAP_PSMLEN_SIZE) {
7121 kfree_skb(skb);
7122 break;
7123 }
7124
7125 psm = get_unaligned((__le16 *) skb->data);
7126 skb_pull(skb, L2CAP_PSMLEN_SIZE);
7127 l2cap_conless_channel(conn, psm, skb);
7128 break;
7129
7130 case L2CAP_CID_LE_SIGNALING:
7131 l2cap_le_sig_channel(conn, skb);
7132 break;
7133
7134 default:
7135 l2cap_data_channel(conn, cid, skb);
7136 break;
7137 }
7138 }
7139
process_pending_rx(struct work_struct * work)7140 static void process_pending_rx(struct work_struct *work)
7141 {
7142 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
7143 pending_rx_work);
7144 struct sk_buff *skb;
7145
7146 BT_DBG("");
7147
7148 mutex_lock(&conn->lock);
7149
7150 while ((skb = skb_dequeue(&conn->pending_rx)))
7151 l2cap_recv_frame(conn, skb);
7152
7153 mutex_unlock(&conn->lock);
7154 }
7155
l2cap_conn_add(struct hci_conn * hcon)7156 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
7157 __must_hold(&hcon->hdev->lock)
7158 {
7159 struct l2cap_conn *conn = hcon->l2cap_data;
7160 struct hci_chan *hchan;
7161
7162 if (conn)
7163 return conn;
7164
7165 hchan = hci_chan_create(hcon);
7166 if (!hchan)
7167 return NULL;
7168
7169 conn = kzalloc_obj(*conn);
7170 if (!conn) {
7171 hci_chan_del(hchan);
7172 return NULL;
7173 }
7174
7175 kref_init(&conn->ref);
7176 conn->hchan = hchan;
7177
7178 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
7179
7180 conn->mtu = hcon->mtu;
7181 conn->feat_mask = 0;
7182
7183 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
7184
7185 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
7186 (bredr_sc_enabled(hcon->hdev) ||
7187 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
7188 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
7189
7190 mutex_init(&conn->lock);
7191
7192 INIT_LIST_HEAD(&conn->chan_l);
7193 INIT_LIST_HEAD(&conn->users);
7194
7195 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
7196 ida_init(&conn->tx_ida);
7197
7198 skb_queue_head_init(&conn->pending_rx);
7199 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
7200 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
7201
7202 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
7203
7204 spin_lock(&hcon->proto_lock);
7205 conn->hcon = hci_conn_get(hcon);
7206 hcon->l2cap_data = conn;
7207 spin_unlock(&hcon->proto_lock);
7208
7209 return conn;
7210 }
7211
is_valid_psm(u16 psm,u8 dst_type)7212 static bool is_valid_psm(u16 psm, u8 dst_type)
7213 {
7214 if (!psm)
7215 return false;
7216
7217 if (bdaddr_type_is_le(dst_type))
7218 return (psm <= 0x00ff);
7219
7220 /* PSM must be odd and lsb of upper byte must be 0 */
7221 return ((psm & 0x0101) == 0x0001);
7222 }
7223
7224 struct l2cap_chan_data {
7225 struct l2cap_chan *chan;
7226 struct pid *pid;
7227 int count;
7228 };
7229
l2cap_chan_by_pid(struct l2cap_chan * chan,void * data)7230 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
7231 {
7232 struct l2cap_chan_data *d = data;
7233 struct pid *pid;
7234
7235 if (chan == d->chan)
7236 return;
7237
7238 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
7239 return;
7240
7241 pid = chan->ops->get_peer_pid(chan);
7242
7243 /* Only count deferred channels with the same PID/PSM */
7244 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
7245 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
7246 return;
7247
7248 d->count++;
7249 }
7250
l2cap_chan_connect(struct l2cap_chan * chan,__le16 psm,u16 cid,bdaddr_t * dst,u8 dst_type,u16 timeout)7251 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
7252 bdaddr_t *dst, u8 dst_type, u16 timeout)
7253 {
7254 struct l2cap_conn *conn;
7255 struct hci_conn *hcon;
7256 struct hci_dev *hdev;
7257 int err;
7258
7259 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
7260 dst, dst_type, __le16_to_cpu(psm), chan->mode);
7261
7262 hdev = hci_get_route(dst, &chan->src, chan->src_type);
7263 if (!hdev)
7264 return -EHOSTUNREACH;
7265
7266 hci_dev_lock(hdev);
7267
7268 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
7269 chan->chan_type != L2CAP_CHAN_RAW) {
7270 err = -EINVAL;
7271 goto done;
7272 }
7273
7274 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
7275 err = -EINVAL;
7276 goto done;
7277 }
7278
7279 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
7280 err = -EINVAL;
7281 goto done;
7282 }
7283
7284 switch (chan->mode) {
7285 case L2CAP_MODE_BASIC:
7286 break;
7287 case L2CAP_MODE_LE_FLOWCTL:
7288 break;
7289 case L2CAP_MODE_EXT_FLOWCTL:
7290 if (!enable_ecred) {
7291 err = -EOPNOTSUPP;
7292 goto done;
7293 }
7294 break;
7295 case L2CAP_MODE_ERTM:
7296 case L2CAP_MODE_STREAMING:
7297 if (!disable_ertm)
7298 break;
7299 fallthrough;
7300 default:
7301 err = -EOPNOTSUPP;
7302 goto done;
7303 }
7304
7305 switch (chan->state) {
7306 case BT_CONNECT:
7307 case BT_CONNECT2:
7308 case BT_CONFIG:
7309 /* Already connecting */
7310 err = 0;
7311 goto done;
7312
7313 case BT_CONNECTED:
7314 /* Already connected */
7315 err = -EISCONN;
7316 goto done;
7317
7318 case BT_OPEN:
7319 case BT_BOUND:
7320 /* Can connect */
7321 break;
7322
7323 default:
7324 err = -EBADFD;
7325 goto done;
7326 }
7327
7328 /* Set destination address and psm */
7329 bacpy(&chan->dst, dst);
7330 chan->dst_type = dst_type;
7331
7332 chan->psm = psm;
7333 chan->dcid = cid;
7334
7335 if (bdaddr_type_is_le(dst_type)) {
7336 /* Convert from L2CAP channel address type to HCI address type
7337 */
7338 if (dst_type == BDADDR_LE_PUBLIC)
7339 dst_type = ADDR_LE_DEV_PUBLIC;
7340 else
7341 dst_type = ADDR_LE_DEV_RANDOM;
7342
7343 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7344 hcon = hci_connect_le(hdev, dst, dst_type, false,
7345 chan->sec_level, timeout,
7346 HCI_ROLE_SLAVE, 0, 0);
7347 else
7348 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7349 chan->sec_level, timeout,
7350 CONN_REASON_L2CAP_CHAN);
7351
7352 } else {
7353 u8 auth_type = l2cap_get_auth_type(chan);
7354 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7355 CONN_REASON_L2CAP_CHAN, timeout);
7356 }
7357
7358 if (IS_ERR(hcon)) {
7359 err = PTR_ERR(hcon);
7360 goto done;
7361 }
7362
7363 lockdep_assert_held(&hcon->hdev->lock);
7364
7365 conn = l2cap_conn_add(hcon);
7366 if (!conn) {
7367 hci_conn_drop(hcon);
7368 err = -ENOMEM;
7369 goto done;
7370 }
7371
7372 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7373 struct l2cap_chan_data data;
7374
7375 data.chan = chan;
7376 data.pid = chan->ops->get_peer_pid(chan);
7377 data.count = 1;
7378
7379 l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7380
7381 /* Check if there isn't too many channels being connected */
7382 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7383 hci_conn_drop(hcon);
7384 err = -EPROTO;
7385 goto done;
7386 }
7387 }
7388
7389 mutex_lock(&conn->lock);
7390 l2cap_chan_lock(chan);
7391
7392 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7393 hci_conn_drop(hcon);
7394 err = -EBUSY;
7395 goto chan_unlock;
7396 }
7397
7398 /* Update source addr of the socket */
7399 bacpy(&chan->src, &hcon->src);
7400 chan->src_type = bdaddr_src_type(hcon);
7401
7402 __l2cap_chan_add(conn, chan);
7403
7404 /* l2cap_chan_add takes its own ref so we can drop this one */
7405 hci_conn_drop(hcon);
7406
7407 l2cap_state_change(chan, BT_CONNECT);
7408 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7409
7410 /* Release chan->sport so that it can be reused by other
7411 * sockets (as it's only used for listening sockets).
7412 */
7413 write_lock(&chan_list_lock);
7414 chan->sport = 0;
7415 write_unlock(&chan_list_lock);
7416
7417 if (hcon->state == BT_CONNECTED) {
7418 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7419 __clear_chan_timer(chan);
7420 if (l2cap_chan_check_security(chan, true))
7421 l2cap_state_change(chan, BT_CONNECTED);
7422 } else
7423 l2cap_do_start(chan);
7424 }
7425
7426 err = 0;
7427
7428 chan_unlock:
7429 l2cap_chan_unlock(chan);
7430 mutex_unlock(&conn->lock);
7431 done:
7432 hci_dev_unlock(hdev);
7433 hci_dev_put(hdev);
7434 return err;
7435 }
7436 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7437
l2cap_ecred_reconfigure(struct l2cap_chan * chan)7438 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
7439 {
7440 struct l2cap_conn *conn = chan->conn;
7441 DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);
7442
7443 pdu->mtu = cpu_to_le16(chan->imtu);
7444 pdu->mps = cpu_to_le16(chan->mps);
7445 pdu->scid[0] = cpu_to_le16(chan->scid);
7446
7447 chan->ident = l2cap_get_ident(conn);
7448
7449 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
7450 struct_size(pdu, scid, 1), pdu);
7451 }
7452
l2cap_chan_reconfigure(struct l2cap_chan * chan,__u16 mtu)7453 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
7454 {
7455 if (chan->imtu > mtu)
7456 return -EINVAL;
7457
7458 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
7459
7460 chan->imtu = mtu;
7461
7462 l2cap_ecred_reconfigure(chan);
7463
7464 return 0;
7465 }
7466
7467 /* ---- L2CAP interface with lower layer (HCI) ---- */
7468
l2cap_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr)7469 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7470 {
7471 int exact = 0, lm1 = 0, lm2 = 0;
7472 struct l2cap_chan *c;
7473
7474 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7475
7476 /* Find listening sockets and check their link_mode */
7477 read_lock(&chan_list_lock);
7478 list_for_each_entry(c, &chan_list, global_l) {
7479 if (c->state != BT_LISTEN)
7480 continue;
7481
7482 if (!bacmp(&c->src, &hdev->bdaddr)) {
7483 lm1 |= HCI_LM_ACCEPT;
7484 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7485 lm1 |= HCI_LM_MASTER;
7486 exact++;
7487 } else if (!bacmp(&c->src, BDADDR_ANY)) {
7488 lm2 |= HCI_LM_ACCEPT;
7489 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7490 lm2 |= HCI_LM_MASTER;
7491 }
7492 }
7493 read_unlock(&chan_list_lock);
7494
7495 return exact ? lm1 : lm2;
7496 }
7497
7498 /* Find the next fixed channel in BT_LISTEN state, continue iteration
7499 * from an existing channel in the list or from the beginning of the
7500 * global list (by passing NULL as first parameter).
7501 */
l2cap_global_fixed_chan(struct l2cap_chan * c,struct hci_conn * hcon)7502 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7503 struct hci_conn *hcon)
7504 {
7505 u8 src_type = bdaddr_src_type(hcon);
7506
7507 read_lock(&chan_list_lock);
7508
7509 if (c)
7510 c = list_next_entry(c, global_l);
7511 else
7512 c = list_entry(chan_list.next, typeof(*c), global_l);
7513
7514 list_for_each_entry_from(c, &chan_list, global_l) {
7515 if (c->chan_type != L2CAP_CHAN_FIXED)
7516 continue;
7517 if (c->state != BT_LISTEN)
7518 continue;
7519 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7520 continue;
7521 if (src_type != c->src_type)
7522 continue;
7523
7524 c = l2cap_chan_hold_unless_zero(c);
7525 read_unlock(&chan_list_lock);
7526 return c;
7527 }
7528
7529 read_unlock(&chan_list_lock);
7530
7531 return NULL;
7532 }
7533
l2cap_connect_cfm(struct hci_conn * hcon,u8 status)7534 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7535 __must_hold(&hcon->hdev->lock)
7536 {
7537 struct hci_dev *hdev = hcon->hdev;
7538 struct l2cap_conn *conn;
7539 struct l2cap_chan *pchan;
7540 u8 dst_type;
7541
7542 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7543 return;
7544
7545 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7546
7547 if (status) {
7548 l2cap_conn_del(hcon, bt_to_errno(status));
7549 return;
7550 }
7551
7552 conn = l2cap_conn_add(hcon);
7553 if (!conn)
7554 return;
7555
7556 dst_type = bdaddr_dst_type(hcon);
7557
7558 /* If device is blocked, do not create channels for it */
7559 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
7560 return;
7561
7562 /* Find fixed channels and notify them of the new connection. We
7563 * use multiple individual lookups, continuing each time where
7564 * we left off, because the list lock would prevent calling the
7565 * potentially sleeping l2cap_chan_lock() function.
7566 */
7567 pchan = l2cap_global_fixed_chan(NULL, hcon);
7568 while (pchan) {
7569 struct l2cap_chan *chan, *next;
7570
7571 /* Client fixed channels should override server ones */
7572 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7573 goto next;
7574
7575 l2cap_chan_lock(pchan);
7576 chan = l2cap_new_connection(conn, pchan);
7577 if (chan) {
7578 bacpy(&chan->src, &hcon->src);
7579 bacpy(&chan->dst, &hcon->dst);
7580 chan->src_type = bdaddr_src_type(hcon);
7581 chan->dst_type = dst_type;
7582 }
7583
7584 l2cap_chan_unlock(pchan);
7585 next:
7586 next = l2cap_global_fixed_chan(pchan, hcon);
7587 l2cap_chan_put(pchan);
7588 pchan = next;
7589 }
7590
7591 l2cap_conn_ready(conn);
7592 }
7593
l2cap_disconn_ind(struct hci_conn * hcon)7594 int l2cap_disconn_ind(struct hci_conn *hcon)
7595 {
7596 struct l2cap_conn *conn;
7597 int ret = HCI_ERROR_REMOTE_USER_TERM;
7598
7599 BT_DBG("hcon %p", hcon);
7600
7601 spin_lock(&hcon->proto_lock);
7602 conn = hcon->l2cap_data;
7603 if (conn)
7604 ret = conn->disc_reason;
7605 spin_unlock(&hcon->proto_lock);
7606
7607 return ret;
7608 }
7609
l2cap_disconn_cfm(struct hci_conn * hcon,u8 reason)7610 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7611 __must_hold(&hcon->hdev->lock)
7612 {
7613 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7614 return;
7615
7616 BT_DBG("hcon %p reason %d", hcon, reason);
7617
7618 l2cap_conn_del(hcon, bt_to_errno(reason));
7619 }
7620
l2cap_check_encryption(struct l2cap_chan * chan,u8 encrypt)7621 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7622 {
7623 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7624 return;
7625
7626 if (encrypt == 0x00) {
7627 if (chan->sec_level == BT_SECURITY_MEDIUM) {
7628 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7629 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7630 chan->sec_level == BT_SECURITY_FIPS)
7631 l2cap_chan_close(chan, ECONNREFUSED);
7632 } else {
7633 if (chan->sec_level == BT_SECURITY_MEDIUM)
7634 __clear_chan_timer(chan);
7635 }
7636 }
7637
l2cap_security_cfm(struct hci_conn * hcon,u8 status,u8 encrypt)7638 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7639 __must_hold(&hcon->hdev->lock)
7640 {
7641 struct l2cap_conn *conn = hcon->l2cap_data;
7642 struct l2cap_chan *chan;
7643
7644 if (!conn)
7645 return;
7646
7647 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7648
7649 mutex_lock(&conn->lock);
7650
7651 list_for_each_entry(chan, &conn->chan_l, list) {
7652 l2cap_chan_lock(chan);
7653
7654 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7655 state_to_string(chan->state));
7656
7657 if (!status && encrypt)
7658 chan->sec_level = hcon->sec_level;
7659
7660 if (!__l2cap_no_conn_pending(chan)) {
7661 l2cap_chan_unlock(chan);
7662 continue;
7663 }
7664
7665 if (!status && (chan->state == BT_CONNECTED ||
7666 chan->state == BT_CONFIG)) {
7667 chan->ops->resume(chan);
7668 l2cap_check_encryption(chan, encrypt);
7669 l2cap_chan_unlock(chan);
7670 continue;
7671 }
7672
7673 if (chan->state == BT_CONNECT) {
7674 if (!status && l2cap_check_enc_key_size(hcon, chan))
7675 l2cap_start_connection(chan);
7676 else
7677 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7678 } else if (chan->state == BT_CONNECT2 &&
7679 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
7680 chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
7681 struct l2cap_conn_rsp rsp;
7682 __u16 res, stat;
7683
7684 if (!status && l2cap_check_enc_key_size(hcon, chan)) {
7685 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
7686 res = L2CAP_CR_PEND;
7687 stat = L2CAP_CS_AUTHOR_PEND;
7688 chan->ops->defer(chan);
7689 } else {
7690 l2cap_state_change(chan, BT_CONFIG);
7691 res = L2CAP_CR_SUCCESS;
7692 stat = L2CAP_CS_NO_INFO;
7693 }
7694 } else {
7695 l2cap_state_change(chan, BT_DISCONN);
7696 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7697 res = L2CAP_CR_SEC_BLOCK;
7698 stat = L2CAP_CS_NO_INFO;
7699 }
7700
7701 rsp.scid = cpu_to_le16(chan->dcid);
7702 rsp.dcid = cpu_to_le16(chan->scid);
7703 rsp.result = cpu_to_le16(res);
7704 rsp.status = cpu_to_le16(stat);
7705 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7706 sizeof(rsp), &rsp);
7707
7708 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7709 res == L2CAP_CR_SUCCESS) {
7710 char buf[128];
7711 set_bit(CONF_REQ_SENT, &chan->conf_state);
7712 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7713 L2CAP_CONF_REQ,
7714 l2cap_build_conf_req(chan, buf, sizeof(buf)),
7715 buf);
7716 chan->num_conf_req++;
7717 }
7718 }
7719
7720 l2cap_chan_unlock(chan);
7721 }
7722
7723 mutex_unlock(&conn->lock);
7724 }
7725
7726 /* Append fragment into frame respecting the maximum len of rx_skb */
l2cap_recv_frag(struct l2cap_conn * conn,struct sk_buff * skb,u16 len)7727 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
7728 u16 len)
7729 {
7730 if (!conn->rx_skb) {
7731 /* Allocate skb for the complete frame (with header) */
7732 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7733 if (!conn->rx_skb)
7734 return -ENOMEM;
7735 /* Init rx_len */
7736 conn->rx_len = len;
7737
7738 skb_set_delivery_time(conn->rx_skb, skb->tstamp,
7739 skb->tstamp_type);
7740 }
7741
7742 /* Copy as much as the rx_skb can hold */
7743 len = min_t(u16, len, skb->len);
7744 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
7745 skb_pull(skb, len);
7746 conn->rx_len -= len;
7747
7748 return len;
7749 }
7750
l2cap_recv_len(struct l2cap_conn * conn,struct sk_buff * skb)7751 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
7752 {
7753 struct sk_buff *rx_skb;
7754 int len;
7755
7756 /* Append just enough to complete the header */
7757 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
7758
7759 /* If header could not be read just continue */
7760 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
7761 return len;
7762
7763 rx_skb = conn->rx_skb;
7764 len = get_unaligned_le16(rx_skb->data);
7765
7766 /* Check if rx_skb has enough space to received all fragments */
7767 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
7768 /* Update expected len */
7769 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
7770 return L2CAP_LEN_SIZE;
7771 }
7772
7773 /* Reset conn->rx_skb since it will need to be reallocated in order to
7774 * fit all fragments.
7775 */
7776 conn->rx_skb = NULL;
7777
7778 /* Reallocates rx_skb using the exact expected length */
7779 len = l2cap_recv_frag(conn, rx_skb,
7780 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
7781 kfree_skb(rx_skb);
7782
7783 return len;
7784 }
7785
l2cap_recv_reset(struct l2cap_conn * conn)7786 static void l2cap_recv_reset(struct l2cap_conn *conn)
7787 {
7788 kfree_skb(conn->rx_skb);
7789 conn->rx_skb = NULL;
7790 conn->rx_len = 0;
7791 }
7792
l2cap_conn_hold_unless_zero(struct l2cap_conn * c)7793 struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
7794 {
7795 if (!c)
7796 return NULL;
7797
7798 BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
7799
7800 if (!kref_get_unless_zero(&c->ref))
7801 return NULL;
7802
7803 return c;
7804 }
7805 EXPORT_SYMBOL(l2cap_conn_hold_unless_zero);
7806
l2cap_recv_acldata(struct hci_dev * hdev,u16 handle,struct sk_buff * skb,u16 flags)7807 int l2cap_recv_acldata(struct hci_dev *hdev, u16 handle,
7808 struct sk_buff *skb, u16 flags)
7809 {
7810 struct hci_conn *hcon;
7811 struct l2cap_conn *conn;
7812 int len;
7813
7814 /* Lock hdev for hci_conn, and race on l2cap_data vs. l2cap_conn_del */
7815 hci_dev_lock(hdev);
7816
7817 hcon = hci_conn_hash_lookup_handle(hdev, handle);
7818 if (!hcon) {
7819 hci_dev_unlock(hdev);
7820 kfree_skb(skb);
7821 return -ENOENT;
7822 }
7823
7824 lockdep_assert_held(&hcon->hdev->lock);
7825
7826 hci_conn_enter_active_mode(hcon, BT_POWER_FORCE_ACTIVE_OFF);
7827
7828 conn = hcon->l2cap_data;
7829
7830 if (!conn)
7831 conn = l2cap_conn_add(hcon);
7832
7833 conn = l2cap_conn_hold_unless_zero(conn);
7834 hcon = NULL;
7835
7836 hci_dev_unlock(hdev);
7837
7838 if (!conn) {
7839 kfree_skb(skb);
7840 return -EINVAL;
7841 }
7842
7843 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
7844
7845 mutex_lock(&conn->lock);
7846
7847 switch (flags) {
7848 case ACL_START:
7849 case ACL_START_NO_FLUSH:
7850 case ACL_COMPLETE:
7851 if (conn->rx_skb) {
7852 BT_ERR("Unexpected start frame (len %d)", skb->len);
7853 l2cap_recv_reset(conn);
7854 l2cap_conn_unreliable(conn, ECOMM);
7855 }
7856
7857 /* Start fragment may not contain the L2CAP length so just
7858 * copy the initial byte when that happens and use conn->mtu as
7859 * expected length.
7860 */
7861 if (skb->len < L2CAP_LEN_SIZE) {
7862 l2cap_recv_frag(conn, skb, conn->mtu);
7863 break;
7864 }
7865
7866 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
7867
7868 if (len == skb->len) {
7869 /* Complete frame received */
7870 l2cap_recv_frame(conn, skb);
7871 goto unlock;
7872 }
7873
7874 BT_DBG("Start: total len %d, frag len %u", len, skb->len);
7875
7876 if (skb->len > len) {
7877 BT_ERR("Frame is too long (len %u, expected len %d)",
7878 skb->len, len);
7879 /* PTS test cases L2CAP/COS/CED/BI-14-C and BI-15-C
7880 * (Multiple Signaling Command in one PDU, Data
7881 * Truncated, BR/EDR) send a C-frame to the IUT with
7882 * PDU Length set to 8 and Channel ID set to the
7883 * correct signaling channel for the logical link.
7884 * The Information payload contains one L2CAP_ECHO_REQ
7885 * packet with Data Length set to 0 with 0 octets of
7886 * echo data and one invalid command packet due to
7887 * data truncated in PDU but present in HCI packet.
7888 *
7889 * Shorter the socket buffer to the PDU length to
7890 * allow to process valid commands from the PDU before
7891 * setting the socket unreliable.
7892 */
7893 skb->len = len;
7894 l2cap_recv_frame(conn, skb);
7895 l2cap_conn_unreliable(conn, ECOMM);
7896 goto unlock;
7897 }
7898
7899 /* Append fragment into frame (with header) */
7900 if (l2cap_recv_frag(conn, skb, len) < 0)
7901 goto drop;
7902
7903 break;
7904
7905 case ACL_CONT:
7906 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
7907
7908 if (!conn->rx_skb) {
7909 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7910 l2cap_conn_unreliable(conn, ECOMM);
7911 goto drop;
7912 }
7913
7914 /* Complete the L2CAP length if it has not been read */
7915 if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
7916 if (l2cap_recv_len(conn, skb) < 0) {
7917 l2cap_conn_unreliable(conn, ECOMM);
7918 goto drop;
7919 }
7920
7921 /* Header still could not be read just continue */
7922 if (conn->rx_skb->len < L2CAP_LEN_SIZE)
7923 break;
7924 }
7925
7926 if (skb->len > conn->rx_len) {
7927 BT_ERR("Fragment is too long (len %u, expected %u)",
7928 skb->len, conn->rx_len);
7929 l2cap_recv_reset(conn);
7930 l2cap_conn_unreliable(conn, ECOMM);
7931 goto drop;
7932 }
7933
7934 /* Append fragment into frame (with header) */
7935 l2cap_recv_frag(conn, skb, skb->len);
7936
7937 if (!conn->rx_len) {
7938 /* Complete frame received. l2cap_recv_frame
7939 * takes ownership of the skb so set the global
7940 * rx_skb pointer to NULL first.
7941 */
7942 struct sk_buff *rx_skb = conn->rx_skb;
7943 conn->rx_skb = NULL;
7944 l2cap_recv_frame(conn, rx_skb);
7945 }
7946 break;
7947 }
7948
7949 drop:
7950 kfree_skb(skb);
7951 unlock:
7952 mutex_unlock(&conn->lock);
7953 l2cap_conn_put(conn);
7954 return 0;
7955 }
7956
7957 static struct hci_cb l2cap_cb = {
7958 .name = "L2CAP",
7959 .connect_cfm = l2cap_connect_cfm,
7960 .disconn_cfm = l2cap_disconn_cfm,
7961 .security_cfm = l2cap_security_cfm,
7962 };
7963
l2cap_debugfs_show(struct seq_file * f,void * p)7964 static int l2cap_debugfs_show(struct seq_file *f, void *p)
7965 {
7966 struct l2cap_chan *c;
7967
7968 read_lock(&chan_list_lock);
7969
7970 list_for_each_entry(c, &chan_list, global_l) {
7971 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7972 &c->src, c->src_type, &c->dst, c->dst_type,
7973 c->state, __le16_to_cpu(c->psm),
7974 c->scid, c->dcid, c->imtu, c->omtu,
7975 c->sec_level, c->mode);
7976 }
7977
7978 read_unlock(&chan_list_lock);
7979
7980 return 0;
7981 }
7982
7983 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
7984
7985 static struct dentry *l2cap_debugfs;
7986
l2cap_init(void)7987 int __init l2cap_init(void)
7988 {
7989 int err;
7990
7991 err = l2cap_init_sockets();
7992 if (err < 0)
7993 return err;
7994
7995 hci_register_cb(&l2cap_cb);
7996
7997 if (IS_ERR_OR_NULL(bt_debugfs))
7998 return 0;
7999
8000 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
8001 NULL, &l2cap_debugfs_fops);
8002
8003 return 0;
8004 }
8005
l2cap_exit(void)8006 void l2cap_exit(void)
8007 {
8008 debugfs_remove(l2cap_debugfs);
8009 hci_unregister_cb(&l2cap_cb);
8010 l2cap_cleanup_sockets();
8011 }
8012
8013 module_param(disable_ertm, bool, 0644);
8014 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
8015
8016 module_param(enable_ecred, bool, 0644);
8017 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
8018