1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 6 Copyright (C) 2010 Google Inc. 7 Copyright (C) 2011 ProFUSION Embedded Systems 8 Copyright (c) 2012 Code Aurora Forum. All rights reserved. 9 10 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 11 12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 23 SOFTWARE IS DISCLAIMED. 24 */ 25 26 /* Bluetooth L2CAP core. */ 27 28 #include <linux/module.h> 29 30 #include <linux/debugfs.h> 31 #include <linux/crc16.h> 32 #include <linux/filter.h> 33 34 #include <net/bluetooth/bluetooth.h> 35 #include <net/bluetooth/hci_core.h> 36 #include <net/bluetooth/l2cap.h> 37 38 #include "smp.h" 39 40 #define LE_FLOWCTL_MAX_CREDITS 65535 41 42 bool disable_ertm; 43 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED); 44 45 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD; 46 47 static DEFINE_RWLOCK(chan_list_lock); 48 static __guarded_by(&chan_list_lock) LIST_HEAD(chan_list); 49 50 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 51 u8 code, u8 ident, u16 dlen, void *data); 52 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 53 void *data); 54 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); 55 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); 56 57 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 58 struct sk_buff_head *skbs, u8 event); 59 static void l2cap_retrans_timeout(struct work_struct *work); 60 static void l2cap_monitor_timeout(struct work_struct *work); 61 static void l2cap_ack_timeout(struct work_struct *work); 62 static void __l2cap_chan_close(struct l2cap_chan *chan, int reason) 63 __must_hold(&chan->lock) __must_hold(&chan->conn->lock); 64 65 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type) 66 { 67 if (link_type == LE_LINK) { 68 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 69 return BDADDR_LE_PUBLIC; 70 else 71 return BDADDR_LE_RANDOM; 72 } 73 74 return BDADDR_BREDR; 75 } 76 77 static inline u8 bdaddr_src_type(struct hci_conn *hcon) 78 { 79 return bdaddr_type(hcon->type, hcon->src_type); 80 } 81 82 static inline u8 bdaddr_dst_type(struct hci_conn *hcon) 83 { 84 return bdaddr_type(hcon->type, hcon->dst_type); 85 } 86 87 /* ---- L2CAP channels ---- */ 88 89 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 90 u16 cid) 91 __must_hold(&conn->lock) 92 { 93 struct l2cap_chan *c; 94 95 list_for_each_entry(c, &conn->chan_l, list) { 96 if (c->dcid == cid) 97 return c; 98 } 99 return NULL; 100 } 101 102 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, 103 u16 cid) 104 __must_hold(&conn->lock) 105 { 106 struct l2cap_chan *c; 107 108 list_for_each_entry(c, &conn->chan_l, list) { 109 if (c->scid == cid) 110 return c; 111 } 112 return NULL; 113 } 114 115 /* Find channel with given SCID. 116 * Returns a reference. 117 */ 118 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, 119 u16 cid) 120 __must_hold(&conn->lock) 121 { 122 struct l2cap_chan *c; 123 124 c = __l2cap_get_chan_by_scid(conn, cid); 125 if (c) 126 c = l2cap_chan_hold_unless_zero(c); 127 128 return c; 129 } 130 131 /* Find channel with given DCID. 132 * Returns a reference. 133 */ 134 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 135 u16 cid) 136 __must_hold(&conn->lock) 137 { 138 struct l2cap_chan *c; 139 140 c = __l2cap_get_chan_by_dcid(conn, cid); 141 if (c) 142 c = l2cap_chan_hold_unless_zero(c); 143 144 return c; 145 } 146 147 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, 148 u8 ident) 149 __must_hold(&conn->lock) 150 { 151 struct l2cap_chan *c; 152 153 list_for_each_entry(c, &conn->chan_l, list) { 154 if (c->ident == ident) 155 return c; 156 } 157 return NULL; 158 } 159 160 /* Our connection request has been sent and is still outstanding */ 161 static bool l2cap_chan_connect_pending(struct l2cap_chan *chan) 162 { 163 return chan->state == BT_CONNECT && 164 test_bit(CONF_CONNECT_PEND, &chan->conf_state); 165 } 166 167 /* Other channels may hold the same ident for a response they still have 168 * to send, so only look at channels waiting for a connection response. 169 */ 170 static struct l2cap_chan *__l2cap_get_connect_chan_by_ident(struct l2cap_conn *conn, 171 u8 ident) 172 __must_hold(&conn->lock) 173 { 174 struct l2cap_chan *c; 175 176 list_for_each_entry(c, &conn->chan_l, list) { 177 if (c->ident == ident && l2cap_chan_connect_pending(c)) 178 return c; 179 } 180 return NULL; 181 } 182 183 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src, 184 u8 src_type) 185 __must_hold_shared(&chan_list_lock) 186 { 187 struct l2cap_chan *c; 188 189 list_for_each_entry(c, &chan_list, global_l) { 190 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR) 191 continue; 192 193 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR) 194 continue; 195 196 if (c->sport == psm && !bacmp(&c->src, src)) 197 return c; 198 } 199 return NULL; 200 } 201 202 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm) 203 { 204 int err; 205 206 write_lock(&chan_list_lock); 207 208 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) { 209 err = -EADDRINUSE; 210 goto done; 211 } 212 213 if (psm) { 214 chan->psm = psm; 215 chan->sport = psm; 216 err = 0; 217 } else { 218 u16 p, start, end, incr; 219 220 if (chan->src_type == BDADDR_BREDR) { 221 start = L2CAP_PSM_DYN_START; 222 end = L2CAP_PSM_AUTO_END; 223 incr = 2; 224 } else { 225 start = L2CAP_PSM_LE_DYN_START; 226 end = L2CAP_PSM_LE_DYN_END; 227 incr = 1; 228 } 229 230 err = -EINVAL; 231 for (p = start; p <= end; p += incr) 232 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src, 233 chan->src_type)) { 234 chan->psm = cpu_to_le16(p); 235 chan->sport = cpu_to_le16(p); 236 err = 0; 237 break; 238 } 239 } 240 241 done: 242 write_unlock(&chan_list_lock); 243 return err; 244 } 245 EXPORT_SYMBOL_GPL(l2cap_add_psm); 246 247 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid) 248 { 249 write_lock(&chan_list_lock); 250 251 /* Override the defaults (which are for conn-oriented) */ 252 chan->omtu = L2CAP_DEFAULT_MTU; 253 chan->chan_type = L2CAP_CHAN_FIXED; 254 255 chan->scid = scid; 256 257 write_unlock(&chan_list_lock); 258 259 return 0; 260 } 261 262 static u16 l2cap_alloc_cid(struct l2cap_conn *conn) 263 __must_hold(&conn->lock) 264 { 265 u16 cid, dyn_end; 266 267 if (conn->hcon->type == LE_LINK) 268 dyn_end = L2CAP_CID_LE_DYN_END; 269 else 270 dyn_end = L2CAP_CID_DYN_END; 271 272 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) { 273 if (!__l2cap_get_chan_by_scid(conn, cid)) 274 return cid; 275 } 276 277 return 0; 278 } 279 280 static void l2cap_state_change(struct l2cap_chan *chan, int state) 281 { 282 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state), 283 state_to_string(state)); 284 285 chan->state = state; 286 chan->ops->state_change(chan, state, 0); 287 } 288 289 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan, 290 int state, int err) 291 { 292 chan->state = state; 293 chan->ops->state_change(chan, chan->state, err); 294 } 295 296 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err) 297 { 298 chan->ops->state_change(chan, chan->state, err); 299 } 300 301 static void __set_retrans_timer(struct l2cap_chan *chan) 302 { 303 if (!delayed_work_pending(&chan->monitor_timer) && 304 chan->retrans_timeout) { 305 l2cap_set_timer(chan, &chan->retrans_timer, 306 msecs_to_jiffies(chan->retrans_timeout)); 307 } 308 } 309 310 static void __set_monitor_timer(struct l2cap_chan *chan) 311 { 312 __clear_retrans_timer(chan); 313 if (chan->monitor_timeout) { 314 l2cap_set_timer(chan, &chan->monitor_timer, 315 msecs_to_jiffies(chan->monitor_timeout)); 316 } 317 } 318 319 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head, 320 u16 seq) 321 { 322 struct sk_buff *skb; 323 324 skb_queue_walk(head, skb) { 325 if (bt_cb(skb)->l2cap.txseq == seq) 326 return skb; 327 } 328 329 return NULL; 330 } 331 332 /* ---- L2CAP sequence number lists ---- */ 333 334 /* For ERTM, ordered lists of sequence numbers must be tracked for 335 * SREJ requests that are received and for frames that are to be 336 * retransmitted. These seq_list functions implement a singly-linked 337 * list in an array, where membership in the list can also be checked 338 * in constant time. Items can also be added to the tail of the list 339 * and removed from the head in constant time, without further memory 340 * allocs or frees. 341 */ 342 343 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size) 344 { 345 size_t alloc_size, i; 346 347 /* roundup_pow_of_two(0) is undefined */ 348 if (!size) 349 return -EINVAL; 350 351 /* Allocated size is a power of 2 to map sequence numbers 352 * (which may be up to 14 bits) in to a smaller array that is 353 * sized for the negotiated ERTM transmit windows. 354 */ 355 alloc_size = roundup_pow_of_two(size); 356 357 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL); 358 if (!seq_list->list) 359 return -ENOMEM; 360 361 seq_list->mask = alloc_size - 1; 362 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 363 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 364 for (i = 0; i < alloc_size; i++) 365 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 366 367 return 0; 368 } 369 370 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list) 371 { 372 kfree(seq_list->list); 373 } 374 375 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list, 376 u16 seq) 377 { 378 /* Constant-time check for list membership */ 379 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR; 380 } 381 382 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list) 383 { 384 u16 seq = seq_list->head; 385 u16 mask = seq_list->mask; 386 387 seq_list->head = seq_list->list[seq & mask]; 388 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR; 389 390 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) { 391 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 392 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 393 } 394 395 return seq; 396 } 397 398 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list) 399 { 400 u16 i; 401 402 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) 403 return; 404 405 for (i = 0; i <= seq_list->mask; i++) 406 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 407 408 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 409 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 410 } 411 412 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq) 413 { 414 u16 mask = seq_list->mask; 415 416 /* All appends happen in constant time */ 417 418 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR) 419 return; 420 421 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR) 422 seq_list->head = seq; 423 else 424 seq_list->list[seq_list->tail & mask] = seq; 425 426 seq_list->tail = seq; 427 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL; 428 } 429 430 static void l2cap_chan_timeout(struct work_struct *work) 431 { 432 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 433 chan_timer.work); 434 struct l2cap_conn *conn = chan->conn; 435 int reason; 436 437 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 438 439 if (test_bit(FLAG_DEL, &chan->flags)) { 440 l2cap_chan_put(chan); 441 return; 442 } 443 444 mutex_lock(&conn->lock); 445 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling 446 * this work. No need to call l2cap_chan_hold(chan) here again. 447 */ 448 l2cap_chan_lock(chan); 449 450 if (test_bit(FLAG_DEL, &chan->flags)) 451 goto unlock; 452 453 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) 454 reason = ECONNREFUSED; 455 else if (chan->state == BT_CONNECT && 456 chan->sec_level != BT_SECURITY_SDP) 457 reason = ECONNREFUSED; 458 else 459 reason = ETIMEDOUT; 460 461 __l2cap_chan_close(chan, reason); 462 463 chan->ops->close(chan); 464 465 unlock: 466 l2cap_chan_unlock(chan); 467 mutex_unlock(&conn->lock); 468 l2cap_chan_put(chan); 469 } 470 471 struct l2cap_chan *l2cap_chan_create(void) 472 { 473 struct l2cap_chan *chan; 474 475 chan = kzalloc_obj(*chan, GFP_ATOMIC); 476 if (!chan) 477 return NULL; 478 479 skb_queue_head_init(&chan->tx_q); 480 skb_queue_head_init(&chan->srej_q); 481 mutex_init(&chan->lock); 482 483 /* Set default lock nesting level */ 484 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL); 485 486 /* Available receive buffer space is initially unknown */ 487 chan->rx_avail = -1; 488 489 write_lock(&chan_list_lock); 490 list_add(&chan->global_l, &chan_list); 491 write_unlock(&chan_list_lock); 492 493 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout); 494 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout); 495 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout); 496 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout); 497 498 chan->state = BT_OPEN; 499 500 kref_init(&chan->kref); 501 502 /* This flag is cleared in l2cap_chan_ready() */ 503 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 504 505 BT_DBG("chan %p", chan); 506 507 return chan; 508 } 509 EXPORT_SYMBOL_GPL(l2cap_chan_create); 510 511 static void l2cap_chan_destroy(struct kref *kref) 512 { 513 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref); 514 515 BT_DBG("chan %p", chan); 516 517 write_lock(&chan_list_lock); 518 list_del(&chan->global_l); 519 write_unlock(&chan_list_lock); 520 521 if (chan->conn) 522 l2cap_conn_put(chan->conn); 523 524 kfree(chan); 525 } 526 527 void l2cap_chan_hold(struct l2cap_chan *c) 528 { 529 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 530 531 kref_get(&c->kref); 532 } 533 EXPORT_SYMBOL_GPL(l2cap_chan_hold); 534 535 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c) 536 { 537 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 538 539 if (!kref_get_unless_zero(&c->kref)) 540 return NULL; 541 542 return c; 543 } 544 545 void l2cap_chan_put(struct l2cap_chan *c) 546 { 547 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 548 549 kref_put(&c->kref, l2cap_chan_destroy); 550 } 551 EXPORT_SYMBOL_GPL(l2cap_chan_put); 552 553 /* Initialise @chan with default values, inheriting from the parent channel 554 * @pchan when it is given. 555 */ 556 void l2cap_chan_set_defaults(struct l2cap_chan *chan, struct l2cap_chan *pchan) 557 { 558 chan->fcs = L2CAP_FCS_CRC16; 559 chan->max_tx = L2CAP_DEFAULT_MAX_TX; 560 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW; 561 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 562 chan->remote_max_tx = chan->max_tx; 563 chan->remote_tx_win = chan->tx_win; 564 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW; 565 chan->sec_level = BT_SECURITY_LOW; 566 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 567 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; 568 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; 569 570 if (pchan) { 571 BT_DBG("chan %p pchan %p", chan, pchan); 572 573 chan->chan_type = pchan->chan_type; 574 chan->imtu = pchan->imtu; 575 chan->omtu = pchan->omtu; 576 chan->mode = pchan->mode; 577 chan->fcs = pchan->fcs; 578 chan->max_tx = pchan->max_tx; 579 chan->tx_win = pchan->tx_win; 580 chan->tx_win_max = pchan->tx_win_max; 581 chan->sec_level = pchan->sec_level; 582 chan->conf_state = pchan->conf_state; 583 chan->flags = pchan->flags; 584 chan->tx_credits = pchan->tx_credits; 585 chan->rx_credits = pchan->rx_credits; 586 587 if (chan->chan_type == L2CAP_CHAN_FIXED) { 588 chan->scid = pchan->scid; 589 chan->dcid = pchan->scid; 590 } 591 592 return; 593 } 594 595 chan->conf_state = 0; 596 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 597 598 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 599 } 600 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults); 601 602 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan) 603 { 604 size_t sdu_len = chan->sdu ? chan->sdu->len : 0; 605 606 if (chan->mps == 0) 607 return 0; 608 609 /* If we don't know the available space in the receiver buffer, give 610 * enough credits for a full packet. 611 */ 612 if (chan->rx_avail == -1) 613 return (chan->imtu / chan->mps) + 1; 614 615 /* If we know how much space is available in the receive buffer, give 616 * out as many credits as would fill the buffer. 617 */ 618 if (chan->rx_avail <= sdu_len) 619 return 0; 620 621 return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps); 622 } 623 624 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits) 625 { 626 chan->sdu = NULL; 627 chan->sdu_last_frag = NULL; 628 chan->sdu_len = 0; 629 chan->tx_credits = tx_credits; 630 /* Derive MPS from connection MTU to stop HCI fragmentation */ 631 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE); 632 chan->rx_credits = l2cap_le_rx_credits(chan); 633 634 skb_queue_head_init(&chan->tx_q); 635 } 636 637 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits) 638 { 639 l2cap_le_flowctl_init(chan, tx_credits); 640 641 /* L2CAP implementations shall support a minimum MPS of 64 octets */ 642 if (chan->mps < L2CAP_ECRED_MIN_MPS) { 643 chan->mps = L2CAP_ECRED_MIN_MPS; 644 chan->rx_credits = l2cap_le_rx_credits(chan); 645 } 646 } 647 648 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 649 { 650 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, 651 __le16_to_cpu(chan->psm), chan->dcid); 652 653 /* Caller must ensure l2cap_chan is linked to l2cap_conn only once */ 654 if (WARN_ON_ONCE(chan->conn || test_bit(FLAG_DEL, &chan->flags))) 655 return; 656 657 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 658 659 chan->conn = l2cap_conn_get(conn); 660 661 switch (chan->chan_type) { 662 case L2CAP_CHAN_CONN_ORIENTED: 663 /* Alloc CID for connection-oriented socket */ 664 chan->scid = l2cap_alloc_cid(conn); 665 if (conn->hcon->type == ACL_LINK) 666 chan->omtu = L2CAP_DEFAULT_MTU; 667 break; 668 669 case L2CAP_CHAN_CONN_LESS: 670 /* Connectionless socket */ 671 chan->scid = L2CAP_CID_CONN_LESS; 672 chan->dcid = L2CAP_CID_CONN_LESS; 673 chan->omtu = L2CAP_DEFAULT_MTU; 674 break; 675 676 case L2CAP_CHAN_FIXED: 677 /* Caller will set CID and CID specific MTU values */ 678 break; 679 680 default: 681 /* Raw socket can send/recv signalling messages only */ 682 chan->scid = L2CAP_CID_SIGNALING; 683 chan->dcid = L2CAP_CID_SIGNALING; 684 chan->omtu = L2CAP_DEFAULT_MTU; 685 } 686 687 chan->local_id = L2CAP_BESTEFFORT_ID; 688 chan->local_stype = L2CAP_SERV_BESTEFFORT; 689 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE; 690 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME; 691 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT; 692 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO; 693 694 l2cap_chan_hold(chan); 695 696 /* Only keep a reference for fixed channels if they requested it */ 697 if (chan->chan_type != L2CAP_CHAN_FIXED || 698 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 699 hci_conn_hold(conn->hcon); 700 701 /* Append to the list since the order matters for ECRED */ 702 list_add_tail(&chan->list, &conn->chan_l); 703 } 704 705 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 706 { 707 mutex_lock(&conn->lock); 708 l2cap_chan_lock(chan); 709 __l2cap_chan_add(conn, chan); 710 l2cap_chan_unlock(chan); 711 mutex_unlock(&conn->lock); 712 } 713 714 void l2cap_chan_del(struct l2cap_chan *chan, int err) 715 { 716 lockdep_assert(!chan->conn || lockdep_is_held(&chan->conn->lock)); 717 718 __clear_chan_timer(chan); 719 720 BT_DBG("chan %p, err %d, state %s", chan, err, 721 state_to_string(chan->state)); 722 723 chan->ops->teardown(chan, err); 724 725 if (!test_and_set_bit(FLAG_DEL, &chan->flags)) { 726 /* Delete from channel list */ 727 list_del(&chan->list); 728 729 l2cap_chan_put(chan); 730 731 /* Reference was only held for non-fixed channels or 732 * fixed channels that explicitly requested it using the 733 * FLAG_HOLD_HCI_CONN flag. 734 */ 735 if (chan->chan_type != L2CAP_CHAN_FIXED || 736 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 737 hci_conn_drop(chan->conn->hcon); 738 } 739 740 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state)) 741 return; 742 743 switch (chan->mode) { 744 case L2CAP_MODE_BASIC: 745 break; 746 747 case L2CAP_MODE_LE_FLOWCTL: 748 case L2CAP_MODE_EXT_FLOWCTL: 749 skb_queue_purge(&chan->tx_q); 750 break; 751 752 case L2CAP_MODE_ERTM: 753 __clear_retrans_timer(chan); 754 __clear_monitor_timer(chan); 755 __clear_ack_timer(chan); 756 757 skb_queue_purge(&chan->srej_q); 758 759 l2cap_seq_list_free(&chan->srej_list); 760 l2cap_seq_list_free(&chan->retrans_list); 761 fallthrough; 762 763 case L2CAP_MODE_STREAMING: 764 skb_queue_purge(&chan->tx_q); 765 break; 766 } 767 } 768 EXPORT_SYMBOL_GPL(l2cap_chan_del); 769 770 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id, 771 l2cap_chan_func_t func, void *data) 772 __must_hold(&conn->lock) 773 { 774 struct l2cap_chan *chan, *l; 775 776 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 777 if (chan->ident == id) 778 func(chan, data); 779 } 780 } 781 782 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 783 void *data) 784 __must_hold(&conn->lock) 785 { 786 struct l2cap_chan *chan; 787 788 list_for_each_entry(chan, &conn->chan_l, list) { 789 func(chan, data); 790 } 791 } 792 793 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 794 void *data) 795 { 796 if (!conn) 797 return; 798 799 mutex_lock(&conn->lock); 800 __l2cap_chan_list(conn, func, data); 801 mutex_unlock(&conn->lock); 802 } 803 804 EXPORT_SYMBOL_GPL(l2cap_chan_list); 805 806 static void l2cap_conn_update_id_addr(struct work_struct *work) 807 { 808 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 809 id_addr_timer.work); 810 struct hci_conn *hcon = conn->hcon; 811 struct l2cap_chan *chan; 812 813 mutex_lock(&conn->lock); 814 815 list_for_each_entry(chan, &conn->chan_l, list) { 816 l2cap_chan_lock(chan); 817 bacpy(&chan->dst, &hcon->dst); 818 chan->dst_type = bdaddr_dst_type(hcon); 819 l2cap_chan_unlock(chan); 820 } 821 822 mutex_unlock(&conn->lock); 823 } 824 825 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) 826 { 827 struct l2cap_conn *conn = chan->conn; 828 struct l2cap_le_conn_rsp rsp; 829 u16 result; 830 831 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 832 result = L2CAP_CR_LE_AUTHORIZATION; 833 else 834 result = L2CAP_CR_LE_BAD_PSM; 835 836 l2cap_state_change(chan, BT_DISCONN); 837 838 rsp.dcid = cpu_to_le16(chan->scid); 839 rsp.mtu = cpu_to_le16(chan->imtu); 840 rsp.mps = cpu_to_le16(chan->mps); 841 rsp.credits = cpu_to_le16(chan->rx_credits); 842 rsp.result = cpu_to_le16(result); 843 844 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 845 &rsp); 846 } 847 848 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan) 849 __must_hold(&chan->lock) 850 __must_hold(&chan->conn->lock) 851 { 852 l2cap_state_change(chan, BT_DISCONN); 853 854 __l2cap_ecred_conn_rsp_defer(chan); 855 } 856 857 static void l2cap_chan_connect_reject(struct l2cap_chan *chan) 858 { 859 struct l2cap_conn *conn = chan->conn; 860 struct l2cap_conn_rsp rsp; 861 u16 result; 862 863 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 864 result = L2CAP_CR_SEC_BLOCK; 865 else 866 result = L2CAP_CR_BAD_PSM; 867 868 l2cap_state_change(chan, BT_DISCONN); 869 870 rsp.scid = cpu_to_le16(chan->dcid); 871 rsp.dcid = cpu_to_le16(chan->scid); 872 rsp.result = cpu_to_le16(result); 873 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 874 875 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 876 } 877 878 static void __l2cap_chan_close(struct l2cap_chan *chan, int reason) 879 { 880 struct l2cap_conn *conn = chan->conn; 881 882 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 883 884 switch (chan->state) { 885 case BT_LISTEN: 886 chan->ops->teardown(chan, 0); 887 break; 888 889 case BT_CONNECTED: 890 case BT_CONFIG: 891 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 892 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 893 l2cap_send_disconn_req(chan, reason); 894 } else 895 l2cap_chan_del(chan, reason); 896 break; 897 898 case BT_CONNECT2: 899 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 900 if (conn->hcon->type == ACL_LINK) 901 l2cap_chan_connect_reject(chan); 902 else if (conn->hcon->type == LE_LINK) { 903 switch (chan->mode) { 904 case L2CAP_MODE_LE_FLOWCTL: 905 l2cap_chan_le_connect_reject(chan); 906 break; 907 case L2CAP_MODE_EXT_FLOWCTL: 908 l2cap_chan_ecred_connect_reject(chan); 909 return; 910 } 911 } 912 } 913 914 l2cap_chan_del(chan, reason); 915 break; 916 917 case BT_CONNECT: 918 case BT_DISCONN: 919 l2cap_chan_del(chan, reason); 920 break; 921 922 default: 923 chan->ops->teardown(chan, 0); 924 break; 925 } 926 } 927 928 /* Take chan->lock. If chan->conn is non-NULL, take new reference on it, take 929 * chan->conn->lock, and return true. Otherwise return false. 930 */ 931 bool l2cap_chan_lock_conn(struct l2cap_chan *chan) 932 __context_unsafe(/* conditional locking */) 933 { 934 /* Handle conn->lock > chan->lock ordering + race on chan->conn */ 935 for (;;) { 936 struct l2cap_conn *conn; 937 938 l2cap_chan_lock(chan); 939 conn = chan->conn; 940 if (conn) 941 l2cap_conn_get(conn); 942 l2cap_chan_unlock(chan); 943 944 if (conn) 945 mutex_lock(&conn->lock); 946 947 l2cap_chan_lock(chan); 948 949 if (chan->conn != conn) { 950 l2cap_chan_unlock(chan); 951 if (conn) { 952 mutex_unlock(&conn->lock); 953 l2cap_conn_put(conn); 954 } 955 schedule(); 956 continue; 957 } 958 959 return chan->conn; 960 } 961 } 962 963 void l2cap_chan_close_unlocked(struct l2cap_chan *chan, int reason) 964 { 965 bool have_conn; 966 967 have_conn = l2cap_chan_lock_conn(chan); 968 969 /* Context analysis: consider chan->conn->lock held also if conn NULL */ 970 context_unsafe(__l2cap_chan_close(chan, reason)); 971 972 l2cap_chan_unlock_conn(chan, have_conn); 973 } 974 EXPORT_SYMBOL(l2cap_chan_close_unlocked); 975 976 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan) 977 { 978 switch (chan->chan_type) { 979 case L2CAP_CHAN_RAW: 980 switch (chan->sec_level) { 981 case BT_SECURITY_HIGH: 982 case BT_SECURITY_FIPS: 983 return HCI_AT_DEDICATED_BONDING_MITM; 984 case BT_SECURITY_MEDIUM: 985 return HCI_AT_DEDICATED_BONDING; 986 default: 987 return HCI_AT_NO_BONDING; 988 } 989 break; 990 case L2CAP_CHAN_CONN_LESS: 991 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) { 992 if (chan->sec_level == BT_SECURITY_LOW) 993 chan->sec_level = BT_SECURITY_SDP; 994 } 995 if (chan->sec_level == BT_SECURITY_HIGH || 996 chan->sec_level == BT_SECURITY_FIPS) 997 return HCI_AT_NO_BONDING_MITM; 998 else 999 return HCI_AT_NO_BONDING; 1000 break; 1001 case L2CAP_CHAN_CONN_ORIENTED: 1002 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) { 1003 if (chan->sec_level == BT_SECURITY_LOW) 1004 chan->sec_level = BT_SECURITY_SDP; 1005 1006 if (chan->sec_level == BT_SECURITY_HIGH || 1007 chan->sec_level == BT_SECURITY_FIPS) 1008 return HCI_AT_NO_BONDING_MITM; 1009 else 1010 return HCI_AT_NO_BONDING; 1011 } 1012 fallthrough; 1013 1014 default: 1015 switch (chan->sec_level) { 1016 case BT_SECURITY_HIGH: 1017 case BT_SECURITY_FIPS: 1018 return HCI_AT_GENERAL_BONDING_MITM; 1019 case BT_SECURITY_MEDIUM: 1020 return HCI_AT_GENERAL_BONDING; 1021 default: 1022 return HCI_AT_NO_BONDING; 1023 } 1024 break; 1025 } 1026 } 1027 1028 /* Service level security */ 1029 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator) 1030 { 1031 struct l2cap_conn *conn = chan->conn; 1032 __u8 auth_type; 1033 1034 if (conn->hcon->type == LE_LINK) 1035 return smp_conn_security(conn->hcon, chan->sec_level); 1036 1037 auth_type = l2cap_get_auth_type(chan); 1038 1039 return hci_conn_security(conn->hcon, chan->sec_level, auth_type, 1040 initiator); 1041 } 1042 1043 static int l2cap_get_ident(struct l2cap_conn *conn) 1044 { 1045 u8 max; 1046 int ident; 1047 1048 /* LE link does not support tools like l2ping so use the full range */ 1049 if (conn->hcon->type == LE_LINK) 1050 max = 255; 1051 /* Get next available identificator. 1052 * 1 - 128 are used by kernel. 1053 * 129 - 199 are reserved. 1054 * 200 - 254 are used by utilities like l2ping, etc. 1055 */ 1056 else 1057 max = 128; 1058 1059 /* Allocate ident using min as last used + 1 (cyclic) */ 1060 ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1, 1061 max, GFP_ATOMIC); 1062 /* Force min 1 to start over */ 1063 if (ident <= 0) { 1064 ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC); 1065 if (ident <= 0) { 1066 /* If all idents are in use, log an error, this is 1067 * extremely unlikely to happen and would indicate a bug 1068 * in the code that idents are not being freed properly. 1069 */ 1070 BT_ERR("Unable to allocate ident: %d", ident); 1071 return 0; 1072 } 1073 } 1074 1075 WRITE_ONCE(conn->tx_ident, ident); 1076 1077 return ident; 1078 } 1079 1080 static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb, 1081 u8 flags) 1082 { 1083 /* Check if the hcon still valid before attempting to send */ 1084 if (hci_conn_valid(conn->hcon->hdev, conn->hcon)) 1085 hci_send_acl(conn->hchan, skb, flags); 1086 else 1087 kfree_skb(skb); 1088 } 1089 1090 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 1091 void *data) 1092 { 1093 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data); 1094 u8 flags; 1095 1096 BT_DBG("code 0x%2.2x", code); 1097 1098 if (!skb) 1099 return; 1100 1101 /* Use NO_FLUSH if supported or we have an LE link (which does 1102 * not support auto-flushing packets) */ 1103 if (lmp_no_flush_capable(conn->hcon->hdev) || 1104 conn->hcon->type == LE_LINK) 1105 flags = ACL_START_NO_FLUSH; 1106 else 1107 flags = ACL_START; 1108 1109 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; 1110 skb->priority = HCI_PRIO_MAX; 1111 1112 l2cap_send_acl(conn, skb, flags); 1113 } 1114 1115 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) 1116 { 1117 struct hci_conn *hcon = chan->conn->hcon; 1118 u16 flags; 1119 1120 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len, 1121 skb->priority); 1122 1123 /* Use NO_FLUSH for LE links (where this is the only option) or 1124 * if the BR/EDR link supports it and flushing has not been 1125 * explicitly requested (through FLAG_FLUSHABLE). 1126 */ 1127 if (hcon->type == LE_LINK || 1128 (!test_bit(FLAG_FLUSHABLE, &chan->flags) && 1129 lmp_no_flush_capable(hcon->hdev))) 1130 flags = ACL_START_NO_FLUSH; 1131 else 1132 flags = ACL_START; 1133 1134 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1135 hci_send_acl(chan->conn->hchan, skb, flags); 1136 } 1137 1138 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control) 1139 { 1140 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT; 1141 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT; 1142 1143 if (enh & L2CAP_CTRL_FRAME_TYPE) { 1144 /* S-Frame */ 1145 control->sframe = 1; 1146 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT; 1147 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT; 1148 1149 control->sar = 0; 1150 control->txseq = 0; 1151 } else { 1152 /* I-Frame */ 1153 control->sframe = 0; 1154 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT; 1155 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT; 1156 1157 control->poll = 0; 1158 control->super = 0; 1159 } 1160 } 1161 1162 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control) 1163 { 1164 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1165 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT; 1166 1167 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) { 1168 /* S-Frame */ 1169 control->sframe = 1; 1170 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT; 1171 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT; 1172 1173 control->sar = 0; 1174 control->txseq = 0; 1175 } else { 1176 /* I-Frame */ 1177 control->sframe = 0; 1178 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT; 1179 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1180 1181 control->poll = 0; 1182 control->super = 0; 1183 } 1184 } 1185 1186 static inline void __unpack_control(struct l2cap_chan *chan, 1187 struct sk_buff *skb) 1188 { 1189 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1190 __unpack_extended_control(get_unaligned_le32(skb->data), 1191 &bt_cb(skb)->l2cap); 1192 skb_pull(skb, L2CAP_EXT_CTRL_SIZE); 1193 } else { 1194 __unpack_enhanced_control(get_unaligned_le16(skb->data), 1195 &bt_cb(skb)->l2cap); 1196 skb_pull(skb, L2CAP_ENH_CTRL_SIZE); 1197 } 1198 } 1199 1200 static u32 __pack_extended_control(struct l2cap_ctrl *control) 1201 { 1202 u32 packed; 1203 1204 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1205 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT; 1206 1207 if (control->sframe) { 1208 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT; 1209 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT; 1210 packed |= L2CAP_EXT_CTRL_FRAME_TYPE; 1211 } else { 1212 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT; 1213 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1214 } 1215 1216 return packed; 1217 } 1218 1219 static u16 __pack_enhanced_control(struct l2cap_ctrl *control) 1220 { 1221 u16 packed; 1222 1223 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT; 1224 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT; 1225 1226 if (control->sframe) { 1227 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT; 1228 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT; 1229 packed |= L2CAP_CTRL_FRAME_TYPE; 1230 } else { 1231 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT; 1232 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT; 1233 } 1234 1235 return packed; 1236 } 1237 1238 static inline void __pack_control(struct l2cap_chan *chan, 1239 struct l2cap_ctrl *control, 1240 struct sk_buff *skb) 1241 { 1242 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1243 put_unaligned_le32(__pack_extended_control(control), 1244 skb->data + L2CAP_HDR_SIZE); 1245 } else { 1246 put_unaligned_le16(__pack_enhanced_control(control), 1247 skb->data + L2CAP_HDR_SIZE); 1248 } 1249 } 1250 1251 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan) 1252 { 1253 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1254 return L2CAP_EXT_HDR_SIZE; 1255 else 1256 return L2CAP_ENH_HDR_SIZE; 1257 } 1258 1259 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan, 1260 u32 control) 1261 { 1262 struct sk_buff *skb; 1263 struct l2cap_hdr *lh; 1264 int hlen = __ertm_hdr_size(chan); 1265 1266 if (chan->fcs == L2CAP_FCS_CRC16) 1267 hlen += L2CAP_FCS_SIZE; 1268 1269 skb = bt_skb_alloc(hlen, GFP_KERNEL); 1270 1271 if (!skb) 1272 return ERR_PTR(-ENOMEM); 1273 1274 lh = skb_put(skb, L2CAP_HDR_SIZE); 1275 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE); 1276 lh->cid = cpu_to_le16(chan->dcid); 1277 1278 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1279 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 1280 else 1281 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 1282 1283 if (chan->fcs == L2CAP_FCS_CRC16) { 1284 u16 fcs = crc16(0, (u8 *)skb->data, skb->len); 1285 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1286 } 1287 1288 skb->priority = HCI_PRIO_MAX; 1289 return skb; 1290 } 1291 1292 static void l2cap_send_sframe(struct l2cap_chan *chan, 1293 struct l2cap_ctrl *control) 1294 { 1295 struct sk_buff *skb; 1296 u32 control_field; 1297 1298 BT_DBG("chan %p, control %p", chan, control); 1299 1300 if (!control->sframe) 1301 return; 1302 1303 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) && 1304 !control->poll) 1305 control->final = 1; 1306 1307 if (control->super == L2CAP_SUPER_RR) 1308 clear_bit(CONN_RNR_SENT, &chan->conn_state); 1309 else if (control->super == L2CAP_SUPER_RNR) 1310 set_bit(CONN_RNR_SENT, &chan->conn_state); 1311 1312 if (control->super != L2CAP_SUPER_SREJ) { 1313 chan->last_acked_seq = control->reqseq; 1314 __clear_ack_timer(chan); 1315 } 1316 1317 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq, 1318 control->final, control->poll, control->super); 1319 1320 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1321 control_field = __pack_extended_control(control); 1322 else 1323 control_field = __pack_enhanced_control(control); 1324 1325 skb = l2cap_create_sframe_pdu(chan, control_field); 1326 if (!IS_ERR(skb)) 1327 l2cap_do_send(chan, skb); 1328 } 1329 1330 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll) 1331 { 1332 struct l2cap_ctrl control; 1333 1334 BT_DBG("chan %p, poll %d", chan, poll); 1335 1336 memset(&control, 0, sizeof(control)); 1337 control.sframe = 1; 1338 control.poll = poll; 1339 1340 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 1341 control.super = L2CAP_SUPER_RNR; 1342 else 1343 control.super = L2CAP_SUPER_RR; 1344 1345 control.reqseq = chan->buffer_seq; 1346 l2cap_send_sframe(chan, &control); 1347 } 1348 1349 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) 1350 { 1351 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 1352 return true; 1353 1354 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); 1355 } 1356 1357 void l2cap_send_conn_req(struct l2cap_chan *chan) 1358 { 1359 struct l2cap_conn *conn = chan->conn; 1360 struct l2cap_conn_req req; 1361 1362 req.scid = cpu_to_le16(chan->scid); 1363 req.psm = chan->psm; 1364 1365 chan->ident = l2cap_get_ident(conn); 1366 1367 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 1368 1369 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req); 1370 } 1371 1372 static void l2cap_chan_ready(struct l2cap_chan *chan) 1373 __must_hold(&chan->lock) 1374 __must_hold(&chan->conn->lock) 1375 { 1376 /* The channel may have already been flagged as connected in 1377 * case of receiving data before the L2CAP info req/rsp 1378 * procedure is complete. 1379 */ 1380 if (chan->state == BT_CONNECTED) 1381 return; 1382 1383 /* This clears all conf flags, including CONF_NOT_COMPLETE */ 1384 chan->conf_state = 0; 1385 __clear_chan_timer(chan); 1386 1387 switch (chan->mode) { 1388 case L2CAP_MODE_LE_FLOWCTL: 1389 case L2CAP_MODE_EXT_FLOWCTL: 1390 if (!chan->tx_credits) 1391 chan->ops->suspend(chan); 1392 break; 1393 } 1394 1395 chan->state = BT_CONNECTED; 1396 1397 chan->ops->ready(chan); 1398 } 1399 1400 static void l2cap_le_connect(struct l2cap_chan *chan) 1401 { 1402 struct l2cap_conn *conn = chan->conn; 1403 struct l2cap_le_conn_req req; 1404 1405 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags)) 1406 return; 1407 1408 if (!chan->imtu) 1409 chan->imtu = chan->conn->mtu; 1410 1411 l2cap_le_flowctl_init(chan, 0); 1412 1413 memset(&req, 0, sizeof(req)); 1414 req.psm = chan->psm; 1415 req.scid = cpu_to_le16(chan->scid); 1416 req.mtu = cpu_to_le16(chan->imtu); 1417 req.mps = cpu_to_le16(chan->mps); 1418 req.credits = cpu_to_le16(chan->rx_credits); 1419 1420 chan->ident = l2cap_get_ident(conn); 1421 1422 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ, 1423 sizeof(req), &req); 1424 } 1425 1426 struct l2cap_ecred_conn_data { 1427 struct { 1428 struct l2cap_ecred_conn_req_hdr req; 1429 __le16 scid[L2CAP_ECRED_CONN_SCID_MAX]; 1430 } __packed pdu; 1431 struct l2cap_chan *chan; 1432 struct pid *pid; 1433 int count; 1434 }; 1435 1436 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data) 1437 { 1438 struct l2cap_ecred_conn_data *conn = data; 1439 struct pid *pid; 1440 1441 if (chan == conn->chan) 1442 return; 1443 1444 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags)) 1445 return; 1446 1447 pid = chan->ops->get_peer_pid(chan); 1448 1449 /* Only add deferred channels with the same PID/PSM */ 1450 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident || 1451 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 1452 return; 1453 1454 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 1455 return; 1456 1457 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1458 return; 1459 1460 /* Unreachable, checked in l2cap_connect (+timer drops it if reached) */ 1461 if (WARN_ON_ONCE(conn->count >= ARRAY_SIZE(conn->pdu.scid))) 1462 return; 1463 1464 l2cap_ecred_init(chan, 0); 1465 1466 /* Set the same ident so we can match on the rsp */ 1467 chan->ident = conn->chan->ident; 1468 1469 /* Include all channels deferred */ 1470 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid); 1471 1472 conn->count++; 1473 } 1474 1475 static void l2cap_ecred_connect(struct l2cap_chan *chan) 1476 __must_hold(&chan->conn->lock) 1477 { 1478 struct l2cap_conn *conn = chan->conn; 1479 struct l2cap_ecred_conn_data data; 1480 1481 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 1482 return; 1483 1484 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1485 return; 1486 1487 l2cap_ecred_init(chan, 0); 1488 1489 memset(&data, 0, sizeof(data)); 1490 data.pdu.req.psm = chan->psm; 1491 data.pdu.req.mtu = cpu_to_le16(chan->imtu); 1492 data.pdu.req.mps = cpu_to_le16(chan->mps); 1493 data.pdu.req.credits = cpu_to_le16(chan->rx_credits); 1494 data.pdu.scid[0] = cpu_to_le16(chan->scid); 1495 1496 chan->ident = l2cap_get_ident(conn); 1497 1498 data.count = 1; 1499 data.chan = chan; 1500 data.pid = chan->ops->get_peer_pid(chan); 1501 1502 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data); 1503 1504 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ, 1505 sizeof(data.pdu.req) + data.count * sizeof(__le16), 1506 &data.pdu); 1507 } 1508 1509 static void l2cap_le_start(struct l2cap_chan *chan) 1510 __must_hold(&chan->lock) 1511 __must_hold(&chan->conn->lock) 1512 { 1513 struct l2cap_conn *conn = chan->conn; 1514 1515 if (!smp_conn_security(conn->hcon, chan->sec_level)) 1516 return; 1517 1518 if (!chan->psm) { 1519 l2cap_chan_ready(chan); 1520 return; 1521 } 1522 1523 if (chan->state == BT_CONNECT) { 1524 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) 1525 l2cap_ecred_connect(chan); 1526 else 1527 l2cap_le_connect(chan); 1528 } 1529 } 1530 1531 static void l2cap_start_connection(struct l2cap_chan *chan) 1532 __must_hold(&chan->lock) 1533 __must_hold(&chan->conn->lock) 1534 { 1535 if (chan->conn->hcon->type == LE_LINK) { 1536 l2cap_le_start(chan); 1537 } else { 1538 l2cap_send_conn_req(chan); 1539 } 1540 } 1541 1542 static void l2cap_request_info(struct l2cap_conn *conn) 1543 { 1544 struct l2cap_info_req req; 1545 1546 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1547 return; 1548 1549 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 1550 1551 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 1552 conn->info_ident = l2cap_get_ident(conn); 1553 1554 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 1555 1556 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 1557 sizeof(req), &req); 1558 } 1559 1560 static bool l2cap_check_enc_key_size(struct hci_conn *hcon, 1561 struct l2cap_chan *chan) 1562 { 1563 /* The minimum encryption key size needs to be enforced by the 1564 * host stack before establishing any L2CAP connections. The 1565 * specification in theory allows a minimum of 1, but to align 1566 * BR/EDR and LE transports, a minimum of 7 is chosen. 1567 * 1568 * This check might also be called for unencrypted connections 1569 * that have no key size requirements. Ensure that the link is 1570 * actually encrypted before enforcing a key size. 1571 */ 1572 int min_key_size = hcon->hdev->min_enc_key_size; 1573 1574 /* On FIPS security level, key size must be 16 bytes */ 1575 if (chan->sec_level == BT_SECURITY_FIPS) 1576 min_key_size = 16; 1577 1578 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || 1579 hcon->enc_key_size >= min_key_size); 1580 } 1581 1582 static void l2cap_do_start(struct l2cap_chan *chan) 1583 __must_hold(&chan->lock) 1584 __must_hold(&chan->conn->lock) 1585 { 1586 struct l2cap_conn *conn = chan->conn; 1587 1588 if (conn->hcon->type == LE_LINK) { 1589 l2cap_le_start(chan); 1590 return; 1591 } 1592 1593 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) { 1594 l2cap_request_info(conn); 1595 return; 1596 } 1597 1598 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) 1599 return; 1600 1601 if (!l2cap_chan_check_security(chan, true) || 1602 !__l2cap_no_conn_pending(chan)) 1603 return; 1604 1605 if (l2cap_check_enc_key_size(conn->hcon, chan)) 1606 l2cap_start_connection(chan); 1607 else 1608 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 1609 } 1610 1611 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) 1612 { 1613 u32 local_feat_mask = l2cap_feat_mask; 1614 if (!disable_ertm) 1615 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING; 1616 1617 switch (mode) { 1618 case L2CAP_MODE_ERTM: 1619 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask; 1620 case L2CAP_MODE_STREAMING: 1621 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask; 1622 default: 1623 return 0x00; 1624 } 1625 } 1626 1627 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err) 1628 { 1629 struct l2cap_conn *conn = chan->conn; 1630 struct l2cap_disconn_req req; 1631 1632 if (!conn) 1633 return; 1634 1635 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) { 1636 __clear_retrans_timer(chan); 1637 __clear_monitor_timer(chan); 1638 __clear_ack_timer(chan); 1639 } 1640 1641 req.dcid = cpu_to_le16(chan->dcid); 1642 req.scid = cpu_to_le16(chan->scid); 1643 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ, 1644 sizeof(req), &req); 1645 1646 l2cap_state_change_and_error(chan, BT_DISCONN, err); 1647 } 1648 1649 /* ---- L2CAP connections ---- */ 1650 static void l2cap_conn_start(struct l2cap_conn *conn) 1651 __must_hold(&conn->lock) 1652 { 1653 struct l2cap_chan *chan, *tmp; 1654 1655 BT_DBG("conn %p", conn); 1656 1657 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 1658 l2cap_chan_lock(chan); 1659 1660 lockdep_assert_held(&chan->conn->lock); 1661 1662 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1663 l2cap_chan_ready(chan); 1664 l2cap_chan_unlock(chan); 1665 continue; 1666 } 1667 1668 if (chan->state == BT_CONNECT) { 1669 if (!l2cap_chan_check_security(chan, true) || 1670 !__l2cap_no_conn_pending(chan)) { 1671 l2cap_chan_unlock(chan); 1672 continue; 1673 } 1674 1675 if (!l2cap_mode_supported(chan->mode, conn->feat_mask) 1676 && test_bit(CONF_STATE2_DEVICE, 1677 &chan->conf_state)) { 1678 __l2cap_chan_close(chan, ECONNRESET); 1679 l2cap_chan_unlock(chan); 1680 continue; 1681 } 1682 1683 if (l2cap_check_enc_key_size(conn->hcon, chan)) 1684 l2cap_start_connection(chan); 1685 else 1686 __l2cap_chan_close(chan, ECONNREFUSED); 1687 1688 } else if (chan->state == BT_CONNECT2) { 1689 struct l2cap_conn_rsp rsp; 1690 char buf[128]; 1691 rsp.scid = cpu_to_le16(chan->dcid); 1692 rsp.dcid = cpu_to_le16(chan->scid); 1693 1694 if (l2cap_chan_check_security(chan, false)) { 1695 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 1696 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1697 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 1698 chan->ops->defer(chan); 1699 1700 } else { 1701 l2cap_state_change(chan, BT_CONFIG); 1702 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 1703 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 1704 } 1705 } else { 1706 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1707 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 1708 } 1709 1710 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 1711 sizeof(rsp), &rsp); 1712 1713 if (test_bit(CONF_REQ_SENT, &chan->conf_state) || 1714 rsp.result != L2CAP_CR_SUCCESS) { 1715 l2cap_chan_unlock(chan); 1716 continue; 1717 } 1718 1719 set_bit(CONF_REQ_SENT, &chan->conf_state); 1720 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 1721 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 1722 chan->num_conf_req++; 1723 } 1724 1725 l2cap_chan_unlock(chan); 1726 } 1727 } 1728 1729 static void l2cap_le_conn_ready(struct l2cap_conn *conn) 1730 { 1731 struct hci_conn *hcon = conn->hcon; 1732 struct hci_dev *hdev = hcon->hdev; 1733 1734 BT_DBG("%s conn %p", hdev->name, conn); 1735 1736 /* For outgoing pairing which doesn't necessarily have an 1737 * associated socket (e.g. mgmt_pair_device). 1738 */ 1739 if (hcon->out) 1740 smp_conn_security(hcon, hcon->pending_sec_level); 1741 1742 /* For LE peripheral connections, make sure the connection interval 1743 * is in the range of the minimum and maximum interval that has 1744 * been configured for this connection. If not, then trigger 1745 * the connection update procedure. 1746 */ 1747 if (hcon->role == HCI_ROLE_SLAVE && 1748 (hcon->le_conn_interval < hcon->le_conn_min_interval || 1749 hcon->le_conn_interval > hcon->le_conn_max_interval)) { 1750 struct l2cap_conn_param_update_req req; 1751 1752 req.min = cpu_to_le16(hcon->le_conn_min_interval); 1753 req.max = cpu_to_le16(hcon->le_conn_max_interval); 1754 req.latency = cpu_to_le16(hcon->le_conn_latency); 1755 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout); 1756 1757 l2cap_send_cmd(conn, l2cap_get_ident(conn), 1758 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req); 1759 } 1760 } 1761 1762 static void l2cap_conn_ready(struct l2cap_conn *conn) 1763 { 1764 struct l2cap_chan *chan; 1765 struct hci_conn *hcon = conn->hcon; 1766 1767 BT_DBG("conn %p", conn); 1768 1769 if (hcon->type == ACL_LINK) 1770 l2cap_request_info(conn); 1771 1772 mutex_lock(&conn->lock); 1773 1774 list_for_each_entry(chan, &conn->chan_l, list) { 1775 1776 l2cap_chan_lock(chan); 1777 1778 lockdep_assert_held(&chan->conn->lock); 1779 1780 if (hcon->type == LE_LINK) { 1781 l2cap_le_start(chan); 1782 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1783 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 1784 l2cap_chan_ready(chan); 1785 } else if (chan->state == BT_CONNECT) { 1786 l2cap_do_start(chan); 1787 } 1788 1789 l2cap_chan_unlock(chan); 1790 } 1791 1792 mutex_unlock(&conn->lock); 1793 1794 if (hcon->type == LE_LINK) 1795 l2cap_le_conn_ready(conn); 1796 1797 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work); 1798 } 1799 1800 /* Notify sockets that we cannot guaranty reliability anymore */ 1801 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) 1802 __must_hold(&conn->lock) 1803 { 1804 struct l2cap_chan *chan; 1805 1806 BT_DBG("conn %p", conn); 1807 1808 list_for_each_entry(chan, &conn->chan_l, list) { 1809 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 1810 l2cap_chan_set_err(chan, err); 1811 } 1812 } 1813 1814 static void l2cap_info_timeout(struct work_struct *work) 1815 { 1816 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 1817 info_timer.work); 1818 1819 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 1820 conn->info_ident = 0; 1821 1822 mutex_lock(&conn->lock); 1823 l2cap_conn_start(conn); 1824 mutex_unlock(&conn->lock); 1825 } 1826 1827 /* 1828 * l2cap_user 1829 * External modules can register l2cap_user objects on l2cap_conn. The ->probe 1830 * callback is called during registration. The ->remove callback is called 1831 * during unregistration. 1832 * An l2cap_user object can either be explicitly unregistered or when the 1833 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon, 1834 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called. 1835 * External modules must own a reference to the l2cap_conn object if they intend 1836 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at 1837 * any time if they don't. 1838 */ 1839 1840 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user) 1841 { 1842 int ret; 1843 1844 /* We need to check whether l2cap_conn is registered. If it is not, we 1845 * must not register the l2cap_user. l2cap_conn_del() unregisters 1846 * l2cap_conn objects under conn->lock, and we use the same lock here 1847 * to protect access to conn->users and conn->hchan. 1848 */ 1849 1850 mutex_lock(&conn->lock); 1851 1852 if (!list_empty(&user->list)) { 1853 ret = -EINVAL; 1854 goto out_unlock; 1855 } 1856 1857 /* conn->hchan is NULL after l2cap_conn_del() was called */ 1858 if (!conn->hchan) { 1859 ret = -ENODEV; 1860 goto out_unlock; 1861 } 1862 1863 ret = user->probe(conn, user); 1864 if (ret) 1865 goto out_unlock; 1866 1867 list_add(&user->list, &conn->users); 1868 ret = 0; 1869 1870 out_unlock: 1871 mutex_unlock(&conn->lock); 1872 return ret; 1873 } 1874 EXPORT_SYMBOL(l2cap_register_user); 1875 1876 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user) 1877 { 1878 mutex_lock(&conn->lock); 1879 1880 if (list_empty(&user->list)) 1881 goto out_unlock; 1882 1883 list_del_init(&user->list); 1884 user->remove(conn, user); 1885 1886 out_unlock: 1887 mutex_unlock(&conn->lock); 1888 } 1889 EXPORT_SYMBOL(l2cap_unregister_user); 1890 1891 static void l2cap_unregister_all_users(struct l2cap_conn *conn) 1892 { 1893 struct l2cap_user *user; 1894 1895 while (!list_empty(&conn->users)) { 1896 user = list_first_entry(&conn->users, struct l2cap_user, list); 1897 list_del_init(&user->list); 1898 user->remove(conn, user); 1899 } 1900 } 1901 1902 static void l2cap_conn_del(struct hci_conn *hcon, int err) 1903 __must_hold(&hcon->hdev->lock) 1904 { 1905 struct l2cap_conn *conn = hcon->l2cap_data; 1906 struct l2cap_chan *chan, *l; 1907 1908 if (!conn) 1909 return; 1910 1911 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 1912 1913 disable_delayed_work_sync(&conn->info_timer); 1914 disable_delayed_work_sync(&conn->id_addr_timer); 1915 1916 cancel_work_sync(&conn->pending_rx_work); 1917 1918 mutex_lock(&conn->lock); 1919 1920 kfree_skb(conn->rx_skb); 1921 1922 skb_queue_purge(&conn->pending_rx); 1923 ida_destroy(&conn->tx_ida); 1924 1925 l2cap_unregister_all_users(conn); 1926 1927 /* Force the connection to be immediately dropped */ 1928 hcon->disc_timeout = 0; 1929 1930 /* Kill channels */ 1931 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 1932 l2cap_chan_hold(chan); 1933 l2cap_chan_lock(chan); 1934 1935 lockdep_assert_held(&chan->conn->lock); 1936 1937 l2cap_chan_del(chan, err); 1938 1939 chan->ops->close(chan); 1940 1941 l2cap_chan_unlock(chan); 1942 l2cap_chan_put(chan); 1943 } 1944 1945 hci_chan_del(conn->hchan); 1946 conn->hchan = NULL; 1947 1948 spin_lock(&hcon->proto_lock); 1949 hcon->l2cap_data = NULL; 1950 spin_unlock(&hcon->proto_lock); 1951 1952 mutex_unlock(&conn->lock); 1953 l2cap_conn_put(conn); 1954 } 1955 1956 static void l2cap_conn_free(struct kref *ref) 1957 { 1958 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref); 1959 1960 hci_conn_put(conn->hcon); 1961 kfree(conn); 1962 } 1963 1964 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn) 1965 { 1966 kref_get(&conn->ref); 1967 return conn; 1968 } 1969 EXPORT_SYMBOL(l2cap_conn_get); 1970 1971 void l2cap_conn_put(struct l2cap_conn *conn) 1972 { 1973 kref_put(&conn->ref, l2cap_conn_free); 1974 } 1975 EXPORT_SYMBOL(l2cap_conn_put); 1976 1977 /* ---- Socket interface ---- */ 1978 1979 /* Find socket with psm and source / destination bdaddr. 1980 * Returns closest match. 1981 */ 1982 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, 1983 bdaddr_t *src, 1984 bdaddr_t *dst, 1985 u8 link_type) 1986 { 1987 struct l2cap_chan *c, *tmp, *c1 = NULL; 1988 1989 read_lock(&chan_list_lock); 1990 1991 list_for_each_entry_safe(c, tmp, &chan_list, global_l) { 1992 if (state && c->state != state) 1993 continue; 1994 1995 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR) 1996 continue; 1997 1998 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR) 1999 continue; 2000 2001 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) { 2002 int src_match, dst_match; 2003 int src_any, dst_any; 2004 2005 /* Exact match. */ 2006 src_match = !bacmp(&c->src, src); 2007 dst_match = !bacmp(&c->dst, dst); 2008 if (src_match && dst_match) { 2009 if (!l2cap_chan_hold_unless_zero(c)) 2010 continue; 2011 2012 read_unlock(&chan_list_lock); 2013 return c; 2014 } 2015 2016 /* Closest match */ 2017 src_any = !bacmp(&c->src, BDADDR_ANY); 2018 dst_any = !bacmp(&c->dst, BDADDR_ANY); 2019 if ((src_match && dst_any) || (src_any && dst_match) || 2020 (src_any && dst_any)) 2021 c1 = c; 2022 } 2023 } 2024 2025 if (c1) 2026 c1 = l2cap_chan_hold_unless_zero(c1); 2027 2028 read_unlock(&chan_list_lock); 2029 2030 return c1; 2031 } 2032 2033 static void l2cap_monitor_timeout(struct work_struct *work) 2034 { 2035 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 2036 monitor_timer.work); 2037 2038 BT_DBG("chan %p", chan); 2039 2040 l2cap_chan_lock(chan); 2041 2042 if (test_bit(FLAG_DEL, &chan->flags)) { 2043 l2cap_chan_unlock(chan); 2044 l2cap_chan_put(chan); 2045 return; 2046 } 2047 2048 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO); 2049 2050 l2cap_chan_unlock(chan); 2051 l2cap_chan_put(chan); 2052 } 2053 2054 static void l2cap_retrans_timeout(struct work_struct *work) 2055 { 2056 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 2057 retrans_timer.work); 2058 2059 BT_DBG("chan %p", chan); 2060 2061 l2cap_chan_lock(chan); 2062 2063 if (test_bit(FLAG_DEL, &chan->flags)) { 2064 l2cap_chan_unlock(chan); 2065 l2cap_chan_put(chan); 2066 return; 2067 } 2068 2069 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO); 2070 l2cap_chan_unlock(chan); 2071 l2cap_chan_put(chan); 2072 } 2073 2074 static void l2cap_streaming_send(struct l2cap_chan *chan, 2075 struct sk_buff_head *skbs) 2076 { 2077 struct sk_buff *skb; 2078 struct l2cap_ctrl *control; 2079 2080 BT_DBG("chan %p, skbs %p", chan, skbs); 2081 2082 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2083 2084 while (!skb_queue_empty(&chan->tx_q)) { 2085 2086 skb = skb_dequeue(&chan->tx_q); 2087 2088 bt_cb(skb)->l2cap.retries = 1; 2089 control = &bt_cb(skb)->l2cap; 2090 2091 control->reqseq = 0; 2092 control->txseq = chan->next_tx_seq; 2093 2094 __pack_control(chan, control, skb); 2095 2096 if (chan->fcs == L2CAP_FCS_CRC16) { 2097 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 2098 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 2099 } 2100 2101 l2cap_do_send(chan, skb); 2102 2103 BT_DBG("Sent txseq %u", control->txseq); 2104 2105 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2106 chan->frames_sent++; 2107 } 2108 } 2109 2110 static int l2cap_ertm_send(struct l2cap_chan *chan) 2111 { 2112 struct sk_buff *skb, *tx_skb; 2113 struct l2cap_ctrl *control; 2114 int sent = 0; 2115 2116 BT_DBG("chan %p", chan); 2117 2118 if (chan->state != BT_CONNECTED) 2119 return -ENOTCONN; 2120 2121 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2122 return 0; 2123 2124 while (chan->tx_send_head && 2125 chan->unacked_frames < chan->remote_tx_win && 2126 chan->tx_state == L2CAP_TX_STATE_XMIT) { 2127 2128 skb = chan->tx_send_head; 2129 2130 bt_cb(skb)->l2cap.retries = 1; 2131 control = &bt_cb(skb)->l2cap; 2132 2133 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2134 control->final = 1; 2135 2136 control->reqseq = chan->buffer_seq; 2137 chan->last_acked_seq = chan->buffer_seq; 2138 control->txseq = chan->next_tx_seq; 2139 2140 __pack_control(chan, control, skb); 2141 2142 if (chan->fcs == L2CAP_FCS_CRC16) { 2143 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 2144 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 2145 } 2146 2147 /* Clone after data has been modified. Data is assumed to be 2148 read-only (for locking purposes) on cloned sk_buffs. 2149 */ 2150 tx_skb = skb_clone(skb, GFP_KERNEL); 2151 2152 if (!tx_skb) 2153 break; 2154 2155 __set_retrans_timer(chan); 2156 2157 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2158 chan->unacked_frames++; 2159 chan->frames_sent++; 2160 sent++; 2161 2162 if (skb_queue_is_last(&chan->tx_q, skb)) 2163 chan->tx_send_head = NULL; 2164 else 2165 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb); 2166 2167 l2cap_do_send(chan, tx_skb); 2168 BT_DBG("Sent txseq %u", control->txseq); 2169 } 2170 2171 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent, 2172 chan->unacked_frames, skb_queue_len(&chan->tx_q)); 2173 2174 return sent; 2175 } 2176 2177 static void l2cap_ertm_resend(struct l2cap_chan *chan) 2178 { 2179 struct l2cap_ctrl control; 2180 struct sk_buff *skb; 2181 struct sk_buff *tx_skb; 2182 u16 seq; 2183 2184 BT_DBG("chan %p", chan); 2185 2186 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2187 return; 2188 2189 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) { 2190 seq = l2cap_seq_list_pop(&chan->retrans_list); 2191 2192 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq); 2193 if (!skb) { 2194 BT_DBG("Error: Can't retransmit seq %d, frame missing", 2195 seq); 2196 continue; 2197 } 2198 2199 bt_cb(skb)->l2cap.retries++; 2200 control = bt_cb(skb)->l2cap; 2201 2202 if (chan->max_tx != 0 && 2203 bt_cb(skb)->l2cap.retries > chan->max_tx) { 2204 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 2205 l2cap_send_disconn_req(chan, ECONNRESET); 2206 l2cap_seq_list_clear(&chan->retrans_list); 2207 break; 2208 } 2209 2210 control.reqseq = chan->buffer_seq; 2211 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2212 control.final = 1; 2213 else 2214 control.final = 0; 2215 2216 if (skb_cloned(skb)) { 2217 /* Cloned sk_buffs are read-only, so we need a 2218 * writeable copy 2219 */ 2220 tx_skb = skb_copy(skb, GFP_KERNEL); 2221 } else { 2222 tx_skb = skb_clone(skb, GFP_KERNEL); 2223 } 2224 2225 if (!tx_skb) { 2226 l2cap_seq_list_clear(&chan->retrans_list); 2227 break; 2228 } 2229 2230 /* Update skb contents */ 2231 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 2232 put_unaligned_le32(__pack_extended_control(&control), 2233 tx_skb->data + L2CAP_HDR_SIZE); 2234 } else { 2235 put_unaligned_le16(__pack_enhanced_control(&control), 2236 tx_skb->data + L2CAP_HDR_SIZE); 2237 } 2238 2239 /* Update FCS */ 2240 if (chan->fcs == L2CAP_FCS_CRC16) { 2241 u16 fcs = crc16(0, (u8 *) tx_skb->data, 2242 tx_skb->len - L2CAP_FCS_SIZE); 2243 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) - 2244 L2CAP_FCS_SIZE); 2245 } 2246 2247 l2cap_do_send(chan, tx_skb); 2248 2249 BT_DBG("Resent txseq %d", control.txseq); 2250 2251 chan->last_acked_seq = chan->buffer_seq; 2252 } 2253 } 2254 2255 static void l2cap_retransmit(struct l2cap_chan *chan, 2256 struct l2cap_ctrl *control) 2257 { 2258 BT_DBG("chan %p, control %p", chan, control); 2259 2260 l2cap_seq_list_append(&chan->retrans_list, control->reqseq); 2261 l2cap_ertm_resend(chan); 2262 } 2263 2264 static void l2cap_retransmit_all(struct l2cap_chan *chan, 2265 struct l2cap_ctrl *control) 2266 { 2267 struct sk_buff *skb; 2268 2269 BT_DBG("chan %p, control %p", chan, control); 2270 2271 if (control->poll) 2272 set_bit(CONN_SEND_FBIT, &chan->conn_state); 2273 2274 l2cap_seq_list_clear(&chan->retrans_list); 2275 2276 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2277 return; 2278 2279 if (chan->unacked_frames) { 2280 skb_queue_walk(&chan->tx_q, skb) { 2281 if (bt_cb(skb)->l2cap.txseq == control->reqseq || 2282 skb == chan->tx_send_head) 2283 break; 2284 } 2285 2286 skb_queue_walk_from(&chan->tx_q, skb) { 2287 if (skb == chan->tx_send_head) 2288 break; 2289 2290 l2cap_seq_list_append(&chan->retrans_list, 2291 bt_cb(skb)->l2cap.txseq); 2292 } 2293 2294 l2cap_ertm_resend(chan); 2295 } 2296 } 2297 2298 static void l2cap_send_ack(struct l2cap_chan *chan) 2299 { 2300 struct l2cap_ctrl control; 2301 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 2302 chan->last_acked_seq); 2303 int threshold; 2304 2305 BT_DBG("chan %p last_acked_seq %d buffer_seq %d", 2306 chan, chan->last_acked_seq, chan->buffer_seq); 2307 2308 memset(&control, 0, sizeof(control)); 2309 control.sframe = 1; 2310 2311 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 2312 chan->rx_state == L2CAP_RX_STATE_RECV) { 2313 __clear_ack_timer(chan); 2314 control.super = L2CAP_SUPER_RNR; 2315 control.reqseq = chan->buffer_seq; 2316 l2cap_send_sframe(chan, &control); 2317 } else { 2318 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) { 2319 l2cap_ertm_send(chan); 2320 /* If any i-frames were sent, they included an ack */ 2321 if (chan->buffer_seq == chan->last_acked_seq) 2322 frames_to_ack = 0; 2323 } 2324 2325 /* Ack now if the window is 3/4ths full. 2326 * Calculate without mul or div 2327 */ 2328 threshold = chan->ack_win; 2329 threshold += threshold << 1; 2330 threshold >>= 2; 2331 2332 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack, 2333 threshold); 2334 2335 if (frames_to_ack >= threshold) { 2336 __clear_ack_timer(chan); 2337 control.super = L2CAP_SUPER_RR; 2338 control.reqseq = chan->buffer_seq; 2339 l2cap_send_sframe(chan, &control); 2340 frames_to_ack = 0; 2341 } 2342 2343 if (frames_to_ack) 2344 __set_ack_timer(chan); 2345 } 2346 } 2347 2348 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan, 2349 struct msghdr *msg, int len, 2350 int count, struct sk_buff *skb) 2351 { 2352 struct l2cap_conn *conn = chan->conn; 2353 struct sk_buff **frag; 2354 int sent = 0; 2355 2356 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter)) 2357 return -EFAULT; 2358 2359 sent += count; 2360 len -= count; 2361 2362 /* Continuation fragments (no L2CAP header) */ 2363 frag = &skb_shinfo(skb)->frag_list; 2364 while (len) { 2365 struct sk_buff *tmp; 2366 2367 count = min_t(unsigned int, conn->mtu, len); 2368 2369 tmp = chan->ops->alloc_skb(chan, 0, count, 2370 msg->msg_flags & MSG_DONTWAIT); 2371 if (IS_ERR(tmp)) 2372 return PTR_ERR(tmp); 2373 2374 *frag = tmp; 2375 2376 if (!copy_from_iter_full(skb_put(*frag, count), count, 2377 &msg->msg_iter)) 2378 return -EFAULT; 2379 2380 sent += count; 2381 len -= count; 2382 2383 skb->len += (*frag)->len; 2384 skb->data_len += (*frag)->len; 2385 2386 frag = &(*frag)->next; 2387 } 2388 2389 return sent; 2390 } 2391 2392 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, 2393 struct msghdr *msg, size_t len) 2394 { 2395 struct l2cap_conn *conn = chan->conn; 2396 struct sk_buff *skb; 2397 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE; 2398 struct l2cap_hdr *lh; 2399 2400 BT_DBG("chan %p psm 0x%2.2x len %zu", chan, 2401 __le16_to_cpu(chan->psm), len); 2402 2403 count = min_t(unsigned int, (conn->mtu - hlen), len); 2404 2405 skb = chan->ops->alloc_skb(chan, hlen, count, 2406 msg->msg_flags & MSG_DONTWAIT); 2407 if (IS_ERR(skb)) 2408 return skb; 2409 2410 /* Create L2CAP header */ 2411 lh = skb_put(skb, L2CAP_HDR_SIZE); 2412 lh->cid = cpu_to_le16(chan->dcid); 2413 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE); 2414 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE)); 2415 2416 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2417 if (unlikely(err < 0)) { 2418 kfree_skb(skb); 2419 return ERR_PTR(err); 2420 } 2421 return skb; 2422 } 2423 2424 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, 2425 struct msghdr *msg, size_t len) 2426 { 2427 struct l2cap_conn *conn = chan->conn; 2428 struct sk_buff *skb; 2429 int err, count; 2430 struct l2cap_hdr *lh; 2431 2432 BT_DBG("chan %p len %zu", chan, len); 2433 2434 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len); 2435 2436 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count, 2437 msg->msg_flags & MSG_DONTWAIT); 2438 if (IS_ERR(skb)) 2439 return skb; 2440 2441 /* Create L2CAP header */ 2442 lh = skb_put(skb, L2CAP_HDR_SIZE); 2443 lh->cid = cpu_to_le16(chan->dcid); 2444 lh->len = cpu_to_le16(len); 2445 2446 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2447 if (unlikely(err < 0)) { 2448 kfree_skb(skb); 2449 return ERR_PTR(err); 2450 } 2451 return skb; 2452 } 2453 2454 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, 2455 struct msghdr *msg, size_t len, 2456 u16 sdulen) 2457 { 2458 struct l2cap_conn *conn = chan->conn; 2459 struct sk_buff *skb; 2460 int err, count, hlen; 2461 struct l2cap_hdr *lh; 2462 2463 BT_DBG("chan %p len %zu", chan, len); 2464 2465 if (!conn) 2466 return ERR_PTR(-ENOTCONN); 2467 2468 hlen = __ertm_hdr_size(chan); 2469 2470 if (sdulen) 2471 hlen += L2CAP_SDULEN_SIZE; 2472 2473 if (chan->fcs == L2CAP_FCS_CRC16) 2474 hlen += L2CAP_FCS_SIZE; 2475 2476 count = min_t(unsigned int, (conn->mtu - hlen), len); 2477 2478 skb = chan->ops->alloc_skb(chan, hlen, count, 2479 msg->msg_flags & MSG_DONTWAIT); 2480 if (IS_ERR(skb)) 2481 return skb; 2482 2483 /* Create L2CAP header */ 2484 lh = skb_put(skb, L2CAP_HDR_SIZE); 2485 lh->cid = cpu_to_le16(chan->dcid); 2486 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2487 2488 /* Control header is populated later */ 2489 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 2490 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 2491 else 2492 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 2493 2494 if (sdulen) 2495 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2496 2497 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2498 if (unlikely(err < 0)) { 2499 kfree_skb(skb); 2500 return ERR_PTR(err); 2501 } 2502 2503 bt_cb(skb)->l2cap.fcs = chan->fcs; 2504 bt_cb(skb)->l2cap.retries = 0; 2505 return skb; 2506 } 2507 2508 static int l2cap_segment_sdu(struct l2cap_chan *chan, 2509 struct sk_buff_head *seg_queue, 2510 struct msghdr *msg, size_t len) 2511 { 2512 struct sk_buff *skb; 2513 u16 sdu_len; 2514 size_t pdu_len; 2515 u8 sar; 2516 2517 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2518 2519 /* It is critical that ERTM PDUs fit in a single HCI fragment, 2520 * so fragmented skbs are not used. The HCI layer's handling 2521 * of fragmented skbs is not compatible with ERTM's queueing. 2522 */ 2523 2524 /* PDU size is derived from the HCI MTU */ 2525 pdu_len = chan->conn->mtu; 2526 2527 /* Constrain PDU size for BR/EDR connections */ 2528 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD); 2529 2530 /* Adjust for largest possible L2CAP overhead. */ 2531 if (chan->fcs) 2532 pdu_len -= L2CAP_FCS_SIZE; 2533 2534 pdu_len -= __ertm_hdr_size(chan); 2535 2536 /* Remote device may have requested smaller PDUs */ 2537 pdu_len = min_t(size_t, pdu_len, chan->remote_mps); 2538 2539 if (!pdu_len) 2540 return -EINVAL; 2541 2542 if (len <= pdu_len) { 2543 sar = L2CAP_SAR_UNSEGMENTED; 2544 sdu_len = 0; 2545 pdu_len = len; 2546 } else { 2547 sar = L2CAP_SAR_START; 2548 sdu_len = len; 2549 } 2550 2551 while (len > 0) { 2552 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len); 2553 2554 if (IS_ERR(skb)) { 2555 __skb_queue_purge(seg_queue); 2556 return PTR_ERR(skb); 2557 } 2558 2559 bt_cb(skb)->l2cap.sar = sar; 2560 __skb_queue_tail(seg_queue, skb); 2561 2562 len -= pdu_len; 2563 if (sdu_len) 2564 sdu_len = 0; 2565 2566 if (len <= pdu_len) { 2567 sar = L2CAP_SAR_END; 2568 pdu_len = len; 2569 } else { 2570 sar = L2CAP_SAR_CONTINUE; 2571 } 2572 } 2573 2574 return 0; 2575 } 2576 2577 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan, 2578 struct msghdr *msg, 2579 size_t len, u16 sdulen) 2580 { 2581 struct l2cap_conn *conn = chan->conn; 2582 struct sk_buff *skb; 2583 int err, count, hlen; 2584 struct l2cap_hdr *lh; 2585 2586 BT_DBG("chan %p len %zu", chan, len); 2587 2588 if (!conn) 2589 return ERR_PTR(-ENOTCONN); 2590 2591 hlen = L2CAP_HDR_SIZE; 2592 2593 if (sdulen) 2594 hlen += L2CAP_SDULEN_SIZE; 2595 2596 count = min_t(unsigned int, (conn->mtu - hlen), len); 2597 2598 skb = chan->ops->alloc_skb(chan, hlen, count, 2599 msg->msg_flags & MSG_DONTWAIT); 2600 if (IS_ERR(skb)) 2601 return skb; 2602 2603 /* Create L2CAP header */ 2604 lh = skb_put(skb, L2CAP_HDR_SIZE); 2605 lh->cid = cpu_to_le16(chan->dcid); 2606 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2607 2608 if (sdulen) 2609 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2610 2611 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2612 if (unlikely(err < 0)) { 2613 kfree_skb(skb); 2614 return ERR_PTR(err); 2615 } 2616 2617 return skb; 2618 } 2619 2620 static int l2cap_segment_le_sdu(struct l2cap_chan *chan, 2621 struct sk_buff_head *seg_queue, 2622 struct msghdr *msg, size_t len) 2623 { 2624 struct sk_buff *skb; 2625 size_t pdu_len; 2626 u16 sdu_len; 2627 2628 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2629 2630 sdu_len = len; 2631 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE; 2632 2633 while (len > 0) { 2634 if (len <= pdu_len) 2635 pdu_len = len; 2636 2637 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len); 2638 if (IS_ERR(skb)) { 2639 __skb_queue_purge(seg_queue); 2640 return PTR_ERR(skb); 2641 } 2642 2643 __skb_queue_tail(seg_queue, skb); 2644 2645 len -= pdu_len; 2646 2647 if (sdu_len) { 2648 sdu_len = 0; 2649 pdu_len += L2CAP_SDULEN_SIZE; 2650 } 2651 } 2652 2653 return 0; 2654 } 2655 2656 static void l2cap_le_flowctl_send(struct l2cap_chan *chan) 2657 { 2658 int sent = 0; 2659 2660 BT_DBG("chan %p", chan); 2661 2662 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) { 2663 l2cap_do_send(chan, skb_dequeue(&chan->tx_q)); 2664 chan->tx_credits--; 2665 sent++; 2666 } 2667 2668 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits, 2669 skb_queue_len(&chan->tx_q)); 2670 } 2671 2672 static void l2cap_tx_timestamp(struct sk_buff *skb, 2673 const struct sockcm_cookie *sockc, 2674 size_t len) 2675 { 2676 struct sock *sk = skb ? skb->sk : NULL; 2677 2678 if (sk && sk->sk_type == SOCK_STREAM) 2679 hci_setup_tx_timestamp(skb, len, sockc); 2680 else 2681 hci_setup_tx_timestamp(skb, 1, sockc); 2682 } 2683 2684 static void l2cap_tx_timestamp_seg(struct sk_buff_head *queue, 2685 const struct sockcm_cookie *sockc, 2686 size_t len) 2687 { 2688 struct sk_buff *skb = skb_peek(queue); 2689 struct sock *sk = skb ? skb->sk : NULL; 2690 2691 if (sk && sk->sk_type == SOCK_STREAM) 2692 l2cap_tx_timestamp(skb_peek_tail(queue), sockc, len); 2693 else 2694 l2cap_tx_timestamp(skb, sockc, len); 2695 } 2696 2697 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len, 2698 const struct sockcm_cookie *sockc) 2699 { 2700 struct sk_buff *skb; 2701 int err; 2702 struct sk_buff_head seg_queue; 2703 2704 if (test_bit(FLAG_DEL, &chan->flags)) 2705 return -ENOTCONN; 2706 2707 /* Connectionless channel */ 2708 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 2709 skb = l2cap_create_connless_pdu(chan, msg, len); 2710 if (IS_ERR(skb)) 2711 return PTR_ERR(skb); 2712 2713 l2cap_tx_timestamp(skb, sockc, len); 2714 2715 l2cap_do_send(chan, skb); 2716 return len; 2717 } 2718 2719 switch (chan->mode) { 2720 case L2CAP_MODE_LE_FLOWCTL: 2721 case L2CAP_MODE_EXT_FLOWCTL: 2722 /* Check outgoing MTU */ 2723 if (len > chan->omtu) 2724 return -EMSGSIZE; 2725 2726 __skb_queue_head_init(&seg_queue); 2727 2728 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len); 2729 2730 if (chan->state != BT_CONNECTED) { 2731 __skb_queue_purge(&seg_queue); 2732 err = -ENOTCONN; 2733 } 2734 2735 if (err) 2736 return err; 2737 2738 l2cap_tx_timestamp_seg(&seg_queue, sockc, len); 2739 2740 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q); 2741 2742 l2cap_le_flowctl_send(chan); 2743 2744 if (!chan->tx_credits) 2745 chan->ops->suspend(chan); 2746 2747 err = len; 2748 2749 break; 2750 2751 case L2CAP_MODE_BASIC: 2752 /* Check outgoing MTU */ 2753 if (len > chan->omtu) 2754 return -EMSGSIZE; 2755 2756 /* Create a basic PDU */ 2757 skb = l2cap_create_basic_pdu(chan, msg, len); 2758 if (IS_ERR(skb)) 2759 return PTR_ERR(skb); 2760 2761 l2cap_tx_timestamp(skb, sockc, len); 2762 2763 l2cap_do_send(chan, skb); 2764 err = len; 2765 break; 2766 2767 case L2CAP_MODE_ERTM: 2768 case L2CAP_MODE_STREAMING: 2769 /* Check outgoing MTU */ 2770 if (len > chan->omtu) { 2771 err = -EMSGSIZE; 2772 break; 2773 } 2774 2775 __skb_queue_head_init(&seg_queue); 2776 2777 /* Do segmentation before calling in to the state machine, 2778 * since it's possible to block while waiting for memory 2779 * allocation. 2780 */ 2781 err = l2cap_segment_sdu(chan, &seg_queue, msg, len); 2782 2783 if (err) 2784 break; 2785 2786 if (chan->mode == L2CAP_MODE_ERTM) { 2787 /* TODO: ERTM mode timestamping */ 2788 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST); 2789 } else { 2790 l2cap_tx_timestamp_seg(&seg_queue, sockc, len); 2791 l2cap_streaming_send(chan, &seg_queue); 2792 } 2793 2794 err = len; 2795 2796 /* If the skbs were not queued for sending, they'll still be in 2797 * seg_queue and need to be purged. 2798 */ 2799 __skb_queue_purge(&seg_queue); 2800 break; 2801 2802 default: 2803 BT_DBG("bad state %1.1x", chan->mode); 2804 err = -EBADFD; 2805 } 2806 2807 return err; 2808 } 2809 EXPORT_SYMBOL_GPL(l2cap_chan_send); 2810 2811 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq) 2812 { 2813 struct l2cap_ctrl control; 2814 u16 seq; 2815 2816 BT_DBG("chan %p, txseq %u", chan, txseq); 2817 2818 memset(&control, 0, sizeof(control)); 2819 control.sframe = 1; 2820 control.super = L2CAP_SUPER_SREJ; 2821 2822 for (seq = chan->expected_tx_seq; seq != txseq; 2823 seq = __next_seq(chan, seq)) { 2824 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) { 2825 control.reqseq = seq; 2826 l2cap_send_sframe(chan, &control); 2827 l2cap_seq_list_append(&chan->srej_list, seq); 2828 } 2829 } 2830 2831 chan->expected_tx_seq = __next_seq(chan, txseq); 2832 } 2833 2834 static void l2cap_send_srej_tail(struct l2cap_chan *chan) 2835 { 2836 struct l2cap_ctrl control; 2837 2838 BT_DBG("chan %p", chan); 2839 2840 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR) 2841 return; 2842 2843 memset(&control, 0, sizeof(control)); 2844 control.sframe = 1; 2845 control.super = L2CAP_SUPER_SREJ; 2846 control.reqseq = chan->srej_list.tail; 2847 l2cap_send_sframe(chan, &control); 2848 } 2849 2850 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq) 2851 { 2852 struct l2cap_ctrl control; 2853 u16 initial_head; 2854 u16 seq; 2855 2856 BT_DBG("chan %p, txseq %u", chan, txseq); 2857 2858 memset(&control, 0, sizeof(control)); 2859 control.sframe = 1; 2860 control.super = L2CAP_SUPER_SREJ; 2861 2862 /* Capture initial list head to allow only one pass through the list. */ 2863 initial_head = chan->srej_list.head; 2864 2865 do { 2866 seq = l2cap_seq_list_pop(&chan->srej_list); 2867 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR) 2868 break; 2869 2870 control.reqseq = seq; 2871 l2cap_send_sframe(chan, &control); 2872 l2cap_seq_list_append(&chan->srej_list, seq); 2873 } while (chan->srej_list.head != initial_head); 2874 } 2875 2876 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq) 2877 { 2878 struct sk_buff *acked_skb; 2879 u16 ackseq; 2880 2881 BT_DBG("chan %p, reqseq %u", chan, reqseq); 2882 2883 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq) 2884 return; 2885 2886 BT_DBG("expected_ack_seq %u, unacked_frames %u", 2887 chan->expected_ack_seq, chan->unacked_frames); 2888 2889 for (ackseq = chan->expected_ack_seq; ackseq != reqseq; 2890 ackseq = __next_seq(chan, ackseq)) { 2891 2892 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq); 2893 if (acked_skb) { 2894 skb_unlink(acked_skb, &chan->tx_q); 2895 kfree_skb(acked_skb); 2896 chan->unacked_frames--; 2897 } 2898 } 2899 2900 chan->expected_ack_seq = reqseq; 2901 2902 if (chan->unacked_frames == 0) 2903 __clear_retrans_timer(chan); 2904 2905 BT_DBG("unacked_frames %u", chan->unacked_frames); 2906 } 2907 2908 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan) 2909 { 2910 BT_DBG("chan %p", chan); 2911 2912 chan->expected_tx_seq = chan->buffer_seq; 2913 l2cap_seq_list_clear(&chan->srej_list); 2914 skb_queue_purge(&chan->srej_q); 2915 chan->rx_state = L2CAP_RX_STATE_RECV; 2916 } 2917 2918 static void l2cap_tx_state_xmit(struct l2cap_chan *chan, 2919 struct l2cap_ctrl *control, 2920 struct sk_buff_head *skbs, u8 event) 2921 { 2922 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2923 event); 2924 2925 switch (event) { 2926 case L2CAP_EV_DATA_REQUEST: 2927 if (chan->tx_send_head == NULL) 2928 chan->tx_send_head = skb_peek(skbs); 2929 2930 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2931 l2cap_ertm_send(chan); 2932 break; 2933 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2934 BT_DBG("Enter LOCAL_BUSY"); 2935 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2936 2937 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2938 /* The SREJ_SENT state must be aborted if we are to 2939 * enter the LOCAL_BUSY state. 2940 */ 2941 l2cap_abort_rx_srej_sent(chan); 2942 } 2943 2944 l2cap_send_ack(chan); 2945 2946 break; 2947 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2948 BT_DBG("Exit LOCAL_BUSY"); 2949 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2950 2951 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2952 struct l2cap_ctrl local_control; 2953 2954 memset(&local_control, 0, sizeof(local_control)); 2955 local_control.sframe = 1; 2956 local_control.super = L2CAP_SUPER_RR; 2957 local_control.poll = 1; 2958 local_control.reqseq = chan->buffer_seq; 2959 l2cap_send_sframe(chan, &local_control); 2960 2961 chan->retry_count = 1; 2962 __set_monitor_timer(chan); 2963 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2964 } 2965 break; 2966 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2967 l2cap_process_reqseq(chan, control->reqseq); 2968 break; 2969 case L2CAP_EV_EXPLICIT_POLL: 2970 l2cap_send_rr_or_rnr(chan, 1); 2971 chan->retry_count = 1; 2972 __set_monitor_timer(chan); 2973 __clear_ack_timer(chan); 2974 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2975 break; 2976 case L2CAP_EV_RETRANS_TO: 2977 l2cap_send_rr_or_rnr(chan, 1); 2978 chan->retry_count = 1; 2979 __set_monitor_timer(chan); 2980 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2981 break; 2982 case L2CAP_EV_RECV_FBIT: 2983 /* Nothing to process */ 2984 break; 2985 default: 2986 break; 2987 } 2988 } 2989 2990 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan, 2991 struct l2cap_ctrl *control, 2992 struct sk_buff_head *skbs, u8 event) 2993 { 2994 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2995 event); 2996 2997 switch (event) { 2998 case L2CAP_EV_DATA_REQUEST: 2999 if (chan->tx_send_head == NULL) 3000 chan->tx_send_head = skb_peek(skbs); 3001 /* Queue data, but don't send. */ 3002 skb_queue_splice_tail_init(skbs, &chan->tx_q); 3003 break; 3004 case L2CAP_EV_LOCAL_BUSY_DETECTED: 3005 BT_DBG("Enter LOCAL_BUSY"); 3006 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 3007 3008 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 3009 /* The SREJ_SENT state must be aborted if we are to 3010 * enter the LOCAL_BUSY state. 3011 */ 3012 l2cap_abort_rx_srej_sent(chan); 3013 } 3014 3015 l2cap_send_ack(chan); 3016 3017 break; 3018 case L2CAP_EV_LOCAL_BUSY_CLEAR: 3019 BT_DBG("Exit LOCAL_BUSY"); 3020 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 3021 3022 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 3023 struct l2cap_ctrl local_control; 3024 memset(&local_control, 0, sizeof(local_control)); 3025 local_control.sframe = 1; 3026 local_control.super = L2CAP_SUPER_RR; 3027 local_control.poll = 1; 3028 local_control.reqseq = chan->buffer_seq; 3029 l2cap_send_sframe(chan, &local_control); 3030 3031 chan->retry_count = 1; 3032 __set_monitor_timer(chan); 3033 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 3034 } 3035 break; 3036 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 3037 l2cap_process_reqseq(chan, control->reqseq); 3038 fallthrough; 3039 3040 case L2CAP_EV_RECV_FBIT: 3041 if (control && control->final) { 3042 __clear_monitor_timer(chan); 3043 if (chan->unacked_frames > 0) 3044 __set_retrans_timer(chan); 3045 chan->retry_count = 0; 3046 chan->tx_state = L2CAP_TX_STATE_XMIT; 3047 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state); 3048 } 3049 break; 3050 case L2CAP_EV_EXPLICIT_POLL: 3051 /* Ignore */ 3052 break; 3053 case L2CAP_EV_MONITOR_TO: 3054 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) { 3055 l2cap_send_rr_or_rnr(chan, 1); 3056 __set_monitor_timer(chan); 3057 chan->retry_count++; 3058 } else { 3059 l2cap_send_disconn_req(chan, ECONNABORTED); 3060 } 3061 break; 3062 default: 3063 break; 3064 } 3065 } 3066 3067 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 3068 struct sk_buff_head *skbs, u8 event) 3069 { 3070 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d", 3071 chan, control, skbs, event, chan->tx_state); 3072 3073 switch (chan->tx_state) { 3074 case L2CAP_TX_STATE_XMIT: 3075 l2cap_tx_state_xmit(chan, control, skbs, event); 3076 break; 3077 case L2CAP_TX_STATE_WAIT_F: 3078 l2cap_tx_state_wait_f(chan, control, skbs, event); 3079 break; 3080 default: 3081 /* Ignore event */ 3082 break; 3083 } 3084 } 3085 3086 static void l2cap_pass_to_tx(struct l2cap_chan *chan, 3087 struct l2cap_ctrl *control) 3088 { 3089 BT_DBG("chan %p, control %p", chan, control); 3090 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT); 3091 } 3092 3093 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan, 3094 struct l2cap_ctrl *control) 3095 { 3096 BT_DBG("chan %p, control %p", chan, control); 3097 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT); 3098 } 3099 3100 /* Copy frame to all raw sockets on that connection */ 3101 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) 3102 __must_hold(&conn->lock) 3103 { 3104 struct sk_buff *nskb; 3105 struct l2cap_chan *chan; 3106 3107 BT_DBG("conn %p", conn); 3108 3109 list_for_each_entry(chan, &conn->chan_l, list) { 3110 if (chan->chan_type != L2CAP_CHAN_RAW) 3111 continue; 3112 3113 /* Don't send frame to the channel it came from */ 3114 if (bt_cb(skb)->l2cap.chan == chan) 3115 continue; 3116 3117 nskb = skb_clone(skb, GFP_KERNEL); 3118 if (!nskb) 3119 continue; 3120 if (chan->ops->recv(chan, nskb)) 3121 kfree_skb(nskb); 3122 } 3123 } 3124 3125 /* ---- L2CAP signalling commands ---- */ 3126 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code, 3127 u8 ident, u16 dlen, void *data) 3128 { 3129 struct sk_buff *skb, **frag; 3130 struct l2cap_cmd_hdr *cmd; 3131 struct l2cap_hdr *lh; 3132 int len, count; 3133 3134 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u", 3135 conn, code, ident, dlen); 3136 3137 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) 3138 return NULL; 3139 3140 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; 3141 count = min_t(unsigned int, conn->mtu, len); 3142 3143 skb = bt_skb_alloc(count, GFP_KERNEL); 3144 if (!skb) 3145 return NULL; 3146 3147 lh = skb_put(skb, L2CAP_HDR_SIZE); 3148 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 3149 3150 if (conn->hcon->type == LE_LINK) 3151 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING); 3152 else 3153 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING); 3154 3155 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE); 3156 cmd->code = code; 3157 cmd->ident = ident; 3158 cmd->len = cpu_to_le16(dlen); 3159 3160 if (dlen) { 3161 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE; 3162 skb_put_data(skb, data, count); 3163 data += count; 3164 } 3165 3166 len -= skb->len; 3167 3168 /* Continuation fragments (no L2CAP header) */ 3169 frag = &skb_shinfo(skb)->frag_list; 3170 while (len) { 3171 count = min_t(unsigned int, conn->mtu, len); 3172 3173 *frag = bt_skb_alloc(count, GFP_KERNEL); 3174 if (!*frag) 3175 goto fail; 3176 3177 skb_put_data(*frag, data, count); 3178 3179 len -= count; 3180 data += count; 3181 3182 frag = &(*frag)->next; 3183 } 3184 3185 return skb; 3186 3187 fail: 3188 kfree_skb(skb); 3189 return NULL; 3190 } 3191 3192 static inline int l2cap_get_conf_opt(void **ptr, void *end, int *type, 3193 int *olen, unsigned long *val) 3194 { 3195 struct l2cap_conf_opt *opt = *ptr; 3196 int len; 3197 3198 /* opt->len is attacker-controlled. Validate that the full option 3199 * (header + value) actually fits in the buffer before touching 3200 * opt->val, otherwise the switch below reads past the end of the 3201 * caller's buffer. 3202 */ 3203 if (end - *ptr < L2CAP_CONF_OPT_SIZE) 3204 return -EINVAL; 3205 3206 len = L2CAP_CONF_OPT_SIZE + opt->len; 3207 if (end - *ptr < len) 3208 return -EINVAL; 3209 3210 *ptr += len; 3211 3212 *type = opt->type; 3213 *olen = opt->len; 3214 3215 switch (opt->len) { 3216 case 1: 3217 *val = *((u8 *) opt->val); 3218 break; 3219 3220 case 2: 3221 *val = get_unaligned_le16(opt->val); 3222 break; 3223 3224 case 4: 3225 *val = get_unaligned_le32(opt->val); 3226 break; 3227 3228 default: 3229 *val = (unsigned long) opt->val; 3230 break; 3231 } 3232 3233 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val); 3234 return len; 3235 } 3236 3237 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) 3238 { 3239 struct l2cap_conf_opt *opt = *ptr; 3240 3241 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); 3242 3243 if (size < L2CAP_CONF_OPT_SIZE + len) 3244 return; 3245 3246 opt->type = type; 3247 opt->len = len; 3248 3249 switch (len) { 3250 case 1: 3251 *((u8 *) opt->val) = val; 3252 break; 3253 3254 case 2: 3255 put_unaligned_le16(val, opt->val); 3256 break; 3257 3258 case 4: 3259 put_unaligned_le32(val, opt->val); 3260 break; 3261 3262 default: 3263 memcpy(opt->val, (void *) val, len); 3264 break; 3265 } 3266 3267 *ptr += L2CAP_CONF_OPT_SIZE + len; 3268 } 3269 3270 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) 3271 { 3272 struct l2cap_conf_efs efs; 3273 3274 switch (chan->mode) { 3275 case L2CAP_MODE_ERTM: 3276 efs.id = chan->local_id; 3277 efs.stype = chan->local_stype; 3278 efs.msdu = cpu_to_le16(chan->local_msdu); 3279 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3280 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT); 3281 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO); 3282 break; 3283 3284 case L2CAP_MODE_STREAMING: 3285 efs.id = 1; 3286 efs.stype = L2CAP_SERV_BESTEFFORT; 3287 efs.msdu = cpu_to_le16(chan->local_msdu); 3288 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3289 efs.acc_lat = 0; 3290 efs.flush_to = 0; 3291 break; 3292 3293 default: 3294 return; 3295 } 3296 3297 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), 3298 (unsigned long) &efs, size); 3299 } 3300 3301 static void l2cap_ack_timeout(struct work_struct *work) 3302 { 3303 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 3304 ack_timer.work); 3305 u16 frames_to_ack; 3306 3307 BT_DBG("chan %p", chan); 3308 3309 l2cap_chan_lock(chan); 3310 3311 if (test_bit(FLAG_DEL, &chan->flags)) 3312 goto unlock; 3313 3314 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 3315 chan->last_acked_seq); 3316 3317 if (frames_to_ack) 3318 l2cap_send_rr_or_rnr(chan, 0); 3319 3320 unlock: 3321 l2cap_chan_unlock(chan); 3322 l2cap_chan_put(chan); 3323 } 3324 3325 int l2cap_ertm_init(struct l2cap_chan *chan) 3326 { 3327 int err; 3328 3329 chan->next_tx_seq = 0; 3330 chan->expected_tx_seq = 0; 3331 chan->expected_ack_seq = 0; 3332 chan->unacked_frames = 0; 3333 chan->buffer_seq = 0; 3334 chan->frames_sent = 0; 3335 chan->last_acked_seq = 0; 3336 chan->sdu = NULL; 3337 chan->sdu_last_frag = NULL; 3338 chan->sdu_len = 0; 3339 3340 skb_queue_head_init(&chan->tx_q); 3341 3342 if (chan->mode != L2CAP_MODE_ERTM) 3343 return 0; 3344 3345 chan->rx_state = L2CAP_RX_STATE_RECV; 3346 chan->tx_state = L2CAP_TX_STATE_XMIT; 3347 3348 skb_queue_head_init(&chan->srej_q); 3349 3350 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win); 3351 if (err < 0) 3352 return err; 3353 3354 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win); 3355 if (err < 0) 3356 l2cap_seq_list_free(&chan->srej_list); 3357 3358 return err; 3359 } 3360 3361 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) 3362 { 3363 switch (mode) { 3364 case L2CAP_MODE_STREAMING: 3365 case L2CAP_MODE_ERTM: 3366 if (l2cap_mode_supported(mode, remote_feat_mask)) 3367 return mode; 3368 fallthrough; 3369 default: 3370 return L2CAP_MODE_BASIC; 3371 } 3372 } 3373 3374 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn) 3375 { 3376 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW); 3377 } 3378 3379 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn) 3380 { 3381 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW); 3382 } 3383 3384 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan, 3385 struct l2cap_conf_rfc *rfc) 3386 { 3387 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); 3388 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); 3389 } 3390 3391 static inline void l2cap_txwin_setup(struct l2cap_chan *chan) 3392 { 3393 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW && 3394 __l2cap_ews_supported(chan->conn)) { 3395 /* use extended control field */ 3396 set_bit(FLAG_EXT_CTRL, &chan->flags); 3397 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; 3398 } else { 3399 chan->tx_win = min_t(u16, chan->tx_win, 3400 L2CAP_DEFAULT_TX_WINDOW); 3401 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 3402 } 3403 chan->ack_win = chan->tx_win; 3404 } 3405 3406 static void l2cap_mtu_auto(struct l2cap_chan *chan) 3407 { 3408 struct hci_conn *conn = chan->conn->hcon; 3409 3410 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3411 3412 /* The 2-DH1 packet has between 2 and 56 information bytes 3413 * (including the 2-byte payload header) 3414 */ 3415 if (!(conn->pkt_type & HCI_2DH1)) 3416 chan->imtu = 54; 3417 3418 /* The 3-DH1 packet has between 2 and 85 information bytes 3419 * (including the 2-byte payload header) 3420 */ 3421 if (!(conn->pkt_type & HCI_3DH1)) 3422 chan->imtu = 83; 3423 3424 /* The 2-DH3 packet has between 2 and 369 information bytes 3425 * (including the 2-byte payload header) 3426 */ 3427 if (!(conn->pkt_type & HCI_2DH3)) 3428 chan->imtu = 367; 3429 3430 /* The 3-DH3 packet has between 2 and 554 information bytes 3431 * (including the 2-byte payload header) 3432 */ 3433 if (!(conn->pkt_type & HCI_3DH3)) 3434 chan->imtu = 552; 3435 3436 /* The 2-DH5 packet has between 2 and 681 information bytes 3437 * (including the 2-byte payload header) 3438 */ 3439 if (!(conn->pkt_type & HCI_2DH5)) 3440 chan->imtu = 679; 3441 3442 /* The 3-DH5 packet has between 2 and 1023 information bytes 3443 * (including the 2-byte payload header) 3444 */ 3445 if (!(conn->pkt_type & HCI_3DH5)) 3446 chan->imtu = 1021; 3447 } 3448 3449 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3450 { 3451 struct l2cap_conf_req *req = data; 3452 struct l2cap_conf_rfc rfc = { .mode = chan->mode }; 3453 void *ptr = req->data; 3454 void *endptr = data + data_size; 3455 u16 size; 3456 3457 BT_DBG("chan %p", chan); 3458 3459 if (chan->num_conf_req || chan->num_conf_rsp) 3460 goto done; 3461 3462 switch (chan->mode) { 3463 case L2CAP_MODE_STREAMING: 3464 case L2CAP_MODE_ERTM: 3465 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) 3466 break; 3467 3468 if (__l2cap_efs_supported(chan->conn)) 3469 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3470 3471 fallthrough; 3472 default: 3473 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask); 3474 break; 3475 } 3476 3477 done: 3478 if (chan->imtu != L2CAP_DEFAULT_MTU) { 3479 if (!chan->imtu) 3480 l2cap_mtu_auto(chan); 3481 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3482 endptr - ptr); 3483 } 3484 3485 switch (chan->mode) { 3486 case L2CAP_MODE_BASIC: 3487 if (disable_ertm) 3488 break; 3489 3490 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) && 3491 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING)) 3492 break; 3493 3494 rfc.mode = L2CAP_MODE_BASIC; 3495 rfc.txwin_size = 0; 3496 rfc.max_transmit = 0; 3497 rfc.retrans_timeout = 0; 3498 rfc.monitor_timeout = 0; 3499 rfc.max_pdu_size = 0; 3500 3501 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3502 (unsigned long) &rfc, endptr - ptr); 3503 break; 3504 3505 case L2CAP_MODE_ERTM: 3506 rfc.mode = L2CAP_MODE_ERTM; 3507 rfc.max_transmit = chan->max_tx; 3508 3509 __l2cap_set_ertm_timeouts(chan, &rfc); 3510 3511 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3512 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3513 L2CAP_FCS_SIZE); 3514 rfc.max_pdu_size = cpu_to_le16(size); 3515 3516 l2cap_txwin_setup(chan); 3517 3518 rfc.txwin_size = min_t(u16, chan->tx_win, 3519 L2CAP_DEFAULT_TX_WINDOW); 3520 3521 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3522 (unsigned long) &rfc, endptr - ptr); 3523 3524 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3525 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3526 3527 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 3528 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3529 chan->tx_win, endptr - ptr); 3530 3531 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3532 if (chan->fcs == L2CAP_FCS_NONE || 3533 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3534 chan->fcs = L2CAP_FCS_NONE; 3535 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3536 chan->fcs, endptr - ptr); 3537 } 3538 break; 3539 3540 case L2CAP_MODE_STREAMING: 3541 l2cap_txwin_setup(chan); 3542 rfc.mode = L2CAP_MODE_STREAMING; 3543 rfc.txwin_size = 0; 3544 rfc.max_transmit = 0; 3545 rfc.retrans_timeout = 0; 3546 rfc.monitor_timeout = 0; 3547 3548 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3549 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3550 L2CAP_FCS_SIZE); 3551 rfc.max_pdu_size = cpu_to_le16(size); 3552 3553 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3554 (unsigned long) &rfc, endptr - ptr); 3555 3556 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3557 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3558 3559 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3560 if (chan->fcs == L2CAP_FCS_NONE || 3561 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3562 chan->fcs = L2CAP_FCS_NONE; 3563 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3564 chan->fcs, endptr - ptr); 3565 } 3566 break; 3567 } 3568 3569 req->dcid = cpu_to_le16(chan->dcid); 3570 req->flags = cpu_to_le16(0); 3571 3572 return ptr - data; 3573 } 3574 3575 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3576 { 3577 struct l2cap_conf_rsp *rsp = data; 3578 void *ptr = rsp->data; 3579 void *endptr = data + data_size; 3580 void *req = chan->conf_req; 3581 void *req_end = req + chan->conf_len; 3582 int len = chan->conf_len; 3583 int type, hint, olen; 3584 unsigned long val; 3585 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3586 struct l2cap_conf_efs efs; 3587 u8 remote_efs = 0; 3588 u16 mtu = 0; 3589 u16 result = L2CAP_CONF_SUCCESS; 3590 u16 size; 3591 3592 BT_DBG("chan %p", chan); 3593 3594 while (len >= L2CAP_CONF_OPT_SIZE) { 3595 int ret = l2cap_get_conf_opt(&req, req_end, &type, &olen, &val); 3596 3597 if (ret < 0) 3598 break; 3599 len -= ret; 3600 3601 hint = type & L2CAP_CONF_HINT; 3602 type &= L2CAP_CONF_MASK; 3603 3604 switch (type) { 3605 case L2CAP_CONF_MTU: 3606 if (olen != 2) 3607 break; 3608 mtu = val; 3609 break; 3610 3611 case L2CAP_CONF_FLUSH_TO: 3612 if (olen != 2) 3613 break; 3614 chan->flush_to = val; 3615 break; 3616 3617 case L2CAP_CONF_QOS: 3618 break; 3619 3620 case L2CAP_CONF_RFC: 3621 if (olen != sizeof(rfc)) 3622 break; 3623 memcpy(&rfc, (void *) val, olen); 3624 break; 3625 3626 case L2CAP_CONF_FCS: 3627 if (olen != 1) 3628 break; 3629 if (val == L2CAP_FCS_NONE) 3630 set_bit(CONF_RECV_NO_FCS, &chan->conf_state); 3631 break; 3632 3633 case L2CAP_CONF_EFS: 3634 if (olen != sizeof(efs)) 3635 break; 3636 remote_efs = 1; 3637 memcpy(&efs, (void *) val, olen); 3638 break; 3639 3640 case L2CAP_CONF_EWS: 3641 if (olen != 2) 3642 break; 3643 return -ECONNREFUSED; 3644 3645 default: 3646 if (hint) 3647 break; 3648 result = L2CAP_CONF_UNKNOWN; 3649 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr); 3650 break; 3651 } 3652 } 3653 3654 if (chan->num_conf_rsp || chan->num_conf_req > 1) 3655 goto done; 3656 3657 switch (chan->mode) { 3658 case L2CAP_MODE_STREAMING: 3659 case L2CAP_MODE_ERTM: 3660 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) { 3661 chan->mode = l2cap_select_mode(rfc.mode, 3662 chan->conn->feat_mask); 3663 break; 3664 } 3665 3666 if (remote_efs) { 3667 if (__l2cap_efs_supported(chan->conn)) 3668 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3669 else 3670 return -ECONNREFUSED; 3671 } 3672 3673 if (chan->mode != rfc.mode) 3674 return -ECONNREFUSED; 3675 3676 break; 3677 } 3678 3679 done: 3680 if (chan->mode != rfc.mode) { 3681 result = L2CAP_CONF_UNACCEPT; 3682 rfc.mode = chan->mode; 3683 3684 if (chan->num_conf_rsp == 1) 3685 return -ECONNREFUSED; 3686 3687 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3688 (unsigned long) &rfc, endptr - ptr); 3689 } 3690 3691 if (result == L2CAP_CONF_SUCCESS) { 3692 /* Configure output options and let the other side know 3693 * which ones we don't like. */ 3694 3695 /* If MTU is not provided in configure request, try adjusting it 3696 * to the current output MTU if it has been set 3697 * 3698 * Bluetooth Core 6.1, Vol 3, Part A, Section 4.5 3699 * 3700 * Each configuration parameter value (if any is present) in an 3701 * L2CAP_CONFIGURATION_RSP packet reflects an ‘adjustment’ to a 3702 * configuration parameter value that has been sent (or, in case 3703 * of default values, implied) in the corresponding 3704 * L2CAP_CONFIGURATION_REQ packet. 3705 */ 3706 if (!mtu) { 3707 /* Only adjust for ERTM channels as for older modes the 3708 * remote stack may not be able to detect that the 3709 * adjustment causing it to silently drop packets. 3710 */ 3711 if (chan->mode == L2CAP_MODE_ERTM && 3712 chan->omtu && chan->omtu != L2CAP_DEFAULT_MTU) 3713 mtu = chan->omtu; 3714 else 3715 mtu = L2CAP_DEFAULT_MTU; 3716 } 3717 3718 if (mtu < L2CAP_DEFAULT_MIN_MTU) 3719 result = L2CAP_CONF_UNACCEPT; 3720 else { 3721 chan->omtu = mtu; 3722 set_bit(CONF_MTU_DONE, &chan->conf_state); 3723 } 3724 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); 3725 3726 if (remote_efs) { 3727 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3728 efs.stype != L2CAP_SERV_NOTRAFIC && 3729 efs.stype != chan->local_stype) { 3730 3731 result = L2CAP_CONF_UNACCEPT; 3732 3733 if (chan->num_conf_req >= 1) 3734 return -ECONNREFUSED; 3735 3736 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3737 sizeof(efs), 3738 (unsigned long) &efs, endptr - ptr); 3739 } else { 3740 /* Send PENDING Conf Rsp */ 3741 result = L2CAP_CONF_PENDING; 3742 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 3743 } 3744 } 3745 3746 switch (rfc.mode) { 3747 case L2CAP_MODE_BASIC: 3748 chan->fcs = L2CAP_FCS_NONE; 3749 set_bit(CONF_MODE_DONE, &chan->conf_state); 3750 break; 3751 3752 case L2CAP_MODE_ERTM: 3753 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3754 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3755 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3756 rfc.max_pdu_size = cpu_to_le16(size); 3757 3758 /* The TxWindow must be within 1 to 63, otherwise 3759 * propose the default one and keep the parameters of 3760 * an earlier request. This overrides a PENDING result 3761 * from the EFS check above, so the request is no 3762 * longer pending, nor done if an earlier one was. 3763 */ 3764 if (!rfc.txwin_size || 3765 rfc.txwin_size > L2CAP_DEFAULT_TX_WINDOW) { 3766 result = L2CAP_CONF_UNACCEPT; 3767 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 3768 clear_bit(CONF_OUTPUT_DONE, &chan->conf_state); 3769 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW; 3770 remote_efs = 0; 3771 } else { 3772 chan->remote_tx_win = rfc.txwin_size; 3773 chan->remote_max_tx = rfc.max_transmit; 3774 chan->remote_mps = size; 3775 } 3776 3777 __l2cap_set_ertm_timeouts(chan, &rfc); 3778 3779 set_bit(CONF_MODE_DONE, &chan->conf_state); 3780 3781 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 3782 sizeof(rfc), (unsigned long) &rfc, endptr - ptr); 3783 3784 if (remote_efs && 3785 test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3786 chan->remote_id = efs.id; 3787 chan->remote_stype = efs.stype; 3788 chan->remote_msdu = le16_to_cpu(efs.msdu); 3789 chan->remote_flush_to = 3790 le32_to_cpu(efs.flush_to); 3791 chan->remote_acc_lat = 3792 le32_to_cpu(efs.acc_lat); 3793 chan->remote_sdu_itime = 3794 le32_to_cpu(efs.sdu_itime); 3795 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3796 sizeof(efs), 3797 (unsigned long) &efs, endptr - ptr); 3798 } 3799 break; 3800 3801 case L2CAP_MODE_STREAMING: 3802 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3803 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3804 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3805 rfc.max_pdu_size = cpu_to_le16(size); 3806 chan->remote_mps = size; 3807 3808 set_bit(CONF_MODE_DONE, &chan->conf_state); 3809 3810 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3811 (unsigned long) &rfc, endptr - ptr); 3812 3813 break; 3814 3815 default: 3816 result = L2CAP_CONF_UNACCEPT; 3817 3818 memset(&rfc, 0, sizeof(rfc)); 3819 rfc.mode = chan->mode; 3820 } 3821 3822 if (result == L2CAP_CONF_SUCCESS) 3823 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 3824 } 3825 rsp->scid = cpu_to_le16(chan->dcid); 3826 rsp->result = cpu_to_le16(result); 3827 rsp->flags = cpu_to_le16(0); 3828 3829 return ptr - data; 3830 } 3831 3832 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, 3833 void *data, size_t size, u16 *result) 3834 { 3835 struct l2cap_conf_req *req = data; 3836 void *ptr = req->data; 3837 void *endptr = data + size; 3838 void *rsp_end = rsp + len; 3839 int type, olen; 3840 unsigned long val; 3841 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3842 struct l2cap_conf_efs efs; 3843 3844 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); 3845 3846 while (len >= L2CAP_CONF_OPT_SIZE) { 3847 int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val); 3848 3849 if (ret < 0) 3850 break; 3851 len -= ret; 3852 3853 switch (type) { 3854 case L2CAP_CONF_MTU: 3855 if (olen != 2) 3856 break; 3857 if (val < L2CAP_DEFAULT_MIN_MTU) { 3858 *result = L2CAP_CONF_UNACCEPT; 3859 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3860 } else 3861 chan->imtu = val; 3862 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3863 endptr - ptr); 3864 break; 3865 3866 case L2CAP_CONF_FLUSH_TO: 3867 if (olen != 2) 3868 break; 3869 chan->flush_to = val; 3870 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, 3871 chan->flush_to, endptr - ptr); 3872 break; 3873 3874 case L2CAP_CONF_RFC: 3875 if (olen != sizeof(rfc)) 3876 break; 3877 memcpy(&rfc, (void *)val, olen); 3878 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && 3879 rfc.mode != chan->mode) 3880 return -ECONNREFUSED; 3881 chan->fcs = 0; 3882 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3883 (unsigned long) &rfc, endptr - ptr); 3884 break; 3885 3886 case L2CAP_CONF_EWS: 3887 if (olen != 2) 3888 break; 3889 chan->ack_win = min_t(u16, val, chan->ack_win); 3890 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3891 chan->tx_win, endptr - ptr); 3892 break; 3893 3894 case L2CAP_CONF_EFS: 3895 if (olen != sizeof(efs)) 3896 break; 3897 memcpy(&efs, (void *)val, olen); 3898 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3899 efs.stype != L2CAP_SERV_NOTRAFIC && 3900 efs.stype != chan->local_stype) 3901 return -ECONNREFUSED; 3902 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), 3903 (unsigned long) &efs, endptr - ptr); 3904 break; 3905 3906 case L2CAP_CONF_FCS: 3907 if (olen != 1) 3908 break; 3909 if (*result == L2CAP_CONF_PENDING) 3910 if (val == L2CAP_FCS_NONE) 3911 set_bit(CONF_RECV_NO_FCS, 3912 &chan->conf_state); 3913 break; 3914 } 3915 } 3916 3917 /* A connected channel cannot change its mode, as the new mode would 3918 * not be initialized. 3919 */ 3920 if (chan->mode != rfc.mode && 3921 (chan->mode == L2CAP_MODE_BASIC || chan->state == BT_CONNECTED)) 3922 return -ECONNREFUSED; 3923 3924 chan->mode = rfc.mode; 3925 3926 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) { 3927 switch (rfc.mode) { 3928 case L2CAP_MODE_ERTM: 3929 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 3930 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 3931 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3932 if (!test_bit(FLAG_EXT_CTRL, &chan->flags)) 3933 chan->ack_win = min_t(u16, chan->ack_win, 3934 rfc.txwin_size); 3935 3936 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3937 chan->local_msdu = le16_to_cpu(efs.msdu); 3938 chan->local_sdu_itime = 3939 le32_to_cpu(efs.sdu_itime); 3940 chan->local_acc_lat = le32_to_cpu(efs.acc_lat); 3941 chan->local_flush_to = 3942 le32_to_cpu(efs.flush_to); 3943 } 3944 break; 3945 3946 case L2CAP_MODE_STREAMING: 3947 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3948 } 3949 } 3950 3951 req->dcid = cpu_to_le16(chan->dcid); 3952 req->flags = cpu_to_le16(0); 3953 3954 return ptr - data; 3955 } 3956 3957 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, 3958 u16 result, u16 flags) 3959 { 3960 struct l2cap_conf_rsp *rsp = data; 3961 void *ptr = rsp->data; 3962 3963 BT_DBG("chan %p", chan); 3964 3965 rsp->scid = cpu_to_le16(chan->dcid); 3966 rsp->result = cpu_to_le16(result); 3967 rsp->flags = cpu_to_le16(flags); 3968 3969 return ptr - data; 3970 } 3971 3972 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) 3973 { 3974 struct l2cap_le_conn_rsp rsp; 3975 struct l2cap_conn *conn = chan->conn; 3976 3977 BT_DBG("chan %p", chan); 3978 3979 rsp.dcid = cpu_to_le16(chan->scid); 3980 rsp.mtu = cpu_to_le16(chan->imtu); 3981 rsp.mps = cpu_to_le16(chan->mps); 3982 rsp.credits = cpu_to_le16(chan->rx_credits); 3983 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3984 3985 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 3986 &rsp); 3987 } 3988 3989 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data) 3990 { 3991 int *result = data; 3992 3993 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 3994 return; 3995 3996 switch (chan->state) { 3997 case BT_CONNECT2: 3998 /* If channel still pending accept add to result */ 3999 (*result)++; 4000 return; 4001 case BT_CONNECTED: 4002 return; 4003 default: 4004 /* If not connected or pending accept it has been refused */ 4005 *result = -ECONNREFUSED; 4006 return; 4007 } 4008 } 4009 4010 struct l2cap_ecred_rsp_data { 4011 struct l2cap_chan *locked_chan; 4012 struct { 4013 struct l2cap_ecred_conn_rsp_hdr rsp; 4014 __le16 scid[L2CAP_ECRED_MAX_CID]; 4015 } __packed pdu; 4016 int count; 4017 }; 4018 4019 /* Lock @chan if it is not @locked_chan, and has same or lower nesting level. 4020 * 4021 * They must have the same chan->conn, and conn->lock must be held. 4022 * 4023 * Caller must ensure @chan has lock nesting level <= that of @locked_chan, as 4024 * nested locking of l2cap_chan of different levels is allowed also without 4025 * holding conn->lock. 4026 * 4027 * See l2cap.h for the global l2cap_chan locking rules. 4028 */ 4029 static bool l2cap_chan_try_sibling_lock(struct l2cap_chan *chan, 4030 struct l2cap_chan *locked_chan) 4031 __must_hold(&locked_chan->lock) 4032 __must_hold(&locked_chan->conn->lock) 4033 __cond_acquires(true, &chan->lock) 4034 { 4035 if (chan == locked_chan) 4036 return false; 4037 4038 if (WARN_ON_ONCE(locked_chan->conn != chan->conn)) 4039 return false; 4040 4041 if (WARN_ON_ONCE(atomic_read(&locked_chan->nesting) 4042 < atomic_read(&chan->nesting))) 4043 return false; 4044 4045 mutex_lock_nest_lock(&chan->lock, &locked_chan->conn->lock); 4046 return true; 4047 } 4048 4049 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data) 4050 { 4051 struct l2cap_ecred_rsp_data *rsp = data; 4052 struct l2cap_ecred_conn_rsp *rsp_flex = 4053 container_of(&rsp->pdu.rsp, struct l2cap_ecred_conn_rsp, hdr); 4054 bool locked; 4055 4056 if (chan->mode != L2CAP_MODE_EXT_FLOWCTL) 4057 return; 4058 4059 /* Check if channel for outgoing connection or if it wasn't deferred 4060 * since in those cases it must be skipped. 4061 */ 4062 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags) || 4063 !test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 4064 return; 4065 4066 lockdep_assert_held(&rsp->locked_chan->lock); 4067 lockdep_assert_held(&rsp->locked_chan->conn->lock); 4068 4069 l2cap_chan_hold(chan); 4070 4071 locked = l2cap_chan_try_sibling_lock(chan, rsp->locked_chan); 4072 4073 /* Cannot occur: PARENT channels do not appear in chan_l, and SMP 4074 * channels never have FLAG_DEFER_SETUP. 4075 */ 4076 if (context_unsafe(!locked && chan != rsp->locked_chan)) 4077 goto done; 4078 4079 lockdep_assert_held(&chan->lock); 4080 lockdep_assert_held(&chan->conn->lock); 4081 4082 /* Reset ident so only one response is sent */ 4083 chan->ident = 0; 4084 4085 /* Unreachable, check in l2cap_ecred_conn_req. If reached, drop rest */ 4086 if (WARN_ON_ONCE(rsp->count >= ARRAY_SIZE(rsp->pdu.scid))) 4087 rsp->pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_NO_MEM); 4088 4089 /* Include all channels pending with the same ident */ 4090 if (!rsp->pdu.rsp.result) 4091 rsp_flex->dcid[rsp->count++] = cpu_to_le16(chan->scid); 4092 else 4093 l2cap_chan_del(chan, ECONNRESET); 4094 4095 done: 4096 if (locked) 4097 l2cap_chan_unlock(chan); 4098 4099 l2cap_chan_put(chan); 4100 } 4101 4102 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) 4103 { 4104 struct l2cap_conn *conn = chan->conn; 4105 struct l2cap_ecred_rsp_data data; 4106 u16 id = chan->ident; 4107 int result = 0; 4108 4109 if (!id) 4110 return; 4111 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags)) 4112 return; 4113 4114 BT_DBG("chan %p id %d", chan, id); 4115 4116 memset(&data, 0, sizeof(data)); 4117 4118 data.locked_chan = chan; 4119 4120 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu); 4121 data.pdu.rsp.mps = cpu_to_le16(chan->mps); 4122 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits); 4123 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 4124 4125 /* Verify that all channels are ready */ 4126 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result); 4127 4128 if (result > 0) 4129 return; 4130 4131 if (result < 0) 4132 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION); 4133 4134 /* Build response */ 4135 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data); 4136 4137 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP, 4138 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)), 4139 &data.pdu); 4140 } 4141 4142 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) 4143 { 4144 struct l2cap_conn_rsp rsp; 4145 struct l2cap_conn *conn = chan->conn; 4146 u8 buf[128]; 4147 u8 rsp_code; 4148 4149 rsp.scid = cpu_to_le16(chan->dcid); 4150 rsp.dcid = cpu_to_le16(chan->scid); 4151 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 4152 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 4153 rsp_code = L2CAP_CONN_RSP; 4154 4155 BT_DBG("chan %p rsp_code %u", chan, rsp_code); 4156 4157 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp); 4158 4159 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 4160 return; 4161 4162 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4163 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4164 chan->num_conf_req++; 4165 } 4166 4167 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) 4168 { 4169 int type, olen; 4170 unsigned long val; 4171 void *rsp_end = rsp + len; 4172 /* Use sane default values in case a misbehaving remote device 4173 * did not send an RFC or extended window size option. 4174 */ 4175 u16 txwin_ext = chan->ack_win; 4176 struct l2cap_conf_rfc rfc = { 4177 .mode = chan->mode, 4178 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO), 4179 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO), 4180 .max_pdu_size = cpu_to_le16(chan->imtu), 4181 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW), 4182 }; 4183 4184 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len); 4185 4186 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING)) 4187 return; 4188 4189 while (len >= L2CAP_CONF_OPT_SIZE) { 4190 int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val); 4191 4192 if (ret < 0) 4193 break; 4194 len -= ret; 4195 4196 switch (type) { 4197 case L2CAP_CONF_RFC: 4198 if (olen != sizeof(rfc)) 4199 break; 4200 memcpy(&rfc, (void *)val, olen); 4201 break; 4202 case L2CAP_CONF_EWS: 4203 if (olen != 2) 4204 break; 4205 txwin_ext = val; 4206 break; 4207 } 4208 } 4209 4210 switch (rfc.mode) { 4211 case L2CAP_MODE_ERTM: 4212 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 4213 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 4214 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4215 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 4216 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext); 4217 else 4218 chan->ack_win = min_t(u16, chan->ack_win, 4219 rfc.txwin_size); 4220 break; 4221 case L2CAP_MODE_STREAMING: 4222 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4223 } 4224 } 4225 4226 static inline int l2cap_command_rej(struct l2cap_conn *conn, 4227 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4228 u8 *data) 4229 __must_hold(&conn->lock) 4230 { 4231 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 4232 4233 if (cmd_len < sizeof(*rej)) 4234 return -EPROTO; 4235 4236 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD) 4237 return 0; 4238 4239 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) && 4240 cmd->ident == conn->info_ident) { 4241 cancel_delayed_work(&conn->info_timer); 4242 4243 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4244 conn->info_ident = 0; 4245 4246 l2cap_conn_start(conn); 4247 } 4248 4249 return 0; 4250 } 4251 4252 /* Allocate and initialise a channel for an incoming connection. 4253 * 4254 * The channel inherits its configuration from @pchan and is linked into @conn 4255 * before ->new_connection() runs, so the conn list reference keeps it alive if 4256 * the callback exposes it (e.g. via the socket accept queue) before this 4257 * returns. The l2cap_chan_create() reference is taken over by the subsystem on 4258 * success and dropped here on failure. 4259 */ 4260 static struct l2cap_chan *l2cap_new_connection(struct l2cap_conn *conn, 4261 struct l2cap_chan *pchan) 4262 __must_hold(&conn->lock) 4263 __must_hold(&pchan->lock) 4264 { 4265 struct l2cap_chan *chan; 4266 4267 chan = l2cap_chan_create(); 4268 if (!chan) 4269 return NULL; 4270 4271 l2cap_chan_lock(chan); 4272 4273 l2cap_chan_set_defaults(chan, pchan); 4274 chan->ops = pchan->ops; 4275 4276 __l2cap_chan_add(conn, chan); 4277 4278 lockdep_assert_held(&chan->conn->lock); 4279 4280 if (pchan->ops->new_connection && 4281 pchan->ops->new_connection(pchan, chan) < 0) { 4282 l2cap_chan_del(chan, 0); 4283 l2cap_chan_unlock(chan); 4284 l2cap_chan_put(chan); 4285 return NULL; 4286 } 4287 4288 l2cap_chan_unlock(chan); 4289 4290 return chan; 4291 } 4292 4293 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, 4294 u8 *data, u8 rsp_code) 4295 __must_hold(&conn->lock) 4296 { 4297 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 4298 struct l2cap_conn_rsp rsp; 4299 struct l2cap_chan *chan = NULL, *pchan = NULL; 4300 int result, status = L2CAP_CS_NO_INFO; 4301 4302 u16 dcid = 0, scid = __le16_to_cpu(req->scid); 4303 __le16 psm = req->psm; 4304 4305 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid); 4306 4307 /* Check if we have socket listening on psm */ 4308 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 4309 &conn->hcon->dst, ACL_LINK); 4310 if (!pchan) { 4311 result = L2CAP_CR_BAD_PSM; 4312 4313 rsp.scid = cpu_to_le16(scid); 4314 rsp.dcid = cpu_to_le16(dcid); 4315 rsp.result = cpu_to_le16(result); 4316 rsp.status = cpu_to_le16(status); 4317 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); 4318 return; 4319 } 4320 4321 l2cap_chan_lock(pchan); 4322 4323 /* Check if the ACL is secure enough (if not SDP) */ 4324 if (psm != cpu_to_le16(L2CAP_PSM_SDP) && 4325 (!hci_conn_check_link_mode(conn->hcon) || 4326 !l2cap_check_enc_key_size(conn->hcon, pchan))) { 4327 conn->disc_reason = HCI_ERROR_AUTH_FAILURE; 4328 result = L2CAP_CR_SEC_BLOCK; 4329 goto response; 4330 } 4331 4332 result = L2CAP_CR_NO_MEM; 4333 4334 /* Check for valid dynamic CID range (as per Erratum 3253) */ 4335 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) { 4336 result = L2CAP_CR_INVALID_SCID; 4337 goto response; 4338 } 4339 4340 /* Check if we already have channel with that dcid */ 4341 if (__l2cap_get_chan_by_dcid(conn, scid)) { 4342 result = L2CAP_CR_SCID_IN_USE; 4343 goto response; 4344 } 4345 4346 chan = l2cap_new_connection(conn, pchan); 4347 if (!chan) 4348 goto response; 4349 4350 /* For certain devices (ex: HID mouse), support for authentication, 4351 * pairing and bonding is optional. For such devices, inorder to avoid 4352 * the ACL alive for too long after L2CAP disconnection, reset the ACL 4353 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect. 4354 */ 4355 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT; 4356 4357 bacpy(&chan->src, &conn->hcon->src); 4358 bacpy(&chan->dst, &conn->hcon->dst); 4359 chan->src_type = bdaddr_src_type(conn->hcon); 4360 chan->dst_type = bdaddr_dst_type(conn->hcon); 4361 chan->psm = psm; 4362 chan->dcid = scid; 4363 4364 dcid = chan->scid; 4365 4366 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 4367 4368 chan->ident = cmd->ident; 4369 4370 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) { 4371 if (l2cap_chan_check_security(chan, false)) { 4372 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 4373 l2cap_state_change(chan, BT_CONNECT2); 4374 result = L2CAP_CR_PEND; 4375 status = L2CAP_CS_AUTHOR_PEND; 4376 chan->ops->defer(chan); 4377 } else { 4378 l2cap_state_change(chan, BT_CONFIG); 4379 result = L2CAP_CR_SUCCESS; 4380 status = L2CAP_CS_NO_INFO; 4381 } 4382 } else { 4383 l2cap_state_change(chan, BT_CONNECT2); 4384 result = L2CAP_CR_PEND; 4385 status = L2CAP_CS_AUTHEN_PEND; 4386 } 4387 } else { 4388 l2cap_state_change(chan, BT_CONNECT2); 4389 result = L2CAP_CR_PEND; 4390 status = L2CAP_CS_NO_INFO; 4391 } 4392 4393 response: 4394 rsp.scid = cpu_to_le16(scid); 4395 rsp.dcid = cpu_to_le16(dcid); 4396 rsp.result = cpu_to_le16(result); 4397 rsp.status = cpu_to_le16(status); 4398 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); 4399 4400 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 4401 struct l2cap_info_req info; 4402 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4403 4404 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 4405 conn->info_ident = l2cap_get_ident(conn); 4406 4407 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 4408 4409 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 4410 sizeof(info), &info); 4411 } 4412 4413 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && 4414 result == L2CAP_CR_SUCCESS) { 4415 u8 buf[128]; 4416 set_bit(CONF_REQ_SENT, &chan->conf_state); 4417 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4418 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4419 chan->num_conf_req++; 4420 } 4421 4422 l2cap_chan_unlock(pchan); 4423 l2cap_chan_put(pchan); 4424 } 4425 4426 static int l2cap_connect_req(struct l2cap_conn *conn, 4427 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 4428 __must_hold(&conn->lock) 4429 { 4430 if (cmd_len < sizeof(struct l2cap_conn_req)) 4431 return -EPROTO; 4432 4433 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP); 4434 return 0; 4435 } 4436 4437 static int l2cap_connect_create_rsp(struct l2cap_conn *conn, 4438 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4439 u8 *data) 4440 __must_hold(&conn->lock) 4441 { 4442 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data; 4443 u16 scid, dcid, result, status; 4444 struct l2cap_chan *chan; 4445 u8 req[128]; 4446 int err; 4447 4448 if (cmd_len < sizeof(*rsp)) 4449 return -EPROTO; 4450 4451 scid = __le16_to_cpu(rsp->scid); 4452 dcid = __le16_to_cpu(rsp->dcid); 4453 result = __le16_to_cpu(rsp->result); 4454 status = __le16_to_cpu(rsp->status); 4455 4456 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START || 4457 dcid > L2CAP_CID_DYN_END)) 4458 return -EPROTO; 4459 4460 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", 4461 dcid, scid, result, status); 4462 4463 if (scid) { 4464 chan = __l2cap_get_chan_by_scid(conn, scid); 4465 if (!chan) 4466 return -EBADSLT; 4467 } else { 4468 chan = __l2cap_get_connect_chan_by_ident(conn, cmd->ident); 4469 if (!chan) 4470 return -EBADSLT; 4471 } 4472 4473 chan = l2cap_chan_hold_unless_zero(chan); 4474 if (!chan) 4475 return -EBADSLT; 4476 4477 err = 0; 4478 4479 l2cap_chan_lock(chan); 4480 4481 lockdep_assert_held(&chan->conn->lock); 4482 4483 /* Only accept a response to a connection request we sent and that 4484 * is still outstanding. A channel waiting in BT_CONNECT for security 4485 * or the feature mask has not sent one yet. 4486 */ 4487 if (!l2cap_chan_connect_pending(chan)) 4488 goto done; 4489 4490 switch (result) { 4491 case L2CAP_CR_SUCCESS: 4492 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 4493 err = -EBADSLT; 4494 break; 4495 } 4496 4497 l2cap_state_change(chan, BT_CONFIG); 4498 chan->ident = 0; 4499 chan->dcid = dcid; 4500 clear_bit(CONF_CONNECT_PEND, &chan->conf_state); 4501 4502 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 4503 break; 4504 4505 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4506 l2cap_build_conf_req(chan, req, sizeof(req)), req); 4507 chan->num_conf_req++; 4508 break; 4509 4510 case L2CAP_CR_PEND: 4511 /* Our request is still outstanding */ 4512 break; 4513 4514 default: 4515 l2cap_chan_del(chan, ECONNREFUSED); 4516 break; 4517 } 4518 4519 done: 4520 l2cap_chan_unlock(chan); 4521 l2cap_chan_put(chan); 4522 4523 return err; 4524 } 4525 4526 static inline void set_default_fcs(struct l2cap_chan *chan) 4527 { 4528 /* FCS is enabled only in ERTM or streaming mode, if one or both 4529 * sides request it. 4530 */ 4531 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING) 4532 chan->fcs = L2CAP_FCS_NONE; 4533 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) 4534 chan->fcs = L2CAP_FCS_CRC16; 4535 } 4536 4537 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data, 4538 u8 ident, u16 flags) 4539 { 4540 struct l2cap_conn *conn = chan->conn; 4541 4542 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident, 4543 flags); 4544 4545 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 4546 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 4547 4548 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP, 4549 l2cap_build_conf_rsp(chan, data, 4550 L2CAP_CONF_SUCCESS, flags), data); 4551 } 4552 4553 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident, 4554 u16 scid, u16 dcid) 4555 { 4556 struct l2cap_cmd_rej_cid rej; 4557 4558 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID); 4559 rej.scid = __cpu_to_le16(scid); 4560 rej.dcid = __cpu_to_le16(dcid); 4561 4562 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 4563 } 4564 4565 static inline int l2cap_config_req(struct l2cap_conn *conn, 4566 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4567 u8 *data) 4568 __must_hold(&conn->lock) 4569 { 4570 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data; 4571 u16 dcid, flags; 4572 u8 rsp[64]; 4573 struct l2cap_chan *chan; 4574 int len, err = 0; 4575 4576 if (cmd_len < sizeof(*req)) 4577 return -EPROTO; 4578 4579 dcid = __le16_to_cpu(req->dcid); 4580 flags = __le16_to_cpu(req->flags); 4581 4582 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags); 4583 4584 chan = l2cap_get_chan_by_scid(conn, dcid); 4585 if (!chan) { 4586 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0); 4587 return 0; 4588 } 4589 4590 l2cap_chan_lock(chan); 4591 4592 lockdep_assert_held(&chan->conn->lock); 4593 4594 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && 4595 chan->state != BT_CONNECTED) { 4596 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, 4597 chan->dcid); 4598 goto unlock; 4599 } 4600 4601 /* Reject if config buffer is too small. */ 4602 len = cmd_len - sizeof(*req); 4603 if (chan->conf_len + len > sizeof(chan->conf_req)) { 4604 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4605 l2cap_build_conf_rsp(chan, rsp, 4606 L2CAP_CONF_REJECT, flags), rsp); 4607 goto unlock; 4608 } 4609 4610 /* Store config. */ 4611 memcpy(chan->conf_req + chan->conf_len, req->data, len); 4612 chan->conf_len += len; 4613 4614 if (flags & L2CAP_CONF_FLAG_CONTINUATION) { 4615 /* Incomplete config. Send empty response. */ 4616 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4617 l2cap_build_conf_rsp(chan, rsp, 4618 L2CAP_CONF_SUCCESS, flags), rsp); 4619 goto unlock; 4620 } 4621 4622 /* Complete config. */ 4623 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); 4624 if (len < 0) { 4625 l2cap_send_disconn_req(chan, ECONNRESET); 4626 goto unlock; 4627 } 4628 4629 chan->ident = cmd->ident; 4630 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); 4631 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP) 4632 chan->num_conf_rsp++; 4633 4634 /* Reset config buffer. */ 4635 chan->conf_len = 0; 4636 4637 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) 4638 goto unlock; 4639 4640 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 4641 set_default_fcs(chan); 4642 4643 if (chan->state != BT_CONNECTED) { 4644 if (chan->mode == L2CAP_MODE_ERTM || 4645 chan->mode == L2CAP_MODE_STREAMING) 4646 err = l2cap_ertm_init(chan); 4647 4648 if (err < 0) 4649 l2cap_send_disconn_req(chan, -err); 4650 else 4651 l2cap_chan_ready(chan); 4652 } 4653 4654 goto unlock; 4655 } 4656 4657 /* A channel in BT_CONNECT2 has not passed security or userspace 4658 * accept yet. Answer the peer's request, but hold our own until 4659 * the channel reaches BT_CONFIG: the CONNECT2 -> CONFIG sites send 4660 * it. Connected channels may also need to reconfigure. 4661 */ 4662 if ((chan->state == BT_CONFIG || chan->state == BT_CONNECTED) && 4663 !test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { 4664 u8 buf[64]; 4665 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4666 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4667 chan->num_conf_req++; 4668 } 4669 4670 /* Got Conf Rsp PENDING from remote side and assume we sent 4671 Conf Rsp PENDING in the code above */ 4672 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) && 4673 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4674 4675 /* check compatibility */ 4676 4677 /* Send rsp for BR/EDR channel */ 4678 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags); 4679 } 4680 4681 unlock: 4682 l2cap_chan_unlock(chan); 4683 l2cap_chan_put(chan); 4684 return err; 4685 } 4686 4687 static inline int l2cap_config_rsp(struct l2cap_conn *conn, 4688 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4689 u8 *data) 4690 __must_hold(&conn->lock) 4691 { 4692 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data; 4693 u16 scid, flags, result; 4694 struct l2cap_chan *chan; 4695 int len = cmd_len - sizeof(*rsp); 4696 int err = 0; 4697 4698 if (cmd_len < sizeof(*rsp)) 4699 return -EPROTO; 4700 4701 scid = __le16_to_cpu(rsp->scid); 4702 flags = __le16_to_cpu(rsp->flags); 4703 result = __le16_to_cpu(rsp->result); 4704 4705 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags, 4706 result, len); 4707 4708 chan = l2cap_get_chan_by_scid(conn, scid); 4709 if (!chan) 4710 return 0; 4711 4712 l2cap_chan_lock(chan); 4713 4714 lockdep_assert_held(&chan->conn->lock); 4715 4716 /* Connected channels may also receive reconfiguration responses. */ 4717 if (chan->state != BT_CONFIG && chan->state != BT_CONNECTED) 4718 goto done; 4719 4720 switch (result) { 4721 case L2CAP_CONF_SUCCESS: 4722 l2cap_conf_rfc_get(chan, rsp->data, len); 4723 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4724 break; 4725 4726 case L2CAP_CONF_PENDING: 4727 set_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4728 4729 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4730 char buf[64]; 4731 4732 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4733 buf, sizeof(buf), &result); 4734 if (len < 0) { 4735 l2cap_send_disconn_req(chan, ECONNRESET); 4736 goto done; 4737 } 4738 4739 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0); 4740 } 4741 goto done; 4742 4743 case L2CAP_CONF_UNKNOWN: 4744 case L2CAP_CONF_UNACCEPT: 4745 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) { 4746 char req[64]; 4747 4748 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { 4749 l2cap_send_disconn_req(chan, ECONNRESET); 4750 goto done; 4751 } 4752 4753 /* throw out any old stored conf requests */ 4754 result = L2CAP_CONF_SUCCESS; 4755 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4756 req, sizeof(req), &result); 4757 if (len < 0) { 4758 l2cap_send_disconn_req(chan, ECONNRESET); 4759 goto done; 4760 } 4761 4762 l2cap_send_cmd(conn, l2cap_get_ident(conn), 4763 L2CAP_CONF_REQ, len, req); 4764 chan->num_conf_req++; 4765 if (result != L2CAP_CONF_SUCCESS) 4766 goto done; 4767 break; 4768 } 4769 fallthrough; 4770 4771 default: 4772 l2cap_chan_set_err(chan, ECONNRESET); 4773 4774 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT); 4775 l2cap_send_disconn_req(chan, ECONNRESET); 4776 goto done; 4777 } 4778 4779 if (flags & L2CAP_CONF_FLAG_CONTINUATION) 4780 goto done; 4781 4782 set_bit(CONF_INPUT_DONE, &chan->conf_state); 4783 4784 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) { 4785 set_default_fcs(chan); 4786 4787 if (chan->state != BT_CONFIG) 4788 goto done; 4789 4790 if (chan->mode == L2CAP_MODE_ERTM || 4791 chan->mode == L2CAP_MODE_STREAMING) 4792 err = l2cap_ertm_init(chan); 4793 4794 if (err < 0) 4795 l2cap_send_disconn_req(chan, -err); 4796 else 4797 l2cap_chan_ready(chan); 4798 } 4799 4800 done: 4801 l2cap_chan_unlock(chan); 4802 l2cap_chan_put(chan); 4803 return err; 4804 } 4805 4806 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, 4807 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4808 u8 *data) 4809 __must_hold(&conn->lock) 4810 { 4811 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data; 4812 struct l2cap_disconn_rsp rsp; 4813 u16 dcid, scid; 4814 struct l2cap_chan *chan; 4815 4816 if (cmd_len != sizeof(*req)) 4817 return -EPROTO; 4818 4819 scid = __le16_to_cpu(req->scid); 4820 dcid = __le16_to_cpu(req->dcid); 4821 4822 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); 4823 4824 chan = l2cap_get_chan_by_scid(conn, dcid); 4825 if (!chan) { 4826 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); 4827 return 0; 4828 } 4829 4830 l2cap_chan_lock(chan); 4831 4832 lockdep_assert_held(&chan->conn->lock); 4833 4834 rsp.dcid = cpu_to_le16(chan->scid); 4835 rsp.scid = cpu_to_le16(chan->dcid); 4836 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); 4837 4838 chan->ops->set_shutdown(chan); 4839 4840 l2cap_chan_del(chan, ECONNRESET); 4841 4842 chan->ops->close(chan); 4843 4844 l2cap_chan_unlock(chan); 4845 l2cap_chan_put(chan); 4846 4847 return 0; 4848 } 4849 4850 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, 4851 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4852 u8 *data) 4853 __must_hold(&conn->lock) 4854 { 4855 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data; 4856 u16 dcid, scid; 4857 struct l2cap_chan *chan; 4858 4859 if (cmd_len != sizeof(*rsp)) 4860 return -EPROTO; 4861 4862 scid = __le16_to_cpu(rsp->scid); 4863 dcid = __le16_to_cpu(rsp->dcid); 4864 4865 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); 4866 4867 chan = l2cap_get_chan_by_scid(conn, scid); 4868 if (!chan) { 4869 return 0; 4870 } 4871 4872 l2cap_chan_lock(chan); 4873 4874 lockdep_assert_held(&chan->conn->lock); 4875 4876 if (chan->state != BT_DISCONN) { 4877 l2cap_chan_unlock(chan); 4878 l2cap_chan_put(chan); 4879 return 0; 4880 } 4881 4882 l2cap_chan_del(chan, 0); 4883 4884 chan->ops->close(chan); 4885 4886 l2cap_chan_unlock(chan); 4887 l2cap_chan_put(chan); 4888 4889 return 0; 4890 } 4891 4892 static inline int l2cap_information_req(struct l2cap_conn *conn, 4893 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4894 u8 *data) 4895 { 4896 struct l2cap_info_req *req = (struct l2cap_info_req *) data; 4897 u16 type; 4898 4899 if (cmd_len != sizeof(*req)) 4900 return -EPROTO; 4901 4902 type = __le16_to_cpu(req->type); 4903 4904 BT_DBG("type 0x%4.4x", type); 4905 4906 if (type == L2CAP_IT_FEAT_MASK) { 4907 u8 buf[8]; 4908 u32 feat_mask = l2cap_feat_mask; 4909 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4910 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4911 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4912 if (!disable_ertm) 4913 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 4914 | L2CAP_FEAT_FCS; 4915 4916 put_unaligned_le32(feat_mask, rsp->data); 4917 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4918 buf); 4919 } else if (type == L2CAP_IT_FIXED_CHAN) { 4920 u8 buf[12]; 4921 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4922 4923 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4924 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4925 rsp->data[0] = conn->local_fixed_chan; 4926 memset(rsp->data + 1, 0, 7); 4927 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4928 buf); 4929 } else { 4930 struct l2cap_info_rsp rsp; 4931 rsp.type = cpu_to_le16(type); 4932 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP); 4933 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), 4934 &rsp); 4935 } 4936 4937 return 0; 4938 } 4939 4940 static inline int l2cap_information_rsp(struct l2cap_conn *conn, 4941 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4942 u8 *data) 4943 __must_hold(&conn->lock) 4944 { 4945 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; 4946 u16 type, result; 4947 4948 if (cmd_len < sizeof(*rsp)) 4949 return -EPROTO; 4950 4951 type = __le16_to_cpu(rsp->type); 4952 result = __le16_to_cpu(rsp->result); 4953 4954 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result); 4955 4956 /* L2CAP Info req/rsp are unbound to channels, add extra checks */ 4957 if (cmd->ident != conn->info_ident || 4958 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 4959 return 0; 4960 4961 cancel_delayed_work(&conn->info_timer); 4962 4963 if (result != L2CAP_IR_SUCCESS) { 4964 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4965 conn->info_ident = 0; 4966 4967 l2cap_conn_start(conn); 4968 4969 return 0; 4970 } 4971 4972 switch (type) { 4973 case L2CAP_IT_FEAT_MASK: 4974 if (cmd_len >= sizeof(*rsp) + sizeof(u32)) 4975 conn->feat_mask = get_unaligned_le32(rsp->data); 4976 4977 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 4978 struct l2cap_info_req req; 4979 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4980 4981 conn->info_ident = l2cap_get_ident(conn); 4982 4983 l2cap_send_cmd(conn, conn->info_ident, 4984 L2CAP_INFO_REQ, sizeof(req), &req); 4985 } else { 4986 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4987 conn->info_ident = 0; 4988 4989 l2cap_conn_start(conn); 4990 } 4991 break; 4992 4993 case L2CAP_IT_FIXED_CHAN: 4994 if (cmd_len >= sizeof(*rsp) + sizeof(rsp->data[0])) 4995 conn->remote_fixed_chan = rsp->data[0]; 4996 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4997 conn->info_ident = 0; 4998 4999 l2cap_conn_start(conn); 5000 break; 5001 } 5002 5003 return 0; 5004 } 5005 5006 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 5007 struct l2cap_cmd_hdr *cmd, 5008 u16 cmd_len, u8 *data) 5009 { 5010 struct hci_conn *hcon = conn->hcon; 5011 struct l2cap_conn_param_update_req *req; 5012 struct l2cap_conn_param_update_rsp rsp; 5013 u16 min, max, latency, to_multiplier; 5014 int err; 5015 5016 if (hcon->role != HCI_ROLE_MASTER) 5017 return -EINVAL; 5018 5019 if (cmd_len != sizeof(struct l2cap_conn_param_update_req)) 5020 return -EPROTO; 5021 5022 req = (struct l2cap_conn_param_update_req *) data; 5023 min = __le16_to_cpu(req->min); 5024 max = __le16_to_cpu(req->max); 5025 latency = __le16_to_cpu(req->latency); 5026 to_multiplier = __le16_to_cpu(req->to_multiplier); 5027 5028 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x", 5029 min, max, latency, to_multiplier); 5030 5031 memset(&rsp, 0, sizeof(rsp)); 5032 5033 err = hci_check_conn_params(min, max, latency, to_multiplier); 5034 if (err) 5035 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 5036 else 5037 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 5038 5039 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 5040 sizeof(rsp), &rsp); 5041 5042 if (!err) 5043 hci_le_conn_update(hcon, min, max, latency, to_multiplier); 5044 5045 return 0; 5046 } 5047 5048 static int l2cap_le_connect_rsp(struct l2cap_conn *conn, 5049 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5050 u8 *data) 5051 __must_hold(&conn->lock) 5052 { 5053 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data; 5054 struct hci_conn *hcon = conn->hcon; 5055 u16 dcid, mtu, mps, credits, result; 5056 struct l2cap_chan *chan; 5057 int err, sec_level; 5058 5059 if (cmd_len < sizeof(*rsp)) 5060 return -EPROTO; 5061 5062 dcid = __le16_to_cpu(rsp->dcid); 5063 mtu = __le16_to_cpu(rsp->mtu); 5064 mps = __le16_to_cpu(rsp->mps); 5065 credits = __le16_to_cpu(rsp->credits); 5066 result = __le16_to_cpu(rsp->result); 5067 5068 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 || 5069 dcid < L2CAP_CID_DYN_START || 5070 dcid > L2CAP_CID_LE_DYN_END)) 5071 return -EPROTO; 5072 5073 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", 5074 dcid, mtu, mps, credits, result); 5075 5076 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 5077 if (!chan) 5078 return -EBADSLT; 5079 5080 chan = l2cap_chan_hold_unless_zero(chan); 5081 if (!chan) 5082 return -EBADSLT; 5083 5084 err = 0; 5085 5086 l2cap_chan_lock(chan); 5087 5088 lockdep_assert_held(&chan->conn->lock); 5089 5090 switch (result) { 5091 case L2CAP_CR_LE_SUCCESS: 5092 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 5093 err = -EBADSLT; 5094 break; 5095 } 5096 5097 chan->ident = 0; 5098 chan->dcid = dcid; 5099 chan->omtu = mtu; 5100 chan->remote_mps = mps; 5101 chan->tx_credits = credits; 5102 l2cap_chan_ready(chan); 5103 break; 5104 5105 case L2CAP_CR_LE_AUTHENTICATION: 5106 case L2CAP_CR_LE_ENCRYPTION: 5107 /* If we already have MITM protection we can't do 5108 * anything. 5109 */ 5110 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 5111 l2cap_chan_del(chan, ECONNREFUSED); 5112 break; 5113 } 5114 5115 sec_level = hcon->sec_level + 1; 5116 if (chan->sec_level < sec_level) 5117 chan->sec_level = sec_level; 5118 5119 /* We'll need to send a new Connect Request */ 5120 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags); 5121 5122 smp_conn_security(hcon, chan->sec_level); 5123 break; 5124 5125 default: 5126 l2cap_chan_del(chan, ECONNREFUSED); 5127 break; 5128 } 5129 5130 l2cap_chan_unlock(chan); 5131 l2cap_chan_put(chan); 5132 5133 return err; 5134 } 5135 5136 static void l2cap_put_ident(struct l2cap_conn *conn, u8 code, u8 id) 5137 { 5138 switch (code) { 5139 case L2CAP_COMMAND_REJ: 5140 case L2CAP_CONN_RSP: 5141 case L2CAP_CONF_RSP: 5142 case L2CAP_DISCONN_RSP: 5143 case L2CAP_ECHO_RSP: 5144 case L2CAP_INFO_RSP: 5145 case L2CAP_CONN_PARAM_UPDATE_RSP: 5146 case L2CAP_LE_CONN_RSP: 5147 case L2CAP_ECRED_CONN_RSP: 5148 case L2CAP_ECRED_RECONF_RSP: 5149 /* First do a lookup since the remote may send bogus ids that 5150 * would make ida_free to generate warnings. 5151 */ 5152 if (ida_find_first_range(&conn->tx_ida, id, id) >= 0) 5153 ida_free(&conn->tx_ida, id); 5154 } 5155 } 5156 5157 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, 5158 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5159 u8 *data) 5160 __must_hold(&conn->lock) 5161 { 5162 int err = 0; 5163 5164 l2cap_put_ident(conn, cmd->code, cmd->ident); 5165 5166 switch (cmd->code) { 5167 case L2CAP_COMMAND_REJ: 5168 l2cap_command_rej(conn, cmd, cmd_len, data); 5169 break; 5170 5171 case L2CAP_CONN_REQ: 5172 err = l2cap_connect_req(conn, cmd, cmd_len, data); 5173 break; 5174 5175 case L2CAP_CONN_RSP: 5176 l2cap_connect_create_rsp(conn, cmd, cmd_len, data); 5177 break; 5178 5179 case L2CAP_CONF_REQ: 5180 err = l2cap_config_req(conn, cmd, cmd_len, data); 5181 break; 5182 5183 case L2CAP_CONF_RSP: 5184 l2cap_config_rsp(conn, cmd, cmd_len, data); 5185 break; 5186 5187 case L2CAP_DISCONN_REQ: 5188 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 5189 break; 5190 5191 case L2CAP_DISCONN_RSP: 5192 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 5193 break; 5194 5195 case L2CAP_ECHO_REQ: 5196 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data); 5197 break; 5198 5199 case L2CAP_ECHO_RSP: 5200 break; 5201 5202 case L2CAP_INFO_REQ: 5203 err = l2cap_information_req(conn, cmd, cmd_len, data); 5204 break; 5205 5206 case L2CAP_INFO_RSP: 5207 l2cap_information_rsp(conn, cmd, cmd_len, data); 5208 break; 5209 5210 default: 5211 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); 5212 err = -EINVAL; 5213 break; 5214 } 5215 5216 return err; 5217 } 5218 5219 static int l2cap_le_connect_req(struct l2cap_conn *conn, 5220 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5221 u8 *data) 5222 __must_hold(&conn->lock) 5223 { 5224 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data; 5225 struct l2cap_le_conn_rsp rsp; 5226 struct l2cap_chan *chan, *pchan; 5227 u16 dcid, scid, credits, mtu, mps; 5228 __le16 psm; 5229 u8 result; 5230 5231 if (cmd_len != sizeof(*req)) 5232 return -EPROTO; 5233 5234 scid = __le16_to_cpu(req->scid); 5235 mtu = __le16_to_cpu(req->mtu); 5236 mps = __le16_to_cpu(req->mps); 5237 psm = req->psm; 5238 dcid = 0; 5239 credits = 0; 5240 5241 if (mtu < 23 || mps < 23) 5242 return -EPROTO; 5243 5244 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm), 5245 scid, mtu, mps); 5246 5247 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 5248 * page 1059: 5249 * 5250 * Valid range: 0x0001-0x00ff 5251 * 5252 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 5253 */ 5254 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 5255 result = L2CAP_CR_LE_BAD_PSM; 5256 chan = NULL; 5257 goto response; 5258 } 5259 5260 /* Check if we have socket listening on psm */ 5261 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5262 &conn->hcon->dst, LE_LINK); 5263 if (!pchan) { 5264 result = L2CAP_CR_LE_BAD_PSM; 5265 chan = NULL; 5266 goto response; 5267 } 5268 5269 l2cap_chan_lock(pchan); 5270 5271 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5272 SMP_ALLOW_STK)) { 5273 result = pchan->sec_level == BT_SECURITY_MEDIUM ? 5274 L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION; 5275 chan = NULL; 5276 goto response_unlock; 5277 } 5278 5279 /* Check if Key Size is sufficient for the security level */ 5280 if (!l2cap_check_enc_key_size(conn->hcon, pchan)) { 5281 result = L2CAP_CR_LE_BAD_KEY_SIZE; 5282 chan = NULL; 5283 goto response_unlock; 5284 } 5285 5286 /* Check for valid dynamic CID range */ 5287 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5288 result = L2CAP_CR_LE_INVALID_SCID; 5289 chan = NULL; 5290 goto response_unlock; 5291 } 5292 5293 /* Check if we already have channel with that dcid */ 5294 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5295 result = L2CAP_CR_LE_SCID_IN_USE; 5296 chan = NULL; 5297 goto response_unlock; 5298 } 5299 5300 chan = l2cap_new_connection(conn, pchan); 5301 if (!chan) { 5302 result = L2CAP_CR_LE_NO_MEM; 5303 goto response_unlock; 5304 } 5305 5306 l2cap_chan_lock(chan); 5307 5308 lockdep_assert_held(&chan->conn->lock); 5309 5310 bacpy(&chan->src, &conn->hcon->src); 5311 bacpy(&chan->dst, &conn->hcon->dst); 5312 chan->src_type = bdaddr_src_type(conn->hcon); 5313 chan->dst_type = bdaddr_dst_type(conn->hcon); 5314 chan->psm = psm; 5315 chan->dcid = scid; 5316 chan->omtu = mtu; 5317 chan->remote_mps = mps; 5318 5319 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits)); 5320 5321 dcid = chan->scid; 5322 credits = chan->rx_credits; 5323 5324 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 5325 5326 chan->ident = cmd->ident; 5327 chan->mode = L2CAP_MODE_LE_FLOWCTL; 5328 5329 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 5330 l2cap_state_change(chan, BT_CONNECT2); 5331 /* The following result value is actually not defined 5332 * for LE CoC but we use it to let the function know 5333 * that it should bail out after doing its cleanup 5334 * instead of sending a response. 5335 */ 5336 result = L2CAP_CR_PEND; 5337 chan->ops->defer(chan); 5338 } else { 5339 l2cap_chan_ready(chan); 5340 result = L2CAP_CR_LE_SUCCESS; 5341 } 5342 5343 l2cap_chan_unlock(chan); 5344 5345 response_unlock: 5346 l2cap_chan_unlock(pchan); 5347 l2cap_chan_put(pchan); 5348 5349 if (result == L2CAP_CR_PEND) 5350 return 0; 5351 5352 response: 5353 if (chan) { 5354 rsp.mtu = cpu_to_le16(chan->imtu); 5355 rsp.mps = cpu_to_le16(chan->mps); 5356 } else { 5357 rsp.mtu = 0; 5358 rsp.mps = 0; 5359 } 5360 5361 rsp.dcid = cpu_to_le16(dcid); 5362 rsp.credits = cpu_to_le16(credits); 5363 rsp.result = cpu_to_le16(result); 5364 5365 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp); 5366 5367 return 0; 5368 } 5369 5370 static inline int l2cap_le_credits(struct l2cap_conn *conn, 5371 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5372 u8 *data) 5373 __must_hold(&conn->lock) 5374 { 5375 struct l2cap_le_credits *pkt; 5376 struct l2cap_chan *chan; 5377 u16 cid, credits, max_credits; 5378 5379 if (cmd_len != sizeof(*pkt)) 5380 return -EPROTO; 5381 5382 pkt = (struct l2cap_le_credits *) data; 5383 cid = __le16_to_cpu(pkt->cid); 5384 credits = __le16_to_cpu(pkt->credits); 5385 5386 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits); 5387 5388 chan = l2cap_get_chan_by_dcid(conn, cid); 5389 if (!chan) 5390 return -EBADSLT; 5391 5392 l2cap_chan_lock(chan); 5393 5394 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits; 5395 if (credits > max_credits) { 5396 BT_ERR("LE credits overflow"); 5397 l2cap_send_disconn_req(chan, ECONNRESET); 5398 5399 /* Return 0 so that we don't trigger an unnecessary 5400 * command reject packet. 5401 */ 5402 goto unlock; 5403 } 5404 5405 chan->tx_credits += credits; 5406 5407 /* Resume sending */ 5408 l2cap_le_flowctl_send(chan); 5409 5410 if (chan->tx_credits) 5411 chan->ops->resume(chan); 5412 5413 unlock: 5414 l2cap_chan_unlock(chan); 5415 l2cap_chan_put(chan); 5416 5417 return 0; 5418 } 5419 5420 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, 5421 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5422 u8 *data) 5423 __must_hold(&conn->lock) 5424 { 5425 struct l2cap_ecred_conn_req *req = (void *) data; 5426 DEFINE_RAW_FLEX(struct l2cap_ecred_conn_rsp, pdu, dcid, L2CAP_ECRED_MAX_CID); 5427 struct l2cap_chan *chan, *pchan; 5428 u16 mtu, mps; 5429 __le16 psm; 5430 u8 result, rsp_len = 0; 5431 int i, num_scid = 0; 5432 bool defer = false; 5433 5434 if (!enable_ecred) 5435 return -EINVAL; 5436 5437 memset(pdu, 0, sizeof(*pdu)); 5438 5439 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) { 5440 result = L2CAP_CR_LE_INVALID_PARAMS; 5441 goto response; 5442 } 5443 5444 /* Check if there are no pending channels with the same ident */ 5445 __l2cap_chan_list_id(conn, cmd->ident, l2cap_ecred_list_defer, 5446 &num_scid); 5447 if (num_scid) { 5448 result = L2CAP_CR_LE_INVALID_PARAMS; 5449 goto response; 5450 } 5451 5452 cmd_len -= sizeof(*req); 5453 num_scid = cmd_len / sizeof(u16); 5454 5455 if (num_scid > L2CAP_ECRED_MAX_CID) { 5456 result = L2CAP_CR_LE_INVALID_PARAMS; 5457 goto response; 5458 } 5459 5460 /* Always respond with the same number of scids as in the request */ 5461 rsp_len = cmd_len; 5462 5463 mtu = __le16_to_cpu(req->mtu); 5464 mps = __le16_to_cpu(req->mps); 5465 5466 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) { 5467 result = L2CAP_CR_LE_INVALID_PARAMS; 5468 goto response; 5469 } 5470 5471 psm = req->psm; 5472 5473 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 5474 * page 1059: 5475 * 5476 * Valid range: 0x0001-0x00ff 5477 * 5478 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 5479 */ 5480 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 5481 result = L2CAP_CR_LE_BAD_PSM; 5482 goto response; 5483 } 5484 5485 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps); 5486 5487 /* Check if we have socket listening on psm */ 5488 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5489 &conn->hcon->dst, LE_LINK); 5490 if (!pchan) { 5491 result = L2CAP_CR_LE_BAD_PSM; 5492 goto response; 5493 } 5494 5495 l2cap_chan_lock(pchan); 5496 5497 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5498 SMP_ALLOW_STK)) { 5499 result = pchan->sec_level == BT_SECURITY_MEDIUM ? 5500 L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION; 5501 goto unlock; 5502 } 5503 5504 /* Check if the listening channel has set an output MTU then the 5505 * requested MTU shall be less than or equal to that value. 5506 */ 5507 if (pchan->omtu && mtu < pchan->omtu) { 5508 result = L2CAP_CR_LE_UNACCEPT_PARAMS; 5509 goto unlock; 5510 } 5511 5512 result = L2CAP_CR_LE_SUCCESS; 5513 5514 for (i = 0; i < num_scid; i++) { 5515 u16 scid = __le16_to_cpu(req->scid[i]); 5516 5517 BT_DBG("scid[%d] 0x%4.4x", i, scid); 5518 5519 pdu->dcid[i] = 0x0000; 5520 5521 /* Check for valid dynamic CID range */ 5522 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5523 result = L2CAP_CR_LE_INVALID_SCID; 5524 continue; 5525 } 5526 5527 /* Check if we already have channel with that dcid */ 5528 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5529 result = L2CAP_CR_LE_SCID_IN_USE; 5530 continue; 5531 } 5532 5533 chan = l2cap_new_connection(conn, pchan); 5534 if (!chan) { 5535 result = L2CAP_CR_LE_NO_MEM; 5536 continue; 5537 } 5538 5539 l2cap_chan_lock(chan); 5540 5541 lockdep_assert_held(&chan->conn->lock); 5542 5543 bacpy(&chan->src, &conn->hcon->src); 5544 bacpy(&chan->dst, &conn->hcon->dst); 5545 chan->src_type = bdaddr_src_type(conn->hcon); 5546 chan->dst_type = bdaddr_dst_type(conn->hcon); 5547 chan->psm = psm; 5548 chan->dcid = scid; 5549 chan->omtu = mtu; 5550 chan->remote_mps = mps; 5551 5552 l2cap_ecred_init(chan, __le16_to_cpu(req->credits)); 5553 5554 /* Init response */ 5555 if (!pdu->credits) { 5556 pdu->mtu = cpu_to_le16(chan->imtu); 5557 pdu->mps = cpu_to_le16(chan->mps); 5558 pdu->credits = cpu_to_le16(chan->rx_credits); 5559 } 5560 5561 pdu->dcid[i] = cpu_to_le16(chan->scid); 5562 5563 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 5564 5565 chan->ident = cmd->ident; 5566 chan->mode = L2CAP_MODE_EXT_FLOWCTL; 5567 5568 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 5569 l2cap_state_change(chan, BT_CONNECT2); 5570 defer = true; 5571 chan->ops->defer(chan); 5572 } else { 5573 l2cap_chan_ready(chan); 5574 } 5575 5576 l2cap_chan_unlock(chan); 5577 } 5578 5579 unlock: 5580 l2cap_chan_unlock(pchan); 5581 l2cap_chan_put(pchan); 5582 5583 response: 5584 pdu->result = cpu_to_le16(result); 5585 5586 if (defer) 5587 return 0; 5588 5589 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP, 5590 sizeof(*pdu) + rsp_len, pdu); 5591 5592 return 0; 5593 } 5594 5595 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 5596 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5597 u8 *data) 5598 __must_hold(&conn->lock) 5599 { 5600 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 5601 struct hci_conn *hcon = conn->hcon; 5602 u16 mtu, mps, credits, result; 5603 struct l2cap_chan *chan, *tmp; 5604 int err = 0, sec_level; 5605 int i = 0; 5606 5607 if (cmd_len < sizeof(*rsp)) 5608 return -EPROTO; 5609 5610 mtu = __le16_to_cpu(rsp->mtu); 5611 mps = __le16_to_cpu(rsp->mps); 5612 credits = __le16_to_cpu(rsp->credits); 5613 result = __le16_to_cpu(rsp->result); 5614 5615 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits, 5616 result); 5617 5618 cmd_len -= sizeof(*rsp); 5619 5620 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 5621 struct l2cap_chan *orig; 5622 u16 dcid; 5623 5624 if (chan->ident != cmd->ident || 5625 chan->mode != L2CAP_MODE_EXT_FLOWCTL || 5626 chan->state == BT_CONNECTED) 5627 continue; 5628 5629 l2cap_chan_hold(chan); 5630 l2cap_chan_lock(chan); 5631 5632 lockdep_assert_held(&chan->conn->lock); 5633 5634 /* Check that there is a dcid for each pending channel */ 5635 if (cmd_len < sizeof(dcid)) { 5636 l2cap_chan_del(chan, ECONNREFUSED); 5637 l2cap_chan_unlock(chan); 5638 l2cap_chan_put(chan); 5639 continue; 5640 } 5641 5642 dcid = __le16_to_cpu(rsp->dcid[i++]); 5643 cmd_len -= sizeof(u16); 5644 5645 BT_DBG("dcid[%d] 0x%4.4x", i, dcid); 5646 5647 orig = __l2cap_get_chan_by_dcid(conn, dcid); 5648 5649 /* Check if dcid is already in use */ 5650 if (dcid && orig) { 5651 /* If a device receives a 5652 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an 5653 * already-assigned Destination CID, then both the 5654 * original channel and the new channel shall be 5655 * immediately discarded and not used. 5656 */ 5657 l2cap_chan_del(chan, ECONNREFUSED); 5658 l2cap_chan_unlock(chan); 5659 5660 /* Check that the dcid channel mode is 5661 * L2CAP_MODE_EXT_FLOWCTL since this procedure is only 5662 * valid for that mode and shouldn't disconnect a dcid 5663 * in other modes. 5664 */ 5665 if (orig->mode == L2CAP_MODE_EXT_FLOWCTL) { 5666 l2cap_chan_lock(orig); 5667 /* Disconnect the original channel as it may be 5668 * considered connected since dcid has already 5669 * been assigned; don't call l2cap_chan_close 5670 * directly since that could lead to 5671 * l2cap_chan_del and then removing the channel 5672 * from the list while we're iterating over it. 5673 */ 5674 __set_chan_timer(orig, 0); 5675 l2cap_chan_unlock(orig); 5676 } 5677 5678 l2cap_chan_put(chan); 5679 continue; 5680 } 5681 5682 switch (result) { 5683 case L2CAP_CR_LE_AUTHENTICATION: 5684 case L2CAP_CR_LE_ENCRYPTION: 5685 /* If we already have MITM protection we can't do 5686 * anything. 5687 */ 5688 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 5689 l2cap_chan_del(chan, ECONNREFUSED); 5690 break; 5691 } 5692 5693 sec_level = hcon->sec_level + 1; 5694 if (chan->sec_level < sec_level) 5695 chan->sec_level = sec_level; 5696 5697 /* We'll need to send a new Connect Request */ 5698 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags); 5699 5700 smp_conn_security(hcon, chan->sec_level); 5701 break; 5702 5703 case L2CAP_CR_LE_BAD_PSM: 5704 l2cap_chan_del(chan, ECONNREFUSED); 5705 break; 5706 5707 default: 5708 /* If dcid was not set it means channels was refused */ 5709 if (!dcid) { 5710 l2cap_chan_del(chan, ECONNREFUSED); 5711 break; 5712 } 5713 5714 chan->ident = 0; 5715 chan->dcid = dcid; 5716 chan->omtu = mtu; 5717 chan->remote_mps = mps; 5718 chan->tx_credits = credits; 5719 l2cap_chan_ready(chan); 5720 break; 5721 } 5722 5723 l2cap_chan_unlock(chan); 5724 l2cap_chan_put(chan); 5725 } 5726 5727 return err; 5728 } 5729 5730 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn, 5731 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5732 u8 *data) 5733 __must_hold(&conn->lock) 5734 { 5735 struct l2cap_ecred_reconf_req *req = (void *) data; 5736 struct l2cap_ecred_reconf_rsp rsp; 5737 u16 mtu, mps, result; 5738 struct l2cap_chan *chan[L2CAP_ECRED_MAX_CID] = {}; 5739 int i, num_scid; 5740 5741 if (!enable_ecred) 5742 return -EINVAL; 5743 5744 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) { 5745 result = L2CAP_RECONF_INVALID_CID; 5746 goto respond; 5747 } 5748 5749 mtu = __le16_to_cpu(req->mtu); 5750 mps = __le16_to_cpu(req->mps); 5751 5752 BT_DBG("mtu %u mps %u", mtu, mps); 5753 5754 if (mtu < L2CAP_ECRED_MIN_MTU) { 5755 result = L2CAP_RECONF_INVALID_PARAMS; 5756 goto respond; 5757 } 5758 5759 if (mps < L2CAP_ECRED_MIN_MPS) { 5760 result = L2CAP_RECONF_INVALID_PARAMS; 5761 goto respond; 5762 } 5763 5764 cmd_len -= sizeof(*req); 5765 num_scid = cmd_len / sizeof(u16); 5766 5767 if (num_scid > L2CAP_ECRED_MAX_CID) { 5768 result = L2CAP_RECONF_INVALID_PARAMS; 5769 goto respond; 5770 } 5771 5772 result = L2CAP_RECONF_SUCCESS; 5773 5774 /* Check if each SCID, MTU and MPS are valid */ 5775 for (i = 0; i < num_scid; i++) { 5776 u16 scid; 5777 5778 scid = __le16_to_cpu(req->scid[i]); 5779 if (!scid) { 5780 result = L2CAP_RECONF_INVALID_CID; 5781 goto respond; 5782 } 5783 5784 chan[i] = __l2cap_get_chan_by_dcid(conn, scid); 5785 if (!chan[i]) { 5786 result = L2CAP_RECONF_INVALID_CID; 5787 goto respond; 5788 } 5789 5790 /* The MTU field shall be greater than or equal to the greatest 5791 * current MTU size of these channels. 5792 */ 5793 if (chan[i]->omtu > mtu) { 5794 BT_ERR("chan %p decreased MTU %u -> %u", chan[i], 5795 chan[i]->omtu, mtu); 5796 result = L2CAP_RECONF_INVALID_MTU; 5797 goto respond; 5798 } 5799 5800 /* If more than one channel is being configured, the MPS field 5801 * shall be greater than or equal to the current MPS size of 5802 * each of these channels. If only one channel is being 5803 * configured, the MPS field may be less than the current MPS 5804 * of that channel. 5805 */ 5806 if (chan[i]->remote_mps > mps && num_scid > 1) { 5807 BT_ERR("chan %p decreased MPS %u -> %u", chan[i], 5808 chan[i]->remote_mps, mps); 5809 result = L2CAP_RECONF_INVALID_MPS; 5810 goto respond; 5811 } 5812 } 5813 5814 /* Commit the new MTU and MPS values after checking they are valid */ 5815 for (i = 0; i < num_scid; i++) { 5816 chan[i]->omtu = mtu; 5817 chan[i]->remote_mps = mps; 5818 } 5819 5820 respond: 5821 rsp.result = cpu_to_le16(result); 5822 5823 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp), 5824 &rsp); 5825 5826 return 0; 5827 } 5828 5829 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn, 5830 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5831 u8 *data) 5832 __must_hold(&conn->lock) 5833 { 5834 struct l2cap_chan *chan, *tmp; 5835 struct l2cap_ecred_reconf_rsp *rsp = (void *)data; 5836 u16 result; 5837 5838 if (cmd_len < sizeof(*rsp)) 5839 return -EPROTO; 5840 5841 result = __le16_to_cpu(rsp->result); 5842 5843 BT_DBG("result 0x%4.4x", result); 5844 5845 if (!result) { 5846 list_for_each_entry(chan, &conn->chan_l, list) { 5847 if (chan->ident == cmd->ident) 5848 chan->ident = 0; 5849 } 5850 return 0; 5851 } 5852 5853 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 5854 if (chan->ident != cmd->ident) 5855 continue; 5856 5857 if (!l2cap_chan_hold_unless_zero(chan)) 5858 continue; 5859 l2cap_chan_lock(chan); 5860 5861 lockdep_assert_held(&chan->conn->lock); 5862 5863 l2cap_chan_del(chan, ECONNRESET); 5864 5865 l2cap_chan_unlock(chan); 5866 l2cap_chan_put(chan); 5867 } 5868 5869 return 0; 5870 } 5871 5872 static inline int l2cap_le_command_rej(struct l2cap_conn *conn, 5873 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5874 u8 *data) 5875 __must_hold(&conn->lock) 5876 { 5877 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 5878 struct l2cap_chan *chan; 5879 5880 if (cmd_len < sizeof(*rej)) 5881 return -EPROTO; 5882 5883 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 5884 if (!chan) 5885 goto done; 5886 5887 chan = l2cap_chan_hold_unless_zero(chan); 5888 if (!chan) 5889 goto done; 5890 5891 l2cap_chan_lock(chan); 5892 lockdep_assert_held(&chan->conn->lock); 5893 l2cap_chan_del(chan, ECONNREFUSED); 5894 l2cap_chan_unlock(chan); 5895 l2cap_chan_put(chan); 5896 5897 done: 5898 return 0; 5899 } 5900 5901 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn, 5902 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5903 u8 *data) 5904 __must_hold(&conn->lock) 5905 { 5906 int err = 0; 5907 5908 l2cap_put_ident(conn, cmd->code, cmd->ident); 5909 5910 switch (cmd->code) { 5911 case L2CAP_COMMAND_REJ: 5912 l2cap_le_command_rej(conn, cmd, cmd_len, data); 5913 break; 5914 5915 case L2CAP_CONN_PARAM_UPDATE_REQ: 5916 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data); 5917 break; 5918 5919 case L2CAP_CONN_PARAM_UPDATE_RSP: 5920 break; 5921 5922 case L2CAP_LE_CONN_RSP: 5923 l2cap_le_connect_rsp(conn, cmd, cmd_len, data); 5924 break; 5925 5926 case L2CAP_LE_CONN_REQ: 5927 err = l2cap_le_connect_req(conn, cmd, cmd_len, data); 5928 break; 5929 5930 case L2CAP_LE_CREDITS: 5931 err = l2cap_le_credits(conn, cmd, cmd_len, data); 5932 break; 5933 5934 case L2CAP_ECRED_CONN_REQ: 5935 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data); 5936 break; 5937 5938 case L2CAP_ECRED_CONN_RSP: 5939 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data); 5940 break; 5941 5942 case L2CAP_ECRED_RECONF_REQ: 5943 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data); 5944 break; 5945 5946 case L2CAP_ECRED_RECONF_RSP: 5947 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data); 5948 break; 5949 5950 case L2CAP_DISCONN_REQ: 5951 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 5952 break; 5953 5954 case L2CAP_DISCONN_RSP: 5955 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 5956 break; 5957 5958 default: 5959 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code); 5960 err = -EINVAL; 5961 break; 5962 } 5963 5964 return err; 5965 } 5966 5967 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, 5968 struct sk_buff *skb) 5969 __must_hold(&conn->lock) 5970 { 5971 struct hci_conn *hcon = conn->hcon; 5972 struct l2cap_cmd_hdr *cmd; 5973 u16 len; 5974 int err; 5975 5976 if (hcon->type != LE_LINK) 5977 goto drop; 5978 5979 if (skb->len < L2CAP_CMD_HDR_SIZE) 5980 goto drop; 5981 5982 cmd = (void *) skb->data; 5983 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 5984 5985 len = le16_to_cpu(cmd->len); 5986 5987 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident); 5988 5989 if (len != skb->len || !cmd->ident) { 5990 BT_DBG("corrupted command"); 5991 goto drop; 5992 } 5993 5994 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data); 5995 if (err) { 5996 struct l2cap_cmd_rej_unk rej; 5997 5998 BT_ERR("Wrong link type (%d)", err); 5999 6000 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 6001 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 6002 sizeof(rej), &rej); 6003 } 6004 6005 drop: 6006 kfree_skb(skb); 6007 } 6008 6009 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident) 6010 { 6011 struct l2cap_cmd_rej_unk rej; 6012 6013 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 6014 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 6015 } 6016 6017 static inline void l2cap_sig_send_mtu_rej(struct l2cap_conn *conn, u8 ident) 6018 { 6019 struct l2cap_cmd_rej_mtu rej; 6020 6021 rej.reason = cpu_to_le16(L2CAP_REJ_MTU_EXCEEDED); 6022 rej.max_mtu = cpu_to_le16(L2CAP_SIG_MTU); 6023 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 6024 } 6025 6026 static inline void l2cap_sig_channel(struct l2cap_conn *conn, 6027 struct sk_buff *skb) 6028 __must_hold(&conn->lock) 6029 { 6030 struct hci_conn *hcon = conn->hcon; 6031 struct l2cap_cmd_hdr *cmd; 6032 int err; 6033 6034 l2cap_raw_recv(conn, skb); 6035 6036 if (hcon->type != ACL_LINK) 6037 goto drop; 6038 6039 /* 6040 * Bluetooth Core v5.4, Vol 3, Part A, Section 4: the BR/EDR 6041 * signaling channel has a fixed signaling MTU (MTUsig) whose 6042 * minimum and default is 48 octets. Section 4.1 says that on 6043 * an MTUExceeded command reject the identifier "shall match 6044 * the first request command in the L2CAP packet" and that 6045 * packets containing only response commands "shall be 6046 * silently discarded". 6047 * 6048 * Linux intentionally deviates from that prescription: 6049 * 6050 * 1. Silently discarding desynchronizes the peer. The 6051 * remote stack never learns its responses were dropped, 6052 * so any state machine waiting on a paired response 6053 * stalls until its own timer fires. 6054 * 6055 * 2. Locating "the first request command" requires walking 6056 * command headers past MTUsig, i.e. processing bytes 6057 * from a packet we have already decided is too large to 6058 * process. 6059 * 6060 * Reject every over-MTUsig signaling packet with one 6061 * L2CAP_REJ_MTU_EXCEEDED command reject. The reject's 6062 * reason field is what tells the peer that the whole packet 6063 * was discarded; the identifier value is informational, so 6064 * we use the identifier from the first command header, a 6065 * single fixed-offset byte read. 6066 */ 6067 if (skb->len > L2CAP_SIG_MTU) { 6068 u8 ident = skb->data[1]; 6069 6070 BT_DBG("signaling packet exceeds MTU: %u > %u", 6071 skb->len, L2CAP_SIG_MTU); 6072 l2cap_sig_send_mtu_rej(conn, ident); 6073 goto drop; 6074 } 6075 6076 while (skb->len >= L2CAP_CMD_HDR_SIZE) { 6077 u16 len; 6078 6079 cmd = (void *) skb->data; 6080 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 6081 6082 len = le16_to_cpu(cmd->len); 6083 6084 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, 6085 cmd->ident); 6086 6087 if (len > skb->len || !cmd->ident) { 6088 BT_DBG("corrupted command"); 6089 l2cap_sig_send_rej(conn, cmd->ident); 6090 skb_pull(skb, len > skb->len ? skb->len : len); 6091 continue; 6092 } 6093 6094 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); 6095 if (err) { 6096 BT_ERR("Wrong link type (%d)", err); 6097 l2cap_sig_send_rej(conn, cmd->ident); 6098 } 6099 6100 skb_pull(skb, len); 6101 } 6102 6103 if (skb->len > 0) { 6104 BT_DBG("corrupted command"); 6105 l2cap_sig_send_rej(conn, 0); 6106 } 6107 6108 drop: 6109 kfree_skb(skb); 6110 } 6111 6112 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb) 6113 { 6114 u16 our_fcs, rcv_fcs; 6115 int hdr_size; 6116 6117 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 6118 hdr_size = L2CAP_EXT_HDR_SIZE; 6119 else 6120 hdr_size = L2CAP_ENH_HDR_SIZE; 6121 6122 if (chan->fcs == L2CAP_FCS_CRC16) { 6123 skb_trim(skb, skb->len - L2CAP_FCS_SIZE); 6124 rcv_fcs = get_unaligned_le16(skb->data + skb->len); 6125 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size); 6126 6127 if (our_fcs != rcv_fcs) 6128 return -EBADMSG; 6129 } 6130 return 0; 6131 } 6132 6133 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan) 6134 { 6135 struct l2cap_ctrl control; 6136 6137 BT_DBG("chan %p", chan); 6138 6139 memset(&control, 0, sizeof(control)); 6140 control.sframe = 1; 6141 control.final = 1; 6142 control.reqseq = chan->buffer_seq; 6143 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6144 6145 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6146 control.super = L2CAP_SUPER_RNR; 6147 l2cap_send_sframe(chan, &control); 6148 } 6149 6150 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 6151 chan->unacked_frames > 0) 6152 __set_retrans_timer(chan); 6153 6154 /* Send pending iframes */ 6155 l2cap_ertm_send(chan); 6156 6157 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 6158 test_bit(CONN_SEND_FBIT, &chan->conn_state)) { 6159 /* F-bit wasn't sent in an s-frame or i-frame yet, so 6160 * send it now. 6161 */ 6162 control.super = L2CAP_SUPER_RR; 6163 l2cap_send_sframe(chan, &control); 6164 } 6165 } 6166 6167 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag, 6168 struct sk_buff **last_frag) 6169 { 6170 /* skb->len reflects data in skb as well as all fragments 6171 * skb->data_len reflects only data in fragments 6172 */ 6173 if (!skb_has_frag_list(skb)) 6174 skb_shinfo(skb)->frag_list = new_frag; 6175 6176 new_frag->next = NULL; 6177 6178 (*last_frag)->next = new_frag; 6179 *last_frag = new_frag; 6180 6181 skb->len += new_frag->len; 6182 skb->data_len += new_frag->len; 6183 skb->truesize += new_frag->truesize; 6184 } 6185 6186 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, 6187 struct l2cap_ctrl *control) 6188 { 6189 int err = -EINVAL; 6190 6191 switch (control->sar) { 6192 case L2CAP_SAR_UNSEGMENTED: 6193 if (chan->sdu) 6194 break; 6195 6196 err = chan->ops->recv(chan, skb); 6197 break; 6198 6199 case L2CAP_SAR_START: 6200 if (chan->sdu) 6201 break; 6202 6203 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) 6204 break; 6205 6206 chan->sdu_len = get_unaligned_le16(skb->data); 6207 skb_pull(skb, L2CAP_SDULEN_SIZE); 6208 6209 if (chan->sdu_len > chan->imtu) { 6210 err = -EMSGSIZE; 6211 break; 6212 } 6213 6214 if (skb->len >= chan->sdu_len) 6215 break; 6216 6217 chan->sdu = skb; 6218 chan->sdu_last_frag = skb; 6219 6220 skb = NULL; 6221 err = 0; 6222 break; 6223 6224 case L2CAP_SAR_CONTINUE: 6225 if (!chan->sdu) 6226 break; 6227 6228 append_skb_frag(chan->sdu, skb, 6229 &chan->sdu_last_frag); 6230 skb = NULL; 6231 6232 if (chan->sdu->len >= chan->sdu_len) 6233 break; 6234 6235 err = 0; 6236 break; 6237 6238 case L2CAP_SAR_END: 6239 if (!chan->sdu) 6240 break; 6241 6242 append_skb_frag(chan->sdu, skb, 6243 &chan->sdu_last_frag); 6244 skb = NULL; 6245 6246 if (chan->sdu->len != chan->sdu_len) 6247 break; 6248 6249 err = chan->ops->recv(chan, chan->sdu); 6250 6251 if (!err) { 6252 /* Reassembly complete */ 6253 chan->sdu = NULL; 6254 chan->sdu_last_frag = NULL; 6255 chan->sdu_len = 0; 6256 } 6257 break; 6258 } 6259 6260 if (err) { 6261 kfree_skb(skb); 6262 kfree_skb(chan->sdu); 6263 chan->sdu = NULL; 6264 chan->sdu_last_frag = NULL; 6265 chan->sdu_len = 0; 6266 } 6267 6268 return err; 6269 } 6270 6271 static int l2cap_resegment(struct l2cap_chan *chan) 6272 { 6273 /* Placeholder */ 6274 return 0; 6275 } 6276 6277 void l2cap_chan_busy(struct l2cap_chan *chan, int busy) 6278 { 6279 u8 event; 6280 6281 if (chan->mode != L2CAP_MODE_ERTM) 6282 return; 6283 6284 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR; 6285 l2cap_tx(chan, NULL, NULL, event); 6286 } 6287 6288 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan) 6289 { 6290 int err = 0; 6291 /* Pass sequential frames to l2cap_reassemble_sdu() 6292 * until a gap is encountered. 6293 */ 6294 6295 BT_DBG("chan %p", chan); 6296 6297 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6298 struct sk_buff *skb; 6299 BT_DBG("Searching for skb with txseq %d (queue len %d)", 6300 chan->buffer_seq, skb_queue_len(&chan->srej_q)); 6301 6302 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq); 6303 6304 if (!skb) 6305 break; 6306 6307 skb_unlink(skb, &chan->srej_q); 6308 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 6309 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap); 6310 if (err) 6311 break; 6312 } 6313 6314 if (skb_queue_empty(&chan->srej_q)) { 6315 chan->rx_state = L2CAP_RX_STATE_RECV; 6316 l2cap_send_ack(chan); 6317 } 6318 6319 return err; 6320 } 6321 6322 static void l2cap_handle_srej(struct l2cap_chan *chan, 6323 struct l2cap_ctrl *control) 6324 { 6325 struct sk_buff *skb; 6326 6327 BT_DBG("chan %p, control %p", chan, control); 6328 6329 if (control->reqseq == chan->next_tx_seq) { 6330 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6331 l2cap_send_disconn_req(chan, ECONNRESET); 6332 return; 6333 } 6334 6335 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6336 6337 if (skb == NULL) { 6338 BT_DBG("Seq %d not available for retransmission", 6339 control->reqseq); 6340 return; 6341 } 6342 6343 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6344 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6345 l2cap_send_disconn_req(chan, ECONNRESET); 6346 return; 6347 } 6348 6349 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6350 6351 if (control->poll) { 6352 l2cap_pass_to_tx(chan, control); 6353 6354 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6355 l2cap_retransmit(chan, control); 6356 l2cap_ertm_send(chan); 6357 6358 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6359 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6360 chan->srej_save_reqseq = control->reqseq; 6361 } 6362 } else { 6363 l2cap_pass_to_tx_fbit(chan, control); 6364 6365 if (control->final) { 6366 if (chan->srej_save_reqseq != control->reqseq || 6367 !test_and_clear_bit(CONN_SREJ_ACT, 6368 &chan->conn_state)) 6369 l2cap_retransmit(chan, control); 6370 } else { 6371 l2cap_retransmit(chan, control); 6372 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6373 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6374 chan->srej_save_reqseq = control->reqseq; 6375 } 6376 } 6377 } 6378 } 6379 6380 static void l2cap_handle_rej(struct l2cap_chan *chan, 6381 struct l2cap_ctrl *control) 6382 { 6383 struct sk_buff *skb; 6384 6385 BT_DBG("chan %p, control %p", chan, control); 6386 6387 if (control->reqseq == chan->next_tx_seq) { 6388 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6389 l2cap_send_disconn_req(chan, ECONNRESET); 6390 return; 6391 } 6392 6393 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6394 6395 if (chan->max_tx && skb && 6396 bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6397 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6398 l2cap_send_disconn_req(chan, ECONNRESET); 6399 return; 6400 } 6401 6402 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6403 6404 l2cap_pass_to_tx(chan, control); 6405 6406 if (control->final) { 6407 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 6408 l2cap_retransmit_all(chan, control); 6409 } else { 6410 l2cap_retransmit_all(chan, control); 6411 l2cap_ertm_send(chan); 6412 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) 6413 set_bit(CONN_REJ_ACT, &chan->conn_state); 6414 } 6415 } 6416 6417 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq) 6418 { 6419 BT_DBG("chan %p, txseq %d", chan, txseq); 6420 6421 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq, 6422 chan->expected_tx_seq); 6423 6424 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 6425 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6426 chan->tx_win) { 6427 /* See notes below regarding "double poll" and 6428 * invalid packets. 6429 */ 6430 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6431 BT_DBG("Invalid/Ignore - after SREJ"); 6432 return L2CAP_TXSEQ_INVALID_IGNORE; 6433 } else { 6434 BT_DBG("Invalid - in window after SREJ sent"); 6435 return L2CAP_TXSEQ_INVALID; 6436 } 6437 } 6438 6439 if (chan->srej_list.head == txseq) { 6440 BT_DBG("Expected SREJ"); 6441 return L2CAP_TXSEQ_EXPECTED_SREJ; 6442 } 6443 6444 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) { 6445 BT_DBG("Duplicate SREJ - txseq already stored"); 6446 return L2CAP_TXSEQ_DUPLICATE_SREJ; 6447 } 6448 6449 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) { 6450 BT_DBG("Unexpected SREJ - not requested"); 6451 return L2CAP_TXSEQ_UNEXPECTED_SREJ; 6452 } 6453 } 6454 6455 if (chan->expected_tx_seq == txseq) { 6456 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6457 chan->tx_win) { 6458 BT_DBG("Invalid - txseq outside tx window"); 6459 return L2CAP_TXSEQ_INVALID; 6460 } else { 6461 BT_DBG("Expected"); 6462 return L2CAP_TXSEQ_EXPECTED; 6463 } 6464 } 6465 6466 if (__seq_offset(chan, txseq, chan->last_acked_seq) < 6467 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) { 6468 BT_DBG("Duplicate - expected_tx_seq later than txseq"); 6469 return L2CAP_TXSEQ_DUPLICATE; 6470 } 6471 6472 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) { 6473 /* A source of invalid packets is a "double poll" condition, 6474 * where delays cause us to send multiple poll packets. If 6475 * the remote stack receives and processes both polls, 6476 * sequence numbers can wrap around in such a way that a 6477 * resent frame has a sequence number that looks like new data 6478 * with a sequence gap. This would trigger an erroneous SREJ 6479 * request. 6480 * 6481 * Fortunately, this is impossible with a tx window that's 6482 * less than half of the maximum sequence number, which allows 6483 * invalid frames to be safely ignored. 6484 * 6485 * With tx window sizes greater than half of the tx window 6486 * maximum, the frame is invalid and cannot be ignored. This 6487 * causes a disconnect. 6488 */ 6489 6490 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6491 BT_DBG("Invalid/Ignore - txseq outside tx window"); 6492 return L2CAP_TXSEQ_INVALID_IGNORE; 6493 } else { 6494 BT_DBG("Invalid - txseq outside tx window"); 6495 return L2CAP_TXSEQ_INVALID; 6496 } 6497 } else { 6498 BT_DBG("Unexpected - txseq indicates missing frames"); 6499 return L2CAP_TXSEQ_UNEXPECTED; 6500 } 6501 } 6502 6503 static int l2cap_rx_state_recv(struct l2cap_chan *chan, 6504 struct l2cap_ctrl *control, 6505 struct sk_buff *skb, u8 event) 6506 { 6507 struct l2cap_ctrl local_control; 6508 int err = 0; 6509 bool skb_in_use = false; 6510 6511 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6512 event); 6513 6514 switch (event) { 6515 case L2CAP_EV_RECV_IFRAME: 6516 switch (l2cap_classify_txseq(chan, control->txseq)) { 6517 case L2CAP_TXSEQ_EXPECTED: 6518 l2cap_pass_to_tx(chan, control); 6519 6520 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6521 BT_DBG("Busy, discarding expected seq %d", 6522 control->txseq); 6523 break; 6524 } 6525 6526 chan->expected_tx_seq = __next_seq(chan, 6527 control->txseq); 6528 6529 chan->buffer_seq = chan->expected_tx_seq; 6530 skb_in_use = true; 6531 6532 /* l2cap_reassemble_sdu may free skb, hence invalidate 6533 * control, so make a copy in advance to use it after 6534 * l2cap_reassemble_sdu returns and to avoid the race 6535 * condition, for example: 6536 * 6537 * The current thread calls: 6538 * l2cap_reassemble_sdu 6539 * chan->ops->recv == l2cap_sock_recv_cb 6540 * __sock_queue_rcv_skb 6541 * Another thread calls: 6542 * bt_sock_recvmsg 6543 * skb_recv_datagram 6544 * skb_free_datagram 6545 * Then the current thread tries to access control, but 6546 * it was freed by skb_free_datagram. 6547 */ 6548 local_control = *control; 6549 err = l2cap_reassemble_sdu(chan, skb, control); 6550 if (err) 6551 break; 6552 6553 if (local_control.final) { 6554 if (!test_and_clear_bit(CONN_REJ_ACT, 6555 &chan->conn_state)) { 6556 local_control.final = 0; 6557 l2cap_retransmit_all(chan, &local_control); 6558 l2cap_ertm_send(chan); 6559 } 6560 } 6561 6562 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 6563 l2cap_send_ack(chan); 6564 break; 6565 case L2CAP_TXSEQ_UNEXPECTED: 6566 l2cap_pass_to_tx(chan, control); 6567 6568 /* Can't issue SREJ frames in the local busy state. 6569 * Drop this frame, it will be seen as missing 6570 * when local busy is exited. 6571 */ 6572 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6573 BT_DBG("Busy, discarding unexpected seq %d", 6574 control->txseq); 6575 break; 6576 } 6577 6578 /* There was a gap in the sequence, so an SREJ 6579 * must be sent for each missing frame. The 6580 * current frame is stored for later use. 6581 */ 6582 skb_queue_tail(&chan->srej_q, skb); 6583 skb_in_use = true; 6584 BT_DBG("Queued %p (queue len %d)", skb, 6585 skb_queue_len(&chan->srej_q)); 6586 6587 clear_bit(CONN_SREJ_ACT, &chan->conn_state); 6588 l2cap_seq_list_clear(&chan->srej_list); 6589 l2cap_send_srej(chan, control->txseq); 6590 6591 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT; 6592 break; 6593 case L2CAP_TXSEQ_DUPLICATE: 6594 l2cap_pass_to_tx(chan, control); 6595 break; 6596 case L2CAP_TXSEQ_INVALID_IGNORE: 6597 break; 6598 case L2CAP_TXSEQ_INVALID: 6599 default: 6600 l2cap_send_disconn_req(chan, ECONNRESET); 6601 break; 6602 } 6603 break; 6604 case L2CAP_EV_RECV_RR: 6605 l2cap_pass_to_tx(chan, control); 6606 if (control->final) { 6607 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6608 6609 if (!test_and_clear_bit(CONN_REJ_ACT, 6610 &chan->conn_state)) { 6611 control->final = 0; 6612 l2cap_retransmit_all(chan, control); 6613 } 6614 6615 l2cap_ertm_send(chan); 6616 } else if (control->poll) { 6617 l2cap_send_i_or_rr_or_rnr(chan); 6618 } else { 6619 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6620 &chan->conn_state) && 6621 chan->unacked_frames) 6622 __set_retrans_timer(chan); 6623 6624 l2cap_ertm_send(chan); 6625 } 6626 break; 6627 case L2CAP_EV_RECV_RNR: 6628 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6629 l2cap_pass_to_tx(chan, control); 6630 if (control && control->poll) { 6631 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6632 l2cap_send_rr_or_rnr(chan, 0); 6633 } 6634 __clear_retrans_timer(chan); 6635 l2cap_seq_list_clear(&chan->retrans_list); 6636 break; 6637 case L2CAP_EV_RECV_REJ: 6638 l2cap_handle_rej(chan, control); 6639 break; 6640 case L2CAP_EV_RECV_SREJ: 6641 l2cap_handle_srej(chan, control); 6642 break; 6643 default: 6644 break; 6645 } 6646 6647 if (skb && !skb_in_use) { 6648 BT_DBG("Freeing %p", skb); 6649 kfree_skb(skb); 6650 } 6651 6652 return err; 6653 } 6654 6655 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan, 6656 struct l2cap_ctrl *control, 6657 struct sk_buff *skb, u8 event) 6658 { 6659 int err = 0; 6660 u16 txseq = control->txseq; 6661 bool skb_in_use = false; 6662 6663 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6664 event); 6665 6666 switch (event) { 6667 case L2CAP_EV_RECV_IFRAME: 6668 switch (l2cap_classify_txseq(chan, txseq)) { 6669 case L2CAP_TXSEQ_EXPECTED: 6670 /* Keep frame for reassembly later */ 6671 l2cap_pass_to_tx(chan, control); 6672 skb_queue_tail(&chan->srej_q, skb); 6673 skb_in_use = true; 6674 BT_DBG("Queued %p (queue len %d)", skb, 6675 skb_queue_len(&chan->srej_q)); 6676 6677 chan->expected_tx_seq = __next_seq(chan, txseq); 6678 break; 6679 case L2CAP_TXSEQ_EXPECTED_SREJ: 6680 l2cap_seq_list_pop(&chan->srej_list); 6681 6682 l2cap_pass_to_tx(chan, control); 6683 skb_queue_tail(&chan->srej_q, skb); 6684 skb_in_use = true; 6685 BT_DBG("Queued %p (queue len %d)", skb, 6686 skb_queue_len(&chan->srej_q)); 6687 6688 err = l2cap_rx_queued_iframes(chan); 6689 if (err) 6690 break; 6691 6692 break; 6693 case L2CAP_TXSEQ_UNEXPECTED: 6694 /* Got a frame that can't be reassembled yet. 6695 * Save it for later, and send SREJs to cover 6696 * the missing frames. 6697 */ 6698 skb_queue_tail(&chan->srej_q, skb); 6699 skb_in_use = true; 6700 BT_DBG("Queued %p (queue len %d)", skb, 6701 skb_queue_len(&chan->srej_q)); 6702 6703 l2cap_pass_to_tx(chan, control); 6704 l2cap_send_srej(chan, control->txseq); 6705 break; 6706 case L2CAP_TXSEQ_UNEXPECTED_SREJ: 6707 /* This frame was requested with an SREJ, but 6708 * some expected retransmitted frames are 6709 * missing. Request retransmission of missing 6710 * SREJ'd frames. 6711 */ 6712 skb_queue_tail(&chan->srej_q, skb); 6713 skb_in_use = true; 6714 BT_DBG("Queued %p (queue len %d)", skb, 6715 skb_queue_len(&chan->srej_q)); 6716 6717 l2cap_pass_to_tx(chan, control); 6718 l2cap_send_srej_list(chan, control->txseq); 6719 break; 6720 case L2CAP_TXSEQ_DUPLICATE_SREJ: 6721 /* We've already queued this frame. Drop this copy. */ 6722 l2cap_pass_to_tx(chan, control); 6723 break; 6724 case L2CAP_TXSEQ_DUPLICATE: 6725 /* Expecting a later sequence number, so this frame 6726 * was already received. Ignore it completely. 6727 */ 6728 break; 6729 case L2CAP_TXSEQ_INVALID_IGNORE: 6730 break; 6731 case L2CAP_TXSEQ_INVALID: 6732 default: 6733 l2cap_send_disconn_req(chan, ECONNRESET); 6734 break; 6735 } 6736 break; 6737 case L2CAP_EV_RECV_RR: 6738 l2cap_pass_to_tx(chan, control); 6739 if (control->final) { 6740 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6741 6742 if (!test_and_clear_bit(CONN_REJ_ACT, 6743 &chan->conn_state)) { 6744 control->final = 0; 6745 l2cap_retransmit_all(chan, control); 6746 } 6747 6748 l2cap_ertm_send(chan); 6749 } else if (control->poll) { 6750 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6751 &chan->conn_state) && 6752 chan->unacked_frames) { 6753 __set_retrans_timer(chan); 6754 } 6755 6756 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6757 l2cap_send_srej_tail(chan); 6758 } else { 6759 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6760 &chan->conn_state) && 6761 chan->unacked_frames) 6762 __set_retrans_timer(chan); 6763 6764 l2cap_send_ack(chan); 6765 } 6766 break; 6767 case L2CAP_EV_RECV_RNR: 6768 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6769 l2cap_pass_to_tx(chan, control); 6770 if (control->poll) { 6771 l2cap_send_srej_tail(chan); 6772 } else { 6773 struct l2cap_ctrl rr_control; 6774 memset(&rr_control, 0, sizeof(rr_control)); 6775 rr_control.sframe = 1; 6776 rr_control.super = L2CAP_SUPER_RR; 6777 rr_control.reqseq = chan->buffer_seq; 6778 l2cap_send_sframe(chan, &rr_control); 6779 } 6780 6781 break; 6782 case L2CAP_EV_RECV_REJ: 6783 l2cap_handle_rej(chan, control); 6784 break; 6785 case L2CAP_EV_RECV_SREJ: 6786 l2cap_handle_srej(chan, control); 6787 break; 6788 } 6789 6790 if (skb && !skb_in_use) { 6791 BT_DBG("Freeing %p", skb); 6792 kfree_skb(skb); 6793 } 6794 6795 return err; 6796 } 6797 6798 static int l2cap_finish_move(struct l2cap_chan *chan) 6799 { 6800 BT_DBG("chan %p", chan); 6801 6802 chan->rx_state = L2CAP_RX_STATE_RECV; 6803 chan->conn->mtu = chan->conn->hcon->mtu; 6804 6805 return l2cap_resegment(chan); 6806 } 6807 6808 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan, 6809 struct l2cap_ctrl *control, 6810 struct sk_buff *skb, u8 event) 6811 { 6812 int err; 6813 6814 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6815 event); 6816 6817 if (!control->poll) 6818 return -EPROTO; 6819 6820 l2cap_process_reqseq(chan, control->reqseq); 6821 6822 if (!skb_queue_empty(&chan->tx_q)) 6823 chan->tx_send_head = skb_peek(&chan->tx_q); 6824 else 6825 chan->tx_send_head = NULL; 6826 6827 /* Rewind next_tx_seq to the point expected 6828 * by the receiver. 6829 */ 6830 chan->next_tx_seq = control->reqseq; 6831 chan->unacked_frames = 0; 6832 6833 err = l2cap_finish_move(chan); 6834 if (err) 6835 return err; 6836 6837 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6838 l2cap_send_i_or_rr_or_rnr(chan); 6839 6840 if (event == L2CAP_EV_RECV_IFRAME) 6841 return -EPROTO; 6842 6843 return l2cap_rx_state_recv(chan, control, NULL, event); 6844 } 6845 6846 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, 6847 struct l2cap_ctrl *control, 6848 struct sk_buff *skb, u8 event) 6849 { 6850 int err; 6851 6852 if (!control->final) 6853 return -EPROTO; 6854 6855 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6856 6857 chan->rx_state = L2CAP_RX_STATE_RECV; 6858 l2cap_process_reqseq(chan, control->reqseq); 6859 6860 if (!skb_queue_empty(&chan->tx_q)) 6861 chan->tx_send_head = skb_peek(&chan->tx_q); 6862 else 6863 chan->tx_send_head = NULL; 6864 6865 /* Rewind next_tx_seq to the point expected 6866 * by the receiver. 6867 */ 6868 chan->next_tx_seq = control->reqseq; 6869 chan->unacked_frames = 0; 6870 chan->conn->mtu = chan->conn->hcon->mtu; 6871 6872 err = l2cap_resegment(chan); 6873 6874 if (!err) 6875 err = l2cap_rx_state_recv(chan, control, skb, event); 6876 6877 return err; 6878 } 6879 6880 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq) 6881 { 6882 /* Make sure reqseq is for a packet that has been sent but not acked */ 6883 u16 unacked; 6884 6885 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq); 6886 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked; 6887 } 6888 6889 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 6890 struct sk_buff *skb, u8 event) 6891 { 6892 int err = 0; 6893 6894 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan, 6895 control, skb, event, chan->rx_state); 6896 6897 if (__valid_reqseq(chan, control->reqseq)) { 6898 switch (chan->rx_state) { 6899 case L2CAP_RX_STATE_RECV: 6900 err = l2cap_rx_state_recv(chan, control, skb, event); 6901 break; 6902 case L2CAP_RX_STATE_SREJ_SENT: 6903 err = l2cap_rx_state_srej_sent(chan, control, skb, 6904 event); 6905 break; 6906 case L2CAP_RX_STATE_WAIT_P: 6907 err = l2cap_rx_state_wait_p(chan, control, skb, event); 6908 break; 6909 case L2CAP_RX_STATE_WAIT_F: 6910 err = l2cap_rx_state_wait_f(chan, control, skb, event); 6911 break; 6912 default: 6913 /* shut it down */ 6914 break; 6915 } 6916 } else { 6917 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d", 6918 control->reqseq, chan->next_tx_seq, 6919 chan->expected_ack_seq); 6920 l2cap_send_disconn_req(chan, ECONNRESET); 6921 } 6922 6923 return err; 6924 } 6925 6926 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 6927 struct sk_buff *skb) 6928 { 6929 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store 6930 * the txseq field in advance to use it after l2cap_reassemble_sdu 6931 * returns and to avoid the race condition, for example: 6932 * 6933 * The current thread calls: 6934 * l2cap_reassemble_sdu 6935 * chan->ops->recv == l2cap_sock_recv_cb 6936 * __sock_queue_rcv_skb 6937 * Another thread calls: 6938 * bt_sock_recvmsg 6939 * skb_recv_datagram 6940 * skb_free_datagram 6941 * Then the current thread tries to access control, but it was freed by 6942 * skb_free_datagram. 6943 */ 6944 u16 txseq = control->txseq; 6945 6946 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, 6947 chan->rx_state); 6948 6949 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) { 6950 l2cap_pass_to_tx(chan, control); 6951 6952 BT_DBG("buffer_seq %u->%u", chan->buffer_seq, 6953 __next_seq(chan, chan->buffer_seq)); 6954 6955 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 6956 6957 l2cap_reassemble_sdu(chan, skb, control); 6958 } else { 6959 if (chan->sdu) { 6960 kfree_skb(chan->sdu); 6961 chan->sdu = NULL; 6962 } 6963 chan->sdu_last_frag = NULL; 6964 chan->sdu_len = 0; 6965 6966 if (skb) { 6967 BT_DBG("Freeing %p", skb); 6968 kfree_skb(skb); 6969 } 6970 } 6971 6972 chan->last_acked_seq = txseq; 6973 chan->expected_tx_seq = __next_seq(chan, txseq); 6974 6975 return 0; 6976 } 6977 6978 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 6979 { 6980 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap; 6981 u16 len, min_len; 6982 u8 event; 6983 6984 min_len = test_bit(FLAG_EXT_CTRL, &chan->flags) ? 6985 L2CAP_EXT_CTRL_SIZE : L2CAP_ENH_CTRL_SIZE; 6986 if (chan->fcs == L2CAP_FCS_CRC16) 6987 min_len += L2CAP_FCS_SIZE; 6988 6989 if (skb->len < min_len) 6990 goto drop; 6991 6992 __unpack_control(chan, skb); 6993 6994 len = skb->len; 6995 6996 /* 6997 * We can just drop the corrupted I-frame here. 6998 * Receiver will miss it and start proper recovery 6999 * procedures and ask for retransmission. 7000 */ 7001 if (l2cap_check_fcs(chan, skb)) 7002 goto drop; 7003 7004 if (!control->sframe && control->sar == L2CAP_SAR_START) 7005 len -= L2CAP_SDULEN_SIZE; 7006 7007 if (chan->fcs == L2CAP_FCS_CRC16) 7008 len -= L2CAP_FCS_SIZE; 7009 7010 if (len > chan->mps) { 7011 l2cap_send_disconn_req(chan, ECONNRESET); 7012 goto drop; 7013 } 7014 7015 if (chan->ops->filter) { 7016 if (chan->ops->filter(chan, skb)) 7017 goto drop; 7018 } 7019 7020 if (!control->sframe) { 7021 int err; 7022 7023 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d", 7024 control->sar, control->reqseq, control->final, 7025 control->txseq); 7026 7027 /* Validate F-bit - F=0 always valid, F=1 only 7028 * valid in TX WAIT_F 7029 */ 7030 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F) 7031 goto drop; 7032 7033 if (chan->mode != L2CAP_MODE_STREAMING) { 7034 event = L2CAP_EV_RECV_IFRAME; 7035 err = l2cap_rx(chan, control, skb, event); 7036 } else { 7037 err = l2cap_stream_rx(chan, control, skb); 7038 } 7039 7040 if (err) 7041 l2cap_send_disconn_req(chan, ECONNRESET); 7042 } else { 7043 const u8 rx_func_to_event[4] = { 7044 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ, 7045 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ 7046 }; 7047 7048 /* Only I-frames are expected in streaming mode */ 7049 if (chan->mode == L2CAP_MODE_STREAMING) 7050 goto drop; 7051 7052 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d", 7053 control->reqseq, control->final, control->poll, 7054 control->super); 7055 7056 if (len != 0) { 7057 BT_ERR("Trailing bytes: %d in sframe", len); 7058 l2cap_send_disconn_req(chan, ECONNRESET); 7059 goto drop; 7060 } 7061 7062 /* Validate F and P bits */ 7063 if (control->final && (control->poll || 7064 chan->tx_state != L2CAP_TX_STATE_WAIT_F)) 7065 goto drop; 7066 7067 event = rx_func_to_event[control->super]; 7068 if (l2cap_rx(chan, control, skb, event)) 7069 l2cap_send_disconn_req(chan, ECONNRESET); 7070 } 7071 7072 return 0; 7073 7074 drop: 7075 kfree_skb(skb); 7076 return 0; 7077 } 7078 7079 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan) 7080 { 7081 struct l2cap_conn *conn = chan->conn; 7082 struct l2cap_le_credits pkt; 7083 u16 return_credits = l2cap_le_rx_credits(chan); 7084 int ident; 7085 7086 if (chan->mode != L2CAP_MODE_LE_FLOWCTL && 7087 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 7088 return; 7089 7090 if (chan->rx_credits >= return_credits) 7091 return; 7092 7093 return_credits -= chan->rx_credits; 7094 7095 BT_DBG("chan %p returning %u credits to sender", chan, return_credits); 7096 7097 chan->rx_credits += return_credits; 7098 7099 pkt.cid = cpu_to_le16(chan->scid); 7100 pkt.credits = cpu_to_le16(return_credits); 7101 7102 ident = l2cap_get_ident(conn); 7103 7104 l2cap_send_cmd(conn, ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); 7105 7106 /* L2CAP_LE_CREDITS has no response so the ident is never released by 7107 * l2cap_put_ident() - release it right away, otherwise the tx_ida 7108 * range is exhausted after 254 packets and from then on credits are 7109 * sent with the invalid ident 0, which some remote stacks ignore, 7110 * stalling the channel. 7111 */ 7112 if (ident > 0) 7113 ida_free(&conn->tx_ida, ident); 7114 } 7115 7116 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail) 7117 { 7118 if (chan->rx_avail == rx_avail) 7119 return; 7120 7121 BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail); 7122 7123 chan->rx_avail = rx_avail; 7124 7125 if (chan->state == BT_CONNECTED) 7126 l2cap_chan_le_send_credits(chan); 7127 } 7128 7129 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb) 7130 { 7131 int err; 7132 7133 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len); 7134 7135 /* Wait recv to confirm reception before updating the credits */ 7136 err = chan->ops->recv(chan, skb); 7137 7138 if (err < 0 && chan->rx_avail != -1) { 7139 BT_ERR("Queueing received LE L2CAP data failed"); 7140 l2cap_send_disconn_req(chan, ECONNRESET); 7141 return err; 7142 } 7143 7144 /* Update credits whenever an SDU is received */ 7145 l2cap_chan_le_send_credits(chan); 7146 7147 return err; 7148 } 7149 7150 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 7151 { 7152 int err; 7153 7154 if (!chan->rx_credits) { 7155 BT_ERR("No credits to receive LE L2CAP data"); 7156 l2cap_send_disconn_req(chan, ECONNRESET); 7157 return -ENOBUFS; 7158 } 7159 7160 if (skb->len > chan->imtu) { 7161 BT_ERR("Too big LE L2CAP PDU: len %u > %u", skb->len, 7162 chan->imtu); 7163 l2cap_send_disconn_req(chan, ECONNRESET); 7164 return -ENOBUFS; 7165 } 7166 7167 if (skb->len > chan->mps) { 7168 BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len, 7169 chan->mps); 7170 l2cap_send_disconn_req(chan, ECONNRESET); 7171 return -ENOBUFS; 7172 } 7173 7174 chan->rx_credits--; 7175 BT_DBG("chan %p: rx_credits %u -> %u", 7176 chan, chan->rx_credits + 1, chan->rx_credits); 7177 7178 /* Update if remote had run out of credits, this should only happens 7179 * if the remote is not using the entire MPS. 7180 */ 7181 if (!chan->rx_credits) 7182 l2cap_chan_le_send_credits(chan); 7183 7184 err = 0; 7185 7186 if (!chan->sdu) { 7187 u16 sdu_len; 7188 7189 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) { 7190 err = -EINVAL; 7191 goto failed; 7192 } 7193 7194 sdu_len = get_unaligned_le16(skb->data); 7195 skb_pull(skb, L2CAP_SDULEN_SIZE); 7196 7197 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u", 7198 sdu_len, skb->len, chan->imtu); 7199 7200 if (sdu_len > chan->imtu) { 7201 BT_ERR("Too big LE L2CAP SDU length: len %u > %u", 7202 sdu_len, chan->imtu); 7203 l2cap_send_disconn_req(chan, ECONNRESET); 7204 err = -EMSGSIZE; 7205 goto failed; 7206 } 7207 7208 if (skb->len > sdu_len) { 7209 BT_ERR("Too much LE L2CAP data received"); 7210 err = -EINVAL; 7211 goto failed; 7212 } 7213 7214 if (skb->len == sdu_len) 7215 return l2cap_ecred_recv(chan, skb); 7216 7217 chan->sdu = skb; 7218 chan->sdu_len = sdu_len; 7219 chan->sdu_last_frag = skb; 7220 7221 /* Detect if remote is not able to use the selected MPS */ 7222 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) { 7223 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE; 7224 7225 /* Adjust the number of credits */ 7226 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len); 7227 chan->mps = mps_len; 7228 l2cap_chan_le_send_credits(chan); 7229 } 7230 7231 return 0; 7232 } 7233 7234 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u", 7235 chan->sdu->len, skb->len, chan->sdu_len); 7236 7237 if (chan->sdu->len + skb->len > chan->sdu_len) { 7238 BT_ERR("Too much LE L2CAP data received"); 7239 l2cap_send_disconn_req(chan, ECONNRESET); 7240 err = -EINVAL; 7241 goto failed; 7242 } 7243 7244 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag); 7245 skb = NULL; 7246 7247 if (chan->sdu->len == chan->sdu_len) { 7248 err = l2cap_ecred_recv(chan, chan->sdu); 7249 if (!err) { 7250 chan->sdu = NULL; 7251 chan->sdu_last_frag = NULL; 7252 chan->sdu_len = 0; 7253 } 7254 } 7255 7256 failed: 7257 if (err) { 7258 kfree_skb(skb); 7259 kfree_skb(chan->sdu); 7260 chan->sdu = NULL; 7261 chan->sdu_last_frag = NULL; 7262 chan->sdu_len = 0; 7263 } 7264 7265 /* We can't return an error here since we took care of the skb 7266 * freeing internally. An error return would cause the caller to 7267 * do a double-free of the skb. 7268 */ 7269 return 0; 7270 } 7271 7272 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid, 7273 struct sk_buff *skb) 7274 __must_hold(&conn->lock) 7275 { 7276 struct l2cap_chan *chan; 7277 7278 chan = l2cap_get_chan_by_scid(conn, cid); 7279 if (!chan) { 7280 BT_DBG("unknown cid 0x%4.4x", cid); 7281 /* Drop packet and return */ 7282 kfree_skb(skb); 7283 return; 7284 } 7285 7286 l2cap_chan_lock(chan); 7287 7288 lockdep_assert_held(&chan->conn->lock); 7289 7290 BT_DBG("chan %p, len %d", chan, skb->len); 7291 7292 /* If we receive data on a fixed channel before the info req/rsp 7293 * procedure is done simply assume that the channel is supported 7294 * and mark it as ready. 7295 */ 7296 if (chan->chan_type == L2CAP_CHAN_FIXED) 7297 l2cap_chan_ready(chan); 7298 7299 if (chan->state != BT_CONNECTED) 7300 goto drop; 7301 7302 switch (chan->mode) { 7303 case L2CAP_MODE_LE_FLOWCTL: 7304 case L2CAP_MODE_EXT_FLOWCTL: 7305 if (l2cap_ecred_data_rcv(chan, skb) < 0) 7306 goto drop; 7307 7308 goto done; 7309 7310 case L2CAP_MODE_BASIC: 7311 /* If socket recv buffers overflows we drop data here 7312 * which is *bad* because L2CAP has to be reliable. 7313 * But we don't have any other choice. L2CAP doesn't 7314 * provide flow control mechanism. */ 7315 7316 if (chan->imtu < skb->len) { 7317 BT_ERR("Dropping L2CAP data: receive buffer overflow"); 7318 goto drop; 7319 } 7320 7321 if (!chan->ops->recv(chan, skb)) 7322 goto done; 7323 break; 7324 7325 case L2CAP_MODE_ERTM: 7326 case L2CAP_MODE_STREAMING: 7327 l2cap_data_rcv(chan, skb); 7328 goto done; 7329 7330 default: 7331 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode); 7332 break; 7333 } 7334 7335 drop: 7336 kfree_skb(skb); 7337 7338 done: 7339 l2cap_chan_unlock(chan); 7340 l2cap_chan_put(chan); 7341 } 7342 7343 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, 7344 struct sk_buff *skb) 7345 { 7346 struct hci_conn *hcon = conn->hcon; 7347 struct l2cap_chan *chan; 7348 7349 if (hcon->type != ACL_LINK) 7350 goto free_skb; 7351 7352 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst, 7353 ACL_LINK); 7354 if (!chan) 7355 goto free_skb; 7356 7357 BT_DBG("chan %p, len %d", chan, skb->len); 7358 7359 l2cap_chan_lock(chan); 7360 7361 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 7362 goto drop; 7363 7364 if (chan->imtu < skb->len) 7365 goto drop; 7366 7367 /* Store remote BD_ADDR and PSM for msg_name */ 7368 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst); 7369 bt_cb(skb)->l2cap.psm = psm; 7370 7371 if (!chan->ops->recv(chan, skb)) { 7372 l2cap_chan_unlock(chan); 7373 l2cap_chan_put(chan); 7374 return; 7375 } 7376 7377 drop: 7378 l2cap_chan_unlock(chan); 7379 l2cap_chan_put(chan); 7380 free_skb: 7381 kfree_skb(skb); 7382 } 7383 7384 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb) 7385 __must_hold(&conn->lock) 7386 { 7387 struct l2cap_hdr *lh = (void *) skb->data; 7388 struct hci_conn *hcon = conn->hcon; 7389 u16 cid, len; 7390 __le16 psm; 7391 7392 if (hcon->state != BT_CONNECTED) { 7393 BT_DBG("queueing pending rx skb"); 7394 skb_queue_tail(&conn->pending_rx, skb); 7395 return; 7396 } 7397 7398 skb_pull(skb, L2CAP_HDR_SIZE); 7399 cid = __le16_to_cpu(lh->cid); 7400 len = __le16_to_cpu(lh->len); 7401 7402 if (len != skb->len) { 7403 kfree_skb(skb); 7404 return; 7405 } 7406 7407 /* Since we can't actively block incoming LE connections we must 7408 * at least ensure that we ignore incoming data from them. 7409 */ 7410 if (hcon->type == LE_LINK && 7411 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst, 7412 bdaddr_dst_type(hcon))) { 7413 kfree_skb(skb); 7414 return; 7415 } 7416 7417 BT_DBG("len %d, cid 0x%4.4x", len, cid); 7418 7419 switch (cid) { 7420 case L2CAP_CID_SIGNALING: 7421 l2cap_sig_channel(conn, skb); 7422 break; 7423 7424 case L2CAP_CID_CONN_LESS: 7425 if (skb->len < L2CAP_PSMLEN_SIZE) { 7426 kfree_skb(skb); 7427 break; 7428 } 7429 7430 psm = get_unaligned((__le16 *) skb->data); 7431 skb_pull(skb, L2CAP_PSMLEN_SIZE); 7432 l2cap_conless_channel(conn, psm, skb); 7433 break; 7434 7435 case L2CAP_CID_LE_SIGNALING: 7436 l2cap_le_sig_channel(conn, skb); 7437 break; 7438 7439 default: 7440 l2cap_data_channel(conn, cid, skb); 7441 break; 7442 } 7443 } 7444 7445 static void process_pending_rx(struct work_struct *work) 7446 { 7447 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 7448 pending_rx_work); 7449 struct sk_buff *skb; 7450 7451 BT_DBG(""); 7452 7453 mutex_lock(&conn->lock); 7454 7455 while ((skb = skb_dequeue(&conn->pending_rx))) 7456 l2cap_recv_frame(conn, skb); 7457 7458 mutex_unlock(&conn->lock); 7459 } 7460 7461 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) 7462 __must_hold(&hcon->hdev->lock) 7463 { 7464 struct l2cap_conn *conn = hcon->l2cap_data; 7465 struct hci_chan *hchan; 7466 7467 if (conn) 7468 return conn; 7469 7470 hchan = hci_chan_create(hcon); 7471 if (!hchan) 7472 return NULL; 7473 7474 conn = kzalloc_obj(*conn); 7475 if (!conn) { 7476 hci_chan_del(hchan); 7477 return NULL; 7478 } 7479 7480 kref_init(&conn->ref); 7481 conn->hchan = hchan; 7482 7483 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); 7484 7485 conn->mtu = hcon->mtu; 7486 conn->feat_mask = 0; 7487 7488 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; 7489 7490 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) && 7491 (bredr_sc_enabled(hcon->hdev) || 7492 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP))) 7493 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR; 7494 7495 scoped_guard(mutex_init, &conn->lock) { 7496 INIT_LIST_HEAD(&conn->chan_l); 7497 } 7498 INIT_LIST_HEAD(&conn->users); 7499 7500 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout); 7501 ida_init(&conn->tx_ida); 7502 7503 skb_queue_head_init(&conn->pending_rx); 7504 INIT_WORK(&conn->pending_rx_work, process_pending_rx); 7505 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr); 7506 7507 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 7508 7509 spin_lock(&hcon->proto_lock); 7510 conn->hcon = hci_conn_get(hcon); 7511 hcon->l2cap_data = conn; 7512 spin_unlock(&hcon->proto_lock); 7513 7514 return conn; 7515 } 7516 7517 static bool is_valid_psm(u16 psm, u8 dst_type) 7518 { 7519 if (!psm) 7520 return false; 7521 7522 if (bdaddr_type_is_le(dst_type)) 7523 return (psm <= 0x00ff); 7524 7525 /* PSM must be odd and lsb of upper byte must be 0 */ 7526 return ((psm & 0x0101) == 0x0001); 7527 } 7528 7529 struct l2cap_chan_data { 7530 struct l2cap_chan *chan; 7531 struct pid *pid; 7532 int count; 7533 }; 7534 7535 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data) 7536 { 7537 struct l2cap_chan_data *d = data; 7538 struct pid *pid; 7539 7540 if (chan == d->chan) 7541 return; 7542 7543 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags)) 7544 return; 7545 7546 pid = chan->ops->get_peer_pid(chan); 7547 7548 /* Only count deferred channels with the same PID/PSM */ 7549 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident || 7550 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 7551 return; 7552 7553 d->count++; 7554 } 7555 7556 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, 7557 bdaddr_t *dst, u8 dst_type, u16 timeout) 7558 { 7559 struct l2cap_conn *conn; 7560 struct hci_conn *hcon; 7561 struct hci_dev *hdev; 7562 int err; 7563 7564 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src, 7565 dst, dst_type, __le16_to_cpu(psm), chan->mode); 7566 7567 hdev = hci_get_route(dst, &chan->src, chan->src_type); 7568 if (!hdev) 7569 return -EHOSTUNREACH; 7570 7571 hci_dev_lock(hdev); 7572 7573 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid && 7574 chan->chan_type != L2CAP_CHAN_RAW) { 7575 err = -EINVAL; 7576 goto done; 7577 } 7578 7579 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) { 7580 err = -EINVAL; 7581 goto done; 7582 } 7583 7584 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) { 7585 err = -EINVAL; 7586 goto done; 7587 } 7588 7589 switch (chan->mode) { 7590 case L2CAP_MODE_BASIC: 7591 break; 7592 case L2CAP_MODE_LE_FLOWCTL: 7593 break; 7594 case L2CAP_MODE_EXT_FLOWCTL: 7595 if (!enable_ecred) { 7596 err = -EOPNOTSUPP; 7597 goto done; 7598 } 7599 break; 7600 case L2CAP_MODE_ERTM: 7601 case L2CAP_MODE_STREAMING: 7602 if (!disable_ertm) 7603 break; 7604 fallthrough; 7605 default: 7606 err = -EOPNOTSUPP; 7607 goto done; 7608 } 7609 7610 switch (chan->state) { 7611 case BT_CONNECT: 7612 case BT_CONNECT2: 7613 case BT_CONFIG: 7614 /* Already connecting */ 7615 err = 0; 7616 goto done; 7617 7618 case BT_CONNECTED: 7619 /* Already connected */ 7620 err = -EISCONN; 7621 goto done; 7622 7623 case BT_OPEN: 7624 case BT_BOUND: 7625 /* Can connect */ 7626 break; 7627 7628 default: 7629 err = -EBADFD; 7630 goto done; 7631 } 7632 7633 /* Set destination address and psm */ 7634 bacpy(&chan->dst, dst); 7635 chan->dst_type = dst_type; 7636 7637 chan->psm = psm; 7638 chan->dcid = cid; 7639 7640 if (bdaddr_type_is_le(dst_type)) { 7641 /* Convert from L2CAP channel address type to HCI address type 7642 */ 7643 if (dst_type == BDADDR_LE_PUBLIC) 7644 dst_type = ADDR_LE_DEV_PUBLIC; 7645 else 7646 dst_type = ADDR_LE_DEV_RANDOM; 7647 7648 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7649 hcon = hci_connect_le(hdev, dst, dst_type, false, 7650 chan->sec_level, timeout, 7651 HCI_ROLE_SLAVE, 0, 0); 7652 else 7653 hcon = hci_connect_le_scan(hdev, dst, dst_type, 7654 chan->sec_level, timeout, 7655 CONN_REASON_L2CAP_CHAN); 7656 7657 } else { 7658 u8 auth_type = l2cap_get_auth_type(chan); 7659 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type, 7660 CONN_REASON_L2CAP_CHAN, timeout); 7661 } 7662 7663 if (IS_ERR(hcon)) { 7664 err = PTR_ERR(hcon); 7665 goto done; 7666 } 7667 7668 lockdep_assert_held(&hcon->hdev->lock); 7669 7670 conn = l2cap_conn_add(hcon); 7671 if (!conn) { 7672 hci_conn_drop(hcon); 7673 err = -ENOMEM; 7674 goto done; 7675 } 7676 7677 mutex_lock(&conn->lock); 7678 l2cap_chan_lock(chan); 7679 7680 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 7681 struct l2cap_chan_data data; 7682 7683 data.chan = chan; 7684 data.pid = chan->ops->get_peer_pid(chan); 7685 data.count = 1; 7686 7687 __l2cap_chan_list(conn, l2cap_chan_by_pid, &data); 7688 7689 /* Leave room for non-deferred channel that ends the group. */ 7690 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 7691 data.count += 1; 7692 7693 /* Check if there isn't too many channels being connected */ 7694 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) { 7695 hci_conn_drop(hcon); 7696 err = -EPROTO; 7697 goto chan_unlock; 7698 } 7699 } 7700 7701 if ((cid && __l2cap_get_chan_by_dcid(conn, cid)) || chan->conn || 7702 test_bit(FLAG_DEL, &chan->flags)) { 7703 hci_conn_drop(hcon); 7704 err = -EBUSY; 7705 goto chan_unlock; 7706 } 7707 7708 /* Update source addr of the socket */ 7709 bacpy(&chan->src, &hcon->src); 7710 chan->src_type = bdaddr_src_type(hcon); 7711 7712 __l2cap_chan_add(conn, chan); 7713 7714 lockdep_assert_held(&chan->conn->lock); 7715 7716 /* l2cap_chan_add takes its own ref so we can drop this one */ 7717 hci_conn_drop(hcon); 7718 7719 l2cap_state_change(chan, BT_CONNECT); 7720 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 7721 7722 /* Release chan->sport so that it can be reused by other 7723 * sockets (as it's only used for listening sockets). 7724 */ 7725 write_lock(&chan_list_lock); 7726 chan->sport = 0; 7727 write_unlock(&chan_list_lock); 7728 7729 if (hcon->state == BT_CONNECTED) { 7730 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 7731 __clear_chan_timer(chan); 7732 if (l2cap_chan_check_security(chan, true)) 7733 l2cap_state_change(chan, BT_CONNECTED); 7734 } else 7735 l2cap_do_start(chan); 7736 } 7737 7738 err = 0; 7739 7740 chan_unlock: 7741 l2cap_chan_unlock(chan); 7742 mutex_unlock(&conn->lock); 7743 done: 7744 hci_dev_unlock(hdev); 7745 hci_dev_put(hdev); 7746 return err; 7747 } 7748 EXPORT_SYMBOL_GPL(l2cap_chan_connect); 7749 7750 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan) 7751 { 7752 struct l2cap_conn *conn = chan->conn; 7753 DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); 7754 7755 pdu->mtu = cpu_to_le16(chan->imtu); 7756 pdu->mps = cpu_to_le16(chan->mps); 7757 pdu->scid[0] = cpu_to_le16(chan->scid); 7758 7759 chan->ident = l2cap_get_ident(conn); 7760 7761 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, 7762 struct_size(pdu, scid, 1), pdu); 7763 } 7764 7765 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu) 7766 { 7767 if (chan->imtu > mtu) 7768 return -EINVAL; 7769 7770 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu); 7771 7772 chan->imtu = mtu; 7773 7774 l2cap_ecred_reconfigure(chan); 7775 7776 return 0; 7777 } 7778 7779 /* ---- L2CAP interface with lower layer (HCI) ---- */ 7780 7781 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr) 7782 { 7783 int exact = 0, lm1 = 0, lm2 = 0; 7784 struct l2cap_chan *c; 7785 7786 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 7787 7788 /* Find listening sockets and check their link_mode */ 7789 read_lock(&chan_list_lock); 7790 list_for_each_entry(c, &chan_list, global_l) { 7791 if (c->state != BT_LISTEN) 7792 continue; 7793 7794 if (!bacmp(&c->src, &hdev->bdaddr)) { 7795 lm1 |= HCI_LM_ACCEPT; 7796 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 7797 lm1 |= HCI_LM_MASTER; 7798 exact++; 7799 } else if (!bacmp(&c->src, BDADDR_ANY)) { 7800 lm2 |= HCI_LM_ACCEPT; 7801 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 7802 lm2 |= HCI_LM_MASTER; 7803 } 7804 } 7805 read_unlock(&chan_list_lock); 7806 7807 return exact ? lm1 : lm2; 7808 } 7809 7810 /* Find the next fixed channel in BT_LISTEN state, continue iteration 7811 * from an existing channel in the list or from the beginning of the 7812 * global list (by passing NULL as first parameter). 7813 */ 7814 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, 7815 struct hci_conn *hcon) 7816 { 7817 u8 src_type = bdaddr_src_type(hcon); 7818 7819 read_lock(&chan_list_lock); 7820 7821 if (c) 7822 c = list_next_entry(c, global_l); 7823 else 7824 c = list_entry(chan_list.next, typeof(*c), global_l); 7825 7826 list_for_each_entry_from(c, &chan_list, global_l) { 7827 if (c->chan_type != L2CAP_CHAN_FIXED) 7828 continue; 7829 if (c->state != BT_LISTEN) 7830 continue; 7831 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY)) 7832 continue; 7833 if (src_type != c->src_type) 7834 continue; 7835 7836 c = l2cap_chan_hold_unless_zero(c); 7837 read_unlock(&chan_list_lock); 7838 return c; 7839 } 7840 7841 read_unlock(&chan_list_lock); 7842 7843 return NULL; 7844 } 7845 7846 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) 7847 __must_hold(&hcon->hdev->lock) 7848 { 7849 struct hci_dev *hdev = hcon->hdev; 7850 struct l2cap_conn *conn; 7851 struct l2cap_chan *pchan; 7852 u8 dst_type; 7853 7854 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 7855 return; 7856 7857 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); 7858 7859 if (status) { 7860 l2cap_conn_del(hcon, bt_to_errno(status)); 7861 return; 7862 } 7863 7864 conn = l2cap_conn_add(hcon); 7865 if (!conn) 7866 return; 7867 7868 dst_type = bdaddr_dst_type(hcon); 7869 7870 /* If device is blocked, do not create channels for it */ 7871 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type)) 7872 return; 7873 7874 /* Find fixed channels and notify them of the new connection. We 7875 * use multiple individual lookups, continuing each time where 7876 * we left off, because the list lock would prevent calling the 7877 * potentially sleeping l2cap_chan_lock() function. 7878 */ 7879 mutex_lock(&conn->lock); 7880 7881 pchan = l2cap_global_fixed_chan(NULL, hcon); 7882 while (pchan) { 7883 struct l2cap_chan *chan, *next; 7884 7885 /* Client fixed channels should override server ones */ 7886 if (__l2cap_get_chan_by_dcid(conn, pchan->scid)) 7887 goto next; 7888 7889 l2cap_chan_lock(pchan); 7890 chan = l2cap_new_connection(conn, pchan); 7891 if (chan) { 7892 bacpy(&chan->src, &hcon->src); 7893 bacpy(&chan->dst, &hcon->dst); 7894 chan->src_type = bdaddr_src_type(hcon); 7895 chan->dst_type = dst_type; 7896 } 7897 7898 l2cap_chan_unlock(pchan); 7899 next: 7900 next = l2cap_global_fixed_chan(pchan, hcon); 7901 l2cap_chan_put(pchan); 7902 pchan = next; 7903 } 7904 7905 mutex_unlock(&conn->lock); 7906 7907 l2cap_conn_ready(conn); 7908 } 7909 7910 int l2cap_disconn_ind(struct hci_conn *hcon) 7911 { 7912 struct l2cap_conn *conn; 7913 int ret = HCI_ERROR_REMOTE_USER_TERM; 7914 7915 BT_DBG("hcon %p", hcon); 7916 7917 spin_lock(&hcon->proto_lock); 7918 conn = hcon->l2cap_data; 7919 if (conn) 7920 ret = conn->disc_reason; 7921 spin_unlock(&hcon->proto_lock); 7922 7923 return ret; 7924 } 7925 7926 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) 7927 __must_hold(&hcon->hdev->lock) 7928 { 7929 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 7930 return; 7931 7932 BT_DBG("hcon %p reason %d", hcon, reason); 7933 7934 l2cap_conn_del(hcon, bt_to_errno(reason)); 7935 } 7936 7937 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt) 7938 __must_hold(&chan->lock) 7939 __must_hold(&chan->conn->lock) 7940 { 7941 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 7942 return; 7943 7944 if (encrypt == 0x00) { 7945 if (chan->sec_level == BT_SECURITY_MEDIUM) { 7946 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT); 7947 } else if (chan->sec_level == BT_SECURITY_HIGH || 7948 chan->sec_level == BT_SECURITY_FIPS) 7949 __l2cap_chan_close(chan, ECONNREFUSED); 7950 } else { 7951 if (chan->sec_level == BT_SECURITY_MEDIUM) 7952 __clear_chan_timer(chan); 7953 } 7954 } 7955 7956 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 7957 __must_hold(&hcon->hdev->lock) 7958 { 7959 struct l2cap_conn *conn = hcon->l2cap_data; 7960 struct l2cap_chan *chan; 7961 7962 if (!conn) 7963 return; 7964 7965 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt); 7966 7967 mutex_lock(&conn->lock); 7968 7969 list_for_each_entry(chan, &conn->chan_l, list) { 7970 l2cap_chan_lock(chan); 7971 7972 lockdep_assert_held(&chan->conn->lock); 7973 7974 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid, 7975 state_to_string(chan->state)); 7976 7977 if (!status && encrypt) 7978 chan->sec_level = hcon->sec_level; 7979 7980 if (!__l2cap_no_conn_pending(chan)) { 7981 l2cap_chan_unlock(chan); 7982 continue; 7983 } 7984 7985 if (!status && (chan->state == BT_CONNECTED || 7986 chan->state == BT_CONFIG)) { 7987 chan->ops->resume(chan); 7988 l2cap_check_encryption(chan, encrypt); 7989 l2cap_chan_unlock(chan); 7990 continue; 7991 } 7992 7993 if (chan->state == BT_CONNECT) { 7994 if (!status && l2cap_check_enc_key_size(hcon, chan)) 7995 l2cap_start_connection(chan); 7996 else 7997 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 7998 } else if (chan->state == BT_CONNECT2 && 7999 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL || 8000 chan->mode == L2CAP_MODE_LE_FLOWCTL)) { 8001 struct l2cap_conn_rsp rsp; 8002 __u16 res, stat; 8003 8004 if (!status && l2cap_check_enc_key_size(hcon, chan)) { 8005 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 8006 res = L2CAP_CR_PEND; 8007 stat = L2CAP_CS_AUTHOR_PEND; 8008 chan->ops->defer(chan); 8009 } else { 8010 l2cap_state_change(chan, BT_CONFIG); 8011 res = L2CAP_CR_SUCCESS; 8012 stat = L2CAP_CS_NO_INFO; 8013 } 8014 } else { 8015 l2cap_state_change(chan, BT_DISCONN); 8016 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 8017 res = L2CAP_CR_SEC_BLOCK; 8018 stat = L2CAP_CS_NO_INFO; 8019 } 8020 8021 rsp.scid = cpu_to_le16(chan->dcid); 8022 rsp.dcid = cpu_to_le16(chan->scid); 8023 rsp.result = cpu_to_le16(res); 8024 rsp.status = cpu_to_le16(stat); 8025 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 8026 sizeof(rsp), &rsp); 8027 8028 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) && 8029 res == L2CAP_CR_SUCCESS) { 8030 char buf[128]; 8031 set_bit(CONF_REQ_SENT, &chan->conf_state); 8032 l2cap_send_cmd(conn, l2cap_get_ident(conn), 8033 L2CAP_CONF_REQ, 8034 l2cap_build_conf_req(chan, buf, sizeof(buf)), 8035 buf); 8036 chan->num_conf_req++; 8037 } 8038 } 8039 8040 l2cap_chan_unlock(chan); 8041 } 8042 8043 mutex_unlock(&conn->lock); 8044 } 8045 8046 /* Append fragment into frame respecting the maximum len of rx_skb */ 8047 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb, 8048 u16 len) 8049 { 8050 if (!conn->rx_skb) { 8051 /* Allocate skb for the complete frame (with header) */ 8052 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL); 8053 if (!conn->rx_skb) 8054 return -ENOMEM; 8055 /* Init rx_len */ 8056 conn->rx_len = len; 8057 8058 skb_set_delivery_time(conn->rx_skb, skb->tstamp, 8059 skb->tstamp_type); 8060 } 8061 8062 /* Copy as much as the rx_skb can hold */ 8063 len = min_t(u16, len, skb->len); 8064 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len); 8065 skb_pull(skb, len); 8066 conn->rx_len -= len; 8067 8068 return len; 8069 } 8070 8071 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb) 8072 { 8073 struct sk_buff *rx_skb; 8074 int len; 8075 8076 /* Append just enough to complete the header */ 8077 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len); 8078 8079 /* If header could not be read just continue */ 8080 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE) 8081 return len; 8082 8083 rx_skb = conn->rx_skb; 8084 len = get_unaligned_le16(rx_skb->data); 8085 8086 /* Check if rx_skb has enough space to received all fragments */ 8087 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) { 8088 /* Update expected len */ 8089 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE); 8090 return L2CAP_LEN_SIZE; 8091 } 8092 8093 /* Reset conn->rx_skb since it will need to be reallocated in order to 8094 * fit all fragments. 8095 */ 8096 conn->rx_skb = NULL; 8097 8098 /* Reallocates rx_skb using the exact expected length */ 8099 len = l2cap_recv_frag(conn, rx_skb, 8100 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE)); 8101 kfree_skb(rx_skb); 8102 8103 return len; 8104 } 8105 8106 static void l2cap_recv_reset(struct l2cap_conn *conn) 8107 { 8108 kfree_skb(conn->rx_skb); 8109 conn->rx_skb = NULL; 8110 conn->rx_len = 0; 8111 } 8112 8113 struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c) 8114 { 8115 if (!c) 8116 return NULL; 8117 8118 BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref)); 8119 8120 if (!kref_get_unless_zero(&c->ref)) 8121 return NULL; 8122 8123 return c; 8124 } 8125 EXPORT_SYMBOL(l2cap_conn_hold_unless_zero); 8126 8127 int l2cap_recv_acldata(struct hci_dev *hdev, u16 handle, 8128 struct sk_buff *skb, u16 flags) 8129 { 8130 struct hci_conn *hcon; 8131 struct l2cap_conn *conn; 8132 int len; 8133 8134 /* Lock hdev for hci_conn, and race on l2cap_data vs. l2cap_conn_del */ 8135 hci_dev_lock(hdev); 8136 8137 hcon = hci_conn_hash_lookup_handle(hdev, handle); 8138 if (!hcon) { 8139 hci_dev_unlock(hdev); 8140 kfree_skb(skb); 8141 return -ENOENT; 8142 } 8143 8144 lockdep_assert_held(&hcon->hdev->lock); 8145 8146 hci_conn_enter_active_mode(hcon, BT_POWER_FORCE_ACTIVE_OFF); 8147 8148 conn = hcon->l2cap_data; 8149 8150 if (!conn) 8151 conn = l2cap_conn_add(hcon); 8152 8153 conn = l2cap_conn_hold_unless_zero(conn); 8154 hcon = NULL; 8155 8156 hci_dev_unlock(hdev); 8157 8158 if (!conn) { 8159 kfree_skb(skb); 8160 return -EINVAL; 8161 } 8162 8163 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); 8164 8165 mutex_lock(&conn->lock); 8166 8167 switch (flags) { 8168 case ACL_START: 8169 case ACL_START_NO_FLUSH: 8170 case ACL_COMPLETE: 8171 if (conn->rx_skb) { 8172 BT_ERR("Unexpected start frame (len %d)", skb->len); 8173 l2cap_recv_reset(conn); 8174 l2cap_conn_unreliable(conn, ECOMM); 8175 } 8176 8177 /* Start fragment may not contain the L2CAP length so just 8178 * copy the initial byte when that happens and use conn->mtu as 8179 * expected length. 8180 */ 8181 if (skb->len < L2CAP_LEN_SIZE) { 8182 l2cap_recv_frag(conn, skb, conn->mtu); 8183 break; 8184 } 8185 8186 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE; 8187 8188 if (len == skb->len) { 8189 /* Complete frame received */ 8190 l2cap_recv_frame(conn, skb); 8191 goto unlock; 8192 } 8193 8194 BT_DBG("Start: total len %d, frag len %u", len, skb->len); 8195 8196 if (skb->len > len) { 8197 BT_ERR("Frame is too long (len %u, expected len %d)", 8198 skb->len, len); 8199 /* PTS test cases L2CAP/COS/CED/BI-14-C and BI-15-C 8200 * (Multiple Signaling Command in one PDU, Data 8201 * Truncated, BR/EDR) send a C-frame to the IUT with 8202 * PDU Length set to 8 and Channel ID set to the 8203 * correct signaling channel for the logical link. 8204 * The Information payload contains one L2CAP_ECHO_REQ 8205 * packet with Data Length set to 0 with 0 octets of 8206 * echo data and one invalid command packet due to 8207 * data truncated in PDU but present in HCI packet. 8208 * 8209 * Shorter the socket buffer to the PDU length to 8210 * allow to process valid commands from the PDU before 8211 * setting the socket unreliable. 8212 */ 8213 skb->len = len; 8214 l2cap_recv_frame(conn, skb); 8215 l2cap_conn_unreliable(conn, ECOMM); 8216 goto unlock; 8217 } 8218 8219 /* Append fragment into frame (with header) */ 8220 if (l2cap_recv_frag(conn, skb, len) < 0) 8221 goto drop; 8222 8223 break; 8224 8225 case ACL_CONT: 8226 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len); 8227 8228 if (!conn->rx_skb) { 8229 BT_ERR("Unexpected continuation frame (len %d)", skb->len); 8230 l2cap_conn_unreliable(conn, ECOMM); 8231 goto drop; 8232 } 8233 8234 /* Complete the L2CAP length if it has not been read */ 8235 if (conn->rx_skb->len < L2CAP_LEN_SIZE) { 8236 if (l2cap_recv_len(conn, skb) < 0) { 8237 l2cap_conn_unreliable(conn, ECOMM); 8238 goto drop; 8239 } 8240 8241 /* Header still could not be read just continue */ 8242 if (conn->rx_skb->len < L2CAP_LEN_SIZE) 8243 break; 8244 } 8245 8246 if (skb->len > conn->rx_len) { 8247 BT_ERR("Fragment is too long (len %u, expected %u)", 8248 skb->len, conn->rx_len); 8249 l2cap_recv_reset(conn); 8250 l2cap_conn_unreliable(conn, ECOMM); 8251 goto drop; 8252 } 8253 8254 /* Append fragment into frame (with header) */ 8255 l2cap_recv_frag(conn, skb, skb->len); 8256 8257 if (!conn->rx_len) { 8258 /* Complete frame received. l2cap_recv_frame 8259 * takes ownership of the skb so set the global 8260 * rx_skb pointer to NULL first. 8261 */ 8262 struct sk_buff *rx_skb = conn->rx_skb; 8263 conn->rx_skb = NULL; 8264 l2cap_recv_frame(conn, rx_skb); 8265 } 8266 break; 8267 } 8268 8269 drop: 8270 kfree_skb(skb); 8271 unlock: 8272 mutex_unlock(&conn->lock); 8273 l2cap_conn_put(conn); 8274 return 0; 8275 } 8276 8277 static struct hci_cb l2cap_cb = { 8278 .name = "L2CAP", 8279 .connect_cfm = l2cap_connect_cfm, 8280 .disconn_cfm = l2cap_disconn_cfm, 8281 .security_cfm = l2cap_security_cfm, 8282 }; 8283 8284 static int l2cap_debugfs_show(struct seq_file *f, void *p) 8285 { 8286 struct l2cap_chan *c; 8287 8288 read_lock(&chan_list_lock); 8289 8290 list_for_each_entry(c, &chan_list, global_l) { 8291 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n", 8292 &c->src, c->src_type, &c->dst, c->dst_type, 8293 c->state, __le16_to_cpu(c->psm), 8294 c->scid, c->dcid, c->imtu, c->omtu, 8295 c->sec_level, c->mode); 8296 } 8297 8298 read_unlock(&chan_list_lock); 8299 8300 return 0; 8301 } 8302 8303 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs); 8304 8305 static struct dentry *l2cap_debugfs; 8306 8307 int __init l2cap_init(void) 8308 { 8309 int err; 8310 8311 err = l2cap_init_sockets(); 8312 if (err < 0) 8313 return err; 8314 8315 hci_register_cb(&l2cap_cb); 8316 8317 if (IS_ERR_OR_NULL(bt_debugfs)) 8318 return 0; 8319 8320 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs, 8321 NULL, &l2cap_debugfs_fops); 8322 8323 return 0; 8324 } 8325 8326 void l2cap_exit(void) 8327 { 8328 debugfs_remove(l2cap_debugfs); 8329 hci_unregister_cb(&l2cap_cb); 8330 l2cap_cleanup_sockets(); 8331 } 8332 8333 module_param(disable_ertm, bool, 0644); 8334 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode"); 8335 8336 module_param(enable_ecred, bool, 0644); 8337 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode"); 8338