1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
6 Copyright (C) 2010 Google Inc.
7 Copyright (C) 2011 ProFUSION Embedded Systems
8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth L2CAP sockets. */
26
27 #include <linux/module.h>
28 #include <linux/export.h>
29 #include <linux/filter.h>
30 #include <linux/sched/signal.h>
31 #include <linux/uio.h>
32
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
36
37 #include "smp.h"
38
39 static struct bt_sock_list l2cap_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
41 };
42
43 static const struct proto_ops l2cap_sock_ops;
44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
46 int proto, gfp_t prio, int kern,
47 struct l2cap_chan *chan);
48 static void l2cap_sock_cleanup_listen(struct sock *parent);
49
l2cap_is_socket(struct socket * sock)50 bool l2cap_is_socket(struct socket *sock)
51 {
52 return sock && sock->ops == &l2cap_sock_ops;
53 }
54 EXPORT_SYMBOL(l2cap_is_socket);
55
l2cap_validate_bredr_psm(u16 psm)56 static int l2cap_validate_bredr_psm(u16 psm)
57 {
58 /* PSM must be odd and lsb of upper byte must be 0 */
59 if ((psm & 0x0101) != 0x0001)
60 return -EINVAL;
61
62 /* Restrict usage of well-known PSMs */
63 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
64 return -EACCES;
65
66 return 0;
67 }
68
l2cap_validate_le_psm(u16 psm)69 static int l2cap_validate_le_psm(u16 psm)
70 {
71 /* Valid LE_PSM ranges are defined only until 0x00ff */
72 if (psm > L2CAP_PSM_LE_DYN_END)
73 return -EINVAL;
74
75 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
76 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
77 return -EACCES;
78
79 return 0;
80 }
81
l2cap_sock_bind(struct socket * sock,struct sockaddr_unsized * addr,int alen)82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen)
83 {
84 struct sock *sk = sock->sk;
85 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
86 struct sockaddr_l2 la;
87 int len, err = 0;
88
89 BT_DBG("sk %p", sk);
90
91 if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
92 addr->sa_family != AF_BLUETOOTH)
93 return -EINVAL;
94
95 memset(&la, 0, sizeof(la));
96 len = min_t(unsigned int, sizeof(la), alen);
97 memcpy(&la, addr, len);
98
99 if (la.l2_cid && la.l2_psm)
100 return -EINVAL;
101
102 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
103 return -EINVAL;
104
105 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
106 /* We only allow ATT user space socket */
107 if (la.l2_cid &&
108 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
109 return -EINVAL;
110 }
111
112 lock_sock(sk);
113
114 if (sk->sk_state != BT_OPEN) {
115 err = -EBADFD;
116 goto done;
117 }
118
119 if (la.l2_psm) {
120 __u16 psm = __le16_to_cpu(la.l2_psm);
121
122 if (la.l2_bdaddr_type == BDADDR_BREDR)
123 err = l2cap_validate_bredr_psm(psm);
124 else
125 err = l2cap_validate_le_psm(psm);
126
127 if (err)
128 goto done;
129 }
130
131 bacpy(&chan->src, &la.l2_bdaddr);
132 chan->src_type = la.l2_bdaddr_type;
133
134 if (la.l2_cid)
135 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
136 else
137 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
138
139 if (err < 0)
140 goto done;
141
142 switch (chan->chan_type) {
143 case L2CAP_CHAN_CONN_LESS:
144 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
145 chan->sec_level = BT_SECURITY_SDP;
146 break;
147 case L2CAP_CHAN_CONN_ORIENTED:
148 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
149 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
150 chan->sec_level = BT_SECURITY_SDP;
151 break;
152 case L2CAP_CHAN_RAW:
153 chan->sec_level = BT_SECURITY_SDP;
154 break;
155 case L2CAP_CHAN_FIXED:
156 /* Fixed channels default to the L2CAP core not holding a
157 * hci_conn reference for them. For fixed channels mapping to
158 * L2CAP sockets we do want to hold a reference so set the
159 * appropriate flag to request it.
160 */
161 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
162 break;
163 }
164
165 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
166 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
167 */
168 if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
169 chan->mode != L2CAP_MODE_EXT_FLOWCTL)
170 chan->mode = L2CAP_MODE_LE_FLOWCTL;
171
172 chan->state = BT_BOUND;
173 sk->sk_state = BT_BOUND;
174
175 done:
176 release_sock(sk);
177 return err;
178 }
179
l2cap_sock_connect(struct socket * sock,struct sockaddr_unsized * addr,int alen,int flags)180 static int l2cap_sock_connect(struct socket *sock, struct sockaddr_unsized *addr,
181 int alen, int flags)
182 {
183 struct sock *sk = sock->sk;
184 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
185 struct sockaddr_l2 la;
186 int len, err = 0;
187 bool zapped;
188
189 BT_DBG("sk %p", sk);
190
191 lock_sock(sk);
192 zapped = sock_flag(sk, SOCK_ZAPPED);
193 release_sock(sk);
194
195 if (zapped)
196 return -EINVAL;
197
198 if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
199 addr->sa_family != AF_BLUETOOTH)
200 return -EINVAL;
201
202 memset(&la, 0, sizeof(la));
203 len = min_t(unsigned int, sizeof(la), alen);
204 memcpy(&la, addr, len);
205
206 if (la.l2_cid && la.l2_psm)
207 return -EINVAL;
208
209 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
210 return -EINVAL;
211
212 /* Check that the socket wasn't bound to something that
213 * conflicts with the address given to connect(). If chan->src
214 * is BDADDR_ANY it means bind() was never used, in which case
215 * chan->src_type and la.l2_bdaddr_type do not need to match.
216 */
217 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
218 bdaddr_type_is_le(la.l2_bdaddr_type)) {
219 /* Old user space versions will try to incorrectly bind
220 * the ATT socket using BDADDR_BREDR. We need to accept
221 * this and fix up the source address type only when
222 * both the source CID and destination CID indicate
223 * ATT. Anything else is an invalid combination.
224 */
225 if (chan->scid != L2CAP_CID_ATT ||
226 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
227 return -EINVAL;
228
229 /* We don't have the hdev available here to make a
230 * better decision on random vs public, but since all
231 * user space versions that exhibit this issue anyway do
232 * not support random local addresses assuming public
233 * here is good enough.
234 */
235 chan->src_type = BDADDR_LE_PUBLIC;
236 }
237
238 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
239 return -EINVAL;
240
241 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
242 /* We only allow ATT user space socket */
243 if (la.l2_cid &&
244 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
245 return -EINVAL;
246 }
247
248 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
249 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
250 */
251 if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
252 chan->mode != L2CAP_MODE_EXT_FLOWCTL)
253 chan->mode = L2CAP_MODE_LE_FLOWCTL;
254
255 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
256 &la.l2_bdaddr, la.l2_bdaddr_type,
257 READ_ONCE(sk->sk_sndtimeo));
258 if (err)
259 return err;
260
261 lock_sock(sk);
262
263 err = bt_sock_wait_state(sk, BT_CONNECTED,
264 sock_sndtimeo(sk, flags & O_NONBLOCK));
265
266 release_sock(sk);
267
268 return err;
269 }
270
l2cap_sock_listen(struct socket * sock,int backlog)271 static int l2cap_sock_listen(struct socket *sock, int backlog)
272 {
273 struct sock *sk = sock->sk;
274 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
275 int err = 0;
276
277 BT_DBG("sk %p backlog %d", sk, backlog);
278
279 lock_sock(sk);
280
281 if (sk->sk_state != BT_BOUND) {
282 err = -EBADFD;
283 goto done;
284 }
285
286 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
287 err = -EINVAL;
288 goto done;
289 }
290
291 switch (chan->mode) {
292 case L2CAP_MODE_BASIC:
293 case L2CAP_MODE_LE_FLOWCTL:
294 break;
295 case L2CAP_MODE_EXT_FLOWCTL:
296 if (!enable_ecred) {
297 err = -EOPNOTSUPP;
298 goto done;
299 }
300 break;
301 case L2CAP_MODE_ERTM:
302 case L2CAP_MODE_STREAMING:
303 if (!disable_ertm)
304 break;
305 fallthrough;
306 default:
307 err = -EOPNOTSUPP;
308 goto done;
309 }
310
311 sk->sk_max_ack_backlog = backlog;
312 sk->sk_ack_backlog = 0;
313
314 /* Listening channels need to use nested locking in order not to
315 * cause lockdep warnings when the created child channels end up
316 * being locked in the same thread as the parent channel.
317 */
318 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
319
320 chan->state = BT_LISTEN;
321 sk->sk_state = BT_LISTEN;
322
323 done:
324 release_sock(sk);
325 return err;
326 }
327
l2cap_sock_accept(struct socket * sock,struct socket * newsock,struct proto_accept_arg * arg)328 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
329 struct proto_accept_arg *arg)
330 {
331 DEFINE_WAIT_FUNC(wait, woken_wake_function);
332 struct sock *sk = sock->sk, *nsk;
333 long timeo;
334 int err = 0;
335
336 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
337
338 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
339
340 BT_DBG("sk %p timeo %ld", sk, timeo);
341
342 /* Wait for an incoming connection. (wake-one). */
343 add_wait_queue_exclusive(sk_sleep(sk), &wait);
344 while (1) {
345 if (sk->sk_state != BT_LISTEN) {
346 err = -EBADFD;
347 break;
348 }
349
350 nsk = bt_accept_dequeue(sk, newsock);
351 if (nsk) {
352 /* Drop the bridging ref from bt_accept_dequeue();
353 * the grafted socket keeps nsk alive from here.
354 */
355 sock_put(nsk);
356 break;
357 }
358
359 if (!timeo) {
360 err = -EAGAIN;
361 break;
362 }
363
364 if (signal_pending(current)) {
365 err = sock_intr_errno(timeo);
366 break;
367 }
368
369 release_sock(sk);
370
371 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
372
373 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
374 }
375 remove_wait_queue(sk_sleep(sk), &wait);
376
377 if (err)
378 goto done;
379
380 newsock->state = SS_CONNECTED;
381
382 BT_DBG("new socket %p", nsk);
383
384 done:
385 release_sock(sk);
386 return err;
387 }
388
l2cap_sock_getname(struct socket * sock,struct sockaddr * addr,int peer)389 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
390 int peer)
391 {
392 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
393 struct sock *sk = sock->sk;
394 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
395
396 BT_DBG("sock %p, sk %p", sock, sk);
397
398 if (peer && sk->sk_state != BT_CONNECTED &&
399 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
400 sk->sk_state != BT_CONFIG)
401 return -ENOTCONN;
402
403 memset(la, 0, sizeof(struct sockaddr_l2));
404 addr->sa_family = AF_BLUETOOTH;
405
406 la->l2_psm = chan->psm;
407
408 if (peer) {
409 bacpy(&la->l2_bdaddr, &chan->dst);
410 la->l2_cid = cpu_to_le16(chan->dcid);
411 la->l2_bdaddr_type = chan->dst_type;
412 } else {
413 bacpy(&la->l2_bdaddr, &chan->src);
414 la->l2_cid = cpu_to_le16(chan->scid);
415 la->l2_bdaddr_type = chan->src_type;
416 }
417
418 return sizeof(struct sockaddr_l2);
419 }
420
l2cap_get_mode(struct l2cap_chan * chan)421 static int l2cap_get_mode(struct l2cap_chan *chan)
422 {
423 switch (chan->mode) {
424 case L2CAP_MODE_BASIC:
425 return BT_MODE_BASIC;
426 case L2CAP_MODE_ERTM:
427 return BT_MODE_ERTM;
428 case L2CAP_MODE_STREAMING:
429 return BT_MODE_STREAMING;
430 case L2CAP_MODE_LE_FLOWCTL:
431 return BT_MODE_LE_FLOWCTL;
432 case L2CAP_MODE_EXT_FLOWCTL:
433 return BT_MODE_EXT_FLOWCTL;
434 }
435
436 return -EINVAL;
437 }
438
l2cap_chan_conn(struct l2cap_chan * chan)439 static struct l2cap_conn *l2cap_chan_conn(struct l2cap_chan *chan)
440 {
441 lockdep_assert_held(&chan->lock);
442
443 /* l2cap_conn_del() sets FLAG_DEL while holding chan->lock before
444 * conn->hcon is deleted. If not set and conn is non-NULL, conn->hcon
445 * remains alive during this chan->lock critical section.
446 */
447 if (test_bit(FLAG_DEL, &chan->flags))
448 return NULL;
449
450 return chan->conn;
451 }
452
l2cap_sock_getsockopt_old(struct socket * sock,int optname,sockopt_t * sopt)453 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
454 sockopt_t *sopt)
455 {
456 struct sock *sk = sock->sk;
457 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
458 struct l2cap_conn *conn;
459 struct l2cap_options opts;
460 struct l2cap_conninfo cinfo;
461 int err = 0;
462 size_t len;
463 u32 opt;
464
465 BT_DBG("sk %p", sk);
466
467 len = sopt->optlen;
468
469 l2cap_chan_lock(chan);
470 lock_sock(sk);
471
472 switch (optname) {
473 case L2CAP_OPTIONS:
474 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
475 * legacy ATT code depends on getsockopt for
476 * L2CAP_OPTIONS we need to let this pass.
477 */
478 if (bdaddr_type_is_le(chan->src_type) &&
479 chan->scid != L2CAP_CID_ATT) {
480 err = -EINVAL;
481 break;
482 }
483
484 /* Only BR/EDR modes are supported here */
485 switch (chan->mode) {
486 case L2CAP_MODE_BASIC:
487 case L2CAP_MODE_ERTM:
488 case L2CAP_MODE_STREAMING:
489 break;
490 default:
491 err = -EINVAL;
492 break;
493 }
494
495 if (err < 0)
496 break;
497
498 memset(&opts, 0, sizeof(opts));
499 opts.imtu = chan->imtu;
500 opts.omtu = chan->omtu;
501 opts.flush_to = chan->flush_to;
502 opts.mode = chan->mode;
503 opts.fcs = chan->fcs;
504 opts.max_tx = chan->max_tx;
505 opts.txwin_size = chan->tx_win;
506
507 BT_DBG("mode 0x%2.2x", chan->mode);
508
509 len = min(len, sizeof(opts));
510 if (copy_to_iter(&opts, len, &sopt->iter_out) != len)
511 err = -EFAULT;
512
513 break;
514
515 case L2CAP_LM:
516 switch (chan->sec_level) {
517 case BT_SECURITY_LOW:
518 opt = L2CAP_LM_AUTH;
519 break;
520 case BT_SECURITY_MEDIUM:
521 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
522 break;
523 case BT_SECURITY_HIGH:
524 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
525 L2CAP_LM_SECURE;
526 break;
527 case BT_SECURITY_FIPS:
528 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
529 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
530 break;
531 default:
532 opt = 0;
533 break;
534 }
535
536 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
537 opt |= L2CAP_LM_MASTER;
538
539 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
540 opt |= L2CAP_LM_RELIABLE;
541
542 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
543 sizeof(opt))
544 err = -EFAULT;
545
546 break;
547
548 case L2CAP_CONNINFO:
549 if (sk->sk_state != BT_CONNECTED &&
550 !(sk->sk_state == BT_CONNECT2 &&
551 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
552 err = -ENOTCONN;
553 break;
554 }
555
556 conn = l2cap_chan_conn(chan);
557 if (!conn) {
558 err = -ENOTCONN;
559 break;
560 }
561
562 memset(&cinfo, 0, sizeof(cinfo));
563 cinfo.hci_handle = conn->hcon->handle;
564 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
565
566 len = min(len, sizeof(cinfo));
567 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len)
568 err = -EFAULT;
569
570 break;
571
572 default:
573 err = -ENOPROTOOPT;
574 break;
575 }
576
577 release_sock(sk);
578 l2cap_chan_unlock(chan);
579
580 return err;
581 }
582
l2cap_sock_getsockopt(struct socket * sock,int level,int optname,sockopt_t * sopt)583 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
584 sockopt_t *sopt)
585 {
586 struct sock *sk = sock->sk;
587 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
588 struct l2cap_conn *conn;
589 struct bt_security sec;
590 struct bt_power pwr;
591 int len, mode, err = 0;
592 u32 opt;
593 u16 mtu;
594 u8 mval;
595
596 BT_DBG("sk %p", sk);
597
598 if (level == SOL_L2CAP)
599 return l2cap_sock_getsockopt_old(sock, optname, sopt);
600
601 if (level != SOL_BLUETOOTH)
602 return -ENOPROTOOPT;
603
604 len = sopt->optlen;
605
606 l2cap_chan_lock(chan);
607 lock_sock(sk);
608
609 switch (optname) {
610 case BT_SECURITY:
611 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
612 chan->chan_type != L2CAP_CHAN_FIXED &&
613 chan->chan_type != L2CAP_CHAN_RAW) {
614 err = -EINVAL;
615 break;
616 }
617
618 conn = l2cap_chan_conn(chan);
619
620 memset(&sec, 0, sizeof(sec));
621 if (conn) {
622 sec.level = conn->hcon->sec_level;
623
624 if (sk->sk_state == BT_CONNECTED)
625 sec.key_size = conn->hcon->enc_key_size;
626 } else {
627 sec.level = chan->sec_level;
628 }
629
630 len = min_t(unsigned int, len, sizeof(sec));
631 if (copy_to_iter(&sec, len, &sopt->iter_out) != len)
632 err = -EFAULT;
633
634 break;
635
636 case BT_DEFER_SETUP:
637 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
638 err = -EINVAL;
639 break;
640 }
641
642 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
643 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
644 sizeof(opt))
645 err = -EFAULT;
646
647 break;
648
649 case BT_FLUSHABLE:
650 opt = test_bit(FLAG_FLUSHABLE, &chan->flags);
651 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
652 sizeof(opt))
653 err = -EFAULT;
654
655 break;
656
657 case BT_POWER:
658 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
659 && sk->sk_type != SOCK_RAW) {
660 err = -EINVAL;
661 break;
662 }
663
664 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
665
666 len = min_t(unsigned int, len, sizeof(pwr));
667 if (copy_to_iter(&pwr, len, &sopt->iter_out) != len)
668 err = -EFAULT;
669
670 break;
671
672 case BT_CHANNEL_POLICY:
673 opt = chan->chan_policy;
674 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
675 sizeof(opt))
676 err = -EFAULT;
677 break;
678
679 case BT_SNDMTU:
680 if (!bdaddr_type_is_le(chan->src_type)) {
681 err = -EINVAL;
682 break;
683 }
684
685 if (sk->sk_state != BT_CONNECTED) {
686 err = -ENOTCONN;
687 break;
688 }
689
690 mtu = chan->omtu;
691 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) !=
692 sizeof(mtu))
693 err = -EFAULT;
694 break;
695
696 case BT_RCVMTU:
697 if (!bdaddr_type_is_le(chan->src_type)) {
698 err = -EINVAL;
699 break;
700 }
701
702 mtu = chan->imtu;
703 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) !=
704 sizeof(mtu))
705 err = -EFAULT;
706 break;
707
708 case BT_PHY:
709 conn = l2cap_chan_conn(chan);
710
711 if (sk->sk_state != BT_CONNECTED || !conn) {
712 err = -ENOTCONN;
713 break;
714 }
715
716 opt = hci_conn_get_phy(conn->hcon);
717
718 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) !=
719 sizeof(opt))
720 err = -EFAULT;
721 break;
722
723 case BT_MODE:
724 if (!enable_ecred) {
725 err = -ENOPROTOOPT;
726 break;
727 }
728
729 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
730 err = -EINVAL;
731 break;
732 }
733
734 mode = l2cap_get_mode(chan);
735 if (mode < 0) {
736 err = mode;
737 break;
738 }
739
740 mval = mode;
741 if (copy_to_iter(&mval, sizeof(mval), &sopt->iter_out) !=
742 sizeof(mval))
743 err = -EFAULT;
744 break;
745
746 default:
747 err = -ENOPROTOOPT;
748 break;
749 }
750
751 release_sock(sk);
752 l2cap_chan_unlock(chan);
753 return err;
754 }
755
l2cap_valid_mtu(struct l2cap_chan * chan,u16 mtu)756 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
757 {
758 switch (chan->scid) {
759 case L2CAP_CID_ATT:
760 if (mtu && mtu < L2CAP_LE_MIN_MTU)
761 return false;
762 break;
763
764 default:
765 if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU)
766 return false;
767 }
768
769 return true;
770 }
771
l2cap_sock_setsockopt_old(struct socket * sock,int optname,sockptr_t optval,unsigned int optlen)772 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
773 sockptr_t optval, unsigned int optlen)
774 {
775 struct sock *sk = sock->sk;
776 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
777 struct l2cap_options opts;
778 int err = 0;
779 u32 opt;
780
781 BT_DBG("sk %p", sk);
782
783 l2cap_chan_lock(chan);
784 lock_sock(sk);
785
786 switch (optname) {
787 case L2CAP_OPTIONS:
788 if (bdaddr_type_is_le(chan->src_type)) {
789 err = -EINVAL;
790 break;
791 }
792
793 if (sk->sk_state == BT_CONNECTED) {
794 err = -EINVAL;
795 break;
796 }
797
798 opts.imtu = chan->imtu;
799 opts.omtu = chan->omtu;
800 opts.flush_to = chan->flush_to;
801 opts.mode = chan->mode;
802 opts.fcs = chan->fcs;
803 opts.max_tx = chan->max_tx;
804 opts.txwin_size = chan->tx_win;
805
806 err = copy_safe_from_sockptr(&opts, sizeof(opts), optval,
807 optlen);
808 if (err)
809 break;
810
811 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
812 err = -EINVAL;
813 break;
814 }
815
816 if (!l2cap_valid_mtu(chan, opts.imtu)) {
817 err = -EINVAL;
818 break;
819 }
820
821 /* Only BR/EDR modes are supported here */
822 switch (opts.mode) {
823 case L2CAP_MODE_BASIC:
824 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
825 break;
826 case L2CAP_MODE_ERTM:
827 case L2CAP_MODE_STREAMING:
828 if (!disable_ertm)
829 break;
830 fallthrough;
831 default:
832 err = -EINVAL;
833 break;
834 }
835
836 if (err < 0)
837 break;
838
839 chan->mode = opts.mode;
840
841 BT_DBG("mode 0x%2.2x", chan->mode);
842
843 chan->imtu = opts.imtu;
844 chan->omtu = opts.omtu;
845 chan->fcs = opts.fcs;
846 chan->max_tx = opts.max_tx;
847 chan->tx_win = opts.txwin_size;
848 chan->flush_to = opts.flush_to;
849 break;
850
851 case L2CAP_LM:
852 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
853 if (err)
854 break;
855
856 if (opt & L2CAP_LM_FIPS) {
857 err = -EINVAL;
858 break;
859 }
860
861 if (opt & L2CAP_LM_AUTH)
862 chan->sec_level = BT_SECURITY_LOW;
863 if (opt & L2CAP_LM_ENCRYPT)
864 chan->sec_level = BT_SECURITY_MEDIUM;
865 if (opt & L2CAP_LM_SECURE)
866 chan->sec_level = BT_SECURITY_HIGH;
867
868 if (opt & L2CAP_LM_MASTER)
869 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
870 else
871 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
872
873 if (opt & L2CAP_LM_RELIABLE)
874 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
875 else
876 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
877 break;
878
879 default:
880 err = -ENOPROTOOPT;
881 break;
882 }
883
884 release_sock(sk);
885 l2cap_chan_unlock(chan);
886 return err;
887 }
888
l2cap_set_mode(struct l2cap_chan * chan,u8 mode)889 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
890 {
891 switch (mode) {
892 case BT_MODE_BASIC:
893 if (bdaddr_type_is_le(chan->src_type))
894 return -EINVAL;
895 mode = L2CAP_MODE_BASIC;
896 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
897 break;
898 case BT_MODE_ERTM:
899 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
900 return -EINVAL;
901 mode = L2CAP_MODE_ERTM;
902 break;
903 case BT_MODE_STREAMING:
904 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
905 return -EINVAL;
906 mode = L2CAP_MODE_STREAMING;
907 break;
908 case BT_MODE_LE_FLOWCTL:
909 if (!bdaddr_type_is_le(chan->src_type))
910 return -EINVAL;
911 mode = L2CAP_MODE_LE_FLOWCTL;
912 break;
913 case BT_MODE_EXT_FLOWCTL:
914 /* TODO: Add support for ECRED PDUs to BR/EDR */
915 if (!bdaddr_type_is_le(chan->src_type))
916 return -EINVAL;
917 mode = L2CAP_MODE_EXT_FLOWCTL;
918 break;
919 default:
920 return -EINVAL;
921 }
922
923 chan->mode = mode;
924
925 return 0;
926 }
927
l2cap_sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)928 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
929 sockptr_t optval, unsigned int optlen)
930 {
931 struct sock *sk = sock->sk;
932 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
933 struct bt_security sec;
934 struct bt_power pwr;
935 struct l2cap_conn *conn;
936 int err = 0;
937 u32 opt, phys;
938 u16 mtu;
939 u8 mode;
940
941 BT_DBG("sk %p", sk);
942
943 if (level == SOL_L2CAP)
944 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
945
946 if (level != SOL_BLUETOOTH)
947 return -ENOPROTOOPT;
948
949 l2cap_chan_lock(chan);
950 lock_sock(sk);
951
952 switch (optname) {
953 case BT_SECURITY:
954 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
955 chan->chan_type != L2CAP_CHAN_FIXED &&
956 chan->chan_type != L2CAP_CHAN_RAW) {
957 err = -EINVAL;
958 break;
959 }
960
961 sec.level = BT_SECURITY_LOW;
962
963 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
964 if (err)
965 break;
966
967 if (sec.level < BT_SECURITY_LOW ||
968 sec.level > BT_SECURITY_FIPS) {
969 err = -EINVAL;
970 break;
971 }
972
973 chan->sec_level = sec.level;
974
975 conn = l2cap_chan_conn(chan);
976 if (!conn)
977 break;
978
979 /* change security for LE channels */
980 if (chan->scid == L2CAP_CID_ATT) {
981 if (smp_conn_security(conn->hcon, sec.level)) {
982 err = -EINVAL;
983 break;
984 }
985
986 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
987 sk->sk_state = BT_CONFIG;
988 chan->state = BT_CONFIG;
989
990 /* or for ACL link */
991 } else if ((sk->sk_state == BT_CONNECT2 &&
992 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
993 sk->sk_state == BT_CONNECTED) {
994 if (!l2cap_chan_check_security(chan, true))
995 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
996 else
997 sk->sk_state_change(sk);
998 } else {
999 err = -EINVAL;
1000 }
1001 break;
1002
1003 case BT_DEFER_SETUP:
1004 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1005 err = -EINVAL;
1006 break;
1007 }
1008
1009 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1010 if (err)
1011 break;
1012
1013 if (opt) {
1014 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1015 set_bit(FLAG_DEFER_SETUP, &chan->flags);
1016 } else {
1017 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1018 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
1019 }
1020 break;
1021
1022 case BT_FLUSHABLE:
1023 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1024 if (err)
1025 break;
1026
1027 if (opt > BT_FLUSHABLE_ON) {
1028 err = -EINVAL;
1029 break;
1030 }
1031
1032 if (opt == BT_FLUSHABLE_OFF) {
1033 conn = l2cap_chan_conn(chan);
1034
1035 /* proceed further only when we have l2cap_conn and
1036 No Flush support in the LM */
1037 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
1038 err = -EINVAL;
1039 break;
1040 }
1041 }
1042
1043 if (opt)
1044 set_bit(FLAG_FLUSHABLE, &chan->flags);
1045 else
1046 clear_bit(FLAG_FLUSHABLE, &chan->flags);
1047 break;
1048
1049 case BT_POWER:
1050 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
1051 chan->chan_type != L2CAP_CHAN_RAW) {
1052 err = -EINVAL;
1053 break;
1054 }
1055
1056 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1057
1058 err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
1059 if (err)
1060 break;
1061
1062 if (pwr.force_active)
1063 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1064 else
1065 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1066 break;
1067
1068 case BT_CHANNEL_POLICY:
1069 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1070 if (err)
1071 break;
1072
1073 err = -EOPNOTSUPP;
1074 break;
1075
1076 case BT_SNDMTU:
1077 if (!bdaddr_type_is_le(chan->src_type)) {
1078 err = -EINVAL;
1079 break;
1080 }
1081
1082 /* Only allow setting output MTU when not connected */
1083 if (sk->sk_state == BT_CONNECTED) {
1084 err = -EISCONN;
1085 break;
1086 }
1087
1088 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1089 if (err)
1090 break;
1091
1092 chan->omtu = mtu;
1093 break;
1094
1095 case BT_RCVMTU:
1096 if (!bdaddr_type_is_le(chan->src_type)) {
1097 err = -EINVAL;
1098 break;
1099 }
1100
1101 if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1102 sk->sk_state == BT_CONNECTED) {
1103 err = -EISCONN;
1104 break;
1105 }
1106
1107 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1108 if (err)
1109 break;
1110
1111 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1112 sk->sk_state == BT_CONNECTED)
1113 err = l2cap_chan_reconfigure(chan, mtu);
1114 else
1115 chan->imtu = mtu;
1116
1117 break;
1118
1119 case BT_PHY:
1120 conn = l2cap_chan_conn(chan);
1121 if (sk->sk_state != BT_CONNECTED || !conn) {
1122 err = -ENOTCONN;
1123 break;
1124 }
1125
1126 err = copy_safe_from_sockptr(&phys, sizeof(phys), optval,
1127 optlen);
1128 if (err)
1129 break;
1130
1131 err = hci_conn_set_phy(conn->hcon, phys);
1132 break;
1133
1134 case BT_MODE:
1135 if (!enable_ecred) {
1136 err = -ENOPROTOOPT;
1137 break;
1138 }
1139
1140 BT_DBG("sk->sk_state %u", sk->sk_state);
1141
1142 if (sk->sk_state != BT_BOUND) {
1143 err = -EINVAL;
1144 break;
1145 }
1146
1147 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1148 err = -EINVAL;
1149 break;
1150 }
1151
1152 err = copy_safe_from_sockptr(&mode, sizeof(mode), optval,
1153 optlen);
1154 if (err)
1155 break;
1156
1157 BT_DBG("mode %u", mode);
1158
1159 err = l2cap_set_mode(chan, mode);
1160 if (err)
1161 break;
1162
1163 BT_DBG("mode 0x%2.2x", chan->mode);
1164
1165 break;
1166
1167 default:
1168 err = -ENOPROTOOPT;
1169 break;
1170 }
1171
1172 release_sock(sk);
1173 l2cap_chan_unlock(chan);
1174 return err;
1175 }
1176
l2cap_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)1177 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1178 size_t len)
1179 {
1180 struct sock *sk = sock->sk;
1181 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1182 struct sockcm_cookie sockc;
1183 int err;
1184
1185 BT_DBG("sock %p, sk %p", sock, sk);
1186
1187 err = sock_error(sk);
1188 if (err)
1189 return err;
1190
1191 if (msg->msg_flags & MSG_OOB)
1192 return -EOPNOTSUPP;
1193
1194 if (sk->sk_state != BT_CONNECTED)
1195 return -ENOTCONN;
1196
1197 hci_sockcm_init(&sockc, sk);
1198
1199 if (msg->msg_controllen) {
1200 err = sock_cmsg_send(sk, msg, &sockc);
1201 if (err)
1202 return err;
1203 }
1204
1205 lock_sock(sk);
1206 err = bt_sock_wait_ready(sk, msg->msg_flags);
1207 release_sock(sk);
1208 if (err)
1209 return err;
1210
1211 l2cap_chan_lock(chan);
1212 err = l2cap_chan_send(chan, msg, len, &sockc);
1213 l2cap_chan_unlock(chan);
1214
1215 return err;
1216 }
1217
l2cap_publish_rx_avail(struct l2cap_chan * chan)1218 static void l2cap_publish_rx_avail(struct l2cap_chan *chan)
1219 {
1220 struct sock *sk = chan->data;
1221 ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc);
1222 int expected_skbs, skb_overhead;
1223
1224 if (avail <= 0) {
1225 l2cap_chan_rx_avail(chan, 0);
1226 return;
1227 }
1228
1229 if (!chan->mps) {
1230 l2cap_chan_rx_avail(chan, -1);
1231 return;
1232 }
1233
1234 /* Correct available memory by estimated sk_buff overhead.
1235 * This is significant due to small transfer sizes. However, accept
1236 * at least one full packet if receive space is non-zero.
1237 */
1238 expected_skbs = DIV_ROUND_UP(avail, chan->mps);
1239 skb_overhead = expected_skbs * sizeof(struct sk_buff);
1240 if (skb_overhead < avail)
1241 l2cap_chan_rx_avail(chan, avail - skb_overhead);
1242 else
1243 l2cap_chan_rx_avail(chan, -1);
1244 }
1245
l2cap_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)1246 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1247 size_t len, int flags)
1248 {
1249 struct sock *sk = sock->sk;
1250 struct l2cap_pinfo *pi = l2cap_pi(sk);
1251 int err;
1252
1253 if (unlikely(flags & MSG_ERRQUEUE))
1254 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH,
1255 BT_SCM_ERROR);
1256
1257 lock_sock(sk);
1258
1259 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1260 &bt_sk(sk)->flags)) {
1261 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1262 sk->sk_state = BT_CONNECTED;
1263 pi->chan->state = BT_CONNECTED;
1264 __l2cap_ecred_conn_rsp_defer(pi->chan);
1265 } else if (bdaddr_type_is_le(pi->chan->src_type)) {
1266 sk->sk_state = BT_CONNECTED;
1267 pi->chan->state = BT_CONNECTED;
1268 __l2cap_le_connect_rsp_defer(pi->chan);
1269 } else {
1270 sk->sk_state = BT_CONFIG;
1271 pi->chan->state = BT_CONFIG;
1272 __l2cap_connect_rsp_defer(pi->chan);
1273 }
1274
1275 err = 0;
1276 goto done;
1277 }
1278
1279 release_sock(sk);
1280
1281 if (sock->type == SOCK_STREAM)
1282 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1283 else
1284 err = bt_sock_recvmsg(sock, msg, len, flags);
1285
1286 if (pi->chan->mode != L2CAP_MODE_ERTM &&
1287 pi->chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1288 pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL)
1289 return err;
1290
1291 lock_sock(sk);
1292
1293 l2cap_publish_rx_avail(pi->chan);
1294
1295 /* Attempt to put pending rx data in the socket buffer */
1296 while (!list_empty(&pi->rx_busy)) {
1297 struct l2cap_rx_busy *rx_busy =
1298 list_first_entry(&pi->rx_busy,
1299 struct l2cap_rx_busy,
1300 list);
1301 if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0)
1302 goto done;
1303 list_del(&rx_busy->list);
1304 kfree(rx_busy);
1305 }
1306
1307 /* Restore data flow when half of the receive buffer is
1308 * available. This avoids resending large numbers of
1309 * frames.
1310 */
1311 if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) &&
1312 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1313 l2cap_chan_busy(pi->chan, 0);
1314
1315 done:
1316 release_sock(sk);
1317 return err;
1318 }
1319
1320 /* Release the sock's ref on chan and clear the pointer so that the ref is
1321 * dropped exactly once even if both l2cap_sock_kill() and
1322 * l2cap_sock_destruct() run. Setting chan->data to NULL first stops any other
1323 * task from dereferencing the now-dead sock pointer.
1324 */
l2cap_sock_put_chan(struct sock * sk)1325 static void l2cap_sock_put_chan(struct sock *sk)
1326 {
1327 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1328
1329 if (!chan)
1330 return;
1331
1332 chan->data = NULL;
1333 l2cap_pi(sk)->chan = NULL;
1334 l2cap_chan_put(chan);
1335 }
1336
1337 /* Kill socket (only if zapped and orphan)
1338 * Must be called on unlocked socket, with l2cap channel lock.
1339 */
l2cap_sock_kill(struct sock * sk)1340 static void l2cap_sock_kill(struct sock *sk)
1341 {
1342 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1343 return;
1344
1345 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1346
1347 /* Take lock to synchronize against access without owning sk->sk_socket,
1348 * eg. in l2cap_sock_cleanup_listen(). proto_ops etc. don't need lock.
1349 */
1350 lock_sock(sk);
1351 l2cap_sock_put_chan(sk);
1352 release_sock(sk);
1353
1354 /* Kill poor orphan */
1355 sock_set_flag(sk, SOCK_DEAD);
1356 sock_put(sk);
1357 }
1358
__l2cap_wait_ack(struct sock * sk,struct l2cap_chan * chan)1359 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1360 {
1361 DECLARE_WAITQUEUE(wait, current);
1362 int err = 0;
1363 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1364 /* Timeout to prevent infinite loop */
1365 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1366
1367 add_wait_queue(sk_sleep(sk), &wait);
1368 set_current_state(TASK_INTERRUPTIBLE);
1369 do {
1370 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1371 chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1372 jiffies_to_msecs(timeout - jiffies));
1373
1374 if (!timeo)
1375 timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1376
1377 if (signal_pending(current)) {
1378 err = sock_intr_errno(timeo);
1379 break;
1380 }
1381
1382 release_sock(sk);
1383 timeo = schedule_timeout(timeo);
1384 lock_sock(sk);
1385 set_current_state(TASK_INTERRUPTIBLE);
1386
1387 err = sock_error(sk);
1388 if (err)
1389 break;
1390
1391 if (time_after(jiffies, timeout)) {
1392 err = -ENOLINK;
1393 break;
1394 }
1395
1396 } while (chan->unacked_frames > 0 &&
1397 chan->state == BT_CONNECTED);
1398
1399 set_current_state(TASK_RUNNING);
1400 remove_wait_queue(sk_sleep(sk), &wait);
1401 return err;
1402 }
1403
l2cap_sock_shutdown(struct socket * sock,int how)1404 static int l2cap_sock_shutdown(struct socket *sock, int how)
1405 __context_unsafe(/* complex chan->conn locking */)
1406 {
1407 struct sock *sk = sock->sk;
1408 struct l2cap_chan *chan;
1409 struct l2cap_conn *conn;
1410 int err = 0;
1411
1412 BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1413
1414 /* 'how' parameter is mapped to sk_shutdown as follows:
1415 * SHUT_RD (0) --> RCV_SHUTDOWN (1)
1416 * SHUT_WR (1) --> SEND_SHUTDOWN (2)
1417 * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1418 */
1419 how++;
1420
1421 if (!sk)
1422 return 0;
1423
1424 lock_sock(sk);
1425
1426 if ((sk->sk_shutdown & how) == how)
1427 goto shutdown_already;
1428
1429 BT_DBG("Handling sock shutdown");
1430
1431 /* prevent sk structure from being freed whilst unlocked */
1432 sock_hold(sk);
1433
1434 /* prevent chan structure from being freed whilst unlocked */
1435 chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
1436 if (!chan)
1437 goto shutdown_already;
1438
1439 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1440
1441 if (chan->mode == L2CAP_MODE_ERTM &&
1442 chan->unacked_frames > 0 &&
1443 chan->state == BT_CONNECTED) {
1444 err = __l2cap_wait_ack(sk, chan);
1445
1446 /* After waiting for ACKs, check whether shutdown
1447 * has already been actioned to close the L2CAP
1448 * link such as by l2cap_disconnection_req().
1449 */
1450 if ((sk->sk_shutdown & how) == how)
1451 goto shutdown_matched;
1452 }
1453
1454 /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1455 * is already set
1456 */
1457 if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1458 sk->sk_shutdown |= RCV_SHUTDOWN;
1459 if ((sk->sk_shutdown & how) == how)
1460 goto shutdown_matched;
1461 }
1462
1463 sk->sk_shutdown |= SEND_SHUTDOWN;
1464 release_sock(sk);
1465
1466 l2cap_chan_lock(chan);
1467 /* prevent conn structure from being freed */
1468 conn = l2cap_conn_hold_unless_zero(chan->conn);
1469 l2cap_chan_unlock(chan);
1470
1471 if (conn)
1472 /* mutex lock must be taken before l2cap_chan_lock() */
1473 mutex_lock(&conn->lock);
1474
1475 l2cap_chan_lock(chan);
1476 l2cap_chan_close(chan, 0);
1477 l2cap_chan_unlock(chan);
1478
1479 if (conn) {
1480 mutex_unlock(&conn->lock);
1481 l2cap_conn_put(conn);
1482 }
1483
1484 lock_sock(sk);
1485
1486 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1487 !(current->flags & PF_EXITING))
1488 err = bt_sock_wait_state(sk, BT_CLOSED,
1489 sk->sk_lingertime);
1490
1491 shutdown_matched:
1492 l2cap_chan_put(chan);
1493 sock_put(sk);
1494
1495 shutdown_already:
1496 if (!err && sk->sk_err)
1497 err = -sk->sk_err;
1498
1499 release_sock(sk);
1500
1501 BT_DBG("Sock shutdown complete err: %d", err);
1502
1503 return err;
1504 }
1505
l2cap_sock_release(struct socket * sock)1506 static int l2cap_sock_release(struct socket *sock)
1507 {
1508 struct sock *sk = sock->sk;
1509 int err;
1510 struct l2cap_chan *chan;
1511
1512 BT_DBG("sock %p, sk %p", sock, sk);
1513
1514 if (!sk)
1515 return 0;
1516
1517 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
1518 l2cap_sock_cleanup_listen(sk);
1519 release_sock(sk);
1520
1521 bt_sock_unlink(&l2cap_sk_list, sk);
1522
1523 err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1524 chan = l2cap_pi(sk)->chan;
1525
1526 l2cap_chan_hold(chan);
1527 l2cap_chan_lock(chan);
1528
1529 sock_orphan(sk);
1530 l2cap_sock_kill(sk);
1531
1532 l2cap_chan_unlock(chan);
1533 l2cap_chan_put(chan);
1534
1535 return err;
1536 }
1537
l2cap_sock_cleanup_listen(struct sock * parent)1538 static void l2cap_sock_cleanup_listen(struct sock *parent)
1539 {
1540 struct sock *sk;
1541
1542 BT_DBG("parent %p state %s", parent,
1543 state_to_string(parent->sk_state));
1544
1545 /* Close not yet accepted channels.
1546 *
1547 * bt_accept_dequeue() returns sk with its temporary queue-walk
1548 * reference held, so a concurrent l2cap_conn_del()
1549 * -> l2cap_sock_kill() cannot free sk under us.
1550 *
1551 * cleanup_listen() runs under the parent sk lock, so unlike
1552 * l2cap_sock_shutdown() we must NOT take conn->lock here: that would
1553 * establish sk_lock -> conn->lock and invert the established
1554 * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock).
1555 *
1556 * Instead, briefly take the child sk lock to synchronize vs.
1557 * l2cap_sock_kill that puts l2cap_pi(sk)->chan. We then drop the sk
1558 * lock before taking chan->lock, so sk and chan locks are never held
1559 * together.
1560 *
1561 * Since we cannot call l2cap_chan_close() without conn->lock,
1562 * schedule l2cap_chan_timeout to close the channel; it already
1563 * acquires conn->lock -> chan->lock in the correct order.
1564 */
1565 while ((sk = bt_accept_dequeue(parent, NULL))) {
1566 struct l2cap_chan *chan;
1567
1568 lock_sock_nested(sk, L2CAP_NESTING_NORMAL);
1569 chan = l2cap_pi(sk)->chan;
1570 if (chan)
1571 l2cap_chan_hold(chan);
1572 release_sock(sk);
1573 if (!chan) {
1574 /* Already torn down */
1575 sock_put(sk);
1576 continue;
1577 }
1578
1579 BT_DBG("child chan %p state %s", chan,
1580 state_to_string(chan->state));
1581
1582 l2cap_chan_lock(chan);
1583 /* Since we cannot call l2cap_chan_close() without
1584 * conn->lock, schedule its timer to trigger the close
1585 * and cleanup of this channel.
1586 */
1587 if (chan->conn)
1588 __set_chan_timer(chan, 0);
1589 l2cap_chan_unlock(chan);
1590
1591 l2cap_chan_put(chan);
1592 sock_put(sk);
1593 }
1594 }
1595
l2cap_sock_new_connection_cb(struct l2cap_chan * chan,struct l2cap_chan * new_chan)1596 static int l2cap_sock_new_connection_cb(struct l2cap_chan *chan,
1597 struct l2cap_chan *new_chan)
1598 {
1599 struct sock *sk, *parent = chan->data;
1600
1601 if (!parent)
1602 return -EINVAL;
1603
1604 lock_sock(parent);
1605
1606 if (parent->sk_state != BT_LISTEN) {
1607 release_sock(parent);
1608 return -EINVAL;
1609 }
1610
1611 /* Check for backlog size */
1612 if (sk_acceptq_is_full(parent)) {
1613 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1614 release_sock(parent);
1615 return -ENOBUFS;
1616 }
1617
1618 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1619 GFP_ATOMIC, 0, new_chan);
1620 if (!sk) {
1621 release_sock(parent);
1622 return -ENOMEM;
1623 }
1624
1625 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1626
1627 l2cap_sock_init(sk, parent);
1628
1629 /* The conn list reference taken by l2cap_new_connection() keeps new_chan
1630 * alive once release_sock() lets another task free this socket.
1631 */
1632 bt_accept_enqueue(parent, sk, false);
1633
1634 release_sock(parent);
1635
1636 return 0;
1637 }
1638
l2cap_sock_recv_cb(struct l2cap_chan * chan,struct sk_buff * skb)1639 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1640 {
1641 struct sock *sk;
1642 struct l2cap_pinfo *pi;
1643 int err;
1644
1645 sk = chan->data;
1646 if (!sk)
1647 return -ENXIO;
1648
1649 pi = l2cap_pi(sk);
1650 lock_sock(sk);
1651 if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) {
1652 err = -ENOMEM;
1653 goto done;
1654 }
1655
1656 if (chan->mode != L2CAP_MODE_ERTM &&
1657 chan->mode != L2CAP_MODE_STREAMING &&
1658 chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1659 chan->mode != L2CAP_MODE_EXT_FLOWCTL) {
1660 /* Even if no filter is attached, we could potentially
1661 * get errors from security modules, etc.
1662 */
1663 err = sk_filter(sk, skb);
1664 if (err)
1665 goto done;
1666 }
1667
1668 err = __sock_queue_rcv_skb(sk, skb);
1669
1670 l2cap_publish_rx_avail(chan);
1671
1672 /* For ERTM and LE, handle a skb that doesn't fit into the recv
1673 * buffer. This is important to do because the data frames
1674 * have already been acked, so the skb cannot be discarded.
1675 *
1676 * Notify the l2cap core that the buffer is full, so the
1677 * LOCAL_BUSY state is entered and no more frames are
1678 * acked and reassembled until there is buffer space
1679 * available.
1680 */
1681 if (err < 0 &&
1682 (chan->mode == L2CAP_MODE_ERTM ||
1683 chan->mode == L2CAP_MODE_LE_FLOWCTL ||
1684 chan->mode == L2CAP_MODE_EXT_FLOWCTL)) {
1685 struct l2cap_rx_busy *rx_busy = kmalloc_obj(*rx_busy);
1686 if (!rx_busy) {
1687 err = -ENOMEM;
1688 goto done;
1689 }
1690 rx_busy->skb = skb;
1691 list_add_tail(&rx_busy->list, &pi->rx_busy);
1692 l2cap_chan_busy(chan, 1);
1693 err = 0;
1694 }
1695
1696 done:
1697 release_sock(sk);
1698
1699 return err;
1700 }
1701
l2cap_sock_close_cb(struct l2cap_chan * chan)1702 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1703 {
1704 struct sock *sk = chan->data;
1705
1706 if (!sk)
1707 return;
1708
1709 l2cap_sock_kill(sk);
1710 }
1711
l2cap_sock_teardown_cb(struct l2cap_chan * chan,int err)1712 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1713 {
1714 struct sock *sk = chan->data;
1715 struct sock *parent;
1716
1717 if (!sk)
1718 return;
1719
1720 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1721
1722 /* This callback can be called both for server (BT_LISTEN)
1723 * sockets as well as "normal" ones. To avoid lockdep warnings
1724 * with child socket locking (through l2cap_sock_cleanup_listen)
1725 * we need separation into separate nesting levels. The simplest
1726 * way to accomplish this is to inherit the nesting level used
1727 * for the channel.
1728 */
1729 lock_sock_nested(sk, atomic_read(&chan->nesting));
1730
1731 parent = bt_sk(sk)->parent;
1732
1733 switch (chan->state) {
1734 case BT_OPEN:
1735 case BT_BOUND:
1736 case BT_CLOSED:
1737 break;
1738 case BT_LISTEN:
1739 l2cap_sock_cleanup_listen(sk);
1740 sk->sk_state = BT_CLOSED;
1741 chan->state = BT_CLOSED;
1742
1743 break;
1744 default:
1745 sk->sk_state = BT_CLOSED;
1746 chan->state = BT_CLOSED;
1747
1748 sk->sk_err = err;
1749
1750 if (parent) {
1751 bt_accept_unlink(sk);
1752 parent->sk_data_ready(parent);
1753 } else {
1754 sk->sk_state_change(sk);
1755 }
1756
1757 break;
1758 }
1759 release_sock(sk);
1760
1761 /* Only zap after cleanup to avoid use after free race */
1762 sock_set_flag(sk, SOCK_ZAPPED);
1763
1764 }
1765
l2cap_sock_state_change_cb(struct l2cap_chan * chan,int state,int err)1766 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1767 int err)
1768 {
1769 struct sock *sk = chan->data;
1770
1771 if (!sk)
1772 return;
1773
1774 lock_sock(sk);
1775
1776 sk->sk_state = state;
1777
1778 if (err)
1779 sk->sk_err = err;
1780
1781 release_sock(sk);
1782 }
1783
l2cap_sock_alloc_skb_cb(struct l2cap_chan * chan,unsigned long hdr_len,unsigned long len,int nb)1784 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1785 unsigned long hdr_len,
1786 unsigned long len, int nb)
1787 {
1788 struct sock *sk = chan->data;
1789 struct sk_buff *skb;
1790 int err;
1791
1792 l2cap_chan_unlock(chan);
1793 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1794 l2cap_chan_lock(chan);
1795
1796 if (!skb)
1797 return ERR_PTR(err);
1798
1799 /* Channel lock is released before requesting new skb and then
1800 * reacquired thus we need to recheck channel state.
1801 */
1802 if (chan->state != BT_CONNECTED) {
1803 kfree_skb(skb);
1804 return ERR_PTR(-ENOTCONN);
1805 }
1806
1807 skb->priority = READ_ONCE(sk->sk_priority);
1808
1809 bt_cb(skb)->l2cap.chan = chan;
1810
1811 return skb;
1812 }
1813
l2cap_sock_ready_cb(struct l2cap_chan * chan)1814 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1815 {
1816 struct sock *sk = chan->data;
1817 struct sock *parent;
1818
1819 if (!sk)
1820 return;
1821
1822 lock_sock(sk);
1823
1824 parent = bt_sk(sk)->parent;
1825
1826 BT_DBG("sk %p, parent %p", sk, parent);
1827
1828 sk->sk_state = BT_CONNECTED;
1829 sk->sk_state_change(sk);
1830
1831 if (parent)
1832 parent->sk_data_ready(parent);
1833
1834 release_sock(sk);
1835 }
1836
l2cap_sock_defer_cb(struct l2cap_chan * chan)1837 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1838 {
1839 struct sock *parent, *sk = chan->data;
1840
1841 lock_sock(sk);
1842
1843 parent = bt_sk(sk)->parent;
1844 if (parent)
1845 parent->sk_data_ready(parent);
1846
1847 release_sock(sk);
1848 }
1849
l2cap_sock_resume_cb(struct l2cap_chan * chan)1850 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1851 {
1852 struct sock *sk = chan->data;
1853
1854 if (!sk)
1855 return;
1856
1857 lock_sock(sk);
1858
1859 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1860 sk->sk_state = BT_CONNECTED;
1861 chan->state = BT_CONNECTED;
1862 }
1863
1864 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1865 sk->sk_state_change(sk);
1866
1867 release_sock(sk);
1868 }
1869
l2cap_sock_set_shutdown_cb(struct l2cap_chan * chan)1870 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1871 {
1872 struct sock *sk = chan->data;
1873
1874 lock_sock(sk);
1875 sk->sk_shutdown = SHUTDOWN_MASK;
1876 release_sock(sk);
1877 }
1878
l2cap_sock_get_sndtimeo_cb(struct l2cap_chan * chan)1879 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1880 {
1881 struct sock *sk = chan->data;
1882
1883 if (!sk)
1884 return 0;
1885
1886 return READ_ONCE(sk->sk_sndtimeo);
1887 }
1888
l2cap_sock_get_peer_pid_cb(struct l2cap_chan * chan)1889 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1890 {
1891 struct sock *sk = chan->data;
1892
1893 return sk->sk_peer_pid;
1894 }
1895
l2cap_sock_suspend_cb(struct l2cap_chan * chan)1896 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1897 {
1898 struct sock *sk = chan->data;
1899
1900 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1901 sk->sk_state_change(sk);
1902 }
1903
l2cap_sock_filter(struct l2cap_chan * chan,struct sk_buff * skb)1904 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1905 {
1906 struct sock *sk = chan->data;
1907
1908 switch (chan->mode) {
1909 case L2CAP_MODE_ERTM:
1910 case L2CAP_MODE_STREAMING:
1911 return sk_filter(sk, skb);
1912 }
1913
1914 return 0;
1915 }
1916
1917 static const struct l2cap_ops l2cap_chan_ops = {
1918 .name = "L2CAP Socket Interface",
1919 .new_connection = l2cap_sock_new_connection_cb,
1920 .recv = l2cap_sock_recv_cb,
1921 .close = l2cap_sock_close_cb,
1922 .teardown = l2cap_sock_teardown_cb,
1923 .state_change = l2cap_sock_state_change_cb,
1924 .ready = l2cap_sock_ready_cb,
1925 .defer = l2cap_sock_defer_cb,
1926 .resume = l2cap_sock_resume_cb,
1927 .suspend = l2cap_sock_suspend_cb,
1928 .set_shutdown = l2cap_sock_set_shutdown_cb,
1929 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1930 .get_peer_pid = l2cap_sock_get_peer_pid_cb,
1931 .alloc_skb = l2cap_sock_alloc_skb_cb,
1932 .filter = l2cap_sock_filter,
1933 };
1934
l2cap_sock_destruct(struct sock * sk)1935 static void l2cap_sock_destruct(struct sock *sk)
1936 {
1937 struct l2cap_rx_busy *rx_busy, *next;
1938
1939 BT_DBG("sk %p", sk);
1940
1941 l2cap_sock_put_chan(sk);
1942
1943 list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) {
1944 kfree_skb(rx_busy->skb);
1945 list_del(&rx_busy->list);
1946 kfree(rx_busy);
1947 }
1948
1949 skb_queue_purge(&sk->sk_receive_queue);
1950 skb_queue_purge(&sk->sk_write_queue);
1951 skb_queue_purge(&sk->sk_error_queue);
1952 }
1953
l2cap_skb_msg_name(struct sk_buff * skb,void * msg_name,int * msg_namelen)1954 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1955 int *msg_namelen)
1956 {
1957 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1958
1959 memset(la, 0, sizeof(struct sockaddr_l2));
1960 la->l2_family = AF_BLUETOOTH;
1961 la->l2_psm = bt_cb(skb)->l2cap.psm;
1962 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1963
1964 *msg_namelen = sizeof(struct sockaddr_l2);
1965 }
1966
l2cap_sock_init(struct sock * sk,struct sock * parent)1967 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1968 {
1969 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1970
1971 BT_DBG("sk %p", sk);
1972
1973 if (parent) {
1974 sk->sk_type = parent->sk_type;
1975 bt_sk(sk)->flags = bt_sk(parent)->flags;
1976
1977 /* Channel configuration is inherited from the parent by
1978 * l2cap_new_connection().
1979 */
1980 security_sk_clone(parent, sk);
1981 } else {
1982 switch (sk->sk_type) {
1983 case SOCK_RAW:
1984 chan->chan_type = L2CAP_CHAN_RAW;
1985 break;
1986 case SOCK_DGRAM:
1987 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1988 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1989 break;
1990 case SOCK_SEQPACKET:
1991 case SOCK_STREAM:
1992 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1993 break;
1994 }
1995
1996 chan->imtu = L2CAP_DEFAULT_MTU;
1997 chan->omtu = 0;
1998 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1999 chan->mode = L2CAP_MODE_ERTM;
2000 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
2001 } else {
2002 chan->mode = L2CAP_MODE_BASIC;
2003 }
2004
2005 l2cap_chan_set_defaults(chan, NULL);
2006 }
2007
2008 /* Default config options */
2009 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
2010
2011 chan->data = sk;
2012 chan->ops = &l2cap_chan_ops;
2013
2014 l2cap_publish_rx_avail(chan);
2015 }
2016
2017 static struct proto l2cap_proto = {
2018 .name = "L2CAP",
2019 .owner = THIS_MODULE,
2020 .obj_size = sizeof(struct l2cap_pinfo)
2021 };
2022
l2cap_sock_alloc(struct net * net,struct socket * sock,int proto,gfp_t prio,int kern,struct l2cap_chan * chan)2023 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
2024 int proto, gfp_t prio, int kern,
2025 struct l2cap_chan *chan)
2026 {
2027 struct sock *sk;
2028
2029 sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern);
2030 if (!sk)
2031 return NULL;
2032
2033 sk->sk_destruct = l2cap_sock_destruct;
2034 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
2035
2036 INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy);
2037
2038 /* The sock takes ownership of the caller's reference on chan. */
2039 l2cap_pi(sk)->chan = chan;
2040
2041 return sk;
2042 }
2043
l2cap_sock_create(struct net * net,struct socket * sock,int protocol,int kern)2044 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
2045 int kern)
2046 {
2047 struct sock *sk;
2048 struct l2cap_chan *chan;
2049
2050 BT_DBG("sock %p", sock);
2051
2052 sock->state = SS_UNCONNECTED;
2053
2054 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
2055 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
2056 return -ESOCKTNOSUPPORT;
2057
2058 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
2059 return -EPERM;
2060
2061 sock->ops = &l2cap_sock_ops;
2062
2063 chan = l2cap_chan_create();
2064 if (!chan)
2065 return -ENOMEM;
2066
2067 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern, chan);
2068 if (!sk) {
2069 l2cap_chan_put(chan);
2070 return -ENOMEM;
2071 }
2072
2073 l2cap_sock_init(sk, NULL);
2074 bt_sock_link(&l2cap_sk_list, sk);
2075 return 0;
2076 }
2077
2078 static const struct proto_ops l2cap_sock_ops = {
2079 .family = PF_BLUETOOTH,
2080 .owner = THIS_MODULE,
2081 .release = l2cap_sock_release,
2082 .bind = l2cap_sock_bind,
2083 .connect = l2cap_sock_connect,
2084 .listen = l2cap_sock_listen,
2085 .accept = l2cap_sock_accept,
2086 .getname = l2cap_sock_getname,
2087 .sendmsg = l2cap_sock_sendmsg,
2088 .recvmsg = l2cap_sock_recvmsg,
2089 .poll = bt_sock_poll,
2090 .ioctl = bt_sock_ioctl,
2091 .gettstamp = sock_gettstamp,
2092 .mmap = sock_no_mmap,
2093 .socketpair = sock_no_socketpair,
2094 .shutdown = l2cap_sock_shutdown,
2095 .setsockopt = l2cap_sock_setsockopt,
2096 .getsockopt_iter = l2cap_sock_getsockopt
2097 };
2098
2099 static const struct net_proto_family l2cap_sock_family_ops = {
2100 .family = PF_BLUETOOTH,
2101 .owner = THIS_MODULE,
2102 .create = l2cap_sock_create,
2103 };
2104
l2cap_init_sockets(void)2105 int __init l2cap_init_sockets(void)
2106 {
2107 int err;
2108
2109 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
2110
2111 err = proto_register(&l2cap_proto, 0);
2112 if (err < 0)
2113 return err;
2114
2115 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
2116 if (err < 0) {
2117 BT_ERR("L2CAP socket registration failed");
2118 goto error;
2119 }
2120
2121 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
2122 NULL);
2123 if (err < 0) {
2124 BT_ERR("Failed to create L2CAP proc file");
2125 bt_sock_unregister(BTPROTO_L2CAP);
2126 goto error;
2127 }
2128
2129 BT_INFO("L2CAP socket layer initialized");
2130
2131 return 0;
2132
2133 error:
2134 proto_unregister(&l2cap_proto);
2135 return err;
2136 }
2137
l2cap_cleanup_sockets(void)2138 void l2cap_cleanup_sockets(void)
2139 {
2140 bt_procfs_cleanup(&init_net, "l2cap");
2141 bt_sock_unregister(BTPROTO_L2CAP);
2142 proto_unregister(&l2cap_proto);
2143 }
2144