1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 6 Copyright (C) 2010 Google Inc. 7 Copyright (C) 2011 ProFUSION Embedded Systems 8 Copyright (c) 2012 Code Aurora Forum. All rights reserved. 9 10 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 11 12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 23 SOFTWARE IS DISCLAIMED. 24 */ 25 26 /* Bluetooth L2CAP core. */ 27 28 #include <linux/module.h> 29 30 #include <linux/debugfs.h> 31 #include <linux/crc16.h> 32 #include <linux/filter.h> 33 34 #include <net/bluetooth/bluetooth.h> 35 #include <net/bluetooth/hci_core.h> 36 #include <net/bluetooth/l2cap.h> 37 38 #include "smp.h" 39 40 #define LE_FLOWCTL_MAX_CREDITS 65535 41 42 bool disable_ertm; 43 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED); 44 45 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD; 46 47 static LIST_HEAD(chan_list); 48 static DEFINE_RWLOCK(chan_list_lock); 49 50 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 51 u8 code, u8 ident, u16 dlen, void *data); 52 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 53 void *data); 54 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); 55 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); 56 57 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 58 struct sk_buff_head *skbs, u8 event); 59 static void l2cap_retrans_timeout(struct work_struct *work); 60 static void l2cap_monitor_timeout(struct work_struct *work); 61 static void l2cap_ack_timeout(struct work_struct *work); 62 63 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type) 64 { 65 if (link_type == LE_LINK) { 66 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 67 return BDADDR_LE_PUBLIC; 68 else 69 return BDADDR_LE_RANDOM; 70 } 71 72 return BDADDR_BREDR; 73 } 74 75 static inline u8 bdaddr_src_type(struct hci_conn *hcon) 76 { 77 return bdaddr_type(hcon->type, hcon->src_type); 78 } 79 80 static inline u8 bdaddr_dst_type(struct hci_conn *hcon) 81 { 82 return bdaddr_type(hcon->type, hcon->dst_type); 83 } 84 85 /* ---- L2CAP channels ---- */ 86 87 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 88 u16 cid) 89 { 90 struct l2cap_chan *c; 91 92 list_for_each_entry(c, &conn->chan_l, list) { 93 if (c->dcid == cid) 94 return c; 95 } 96 return NULL; 97 } 98 99 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, 100 u16 cid) 101 { 102 struct l2cap_chan *c; 103 104 list_for_each_entry(c, &conn->chan_l, list) { 105 if (c->scid == cid) 106 return c; 107 } 108 return NULL; 109 } 110 111 /* Find channel with given SCID. 112 * Returns a reference locked channel. 113 */ 114 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, 115 u16 cid) 116 { 117 struct l2cap_chan *c; 118 119 c = __l2cap_get_chan_by_scid(conn, cid); 120 if (c) { 121 /* Only lock if chan reference is not 0 */ 122 c = l2cap_chan_hold_unless_zero(c); 123 if (c) 124 l2cap_chan_lock(c); 125 } 126 127 return c; 128 } 129 130 /* Find channel with given DCID. 131 * Returns a reference locked channel. 132 */ 133 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 134 u16 cid) 135 { 136 struct l2cap_chan *c; 137 138 c = __l2cap_get_chan_by_dcid(conn, cid); 139 if (c) { 140 /* Only lock if chan reference is not 0 */ 141 c = l2cap_chan_hold_unless_zero(c); 142 if (c) 143 l2cap_chan_lock(c); 144 } 145 146 return c; 147 } 148 149 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, 150 u8 ident) 151 { 152 struct l2cap_chan *c; 153 154 list_for_each_entry(c, &conn->chan_l, list) { 155 if (c->ident == ident) 156 return c; 157 } 158 return NULL; 159 } 160 161 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src, 162 u8 src_type) 163 { 164 struct l2cap_chan *c; 165 166 list_for_each_entry(c, &chan_list, global_l) { 167 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR) 168 continue; 169 170 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR) 171 continue; 172 173 if (c->sport == psm && !bacmp(&c->src, src)) 174 return c; 175 } 176 return NULL; 177 } 178 179 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm) 180 { 181 int err; 182 183 write_lock(&chan_list_lock); 184 185 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) { 186 err = -EADDRINUSE; 187 goto done; 188 } 189 190 if (psm) { 191 chan->psm = psm; 192 chan->sport = psm; 193 err = 0; 194 } else { 195 u16 p, start, end, incr; 196 197 if (chan->src_type == BDADDR_BREDR) { 198 start = L2CAP_PSM_DYN_START; 199 end = L2CAP_PSM_AUTO_END; 200 incr = 2; 201 } else { 202 start = L2CAP_PSM_LE_DYN_START; 203 end = L2CAP_PSM_LE_DYN_END; 204 incr = 1; 205 } 206 207 err = -EINVAL; 208 for (p = start; p <= end; p += incr) 209 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src, 210 chan->src_type)) { 211 chan->psm = cpu_to_le16(p); 212 chan->sport = cpu_to_le16(p); 213 err = 0; 214 break; 215 } 216 } 217 218 done: 219 write_unlock(&chan_list_lock); 220 return err; 221 } 222 EXPORT_SYMBOL_GPL(l2cap_add_psm); 223 224 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid) 225 { 226 write_lock(&chan_list_lock); 227 228 /* Override the defaults (which are for conn-oriented) */ 229 chan->omtu = L2CAP_DEFAULT_MTU; 230 chan->chan_type = L2CAP_CHAN_FIXED; 231 232 chan->scid = scid; 233 234 write_unlock(&chan_list_lock); 235 236 return 0; 237 } 238 239 static u16 l2cap_alloc_cid(struct l2cap_conn *conn) 240 { 241 u16 cid, dyn_end; 242 243 if (conn->hcon->type == LE_LINK) 244 dyn_end = L2CAP_CID_LE_DYN_END; 245 else 246 dyn_end = L2CAP_CID_DYN_END; 247 248 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) { 249 if (!__l2cap_get_chan_by_scid(conn, cid)) 250 return cid; 251 } 252 253 return 0; 254 } 255 256 static void l2cap_state_change(struct l2cap_chan *chan, int state) 257 { 258 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state), 259 state_to_string(state)); 260 261 chan->state = state; 262 chan->ops->state_change(chan, state, 0); 263 } 264 265 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan, 266 int state, int err) 267 { 268 chan->state = state; 269 chan->ops->state_change(chan, chan->state, err); 270 } 271 272 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err) 273 { 274 chan->ops->state_change(chan, chan->state, err); 275 } 276 277 static void __set_retrans_timer(struct l2cap_chan *chan) 278 { 279 if (!delayed_work_pending(&chan->monitor_timer) && 280 chan->retrans_timeout) { 281 l2cap_set_timer(chan, &chan->retrans_timer, 282 msecs_to_jiffies(chan->retrans_timeout)); 283 } 284 } 285 286 static void __set_monitor_timer(struct l2cap_chan *chan) 287 { 288 __clear_retrans_timer(chan); 289 if (chan->monitor_timeout) { 290 l2cap_set_timer(chan, &chan->monitor_timer, 291 msecs_to_jiffies(chan->monitor_timeout)); 292 } 293 } 294 295 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head, 296 u16 seq) 297 { 298 struct sk_buff *skb; 299 300 skb_queue_walk(head, skb) { 301 if (bt_cb(skb)->l2cap.txseq == seq) 302 return skb; 303 } 304 305 return NULL; 306 } 307 308 /* ---- L2CAP sequence number lists ---- */ 309 310 /* For ERTM, ordered lists of sequence numbers must be tracked for 311 * SREJ requests that are received and for frames that are to be 312 * retransmitted. These seq_list functions implement a singly-linked 313 * list in an array, where membership in the list can also be checked 314 * in constant time. Items can also be added to the tail of the list 315 * and removed from the head in constant time, without further memory 316 * allocs or frees. 317 */ 318 319 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size) 320 { 321 size_t alloc_size, i; 322 323 /* Allocated size is a power of 2 to map sequence numbers 324 * (which may be up to 14 bits) in to a smaller array that is 325 * sized for the negotiated ERTM transmit windows. 326 */ 327 alloc_size = roundup_pow_of_two(size); 328 329 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL); 330 if (!seq_list->list) 331 return -ENOMEM; 332 333 seq_list->mask = alloc_size - 1; 334 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 335 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 336 for (i = 0; i < alloc_size; i++) 337 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 338 339 return 0; 340 } 341 342 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list) 343 { 344 kfree(seq_list->list); 345 } 346 347 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list, 348 u16 seq) 349 { 350 /* Constant-time check for list membership */ 351 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR; 352 } 353 354 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list) 355 { 356 u16 seq = seq_list->head; 357 u16 mask = seq_list->mask; 358 359 seq_list->head = seq_list->list[seq & mask]; 360 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR; 361 362 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) { 363 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 364 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 365 } 366 367 return seq; 368 } 369 370 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list) 371 { 372 u16 i; 373 374 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) 375 return; 376 377 for (i = 0; i <= seq_list->mask; i++) 378 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 379 380 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 381 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 382 } 383 384 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq) 385 { 386 u16 mask = seq_list->mask; 387 388 /* All appends happen in constant time */ 389 390 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR) 391 return; 392 393 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR) 394 seq_list->head = seq; 395 else 396 seq_list->list[seq_list->tail & mask] = seq; 397 398 seq_list->tail = seq; 399 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL; 400 } 401 402 static void l2cap_chan_timeout(struct work_struct *work) 403 { 404 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 405 chan_timer.work); 406 struct l2cap_conn *conn = chan->conn; 407 int reason; 408 409 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 410 411 if (test_bit(FLAG_DEL, &chan->flags)) { 412 l2cap_chan_put(chan); 413 return; 414 } 415 416 mutex_lock(&conn->lock); 417 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling 418 * this work. No need to call l2cap_chan_hold(chan) here again. 419 */ 420 l2cap_chan_lock(chan); 421 422 if (test_bit(FLAG_DEL, &chan->flags)) 423 goto unlock; 424 425 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) 426 reason = ECONNREFUSED; 427 else if (chan->state == BT_CONNECT && 428 chan->sec_level != BT_SECURITY_SDP) 429 reason = ECONNREFUSED; 430 else 431 reason = ETIMEDOUT; 432 433 l2cap_chan_close(chan, reason); 434 435 chan->ops->close(chan); 436 437 unlock: 438 l2cap_chan_unlock(chan); 439 mutex_unlock(&conn->lock); 440 l2cap_chan_put(chan); 441 } 442 443 struct l2cap_chan *l2cap_chan_create(void) 444 { 445 struct l2cap_chan *chan; 446 447 chan = kzalloc_obj(*chan, GFP_ATOMIC); 448 if (!chan) 449 return NULL; 450 451 skb_queue_head_init(&chan->tx_q); 452 skb_queue_head_init(&chan->srej_q); 453 mutex_init(&chan->lock); 454 455 /* Set default lock nesting level */ 456 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL); 457 458 /* Available receive buffer space is initially unknown */ 459 chan->rx_avail = -1; 460 461 write_lock(&chan_list_lock); 462 list_add(&chan->global_l, &chan_list); 463 write_unlock(&chan_list_lock); 464 465 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout); 466 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout); 467 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout); 468 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout); 469 470 chan->state = BT_OPEN; 471 472 kref_init(&chan->kref); 473 474 /* This flag is cleared in l2cap_chan_ready() */ 475 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 476 477 BT_DBG("chan %p", chan); 478 479 return chan; 480 } 481 EXPORT_SYMBOL_GPL(l2cap_chan_create); 482 483 static void l2cap_chan_destroy(struct kref *kref) 484 { 485 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref); 486 487 BT_DBG("chan %p", chan); 488 489 write_lock(&chan_list_lock); 490 list_del(&chan->global_l); 491 write_unlock(&chan_list_lock); 492 493 if (chan->conn) 494 l2cap_conn_put(chan->conn); 495 496 kfree(chan); 497 } 498 499 void l2cap_chan_hold(struct l2cap_chan *c) 500 { 501 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 502 503 kref_get(&c->kref); 504 } 505 EXPORT_SYMBOL_GPL(l2cap_chan_hold); 506 507 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c) 508 { 509 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 510 511 if (!kref_get_unless_zero(&c->kref)) 512 return NULL; 513 514 return c; 515 } 516 517 void l2cap_chan_put(struct l2cap_chan *c) 518 { 519 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 520 521 kref_put(&c->kref, l2cap_chan_destroy); 522 } 523 EXPORT_SYMBOL_GPL(l2cap_chan_put); 524 525 /* Initialise @chan with default values, inheriting from the parent channel 526 * @pchan when it is given. 527 */ 528 void l2cap_chan_set_defaults(struct l2cap_chan *chan, struct l2cap_chan *pchan) 529 { 530 chan->fcs = L2CAP_FCS_CRC16; 531 chan->max_tx = L2CAP_DEFAULT_MAX_TX; 532 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW; 533 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 534 chan->remote_max_tx = chan->max_tx; 535 chan->remote_tx_win = chan->tx_win; 536 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW; 537 chan->sec_level = BT_SECURITY_LOW; 538 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 539 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; 540 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; 541 542 if (pchan) { 543 BT_DBG("chan %p pchan %p", chan, pchan); 544 545 chan->chan_type = pchan->chan_type; 546 chan->imtu = pchan->imtu; 547 chan->omtu = pchan->omtu; 548 chan->mode = pchan->mode; 549 chan->fcs = pchan->fcs; 550 chan->max_tx = pchan->max_tx; 551 chan->tx_win = pchan->tx_win; 552 chan->tx_win_max = pchan->tx_win_max; 553 chan->sec_level = pchan->sec_level; 554 chan->conf_state = pchan->conf_state; 555 chan->flags = pchan->flags; 556 chan->tx_credits = pchan->tx_credits; 557 chan->rx_credits = pchan->rx_credits; 558 559 if (chan->chan_type == L2CAP_CHAN_FIXED) { 560 chan->scid = pchan->scid; 561 chan->dcid = pchan->scid; 562 } 563 564 return; 565 } 566 567 chan->conf_state = 0; 568 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 569 570 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 571 } 572 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults); 573 574 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan) 575 { 576 size_t sdu_len = chan->sdu ? chan->sdu->len : 0; 577 578 if (chan->mps == 0) 579 return 0; 580 581 /* If we don't know the available space in the receiver buffer, give 582 * enough credits for a full packet. 583 */ 584 if (chan->rx_avail == -1) 585 return (chan->imtu / chan->mps) + 1; 586 587 /* If we know how much space is available in the receive buffer, give 588 * out as many credits as would fill the buffer. 589 */ 590 if (chan->rx_avail <= sdu_len) 591 return 0; 592 593 return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps); 594 } 595 596 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits) 597 { 598 chan->sdu = NULL; 599 chan->sdu_last_frag = NULL; 600 chan->sdu_len = 0; 601 chan->tx_credits = tx_credits; 602 /* Derive MPS from connection MTU to stop HCI fragmentation */ 603 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE); 604 chan->rx_credits = l2cap_le_rx_credits(chan); 605 606 skb_queue_head_init(&chan->tx_q); 607 } 608 609 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits) 610 { 611 l2cap_le_flowctl_init(chan, tx_credits); 612 613 /* L2CAP implementations shall support a minimum MPS of 64 octets */ 614 if (chan->mps < L2CAP_ECRED_MIN_MPS) { 615 chan->mps = L2CAP_ECRED_MIN_MPS; 616 chan->rx_credits = l2cap_le_rx_credits(chan); 617 } 618 } 619 620 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 621 { 622 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, 623 __le16_to_cpu(chan->psm), chan->dcid); 624 625 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 626 627 chan->conn = l2cap_conn_get(conn); 628 629 switch (chan->chan_type) { 630 case L2CAP_CHAN_CONN_ORIENTED: 631 /* Alloc CID for connection-oriented socket */ 632 chan->scid = l2cap_alloc_cid(conn); 633 if (conn->hcon->type == ACL_LINK) 634 chan->omtu = L2CAP_DEFAULT_MTU; 635 break; 636 637 case L2CAP_CHAN_CONN_LESS: 638 /* Connectionless socket */ 639 chan->scid = L2CAP_CID_CONN_LESS; 640 chan->dcid = L2CAP_CID_CONN_LESS; 641 chan->omtu = L2CAP_DEFAULT_MTU; 642 break; 643 644 case L2CAP_CHAN_FIXED: 645 /* Caller will set CID and CID specific MTU values */ 646 break; 647 648 default: 649 /* Raw socket can send/recv signalling messages only */ 650 chan->scid = L2CAP_CID_SIGNALING; 651 chan->dcid = L2CAP_CID_SIGNALING; 652 chan->omtu = L2CAP_DEFAULT_MTU; 653 } 654 655 chan->local_id = L2CAP_BESTEFFORT_ID; 656 chan->local_stype = L2CAP_SERV_BESTEFFORT; 657 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE; 658 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME; 659 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT; 660 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO; 661 662 l2cap_chan_hold(chan); 663 664 /* Only keep a reference for fixed channels if they requested it */ 665 if (chan->chan_type != L2CAP_CHAN_FIXED || 666 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 667 hci_conn_hold(conn->hcon); 668 669 /* Append to the list since the order matters for ECRED */ 670 list_add_tail(&chan->list, &conn->chan_l); 671 } 672 673 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 674 { 675 mutex_lock(&conn->lock); 676 __l2cap_chan_add(conn, chan); 677 mutex_unlock(&conn->lock); 678 } 679 680 void l2cap_chan_del(struct l2cap_chan *chan, int err) 681 { 682 __clear_chan_timer(chan); 683 684 BT_DBG("chan %p, err %d, state %s", chan, err, 685 state_to_string(chan->state)); 686 687 chan->ops->teardown(chan, err); 688 689 if (!test_and_set_bit(FLAG_DEL, &chan->flags)) { 690 /* Delete from channel list */ 691 list_del(&chan->list); 692 693 l2cap_chan_put(chan); 694 695 /* Reference was only held for non-fixed channels or 696 * fixed channels that explicitly requested it using the 697 * FLAG_HOLD_HCI_CONN flag. 698 */ 699 if (chan->chan_type != L2CAP_CHAN_FIXED || 700 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 701 hci_conn_drop(chan->conn->hcon); 702 } 703 704 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state)) 705 return; 706 707 switch (chan->mode) { 708 case L2CAP_MODE_BASIC: 709 break; 710 711 case L2CAP_MODE_LE_FLOWCTL: 712 case L2CAP_MODE_EXT_FLOWCTL: 713 skb_queue_purge(&chan->tx_q); 714 break; 715 716 case L2CAP_MODE_ERTM: 717 __clear_retrans_timer(chan); 718 __clear_monitor_timer(chan); 719 __clear_ack_timer(chan); 720 721 skb_queue_purge(&chan->srej_q); 722 723 l2cap_seq_list_free(&chan->srej_list); 724 l2cap_seq_list_free(&chan->retrans_list); 725 fallthrough; 726 727 case L2CAP_MODE_STREAMING: 728 skb_queue_purge(&chan->tx_q); 729 break; 730 } 731 } 732 EXPORT_SYMBOL_GPL(l2cap_chan_del); 733 734 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id, 735 l2cap_chan_func_t func, void *data) 736 { 737 struct l2cap_chan *chan, *l; 738 739 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 740 if (chan->ident == id) 741 func(chan, data); 742 } 743 } 744 745 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 746 void *data) 747 { 748 struct l2cap_chan *chan; 749 750 list_for_each_entry(chan, &conn->chan_l, list) { 751 func(chan, data); 752 } 753 } 754 755 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 756 void *data) 757 { 758 if (!conn) 759 return; 760 761 mutex_lock(&conn->lock); 762 __l2cap_chan_list(conn, func, data); 763 mutex_unlock(&conn->lock); 764 } 765 766 EXPORT_SYMBOL_GPL(l2cap_chan_list); 767 768 static void l2cap_conn_update_id_addr(struct work_struct *work) 769 { 770 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 771 id_addr_timer.work); 772 struct hci_conn *hcon = conn->hcon; 773 struct l2cap_chan *chan; 774 775 mutex_lock(&conn->lock); 776 777 list_for_each_entry(chan, &conn->chan_l, list) { 778 l2cap_chan_lock(chan); 779 bacpy(&chan->dst, &hcon->dst); 780 chan->dst_type = bdaddr_dst_type(hcon); 781 l2cap_chan_unlock(chan); 782 } 783 784 mutex_unlock(&conn->lock); 785 } 786 787 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) 788 { 789 struct l2cap_conn *conn = chan->conn; 790 struct l2cap_le_conn_rsp rsp; 791 u16 result; 792 793 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 794 result = L2CAP_CR_LE_AUTHORIZATION; 795 else 796 result = L2CAP_CR_LE_BAD_PSM; 797 798 l2cap_state_change(chan, BT_DISCONN); 799 800 rsp.dcid = cpu_to_le16(chan->scid); 801 rsp.mtu = cpu_to_le16(chan->imtu); 802 rsp.mps = cpu_to_le16(chan->mps); 803 rsp.credits = cpu_to_le16(chan->rx_credits); 804 rsp.result = cpu_to_le16(result); 805 806 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 807 &rsp); 808 } 809 810 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan) 811 { 812 l2cap_state_change(chan, BT_DISCONN); 813 814 __l2cap_ecred_conn_rsp_defer(chan); 815 } 816 817 static void l2cap_chan_connect_reject(struct l2cap_chan *chan) 818 { 819 struct l2cap_conn *conn = chan->conn; 820 struct l2cap_conn_rsp rsp; 821 u16 result; 822 823 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 824 result = L2CAP_CR_SEC_BLOCK; 825 else 826 result = L2CAP_CR_BAD_PSM; 827 828 l2cap_state_change(chan, BT_DISCONN); 829 830 rsp.scid = cpu_to_le16(chan->dcid); 831 rsp.dcid = cpu_to_le16(chan->scid); 832 rsp.result = cpu_to_le16(result); 833 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 834 835 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 836 } 837 838 void l2cap_chan_close(struct l2cap_chan *chan, int reason) 839 { 840 struct l2cap_conn *conn = chan->conn; 841 842 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 843 844 switch (chan->state) { 845 case BT_LISTEN: 846 chan->ops->teardown(chan, 0); 847 break; 848 849 case BT_CONNECTED: 850 case BT_CONFIG: 851 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 852 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 853 l2cap_send_disconn_req(chan, reason); 854 } else 855 l2cap_chan_del(chan, reason); 856 break; 857 858 case BT_CONNECT2: 859 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 860 if (conn->hcon->type == ACL_LINK) 861 l2cap_chan_connect_reject(chan); 862 else if (conn->hcon->type == LE_LINK) { 863 switch (chan->mode) { 864 case L2CAP_MODE_LE_FLOWCTL: 865 l2cap_chan_le_connect_reject(chan); 866 break; 867 case L2CAP_MODE_EXT_FLOWCTL: 868 l2cap_chan_ecred_connect_reject(chan); 869 return; 870 } 871 } 872 } 873 874 l2cap_chan_del(chan, reason); 875 break; 876 877 case BT_CONNECT: 878 case BT_DISCONN: 879 l2cap_chan_del(chan, reason); 880 break; 881 882 default: 883 chan->ops->teardown(chan, 0); 884 break; 885 } 886 } 887 EXPORT_SYMBOL(l2cap_chan_close); 888 889 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan) 890 { 891 switch (chan->chan_type) { 892 case L2CAP_CHAN_RAW: 893 switch (chan->sec_level) { 894 case BT_SECURITY_HIGH: 895 case BT_SECURITY_FIPS: 896 return HCI_AT_DEDICATED_BONDING_MITM; 897 case BT_SECURITY_MEDIUM: 898 return HCI_AT_DEDICATED_BONDING; 899 default: 900 return HCI_AT_NO_BONDING; 901 } 902 break; 903 case L2CAP_CHAN_CONN_LESS: 904 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) { 905 if (chan->sec_level == BT_SECURITY_LOW) 906 chan->sec_level = BT_SECURITY_SDP; 907 } 908 if (chan->sec_level == BT_SECURITY_HIGH || 909 chan->sec_level == BT_SECURITY_FIPS) 910 return HCI_AT_NO_BONDING_MITM; 911 else 912 return HCI_AT_NO_BONDING; 913 break; 914 case L2CAP_CHAN_CONN_ORIENTED: 915 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) { 916 if (chan->sec_level == BT_SECURITY_LOW) 917 chan->sec_level = BT_SECURITY_SDP; 918 919 if (chan->sec_level == BT_SECURITY_HIGH || 920 chan->sec_level == BT_SECURITY_FIPS) 921 return HCI_AT_NO_BONDING_MITM; 922 else 923 return HCI_AT_NO_BONDING; 924 } 925 fallthrough; 926 927 default: 928 switch (chan->sec_level) { 929 case BT_SECURITY_HIGH: 930 case BT_SECURITY_FIPS: 931 return HCI_AT_GENERAL_BONDING_MITM; 932 case BT_SECURITY_MEDIUM: 933 return HCI_AT_GENERAL_BONDING; 934 default: 935 return HCI_AT_NO_BONDING; 936 } 937 break; 938 } 939 } 940 941 /* Service level security */ 942 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator) 943 { 944 struct l2cap_conn *conn = chan->conn; 945 __u8 auth_type; 946 947 if (conn->hcon->type == LE_LINK) 948 return smp_conn_security(conn->hcon, chan->sec_level); 949 950 auth_type = l2cap_get_auth_type(chan); 951 952 return hci_conn_security(conn->hcon, chan->sec_level, auth_type, 953 initiator); 954 } 955 956 static int l2cap_get_ident(struct l2cap_conn *conn) 957 { 958 u8 max; 959 int ident; 960 961 /* LE link does not support tools like l2ping so use the full range */ 962 if (conn->hcon->type == LE_LINK) 963 max = 255; 964 /* Get next available identificator. 965 * 1 - 128 are used by kernel. 966 * 129 - 199 are reserved. 967 * 200 - 254 are used by utilities like l2ping, etc. 968 */ 969 else 970 max = 128; 971 972 /* Allocate ident using min as last used + 1 (cyclic) */ 973 ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1, 974 max, GFP_ATOMIC); 975 /* Force min 1 to start over */ 976 if (ident <= 0) { 977 ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC); 978 if (ident <= 0) { 979 /* If all idents are in use, log an error, this is 980 * extremely unlikely to happen and would indicate a bug 981 * in the code that idents are not being freed properly. 982 */ 983 BT_ERR("Unable to allocate ident: %d", ident); 984 return 0; 985 } 986 } 987 988 WRITE_ONCE(conn->tx_ident, ident); 989 990 return ident; 991 } 992 993 static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb, 994 u8 flags) 995 { 996 /* Check if the hcon still valid before attempting to send */ 997 if (hci_conn_valid(conn->hcon->hdev, conn->hcon)) 998 hci_send_acl(conn->hchan, skb, flags); 999 else 1000 kfree_skb(skb); 1001 } 1002 1003 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 1004 void *data) 1005 { 1006 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data); 1007 u8 flags; 1008 1009 BT_DBG("code 0x%2.2x", code); 1010 1011 if (!skb) 1012 return; 1013 1014 /* Use NO_FLUSH if supported or we have an LE link (which does 1015 * not support auto-flushing packets) */ 1016 if (lmp_no_flush_capable(conn->hcon->hdev) || 1017 conn->hcon->type == LE_LINK) 1018 flags = ACL_START_NO_FLUSH; 1019 else 1020 flags = ACL_START; 1021 1022 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; 1023 skb->priority = HCI_PRIO_MAX; 1024 1025 l2cap_send_acl(conn, skb, flags); 1026 } 1027 1028 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) 1029 { 1030 struct hci_conn *hcon = chan->conn->hcon; 1031 u16 flags; 1032 1033 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len, 1034 skb->priority); 1035 1036 /* Use NO_FLUSH for LE links (where this is the only option) or 1037 * if the BR/EDR link supports it and flushing has not been 1038 * explicitly requested (through FLAG_FLUSHABLE). 1039 */ 1040 if (hcon->type == LE_LINK || 1041 (!test_bit(FLAG_FLUSHABLE, &chan->flags) && 1042 lmp_no_flush_capable(hcon->hdev))) 1043 flags = ACL_START_NO_FLUSH; 1044 else 1045 flags = ACL_START; 1046 1047 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1048 hci_send_acl(chan->conn->hchan, skb, flags); 1049 } 1050 1051 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control) 1052 { 1053 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT; 1054 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT; 1055 1056 if (enh & L2CAP_CTRL_FRAME_TYPE) { 1057 /* S-Frame */ 1058 control->sframe = 1; 1059 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT; 1060 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT; 1061 1062 control->sar = 0; 1063 control->txseq = 0; 1064 } else { 1065 /* I-Frame */ 1066 control->sframe = 0; 1067 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT; 1068 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT; 1069 1070 control->poll = 0; 1071 control->super = 0; 1072 } 1073 } 1074 1075 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control) 1076 { 1077 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1078 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT; 1079 1080 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) { 1081 /* S-Frame */ 1082 control->sframe = 1; 1083 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT; 1084 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT; 1085 1086 control->sar = 0; 1087 control->txseq = 0; 1088 } else { 1089 /* I-Frame */ 1090 control->sframe = 0; 1091 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT; 1092 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1093 1094 control->poll = 0; 1095 control->super = 0; 1096 } 1097 } 1098 1099 static inline void __unpack_control(struct l2cap_chan *chan, 1100 struct sk_buff *skb) 1101 { 1102 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1103 __unpack_extended_control(get_unaligned_le32(skb->data), 1104 &bt_cb(skb)->l2cap); 1105 skb_pull(skb, L2CAP_EXT_CTRL_SIZE); 1106 } else { 1107 __unpack_enhanced_control(get_unaligned_le16(skb->data), 1108 &bt_cb(skb)->l2cap); 1109 skb_pull(skb, L2CAP_ENH_CTRL_SIZE); 1110 } 1111 } 1112 1113 static u32 __pack_extended_control(struct l2cap_ctrl *control) 1114 { 1115 u32 packed; 1116 1117 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1118 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT; 1119 1120 if (control->sframe) { 1121 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT; 1122 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT; 1123 packed |= L2CAP_EXT_CTRL_FRAME_TYPE; 1124 } else { 1125 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT; 1126 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1127 } 1128 1129 return packed; 1130 } 1131 1132 static u16 __pack_enhanced_control(struct l2cap_ctrl *control) 1133 { 1134 u16 packed; 1135 1136 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT; 1137 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT; 1138 1139 if (control->sframe) { 1140 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT; 1141 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT; 1142 packed |= L2CAP_CTRL_FRAME_TYPE; 1143 } else { 1144 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT; 1145 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT; 1146 } 1147 1148 return packed; 1149 } 1150 1151 static inline void __pack_control(struct l2cap_chan *chan, 1152 struct l2cap_ctrl *control, 1153 struct sk_buff *skb) 1154 { 1155 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1156 put_unaligned_le32(__pack_extended_control(control), 1157 skb->data + L2CAP_HDR_SIZE); 1158 } else { 1159 put_unaligned_le16(__pack_enhanced_control(control), 1160 skb->data + L2CAP_HDR_SIZE); 1161 } 1162 } 1163 1164 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan) 1165 { 1166 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1167 return L2CAP_EXT_HDR_SIZE; 1168 else 1169 return L2CAP_ENH_HDR_SIZE; 1170 } 1171 1172 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan, 1173 u32 control) 1174 { 1175 struct sk_buff *skb; 1176 struct l2cap_hdr *lh; 1177 int hlen = __ertm_hdr_size(chan); 1178 1179 if (chan->fcs == L2CAP_FCS_CRC16) 1180 hlen += L2CAP_FCS_SIZE; 1181 1182 skb = bt_skb_alloc(hlen, GFP_KERNEL); 1183 1184 if (!skb) 1185 return ERR_PTR(-ENOMEM); 1186 1187 lh = skb_put(skb, L2CAP_HDR_SIZE); 1188 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE); 1189 lh->cid = cpu_to_le16(chan->dcid); 1190 1191 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1192 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 1193 else 1194 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 1195 1196 if (chan->fcs == L2CAP_FCS_CRC16) { 1197 u16 fcs = crc16(0, (u8 *)skb->data, skb->len); 1198 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1199 } 1200 1201 skb->priority = HCI_PRIO_MAX; 1202 return skb; 1203 } 1204 1205 static void l2cap_send_sframe(struct l2cap_chan *chan, 1206 struct l2cap_ctrl *control) 1207 { 1208 struct sk_buff *skb; 1209 u32 control_field; 1210 1211 BT_DBG("chan %p, control %p", chan, control); 1212 1213 if (!control->sframe) 1214 return; 1215 1216 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) && 1217 !control->poll) 1218 control->final = 1; 1219 1220 if (control->super == L2CAP_SUPER_RR) 1221 clear_bit(CONN_RNR_SENT, &chan->conn_state); 1222 else if (control->super == L2CAP_SUPER_RNR) 1223 set_bit(CONN_RNR_SENT, &chan->conn_state); 1224 1225 if (control->super != L2CAP_SUPER_SREJ) { 1226 chan->last_acked_seq = control->reqseq; 1227 __clear_ack_timer(chan); 1228 } 1229 1230 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq, 1231 control->final, control->poll, control->super); 1232 1233 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1234 control_field = __pack_extended_control(control); 1235 else 1236 control_field = __pack_enhanced_control(control); 1237 1238 skb = l2cap_create_sframe_pdu(chan, control_field); 1239 if (!IS_ERR(skb)) 1240 l2cap_do_send(chan, skb); 1241 } 1242 1243 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll) 1244 { 1245 struct l2cap_ctrl control; 1246 1247 BT_DBG("chan %p, poll %d", chan, poll); 1248 1249 memset(&control, 0, sizeof(control)); 1250 control.sframe = 1; 1251 control.poll = poll; 1252 1253 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 1254 control.super = L2CAP_SUPER_RNR; 1255 else 1256 control.super = L2CAP_SUPER_RR; 1257 1258 control.reqseq = chan->buffer_seq; 1259 l2cap_send_sframe(chan, &control); 1260 } 1261 1262 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) 1263 { 1264 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 1265 return true; 1266 1267 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); 1268 } 1269 1270 void l2cap_send_conn_req(struct l2cap_chan *chan) 1271 { 1272 struct l2cap_conn *conn = chan->conn; 1273 struct l2cap_conn_req req; 1274 1275 req.scid = cpu_to_le16(chan->scid); 1276 req.psm = chan->psm; 1277 1278 chan->ident = l2cap_get_ident(conn); 1279 1280 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 1281 1282 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req); 1283 } 1284 1285 static void l2cap_chan_ready(struct l2cap_chan *chan) 1286 { 1287 /* The channel may have already been flagged as connected in 1288 * case of receiving data before the L2CAP info req/rsp 1289 * procedure is complete. 1290 */ 1291 if (chan->state == BT_CONNECTED) 1292 return; 1293 1294 /* This clears all conf flags, including CONF_NOT_COMPLETE */ 1295 chan->conf_state = 0; 1296 __clear_chan_timer(chan); 1297 1298 switch (chan->mode) { 1299 case L2CAP_MODE_LE_FLOWCTL: 1300 case L2CAP_MODE_EXT_FLOWCTL: 1301 if (!chan->tx_credits) 1302 chan->ops->suspend(chan); 1303 break; 1304 } 1305 1306 chan->state = BT_CONNECTED; 1307 1308 chan->ops->ready(chan); 1309 } 1310 1311 static void l2cap_le_connect(struct l2cap_chan *chan) 1312 { 1313 struct l2cap_conn *conn = chan->conn; 1314 struct l2cap_le_conn_req req; 1315 1316 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags)) 1317 return; 1318 1319 if (!chan->imtu) 1320 chan->imtu = chan->conn->mtu; 1321 1322 l2cap_le_flowctl_init(chan, 0); 1323 1324 memset(&req, 0, sizeof(req)); 1325 req.psm = chan->psm; 1326 req.scid = cpu_to_le16(chan->scid); 1327 req.mtu = cpu_to_le16(chan->imtu); 1328 req.mps = cpu_to_le16(chan->mps); 1329 req.credits = cpu_to_le16(chan->rx_credits); 1330 1331 chan->ident = l2cap_get_ident(conn); 1332 1333 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ, 1334 sizeof(req), &req); 1335 } 1336 1337 struct l2cap_ecred_conn_data { 1338 struct { 1339 struct l2cap_ecred_conn_req_hdr req; 1340 __le16 scid[5]; 1341 } __packed pdu; 1342 struct l2cap_chan *chan; 1343 struct pid *pid; 1344 int count; 1345 }; 1346 1347 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data) 1348 { 1349 struct l2cap_ecred_conn_data *conn = data; 1350 struct pid *pid; 1351 1352 if (chan == conn->chan) 1353 return; 1354 1355 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 1356 return; 1357 1358 pid = chan->ops->get_peer_pid(chan); 1359 1360 /* Only add deferred channels with the same PID/PSM */ 1361 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident || 1362 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 1363 return; 1364 1365 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1366 return; 1367 1368 l2cap_ecred_init(chan, 0); 1369 1370 /* Set the same ident so we can match on the rsp */ 1371 chan->ident = conn->chan->ident; 1372 1373 /* Include all channels deferred */ 1374 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid); 1375 1376 conn->count++; 1377 } 1378 1379 static void l2cap_ecred_connect(struct l2cap_chan *chan) 1380 { 1381 struct l2cap_conn *conn = chan->conn; 1382 struct l2cap_ecred_conn_data data; 1383 1384 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 1385 return; 1386 1387 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1388 return; 1389 1390 l2cap_ecred_init(chan, 0); 1391 1392 memset(&data, 0, sizeof(data)); 1393 data.pdu.req.psm = chan->psm; 1394 data.pdu.req.mtu = cpu_to_le16(chan->imtu); 1395 data.pdu.req.mps = cpu_to_le16(chan->mps); 1396 data.pdu.req.credits = cpu_to_le16(chan->rx_credits); 1397 data.pdu.scid[0] = cpu_to_le16(chan->scid); 1398 1399 chan->ident = l2cap_get_ident(conn); 1400 1401 data.count = 1; 1402 data.chan = chan; 1403 data.pid = chan->ops->get_peer_pid(chan); 1404 1405 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data); 1406 1407 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ, 1408 sizeof(data.pdu.req) + data.count * sizeof(__le16), 1409 &data.pdu); 1410 } 1411 1412 static void l2cap_le_start(struct l2cap_chan *chan) 1413 { 1414 struct l2cap_conn *conn = chan->conn; 1415 1416 if (!smp_conn_security(conn->hcon, chan->sec_level)) 1417 return; 1418 1419 if (!chan->psm) { 1420 l2cap_chan_ready(chan); 1421 return; 1422 } 1423 1424 if (chan->state == BT_CONNECT) { 1425 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) 1426 l2cap_ecred_connect(chan); 1427 else 1428 l2cap_le_connect(chan); 1429 } 1430 } 1431 1432 static void l2cap_start_connection(struct l2cap_chan *chan) 1433 { 1434 if (chan->conn->hcon->type == LE_LINK) { 1435 l2cap_le_start(chan); 1436 } else { 1437 l2cap_send_conn_req(chan); 1438 } 1439 } 1440 1441 static void l2cap_request_info(struct l2cap_conn *conn) 1442 { 1443 struct l2cap_info_req req; 1444 1445 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1446 return; 1447 1448 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 1449 1450 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 1451 conn->info_ident = l2cap_get_ident(conn); 1452 1453 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 1454 1455 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 1456 sizeof(req), &req); 1457 } 1458 1459 static bool l2cap_check_enc_key_size(struct hci_conn *hcon, 1460 struct l2cap_chan *chan) 1461 { 1462 /* The minimum encryption key size needs to be enforced by the 1463 * host stack before establishing any L2CAP connections. The 1464 * specification in theory allows a minimum of 1, but to align 1465 * BR/EDR and LE transports, a minimum of 7 is chosen. 1466 * 1467 * This check might also be called for unencrypted connections 1468 * that have no key size requirements. Ensure that the link is 1469 * actually encrypted before enforcing a key size. 1470 */ 1471 int min_key_size = hcon->hdev->min_enc_key_size; 1472 1473 /* On FIPS security level, key size must be 16 bytes */ 1474 if (chan->sec_level == BT_SECURITY_FIPS) 1475 min_key_size = 16; 1476 1477 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || 1478 hcon->enc_key_size >= min_key_size); 1479 } 1480 1481 static void l2cap_do_start(struct l2cap_chan *chan) 1482 { 1483 struct l2cap_conn *conn = chan->conn; 1484 1485 if (conn->hcon->type == LE_LINK) { 1486 l2cap_le_start(chan); 1487 return; 1488 } 1489 1490 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) { 1491 l2cap_request_info(conn); 1492 return; 1493 } 1494 1495 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) 1496 return; 1497 1498 if (!l2cap_chan_check_security(chan, true) || 1499 !__l2cap_no_conn_pending(chan)) 1500 return; 1501 1502 if (l2cap_check_enc_key_size(conn->hcon, chan)) 1503 l2cap_start_connection(chan); 1504 else 1505 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 1506 } 1507 1508 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) 1509 { 1510 u32 local_feat_mask = l2cap_feat_mask; 1511 if (!disable_ertm) 1512 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING; 1513 1514 switch (mode) { 1515 case L2CAP_MODE_ERTM: 1516 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask; 1517 case L2CAP_MODE_STREAMING: 1518 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask; 1519 default: 1520 return 0x00; 1521 } 1522 } 1523 1524 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err) 1525 { 1526 struct l2cap_conn *conn = chan->conn; 1527 struct l2cap_disconn_req req; 1528 1529 if (!conn) 1530 return; 1531 1532 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) { 1533 __clear_retrans_timer(chan); 1534 __clear_monitor_timer(chan); 1535 __clear_ack_timer(chan); 1536 } 1537 1538 req.dcid = cpu_to_le16(chan->dcid); 1539 req.scid = cpu_to_le16(chan->scid); 1540 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ, 1541 sizeof(req), &req); 1542 1543 l2cap_state_change_and_error(chan, BT_DISCONN, err); 1544 } 1545 1546 /* ---- L2CAP connections ---- */ 1547 static void l2cap_conn_start(struct l2cap_conn *conn) 1548 { 1549 struct l2cap_chan *chan, *tmp; 1550 1551 BT_DBG("conn %p", conn); 1552 1553 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 1554 l2cap_chan_lock(chan); 1555 1556 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1557 l2cap_chan_ready(chan); 1558 l2cap_chan_unlock(chan); 1559 continue; 1560 } 1561 1562 if (chan->state == BT_CONNECT) { 1563 if (!l2cap_chan_check_security(chan, true) || 1564 !__l2cap_no_conn_pending(chan)) { 1565 l2cap_chan_unlock(chan); 1566 continue; 1567 } 1568 1569 if (!l2cap_mode_supported(chan->mode, conn->feat_mask) 1570 && test_bit(CONF_STATE2_DEVICE, 1571 &chan->conf_state)) { 1572 l2cap_chan_close(chan, ECONNRESET); 1573 l2cap_chan_unlock(chan); 1574 continue; 1575 } 1576 1577 if (l2cap_check_enc_key_size(conn->hcon, chan)) 1578 l2cap_start_connection(chan); 1579 else 1580 l2cap_chan_close(chan, ECONNREFUSED); 1581 1582 } else if (chan->state == BT_CONNECT2) { 1583 struct l2cap_conn_rsp rsp; 1584 char buf[128]; 1585 rsp.scid = cpu_to_le16(chan->dcid); 1586 rsp.dcid = cpu_to_le16(chan->scid); 1587 1588 if (l2cap_chan_check_security(chan, false)) { 1589 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 1590 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1591 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 1592 chan->ops->defer(chan); 1593 1594 } else { 1595 l2cap_state_change(chan, BT_CONFIG); 1596 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 1597 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 1598 } 1599 } else { 1600 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1601 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 1602 } 1603 1604 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 1605 sizeof(rsp), &rsp); 1606 1607 if (test_bit(CONF_REQ_SENT, &chan->conf_state) || 1608 rsp.result != L2CAP_CR_SUCCESS) { 1609 l2cap_chan_unlock(chan); 1610 continue; 1611 } 1612 1613 set_bit(CONF_REQ_SENT, &chan->conf_state); 1614 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 1615 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 1616 chan->num_conf_req++; 1617 } 1618 1619 l2cap_chan_unlock(chan); 1620 } 1621 } 1622 1623 static void l2cap_le_conn_ready(struct l2cap_conn *conn) 1624 { 1625 struct hci_conn *hcon = conn->hcon; 1626 struct hci_dev *hdev = hcon->hdev; 1627 1628 BT_DBG("%s conn %p", hdev->name, conn); 1629 1630 /* For outgoing pairing which doesn't necessarily have an 1631 * associated socket (e.g. mgmt_pair_device). 1632 */ 1633 if (hcon->out) 1634 smp_conn_security(hcon, hcon->pending_sec_level); 1635 1636 /* For LE peripheral connections, make sure the connection interval 1637 * is in the range of the minimum and maximum interval that has 1638 * been configured for this connection. If not, then trigger 1639 * the connection update procedure. 1640 */ 1641 if (hcon->role == HCI_ROLE_SLAVE && 1642 (hcon->le_conn_interval < hcon->le_conn_min_interval || 1643 hcon->le_conn_interval > hcon->le_conn_max_interval)) { 1644 struct l2cap_conn_param_update_req req; 1645 1646 req.min = cpu_to_le16(hcon->le_conn_min_interval); 1647 req.max = cpu_to_le16(hcon->le_conn_max_interval); 1648 req.latency = cpu_to_le16(hcon->le_conn_latency); 1649 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout); 1650 1651 l2cap_send_cmd(conn, l2cap_get_ident(conn), 1652 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req); 1653 } 1654 } 1655 1656 static void l2cap_conn_ready(struct l2cap_conn *conn) 1657 { 1658 struct l2cap_chan *chan; 1659 struct hci_conn *hcon = conn->hcon; 1660 1661 BT_DBG("conn %p", conn); 1662 1663 if (hcon->type == ACL_LINK) 1664 l2cap_request_info(conn); 1665 1666 mutex_lock(&conn->lock); 1667 1668 list_for_each_entry(chan, &conn->chan_l, list) { 1669 1670 l2cap_chan_lock(chan); 1671 1672 if (hcon->type == LE_LINK) { 1673 l2cap_le_start(chan); 1674 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1675 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 1676 l2cap_chan_ready(chan); 1677 } else if (chan->state == BT_CONNECT) { 1678 l2cap_do_start(chan); 1679 } 1680 1681 l2cap_chan_unlock(chan); 1682 } 1683 1684 mutex_unlock(&conn->lock); 1685 1686 if (hcon->type == LE_LINK) 1687 l2cap_le_conn_ready(conn); 1688 1689 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work); 1690 } 1691 1692 /* Notify sockets that we cannot guaranty reliability anymore */ 1693 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) 1694 { 1695 struct l2cap_chan *chan; 1696 1697 BT_DBG("conn %p", conn); 1698 1699 list_for_each_entry(chan, &conn->chan_l, list) { 1700 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 1701 l2cap_chan_set_err(chan, err); 1702 } 1703 } 1704 1705 static void l2cap_info_timeout(struct work_struct *work) 1706 { 1707 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 1708 info_timer.work); 1709 1710 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 1711 conn->info_ident = 0; 1712 1713 mutex_lock(&conn->lock); 1714 l2cap_conn_start(conn); 1715 mutex_unlock(&conn->lock); 1716 } 1717 1718 /* 1719 * l2cap_user 1720 * External modules can register l2cap_user objects on l2cap_conn. The ->probe 1721 * callback is called during registration. The ->remove callback is called 1722 * during unregistration. 1723 * An l2cap_user object can either be explicitly unregistered or when the 1724 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon, 1725 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called. 1726 * External modules must own a reference to the l2cap_conn object if they intend 1727 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at 1728 * any time if they don't. 1729 */ 1730 1731 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user) 1732 { 1733 int ret; 1734 1735 /* We need to check whether l2cap_conn is registered. If it is not, we 1736 * must not register the l2cap_user. l2cap_conn_del() unregisters 1737 * l2cap_conn objects under conn->lock, and we use the same lock here 1738 * to protect access to conn->users and conn->hchan. 1739 */ 1740 1741 mutex_lock(&conn->lock); 1742 1743 if (!list_empty(&user->list)) { 1744 ret = -EINVAL; 1745 goto out_unlock; 1746 } 1747 1748 /* conn->hchan is NULL after l2cap_conn_del() was called */ 1749 if (!conn->hchan) { 1750 ret = -ENODEV; 1751 goto out_unlock; 1752 } 1753 1754 ret = user->probe(conn, user); 1755 if (ret) 1756 goto out_unlock; 1757 1758 list_add(&user->list, &conn->users); 1759 ret = 0; 1760 1761 out_unlock: 1762 mutex_unlock(&conn->lock); 1763 return ret; 1764 } 1765 EXPORT_SYMBOL(l2cap_register_user); 1766 1767 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user) 1768 { 1769 mutex_lock(&conn->lock); 1770 1771 if (list_empty(&user->list)) 1772 goto out_unlock; 1773 1774 list_del_init(&user->list); 1775 user->remove(conn, user); 1776 1777 out_unlock: 1778 mutex_unlock(&conn->lock); 1779 } 1780 EXPORT_SYMBOL(l2cap_unregister_user); 1781 1782 static void l2cap_unregister_all_users(struct l2cap_conn *conn) 1783 { 1784 struct l2cap_user *user; 1785 1786 while (!list_empty(&conn->users)) { 1787 user = list_first_entry(&conn->users, struct l2cap_user, list); 1788 list_del_init(&user->list); 1789 user->remove(conn, user); 1790 } 1791 } 1792 1793 static void l2cap_conn_del(struct hci_conn *hcon, int err) 1794 __must_hold(&hcon->hdev->lock) 1795 { 1796 struct l2cap_conn *conn = hcon->l2cap_data; 1797 struct l2cap_chan *chan, *l; 1798 1799 if (!conn) 1800 return; 1801 1802 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 1803 1804 disable_delayed_work_sync(&conn->info_timer); 1805 disable_delayed_work_sync(&conn->id_addr_timer); 1806 1807 cancel_work_sync(&conn->pending_rx_work); 1808 1809 mutex_lock(&conn->lock); 1810 1811 kfree_skb(conn->rx_skb); 1812 1813 skb_queue_purge(&conn->pending_rx); 1814 ida_destroy(&conn->tx_ida); 1815 1816 l2cap_unregister_all_users(conn); 1817 1818 /* Force the connection to be immediately dropped */ 1819 hcon->disc_timeout = 0; 1820 1821 /* Kill channels */ 1822 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 1823 l2cap_chan_hold(chan); 1824 l2cap_chan_lock(chan); 1825 1826 l2cap_chan_del(chan, err); 1827 1828 chan->ops->close(chan); 1829 1830 l2cap_chan_unlock(chan); 1831 l2cap_chan_put(chan); 1832 } 1833 1834 hci_chan_del(conn->hchan); 1835 conn->hchan = NULL; 1836 1837 spin_lock(&hcon->proto_lock); 1838 hcon->l2cap_data = NULL; 1839 spin_unlock(&hcon->proto_lock); 1840 1841 mutex_unlock(&conn->lock); 1842 l2cap_conn_put(conn); 1843 } 1844 1845 static void l2cap_conn_free(struct kref *ref) 1846 { 1847 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref); 1848 1849 hci_conn_put(conn->hcon); 1850 kfree(conn); 1851 } 1852 1853 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn) 1854 { 1855 kref_get(&conn->ref); 1856 return conn; 1857 } 1858 EXPORT_SYMBOL(l2cap_conn_get); 1859 1860 void l2cap_conn_put(struct l2cap_conn *conn) 1861 { 1862 kref_put(&conn->ref, l2cap_conn_free); 1863 } 1864 EXPORT_SYMBOL(l2cap_conn_put); 1865 1866 /* ---- Socket interface ---- */ 1867 1868 /* Find socket with psm and source / destination bdaddr. 1869 * Returns closest match. 1870 */ 1871 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, 1872 bdaddr_t *src, 1873 bdaddr_t *dst, 1874 u8 link_type) 1875 { 1876 struct l2cap_chan *c, *tmp, *c1 = NULL; 1877 1878 read_lock(&chan_list_lock); 1879 1880 list_for_each_entry_safe(c, tmp, &chan_list, global_l) { 1881 if (state && c->state != state) 1882 continue; 1883 1884 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR) 1885 continue; 1886 1887 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR) 1888 continue; 1889 1890 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) { 1891 int src_match, dst_match; 1892 int src_any, dst_any; 1893 1894 /* Exact match. */ 1895 src_match = !bacmp(&c->src, src); 1896 dst_match = !bacmp(&c->dst, dst); 1897 if (src_match && dst_match) { 1898 if (!l2cap_chan_hold_unless_zero(c)) 1899 continue; 1900 1901 read_unlock(&chan_list_lock); 1902 return c; 1903 } 1904 1905 /* Closest match */ 1906 src_any = !bacmp(&c->src, BDADDR_ANY); 1907 dst_any = !bacmp(&c->dst, BDADDR_ANY); 1908 if ((src_match && dst_any) || (src_any && dst_match) || 1909 (src_any && dst_any)) 1910 c1 = c; 1911 } 1912 } 1913 1914 if (c1) 1915 c1 = l2cap_chan_hold_unless_zero(c1); 1916 1917 read_unlock(&chan_list_lock); 1918 1919 return c1; 1920 } 1921 1922 static void l2cap_monitor_timeout(struct work_struct *work) 1923 { 1924 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 1925 monitor_timer.work); 1926 1927 BT_DBG("chan %p", chan); 1928 1929 l2cap_chan_lock(chan); 1930 1931 if (test_bit(FLAG_DEL, &chan->flags)) { 1932 l2cap_chan_unlock(chan); 1933 l2cap_chan_put(chan); 1934 return; 1935 } 1936 1937 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO); 1938 1939 l2cap_chan_unlock(chan); 1940 l2cap_chan_put(chan); 1941 } 1942 1943 static void l2cap_retrans_timeout(struct work_struct *work) 1944 { 1945 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 1946 retrans_timer.work); 1947 1948 BT_DBG("chan %p", chan); 1949 1950 l2cap_chan_lock(chan); 1951 1952 if (test_bit(FLAG_DEL, &chan->flags)) { 1953 l2cap_chan_unlock(chan); 1954 l2cap_chan_put(chan); 1955 return; 1956 } 1957 1958 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO); 1959 l2cap_chan_unlock(chan); 1960 l2cap_chan_put(chan); 1961 } 1962 1963 static void l2cap_streaming_send(struct l2cap_chan *chan, 1964 struct sk_buff_head *skbs) 1965 { 1966 struct sk_buff *skb; 1967 struct l2cap_ctrl *control; 1968 1969 BT_DBG("chan %p, skbs %p", chan, skbs); 1970 1971 skb_queue_splice_tail_init(skbs, &chan->tx_q); 1972 1973 while (!skb_queue_empty(&chan->tx_q)) { 1974 1975 skb = skb_dequeue(&chan->tx_q); 1976 1977 bt_cb(skb)->l2cap.retries = 1; 1978 control = &bt_cb(skb)->l2cap; 1979 1980 control->reqseq = 0; 1981 control->txseq = chan->next_tx_seq; 1982 1983 __pack_control(chan, control, skb); 1984 1985 if (chan->fcs == L2CAP_FCS_CRC16) { 1986 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 1987 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1988 } 1989 1990 l2cap_do_send(chan, skb); 1991 1992 BT_DBG("Sent txseq %u", control->txseq); 1993 1994 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 1995 chan->frames_sent++; 1996 } 1997 } 1998 1999 static int l2cap_ertm_send(struct l2cap_chan *chan) 2000 { 2001 struct sk_buff *skb, *tx_skb; 2002 struct l2cap_ctrl *control; 2003 int sent = 0; 2004 2005 BT_DBG("chan %p", chan); 2006 2007 if (chan->state != BT_CONNECTED) 2008 return -ENOTCONN; 2009 2010 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2011 return 0; 2012 2013 while (chan->tx_send_head && 2014 chan->unacked_frames < chan->remote_tx_win && 2015 chan->tx_state == L2CAP_TX_STATE_XMIT) { 2016 2017 skb = chan->tx_send_head; 2018 2019 bt_cb(skb)->l2cap.retries = 1; 2020 control = &bt_cb(skb)->l2cap; 2021 2022 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2023 control->final = 1; 2024 2025 control->reqseq = chan->buffer_seq; 2026 chan->last_acked_seq = chan->buffer_seq; 2027 control->txseq = chan->next_tx_seq; 2028 2029 __pack_control(chan, control, skb); 2030 2031 if (chan->fcs == L2CAP_FCS_CRC16) { 2032 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 2033 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 2034 } 2035 2036 /* Clone after data has been modified. Data is assumed to be 2037 read-only (for locking purposes) on cloned sk_buffs. 2038 */ 2039 tx_skb = skb_clone(skb, GFP_KERNEL); 2040 2041 if (!tx_skb) 2042 break; 2043 2044 __set_retrans_timer(chan); 2045 2046 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2047 chan->unacked_frames++; 2048 chan->frames_sent++; 2049 sent++; 2050 2051 if (skb_queue_is_last(&chan->tx_q, skb)) 2052 chan->tx_send_head = NULL; 2053 else 2054 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb); 2055 2056 l2cap_do_send(chan, tx_skb); 2057 BT_DBG("Sent txseq %u", control->txseq); 2058 } 2059 2060 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent, 2061 chan->unacked_frames, skb_queue_len(&chan->tx_q)); 2062 2063 return sent; 2064 } 2065 2066 static void l2cap_ertm_resend(struct l2cap_chan *chan) 2067 { 2068 struct l2cap_ctrl control; 2069 struct sk_buff *skb; 2070 struct sk_buff *tx_skb; 2071 u16 seq; 2072 2073 BT_DBG("chan %p", chan); 2074 2075 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2076 return; 2077 2078 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) { 2079 seq = l2cap_seq_list_pop(&chan->retrans_list); 2080 2081 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq); 2082 if (!skb) { 2083 BT_DBG("Error: Can't retransmit seq %d, frame missing", 2084 seq); 2085 continue; 2086 } 2087 2088 bt_cb(skb)->l2cap.retries++; 2089 control = bt_cb(skb)->l2cap; 2090 2091 if (chan->max_tx != 0 && 2092 bt_cb(skb)->l2cap.retries > chan->max_tx) { 2093 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 2094 l2cap_send_disconn_req(chan, ECONNRESET); 2095 l2cap_seq_list_clear(&chan->retrans_list); 2096 break; 2097 } 2098 2099 control.reqseq = chan->buffer_seq; 2100 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2101 control.final = 1; 2102 else 2103 control.final = 0; 2104 2105 if (skb_cloned(skb)) { 2106 /* Cloned sk_buffs are read-only, so we need a 2107 * writeable copy 2108 */ 2109 tx_skb = skb_copy(skb, GFP_KERNEL); 2110 } else { 2111 tx_skb = skb_clone(skb, GFP_KERNEL); 2112 } 2113 2114 if (!tx_skb) { 2115 l2cap_seq_list_clear(&chan->retrans_list); 2116 break; 2117 } 2118 2119 /* Update skb contents */ 2120 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 2121 put_unaligned_le32(__pack_extended_control(&control), 2122 tx_skb->data + L2CAP_HDR_SIZE); 2123 } else { 2124 put_unaligned_le16(__pack_enhanced_control(&control), 2125 tx_skb->data + L2CAP_HDR_SIZE); 2126 } 2127 2128 /* Update FCS */ 2129 if (chan->fcs == L2CAP_FCS_CRC16) { 2130 u16 fcs = crc16(0, (u8 *) tx_skb->data, 2131 tx_skb->len - L2CAP_FCS_SIZE); 2132 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) - 2133 L2CAP_FCS_SIZE); 2134 } 2135 2136 l2cap_do_send(chan, tx_skb); 2137 2138 BT_DBG("Resent txseq %d", control.txseq); 2139 2140 chan->last_acked_seq = chan->buffer_seq; 2141 } 2142 } 2143 2144 static void l2cap_retransmit(struct l2cap_chan *chan, 2145 struct l2cap_ctrl *control) 2146 { 2147 BT_DBG("chan %p, control %p", chan, control); 2148 2149 l2cap_seq_list_append(&chan->retrans_list, control->reqseq); 2150 l2cap_ertm_resend(chan); 2151 } 2152 2153 static void l2cap_retransmit_all(struct l2cap_chan *chan, 2154 struct l2cap_ctrl *control) 2155 { 2156 struct sk_buff *skb; 2157 2158 BT_DBG("chan %p, control %p", chan, control); 2159 2160 if (control->poll) 2161 set_bit(CONN_SEND_FBIT, &chan->conn_state); 2162 2163 l2cap_seq_list_clear(&chan->retrans_list); 2164 2165 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2166 return; 2167 2168 if (chan->unacked_frames) { 2169 skb_queue_walk(&chan->tx_q, skb) { 2170 if (bt_cb(skb)->l2cap.txseq == control->reqseq || 2171 skb == chan->tx_send_head) 2172 break; 2173 } 2174 2175 skb_queue_walk_from(&chan->tx_q, skb) { 2176 if (skb == chan->tx_send_head) 2177 break; 2178 2179 l2cap_seq_list_append(&chan->retrans_list, 2180 bt_cb(skb)->l2cap.txseq); 2181 } 2182 2183 l2cap_ertm_resend(chan); 2184 } 2185 } 2186 2187 static void l2cap_send_ack(struct l2cap_chan *chan) 2188 { 2189 struct l2cap_ctrl control; 2190 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 2191 chan->last_acked_seq); 2192 int threshold; 2193 2194 BT_DBG("chan %p last_acked_seq %d buffer_seq %d", 2195 chan, chan->last_acked_seq, chan->buffer_seq); 2196 2197 memset(&control, 0, sizeof(control)); 2198 control.sframe = 1; 2199 2200 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 2201 chan->rx_state == L2CAP_RX_STATE_RECV) { 2202 __clear_ack_timer(chan); 2203 control.super = L2CAP_SUPER_RNR; 2204 control.reqseq = chan->buffer_seq; 2205 l2cap_send_sframe(chan, &control); 2206 } else { 2207 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) { 2208 l2cap_ertm_send(chan); 2209 /* If any i-frames were sent, they included an ack */ 2210 if (chan->buffer_seq == chan->last_acked_seq) 2211 frames_to_ack = 0; 2212 } 2213 2214 /* Ack now if the window is 3/4ths full. 2215 * Calculate without mul or div 2216 */ 2217 threshold = chan->ack_win; 2218 threshold += threshold << 1; 2219 threshold >>= 2; 2220 2221 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack, 2222 threshold); 2223 2224 if (frames_to_ack >= threshold) { 2225 __clear_ack_timer(chan); 2226 control.super = L2CAP_SUPER_RR; 2227 control.reqseq = chan->buffer_seq; 2228 l2cap_send_sframe(chan, &control); 2229 frames_to_ack = 0; 2230 } 2231 2232 if (frames_to_ack) 2233 __set_ack_timer(chan); 2234 } 2235 } 2236 2237 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan, 2238 struct msghdr *msg, int len, 2239 int count, struct sk_buff *skb) 2240 { 2241 struct l2cap_conn *conn = chan->conn; 2242 struct sk_buff **frag; 2243 int sent = 0; 2244 2245 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter)) 2246 return -EFAULT; 2247 2248 sent += count; 2249 len -= count; 2250 2251 /* Continuation fragments (no L2CAP header) */ 2252 frag = &skb_shinfo(skb)->frag_list; 2253 while (len) { 2254 struct sk_buff *tmp; 2255 2256 count = min_t(unsigned int, conn->mtu, len); 2257 2258 tmp = chan->ops->alloc_skb(chan, 0, count, 2259 msg->msg_flags & MSG_DONTWAIT); 2260 if (IS_ERR(tmp)) 2261 return PTR_ERR(tmp); 2262 2263 *frag = tmp; 2264 2265 if (!copy_from_iter_full(skb_put(*frag, count), count, 2266 &msg->msg_iter)) 2267 return -EFAULT; 2268 2269 sent += count; 2270 len -= count; 2271 2272 skb->len += (*frag)->len; 2273 skb->data_len += (*frag)->len; 2274 2275 frag = &(*frag)->next; 2276 } 2277 2278 return sent; 2279 } 2280 2281 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, 2282 struct msghdr *msg, size_t len) 2283 { 2284 struct l2cap_conn *conn = chan->conn; 2285 struct sk_buff *skb; 2286 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE; 2287 struct l2cap_hdr *lh; 2288 2289 BT_DBG("chan %p psm 0x%2.2x len %zu", chan, 2290 __le16_to_cpu(chan->psm), len); 2291 2292 count = min_t(unsigned int, (conn->mtu - hlen), len); 2293 2294 skb = chan->ops->alloc_skb(chan, hlen, count, 2295 msg->msg_flags & MSG_DONTWAIT); 2296 if (IS_ERR(skb)) 2297 return skb; 2298 2299 /* Create L2CAP header */ 2300 lh = skb_put(skb, L2CAP_HDR_SIZE); 2301 lh->cid = cpu_to_le16(chan->dcid); 2302 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE); 2303 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE)); 2304 2305 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2306 if (unlikely(err < 0)) { 2307 kfree_skb(skb); 2308 return ERR_PTR(err); 2309 } 2310 return skb; 2311 } 2312 2313 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, 2314 struct msghdr *msg, size_t len) 2315 { 2316 struct l2cap_conn *conn = chan->conn; 2317 struct sk_buff *skb; 2318 int err, count; 2319 struct l2cap_hdr *lh; 2320 2321 BT_DBG("chan %p len %zu", chan, len); 2322 2323 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len); 2324 2325 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count, 2326 msg->msg_flags & MSG_DONTWAIT); 2327 if (IS_ERR(skb)) 2328 return skb; 2329 2330 /* Create L2CAP header */ 2331 lh = skb_put(skb, L2CAP_HDR_SIZE); 2332 lh->cid = cpu_to_le16(chan->dcid); 2333 lh->len = cpu_to_le16(len); 2334 2335 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2336 if (unlikely(err < 0)) { 2337 kfree_skb(skb); 2338 return ERR_PTR(err); 2339 } 2340 return skb; 2341 } 2342 2343 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, 2344 struct msghdr *msg, size_t len, 2345 u16 sdulen) 2346 { 2347 struct l2cap_conn *conn = chan->conn; 2348 struct sk_buff *skb; 2349 int err, count, hlen; 2350 struct l2cap_hdr *lh; 2351 2352 BT_DBG("chan %p len %zu", chan, len); 2353 2354 if (!conn) 2355 return ERR_PTR(-ENOTCONN); 2356 2357 hlen = __ertm_hdr_size(chan); 2358 2359 if (sdulen) 2360 hlen += L2CAP_SDULEN_SIZE; 2361 2362 if (chan->fcs == L2CAP_FCS_CRC16) 2363 hlen += L2CAP_FCS_SIZE; 2364 2365 count = min_t(unsigned int, (conn->mtu - hlen), len); 2366 2367 skb = chan->ops->alloc_skb(chan, hlen, count, 2368 msg->msg_flags & MSG_DONTWAIT); 2369 if (IS_ERR(skb)) 2370 return skb; 2371 2372 /* Create L2CAP header */ 2373 lh = skb_put(skb, L2CAP_HDR_SIZE); 2374 lh->cid = cpu_to_le16(chan->dcid); 2375 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2376 2377 /* Control header is populated later */ 2378 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 2379 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 2380 else 2381 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 2382 2383 if (sdulen) 2384 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2385 2386 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2387 if (unlikely(err < 0)) { 2388 kfree_skb(skb); 2389 return ERR_PTR(err); 2390 } 2391 2392 bt_cb(skb)->l2cap.fcs = chan->fcs; 2393 bt_cb(skb)->l2cap.retries = 0; 2394 return skb; 2395 } 2396 2397 static int l2cap_segment_sdu(struct l2cap_chan *chan, 2398 struct sk_buff_head *seg_queue, 2399 struct msghdr *msg, size_t len) 2400 { 2401 struct sk_buff *skb; 2402 u16 sdu_len; 2403 size_t pdu_len; 2404 u8 sar; 2405 2406 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2407 2408 /* It is critical that ERTM PDUs fit in a single HCI fragment, 2409 * so fragmented skbs are not used. The HCI layer's handling 2410 * of fragmented skbs is not compatible with ERTM's queueing. 2411 */ 2412 2413 /* PDU size is derived from the HCI MTU */ 2414 pdu_len = chan->conn->mtu; 2415 2416 /* Constrain PDU size for BR/EDR connections */ 2417 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD); 2418 2419 /* Adjust for largest possible L2CAP overhead. */ 2420 if (chan->fcs) 2421 pdu_len -= L2CAP_FCS_SIZE; 2422 2423 pdu_len -= __ertm_hdr_size(chan); 2424 2425 /* Remote device may have requested smaller PDUs */ 2426 pdu_len = min_t(size_t, pdu_len, chan->remote_mps); 2427 2428 if (!pdu_len) 2429 return -EINVAL; 2430 2431 if (len <= pdu_len) { 2432 sar = L2CAP_SAR_UNSEGMENTED; 2433 sdu_len = 0; 2434 pdu_len = len; 2435 } else { 2436 sar = L2CAP_SAR_START; 2437 sdu_len = len; 2438 } 2439 2440 while (len > 0) { 2441 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len); 2442 2443 if (IS_ERR(skb)) { 2444 __skb_queue_purge(seg_queue); 2445 return PTR_ERR(skb); 2446 } 2447 2448 bt_cb(skb)->l2cap.sar = sar; 2449 __skb_queue_tail(seg_queue, skb); 2450 2451 len -= pdu_len; 2452 if (sdu_len) 2453 sdu_len = 0; 2454 2455 if (len <= pdu_len) { 2456 sar = L2CAP_SAR_END; 2457 pdu_len = len; 2458 } else { 2459 sar = L2CAP_SAR_CONTINUE; 2460 } 2461 } 2462 2463 return 0; 2464 } 2465 2466 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan, 2467 struct msghdr *msg, 2468 size_t len, u16 sdulen) 2469 { 2470 struct l2cap_conn *conn = chan->conn; 2471 struct sk_buff *skb; 2472 int err, count, hlen; 2473 struct l2cap_hdr *lh; 2474 2475 BT_DBG("chan %p len %zu", chan, len); 2476 2477 if (!conn) 2478 return ERR_PTR(-ENOTCONN); 2479 2480 hlen = L2CAP_HDR_SIZE; 2481 2482 if (sdulen) 2483 hlen += L2CAP_SDULEN_SIZE; 2484 2485 count = min_t(unsigned int, (conn->mtu - hlen), len); 2486 2487 skb = chan->ops->alloc_skb(chan, hlen, count, 2488 msg->msg_flags & MSG_DONTWAIT); 2489 if (IS_ERR(skb)) 2490 return skb; 2491 2492 /* Create L2CAP header */ 2493 lh = skb_put(skb, L2CAP_HDR_SIZE); 2494 lh->cid = cpu_to_le16(chan->dcid); 2495 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2496 2497 if (sdulen) 2498 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2499 2500 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2501 if (unlikely(err < 0)) { 2502 kfree_skb(skb); 2503 return ERR_PTR(err); 2504 } 2505 2506 return skb; 2507 } 2508 2509 static int l2cap_segment_le_sdu(struct l2cap_chan *chan, 2510 struct sk_buff_head *seg_queue, 2511 struct msghdr *msg, size_t len) 2512 { 2513 struct sk_buff *skb; 2514 size_t pdu_len; 2515 u16 sdu_len; 2516 2517 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2518 2519 sdu_len = len; 2520 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE; 2521 2522 while (len > 0) { 2523 if (len <= pdu_len) 2524 pdu_len = len; 2525 2526 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len); 2527 if (IS_ERR(skb)) { 2528 __skb_queue_purge(seg_queue); 2529 return PTR_ERR(skb); 2530 } 2531 2532 __skb_queue_tail(seg_queue, skb); 2533 2534 len -= pdu_len; 2535 2536 if (sdu_len) { 2537 sdu_len = 0; 2538 pdu_len += L2CAP_SDULEN_SIZE; 2539 } 2540 } 2541 2542 return 0; 2543 } 2544 2545 static void l2cap_le_flowctl_send(struct l2cap_chan *chan) 2546 { 2547 int sent = 0; 2548 2549 BT_DBG("chan %p", chan); 2550 2551 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) { 2552 l2cap_do_send(chan, skb_dequeue(&chan->tx_q)); 2553 chan->tx_credits--; 2554 sent++; 2555 } 2556 2557 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits, 2558 skb_queue_len(&chan->tx_q)); 2559 } 2560 2561 static void l2cap_tx_timestamp(struct sk_buff *skb, 2562 const struct sockcm_cookie *sockc, 2563 size_t len) 2564 { 2565 struct sock *sk = skb ? skb->sk : NULL; 2566 2567 if (sk && sk->sk_type == SOCK_STREAM) 2568 hci_setup_tx_timestamp(skb, len, sockc); 2569 else 2570 hci_setup_tx_timestamp(skb, 1, sockc); 2571 } 2572 2573 static void l2cap_tx_timestamp_seg(struct sk_buff_head *queue, 2574 const struct sockcm_cookie *sockc, 2575 size_t len) 2576 { 2577 struct sk_buff *skb = skb_peek(queue); 2578 struct sock *sk = skb ? skb->sk : NULL; 2579 2580 if (sk && sk->sk_type == SOCK_STREAM) 2581 l2cap_tx_timestamp(skb_peek_tail(queue), sockc, len); 2582 else 2583 l2cap_tx_timestamp(skb, sockc, len); 2584 } 2585 2586 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len, 2587 const struct sockcm_cookie *sockc) 2588 { 2589 struct sk_buff *skb; 2590 int err; 2591 struct sk_buff_head seg_queue; 2592 2593 if (test_bit(FLAG_DEL, &chan->flags)) 2594 return -ENOTCONN; 2595 2596 /* Connectionless channel */ 2597 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 2598 skb = l2cap_create_connless_pdu(chan, msg, len); 2599 if (IS_ERR(skb)) 2600 return PTR_ERR(skb); 2601 2602 l2cap_tx_timestamp(skb, sockc, len); 2603 2604 l2cap_do_send(chan, skb); 2605 return len; 2606 } 2607 2608 switch (chan->mode) { 2609 case L2CAP_MODE_LE_FLOWCTL: 2610 case L2CAP_MODE_EXT_FLOWCTL: 2611 /* Check outgoing MTU */ 2612 if (len > chan->omtu) 2613 return -EMSGSIZE; 2614 2615 __skb_queue_head_init(&seg_queue); 2616 2617 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len); 2618 2619 if (chan->state != BT_CONNECTED) { 2620 __skb_queue_purge(&seg_queue); 2621 err = -ENOTCONN; 2622 } 2623 2624 if (err) 2625 return err; 2626 2627 l2cap_tx_timestamp_seg(&seg_queue, sockc, len); 2628 2629 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q); 2630 2631 l2cap_le_flowctl_send(chan); 2632 2633 if (!chan->tx_credits) 2634 chan->ops->suspend(chan); 2635 2636 err = len; 2637 2638 break; 2639 2640 case L2CAP_MODE_BASIC: 2641 /* Check outgoing MTU */ 2642 if (len > chan->omtu) 2643 return -EMSGSIZE; 2644 2645 /* Create a basic PDU */ 2646 skb = l2cap_create_basic_pdu(chan, msg, len); 2647 if (IS_ERR(skb)) 2648 return PTR_ERR(skb); 2649 2650 l2cap_tx_timestamp(skb, sockc, len); 2651 2652 l2cap_do_send(chan, skb); 2653 err = len; 2654 break; 2655 2656 case L2CAP_MODE_ERTM: 2657 case L2CAP_MODE_STREAMING: 2658 /* Check outgoing MTU */ 2659 if (len > chan->omtu) { 2660 err = -EMSGSIZE; 2661 break; 2662 } 2663 2664 __skb_queue_head_init(&seg_queue); 2665 2666 /* Do segmentation before calling in to the state machine, 2667 * since it's possible to block while waiting for memory 2668 * allocation. 2669 */ 2670 err = l2cap_segment_sdu(chan, &seg_queue, msg, len); 2671 2672 if (err) 2673 break; 2674 2675 if (chan->mode == L2CAP_MODE_ERTM) { 2676 /* TODO: ERTM mode timestamping */ 2677 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST); 2678 } else { 2679 l2cap_tx_timestamp_seg(&seg_queue, sockc, len); 2680 l2cap_streaming_send(chan, &seg_queue); 2681 } 2682 2683 err = len; 2684 2685 /* If the skbs were not queued for sending, they'll still be in 2686 * seg_queue and need to be purged. 2687 */ 2688 __skb_queue_purge(&seg_queue); 2689 break; 2690 2691 default: 2692 BT_DBG("bad state %1.1x", chan->mode); 2693 err = -EBADFD; 2694 } 2695 2696 return err; 2697 } 2698 EXPORT_SYMBOL_GPL(l2cap_chan_send); 2699 2700 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq) 2701 { 2702 struct l2cap_ctrl control; 2703 u16 seq; 2704 2705 BT_DBG("chan %p, txseq %u", chan, txseq); 2706 2707 memset(&control, 0, sizeof(control)); 2708 control.sframe = 1; 2709 control.super = L2CAP_SUPER_SREJ; 2710 2711 for (seq = chan->expected_tx_seq; seq != txseq; 2712 seq = __next_seq(chan, seq)) { 2713 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) { 2714 control.reqseq = seq; 2715 l2cap_send_sframe(chan, &control); 2716 l2cap_seq_list_append(&chan->srej_list, seq); 2717 } 2718 } 2719 2720 chan->expected_tx_seq = __next_seq(chan, txseq); 2721 } 2722 2723 static void l2cap_send_srej_tail(struct l2cap_chan *chan) 2724 { 2725 struct l2cap_ctrl control; 2726 2727 BT_DBG("chan %p", chan); 2728 2729 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR) 2730 return; 2731 2732 memset(&control, 0, sizeof(control)); 2733 control.sframe = 1; 2734 control.super = L2CAP_SUPER_SREJ; 2735 control.reqseq = chan->srej_list.tail; 2736 l2cap_send_sframe(chan, &control); 2737 } 2738 2739 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq) 2740 { 2741 struct l2cap_ctrl control; 2742 u16 initial_head; 2743 u16 seq; 2744 2745 BT_DBG("chan %p, txseq %u", chan, txseq); 2746 2747 memset(&control, 0, sizeof(control)); 2748 control.sframe = 1; 2749 control.super = L2CAP_SUPER_SREJ; 2750 2751 /* Capture initial list head to allow only one pass through the list. */ 2752 initial_head = chan->srej_list.head; 2753 2754 do { 2755 seq = l2cap_seq_list_pop(&chan->srej_list); 2756 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR) 2757 break; 2758 2759 control.reqseq = seq; 2760 l2cap_send_sframe(chan, &control); 2761 l2cap_seq_list_append(&chan->srej_list, seq); 2762 } while (chan->srej_list.head != initial_head); 2763 } 2764 2765 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq) 2766 { 2767 struct sk_buff *acked_skb; 2768 u16 ackseq; 2769 2770 BT_DBG("chan %p, reqseq %u", chan, reqseq); 2771 2772 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq) 2773 return; 2774 2775 BT_DBG("expected_ack_seq %u, unacked_frames %u", 2776 chan->expected_ack_seq, chan->unacked_frames); 2777 2778 for (ackseq = chan->expected_ack_seq; ackseq != reqseq; 2779 ackseq = __next_seq(chan, ackseq)) { 2780 2781 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq); 2782 if (acked_skb) { 2783 skb_unlink(acked_skb, &chan->tx_q); 2784 kfree_skb(acked_skb); 2785 chan->unacked_frames--; 2786 } 2787 } 2788 2789 chan->expected_ack_seq = reqseq; 2790 2791 if (chan->unacked_frames == 0) 2792 __clear_retrans_timer(chan); 2793 2794 BT_DBG("unacked_frames %u", chan->unacked_frames); 2795 } 2796 2797 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan) 2798 { 2799 BT_DBG("chan %p", chan); 2800 2801 chan->expected_tx_seq = chan->buffer_seq; 2802 l2cap_seq_list_clear(&chan->srej_list); 2803 skb_queue_purge(&chan->srej_q); 2804 chan->rx_state = L2CAP_RX_STATE_RECV; 2805 } 2806 2807 static void l2cap_tx_state_xmit(struct l2cap_chan *chan, 2808 struct l2cap_ctrl *control, 2809 struct sk_buff_head *skbs, u8 event) 2810 { 2811 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2812 event); 2813 2814 switch (event) { 2815 case L2CAP_EV_DATA_REQUEST: 2816 if (chan->tx_send_head == NULL) 2817 chan->tx_send_head = skb_peek(skbs); 2818 2819 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2820 l2cap_ertm_send(chan); 2821 break; 2822 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2823 BT_DBG("Enter LOCAL_BUSY"); 2824 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2825 2826 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2827 /* The SREJ_SENT state must be aborted if we are to 2828 * enter the LOCAL_BUSY state. 2829 */ 2830 l2cap_abort_rx_srej_sent(chan); 2831 } 2832 2833 l2cap_send_ack(chan); 2834 2835 break; 2836 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2837 BT_DBG("Exit LOCAL_BUSY"); 2838 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2839 2840 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2841 struct l2cap_ctrl local_control; 2842 2843 memset(&local_control, 0, sizeof(local_control)); 2844 local_control.sframe = 1; 2845 local_control.super = L2CAP_SUPER_RR; 2846 local_control.poll = 1; 2847 local_control.reqseq = chan->buffer_seq; 2848 l2cap_send_sframe(chan, &local_control); 2849 2850 chan->retry_count = 1; 2851 __set_monitor_timer(chan); 2852 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2853 } 2854 break; 2855 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2856 l2cap_process_reqseq(chan, control->reqseq); 2857 break; 2858 case L2CAP_EV_EXPLICIT_POLL: 2859 l2cap_send_rr_or_rnr(chan, 1); 2860 chan->retry_count = 1; 2861 __set_monitor_timer(chan); 2862 __clear_ack_timer(chan); 2863 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2864 break; 2865 case L2CAP_EV_RETRANS_TO: 2866 l2cap_send_rr_or_rnr(chan, 1); 2867 chan->retry_count = 1; 2868 __set_monitor_timer(chan); 2869 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2870 break; 2871 case L2CAP_EV_RECV_FBIT: 2872 /* Nothing to process */ 2873 break; 2874 default: 2875 break; 2876 } 2877 } 2878 2879 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan, 2880 struct l2cap_ctrl *control, 2881 struct sk_buff_head *skbs, u8 event) 2882 { 2883 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2884 event); 2885 2886 switch (event) { 2887 case L2CAP_EV_DATA_REQUEST: 2888 if (chan->tx_send_head == NULL) 2889 chan->tx_send_head = skb_peek(skbs); 2890 /* Queue data, but don't send. */ 2891 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2892 break; 2893 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2894 BT_DBG("Enter LOCAL_BUSY"); 2895 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2896 2897 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2898 /* The SREJ_SENT state must be aborted if we are to 2899 * enter the LOCAL_BUSY state. 2900 */ 2901 l2cap_abort_rx_srej_sent(chan); 2902 } 2903 2904 l2cap_send_ack(chan); 2905 2906 break; 2907 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2908 BT_DBG("Exit LOCAL_BUSY"); 2909 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2910 2911 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2912 struct l2cap_ctrl local_control; 2913 memset(&local_control, 0, sizeof(local_control)); 2914 local_control.sframe = 1; 2915 local_control.super = L2CAP_SUPER_RR; 2916 local_control.poll = 1; 2917 local_control.reqseq = chan->buffer_seq; 2918 l2cap_send_sframe(chan, &local_control); 2919 2920 chan->retry_count = 1; 2921 __set_monitor_timer(chan); 2922 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2923 } 2924 break; 2925 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2926 l2cap_process_reqseq(chan, control->reqseq); 2927 fallthrough; 2928 2929 case L2CAP_EV_RECV_FBIT: 2930 if (control && control->final) { 2931 __clear_monitor_timer(chan); 2932 if (chan->unacked_frames > 0) 2933 __set_retrans_timer(chan); 2934 chan->retry_count = 0; 2935 chan->tx_state = L2CAP_TX_STATE_XMIT; 2936 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state); 2937 } 2938 break; 2939 case L2CAP_EV_EXPLICIT_POLL: 2940 /* Ignore */ 2941 break; 2942 case L2CAP_EV_MONITOR_TO: 2943 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) { 2944 l2cap_send_rr_or_rnr(chan, 1); 2945 __set_monitor_timer(chan); 2946 chan->retry_count++; 2947 } else { 2948 l2cap_send_disconn_req(chan, ECONNABORTED); 2949 } 2950 break; 2951 default: 2952 break; 2953 } 2954 } 2955 2956 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 2957 struct sk_buff_head *skbs, u8 event) 2958 { 2959 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d", 2960 chan, control, skbs, event, chan->tx_state); 2961 2962 switch (chan->tx_state) { 2963 case L2CAP_TX_STATE_XMIT: 2964 l2cap_tx_state_xmit(chan, control, skbs, event); 2965 break; 2966 case L2CAP_TX_STATE_WAIT_F: 2967 l2cap_tx_state_wait_f(chan, control, skbs, event); 2968 break; 2969 default: 2970 /* Ignore event */ 2971 break; 2972 } 2973 } 2974 2975 static void l2cap_pass_to_tx(struct l2cap_chan *chan, 2976 struct l2cap_ctrl *control) 2977 { 2978 BT_DBG("chan %p, control %p", chan, control); 2979 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT); 2980 } 2981 2982 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan, 2983 struct l2cap_ctrl *control) 2984 { 2985 BT_DBG("chan %p, control %p", chan, control); 2986 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT); 2987 } 2988 2989 /* Copy frame to all raw sockets on that connection */ 2990 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) 2991 { 2992 struct sk_buff *nskb; 2993 struct l2cap_chan *chan; 2994 2995 BT_DBG("conn %p", conn); 2996 2997 list_for_each_entry(chan, &conn->chan_l, list) { 2998 if (chan->chan_type != L2CAP_CHAN_RAW) 2999 continue; 3000 3001 /* Don't send frame to the channel it came from */ 3002 if (bt_cb(skb)->l2cap.chan == chan) 3003 continue; 3004 3005 nskb = skb_clone(skb, GFP_KERNEL); 3006 if (!nskb) 3007 continue; 3008 if (chan->ops->recv(chan, nskb)) 3009 kfree_skb(nskb); 3010 } 3011 } 3012 3013 /* ---- L2CAP signalling commands ---- */ 3014 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code, 3015 u8 ident, u16 dlen, void *data) 3016 { 3017 struct sk_buff *skb, **frag; 3018 struct l2cap_cmd_hdr *cmd; 3019 struct l2cap_hdr *lh; 3020 int len, count; 3021 3022 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u", 3023 conn, code, ident, dlen); 3024 3025 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) 3026 return NULL; 3027 3028 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; 3029 count = min_t(unsigned int, conn->mtu, len); 3030 3031 skb = bt_skb_alloc(count, GFP_KERNEL); 3032 if (!skb) 3033 return NULL; 3034 3035 lh = skb_put(skb, L2CAP_HDR_SIZE); 3036 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 3037 3038 if (conn->hcon->type == LE_LINK) 3039 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING); 3040 else 3041 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING); 3042 3043 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE); 3044 cmd->code = code; 3045 cmd->ident = ident; 3046 cmd->len = cpu_to_le16(dlen); 3047 3048 if (dlen) { 3049 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE; 3050 skb_put_data(skb, data, count); 3051 data += count; 3052 } 3053 3054 len -= skb->len; 3055 3056 /* Continuation fragments (no L2CAP header) */ 3057 frag = &skb_shinfo(skb)->frag_list; 3058 while (len) { 3059 count = min_t(unsigned int, conn->mtu, len); 3060 3061 *frag = bt_skb_alloc(count, GFP_KERNEL); 3062 if (!*frag) 3063 goto fail; 3064 3065 skb_put_data(*frag, data, count); 3066 3067 len -= count; 3068 data += count; 3069 3070 frag = &(*frag)->next; 3071 } 3072 3073 return skb; 3074 3075 fail: 3076 kfree_skb(skb); 3077 return NULL; 3078 } 3079 3080 static inline int l2cap_get_conf_opt(void **ptr, void *end, int *type, 3081 int *olen, unsigned long *val) 3082 { 3083 struct l2cap_conf_opt *opt = *ptr; 3084 int len; 3085 3086 /* opt->len is attacker-controlled. Validate that the full option 3087 * (header + value) actually fits in the buffer before touching 3088 * opt->val, otherwise the switch below reads past the end of the 3089 * caller's buffer. 3090 */ 3091 if (end - *ptr < L2CAP_CONF_OPT_SIZE) 3092 return -EINVAL; 3093 3094 len = L2CAP_CONF_OPT_SIZE + opt->len; 3095 if (end - *ptr < len) 3096 return -EINVAL; 3097 3098 *ptr += len; 3099 3100 *type = opt->type; 3101 *olen = opt->len; 3102 3103 switch (opt->len) { 3104 case 1: 3105 *val = *((u8 *) opt->val); 3106 break; 3107 3108 case 2: 3109 *val = get_unaligned_le16(opt->val); 3110 break; 3111 3112 case 4: 3113 *val = get_unaligned_le32(opt->val); 3114 break; 3115 3116 default: 3117 *val = (unsigned long) opt->val; 3118 break; 3119 } 3120 3121 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val); 3122 return len; 3123 } 3124 3125 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) 3126 { 3127 struct l2cap_conf_opt *opt = *ptr; 3128 3129 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); 3130 3131 if (size < L2CAP_CONF_OPT_SIZE + len) 3132 return; 3133 3134 opt->type = type; 3135 opt->len = len; 3136 3137 switch (len) { 3138 case 1: 3139 *((u8 *) opt->val) = val; 3140 break; 3141 3142 case 2: 3143 put_unaligned_le16(val, opt->val); 3144 break; 3145 3146 case 4: 3147 put_unaligned_le32(val, opt->val); 3148 break; 3149 3150 default: 3151 memcpy(opt->val, (void *) val, len); 3152 break; 3153 } 3154 3155 *ptr += L2CAP_CONF_OPT_SIZE + len; 3156 } 3157 3158 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) 3159 { 3160 struct l2cap_conf_efs efs; 3161 3162 switch (chan->mode) { 3163 case L2CAP_MODE_ERTM: 3164 efs.id = chan->local_id; 3165 efs.stype = chan->local_stype; 3166 efs.msdu = cpu_to_le16(chan->local_msdu); 3167 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3168 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT); 3169 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO); 3170 break; 3171 3172 case L2CAP_MODE_STREAMING: 3173 efs.id = 1; 3174 efs.stype = L2CAP_SERV_BESTEFFORT; 3175 efs.msdu = cpu_to_le16(chan->local_msdu); 3176 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3177 efs.acc_lat = 0; 3178 efs.flush_to = 0; 3179 break; 3180 3181 default: 3182 return; 3183 } 3184 3185 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), 3186 (unsigned long) &efs, size); 3187 } 3188 3189 static void l2cap_ack_timeout(struct work_struct *work) 3190 { 3191 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 3192 ack_timer.work); 3193 u16 frames_to_ack; 3194 3195 BT_DBG("chan %p", chan); 3196 3197 l2cap_chan_lock(chan); 3198 3199 if (test_bit(FLAG_DEL, &chan->flags)) 3200 goto unlock; 3201 3202 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 3203 chan->last_acked_seq); 3204 3205 if (frames_to_ack) 3206 l2cap_send_rr_or_rnr(chan, 0); 3207 3208 unlock: 3209 l2cap_chan_unlock(chan); 3210 l2cap_chan_put(chan); 3211 } 3212 3213 int l2cap_ertm_init(struct l2cap_chan *chan) 3214 { 3215 int err; 3216 3217 chan->next_tx_seq = 0; 3218 chan->expected_tx_seq = 0; 3219 chan->expected_ack_seq = 0; 3220 chan->unacked_frames = 0; 3221 chan->buffer_seq = 0; 3222 chan->frames_sent = 0; 3223 chan->last_acked_seq = 0; 3224 chan->sdu = NULL; 3225 chan->sdu_last_frag = NULL; 3226 chan->sdu_len = 0; 3227 3228 skb_queue_head_init(&chan->tx_q); 3229 3230 if (chan->mode != L2CAP_MODE_ERTM) 3231 return 0; 3232 3233 chan->rx_state = L2CAP_RX_STATE_RECV; 3234 chan->tx_state = L2CAP_TX_STATE_XMIT; 3235 3236 skb_queue_head_init(&chan->srej_q); 3237 3238 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win); 3239 if (err < 0) 3240 return err; 3241 3242 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win); 3243 if (err < 0) 3244 l2cap_seq_list_free(&chan->srej_list); 3245 3246 return err; 3247 } 3248 3249 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) 3250 { 3251 switch (mode) { 3252 case L2CAP_MODE_STREAMING: 3253 case L2CAP_MODE_ERTM: 3254 if (l2cap_mode_supported(mode, remote_feat_mask)) 3255 return mode; 3256 fallthrough; 3257 default: 3258 return L2CAP_MODE_BASIC; 3259 } 3260 } 3261 3262 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn) 3263 { 3264 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW); 3265 } 3266 3267 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn) 3268 { 3269 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW); 3270 } 3271 3272 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan, 3273 struct l2cap_conf_rfc *rfc) 3274 { 3275 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); 3276 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); 3277 } 3278 3279 static inline void l2cap_txwin_setup(struct l2cap_chan *chan) 3280 { 3281 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW && 3282 __l2cap_ews_supported(chan->conn)) { 3283 /* use extended control field */ 3284 set_bit(FLAG_EXT_CTRL, &chan->flags); 3285 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; 3286 } else { 3287 chan->tx_win = min_t(u16, chan->tx_win, 3288 L2CAP_DEFAULT_TX_WINDOW); 3289 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 3290 } 3291 chan->ack_win = chan->tx_win; 3292 } 3293 3294 static void l2cap_mtu_auto(struct l2cap_chan *chan) 3295 { 3296 struct hci_conn *conn = chan->conn->hcon; 3297 3298 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3299 3300 /* The 2-DH1 packet has between 2 and 56 information bytes 3301 * (including the 2-byte payload header) 3302 */ 3303 if (!(conn->pkt_type & HCI_2DH1)) 3304 chan->imtu = 54; 3305 3306 /* The 3-DH1 packet has between 2 and 85 information bytes 3307 * (including the 2-byte payload header) 3308 */ 3309 if (!(conn->pkt_type & HCI_3DH1)) 3310 chan->imtu = 83; 3311 3312 /* The 2-DH3 packet has between 2 and 369 information bytes 3313 * (including the 2-byte payload header) 3314 */ 3315 if (!(conn->pkt_type & HCI_2DH3)) 3316 chan->imtu = 367; 3317 3318 /* The 3-DH3 packet has between 2 and 554 information bytes 3319 * (including the 2-byte payload header) 3320 */ 3321 if (!(conn->pkt_type & HCI_3DH3)) 3322 chan->imtu = 552; 3323 3324 /* The 2-DH5 packet has between 2 and 681 information bytes 3325 * (including the 2-byte payload header) 3326 */ 3327 if (!(conn->pkt_type & HCI_2DH5)) 3328 chan->imtu = 679; 3329 3330 /* The 3-DH5 packet has between 2 and 1023 information bytes 3331 * (including the 2-byte payload header) 3332 */ 3333 if (!(conn->pkt_type & HCI_3DH5)) 3334 chan->imtu = 1021; 3335 } 3336 3337 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3338 { 3339 struct l2cap_conf_req *req = data; 3340 struct l2cap_conf_rfc rfc = { .mode = chan->mode }; 3341 void *ptr = req->data; 3342 void *endptr = data + data_size; 3343 u16 size; 3344 3345 BT_DBG("chan %p", chan); 3346 3347 if (chan->num_conf_req || chan->num_conf_rsp) 3348 goto done; 3349 3350 switch (chan->mode) { 3351 case L2CAP_MODE_STREAMING: 3352 case L2CAP_MODE_ERTM: 3353 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) 3354 break; 3355 3356 if (__l2cap_efs_supported(chan->conn)) 3357 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3358 3359 fallthrough; 3360 default: 3361 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask); 3362 break; 3363 } 3364 3365 done: 3366 if (chan->imtu != L2CAP_DEFAULT_MTU) { 3367 if (!chan->imtu) 3368 l2cap_mtu_auto(chan); 3369 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3370 endptr - ptr); 3371 } 3372 3373 switch (chan->mode) { 3374 case L2CAP_MODE_BASIC: 3375 if (disable_ertm) 3376 break; 3377 3378 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) && 3379 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING)) 3380 break; 3381 3382 rfc.mode = L2CAP_MODE_BASIC; 3383 rfc.txwin_size = 0; 3384 rfc.max_transmit = 0; 3385 rfc.retrans_timeout = 0; 3386 rfc.monitor_timeout = 0; 3387 rfc.max_pdu_size = 0; 3388 3389 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3390 (unsigned long) &rfc, endptr - ptr); 3391 break; 3392 3393 case L2CAP_MODE_ERTM: 3394 rfc.mode = L2CAP_MODE_ERTM; 3395 rfc.max_transmit = chan->max_tx; 3396 3397 __l2cap_set_ertm_timeouts(chan, &rfc); 3398 3399 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3400 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3401 L2CAP_FCS_SIZE); 3402 rfc.max_pdu_size = cpu_to_le16(size); 3403 3404 l2cap_txwin_setup(chan); 3405 3406 rfc.txwin_size = min_t(u16, chan->tx_win, 3407 L2CAP_DEFAULT_TX_WINDOW); 3408 3409 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3410 (unsigned long) &rfc, endptr - ptr); 3411 3412 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3413 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3414 3415 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 3416 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3417 chan->tx_win, endptr - ptr); 3418 3419 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3420 if (chan->fcs == L2CAP_FCS_NONE || 3421 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3422 chan->fcs = L2CAP_FCS_NONE; 3423 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3424 chan->fcs, endptr - ptr); 3425 } 3426 break; 3427 3428 case L2CAP_MODE_STREAMING: 3429 l2cap_txwin_setup(chan); 3430 rfc.mode = L2CAP_MODE_STREAMING; 3431 rfc.txwin_size = 0; 3432 rfc.max_transmit = 0; 3433 rfc.retrans_timeout = 0; 3434 rfc.monitor_timeout = 0; 3435 3436 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3437 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3438 L2CAP_FCS_SIZE); 3439 rfc.max_pdu_size = cpu_to_le16(size); 3440 3441 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3442 (unsigned long) &rfc, endptr - ptr); 3443 3444 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3445 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3446 3447 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3448 if (chan->fcs == L2CAP_FCS_NONE || 3449 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3450 chan->fcs = L2CAP_FCS_NONE; 3451 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3452 chan->fcs, endptr - ptr); 3453 } 3454 break; 3455 } 3456 3457 req->dcid = cpu_to_le16(chan->dcid); 3458 req->flags = cpu_to_le16(0); 3459 3460 return ptr - data; 3461 } 3462 3463 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3464 { 3465 struct l2cap_conf_rsp *rsp = data; 3466 void *ptr = rsp->data; 3467 void *endptr = data + data_size; 3468 void *req = chan->conf_req; 3469 void *req_end = req + chan->conf_len; 3470 int len = chan->conf_len; 3471 int type, hint, olen; 3472 unsigned long val; 3473 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3474 struct l2cap_conf_efs efs; 3475 u8 remote_efs = 0; 3476 u16 mtu = 0; 3477 u16 result = L2CAP_CONF_SUCCESS; 3478 u16 size; 3479 3480 BT_DBG("chan %p", chan); 3481 3482 while (len >= L2CAP_CONF_OPT_SIZE) { 3483 int ret = l2cap_get_conf_opt(&req, req_end, &type, &olen, &val); 3484 3485 if (ret < 0) 3486 break; 3487 len -= ret; 3488 3489 hint = type & L2CAP_CONF_HINT; 3490 type &= L2CAP_CONF_MASK; 3491 3492 switch (type) { 3493 case L2CAP_CONF_MTU: 3494 if (olen != 2) 3495 break; 3496 mtu = val; 3497 break; 3498 3499 case L2CAP_CONF_FLUSH_TO: 3500 if (olen != 2) 3501 break; 3502 chan->flush_to = val; 3503 break; 3504 3505 case L2CAP_CONF_QOS: 3506 break; 3507 3508 case L2CAP_CONF_RFC: 3509 if (olen != sizeof(rfc)) 3510 break; 3511 memcpy(&rfc, (void *) val, olen); 3512 break; 3513 3514 case L2CAP_CONF_FCS: 3515 if (olen != 1) 3516 break; 3517 if (val == L2CAP_FCS_NONE) 3518 set_bit(CONF_RECV_NO_FCS, &chan->conf_state); 3519 break; 3520 3521 case L2CAP_CONF_EFS: 3522 if (olen != sizeof(efs)) 3523 break; 3524 remote_efs = 1; 3525 memcpy(&efs, (void *) val, olen); 3526 break; 3527 3528 case L2CAP_CONF_EWS: 3529 if (olen != 2) 3530 break; 3531 return -ECONNREFUSED; 3532 3533 default: 3534 if (hint) 3535 break; 3536 result = L2CAP_CONF_UNKNOWN; 3537 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr); 3538 break; 3539 } 3540 } 3541 3542 if (chan->num_conf_rsp || chan->num_conf_req > 1) 3543 goto done; 3544 3545 switch (chan->mode) { 3546 case L2CAP_MODE_STREAMING: 3547 case L2CAP_MODE_ERTM: 3548 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) { 3549 chan->mode = l2cap_select_mode(rfc.mode, 3550 chan->conn->feat_mask); 3551 break; 3552 } 3553 3554 if (remote_efs) { 3555 if (__l2cap_efs_supported(chan->conn)) 3556 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3557 else 3558 return -ECONNREFUSED; 3559 } 3560 3561 if (chan->mode != rfc.mode) 3562 return -ECONNREFUSED; 3563 3564 break; 3565 } 3566 3567 done: 3568 if (chan->mode != rfc.mode) { 3569 result = L2CAP_CONF_UNACCEPT; 3570 rfc.mode = chan->mode; 3571 3572 if (chan->num_conf_rsp == 1) 3573 return -ECONNREFUSED; 3574 3575 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3576 (unsigned long) &rfc, endptr - ptr); 3577 } 3578 3579 if (result == L2CAP_CONF_SUCCESS) { 3580 /* Configure output options and let the other side know 3581 * which ones we don't like. */ 3582 3583 /* If MTU is not provided in configure request, try adjusting it 3584 * to the current output MTU if it has been set 3585 * 3586 * Bluetooth Core 6.1, Vol 3, Part A, Section 4.5 3587 * 3588 * Each configuration parameter value (if any is present) in an 3589 * L2CAP_CONFIGURATION_RSP packet reflects an ‘adjustment’ to a 3590 * configuration parameter value that has been sent (or, in case 3591 * of default values, implied) in the corresponding 3592 * L2CAP_CONFIGURATION_REQ packet. 3593 */ 3594 if (!mtu) { 3595 /* Only adjust for ERTM channels as for older modes the 3596 * remote stack may not be able to detect that the 3597 * adjustment causing it to silently drop packets. 3598 */ 3599 if (chan->mode == L2CAP_MODE_ERTM && 3600 chan->omtu && chan->omtu != L2CAP_DEFAULT_MTU) 3601 mtu = chan->omtu; 3602 else 3603 mtu = L2CAP_DEFAULT_MTU; 3604 } 3605 3606 if (mtu < L2CAP_DEFAULT_MIN_MTU) 3607 result = L2CAP_CONF_UNACCEPT; 3608 else { 3609 chan->omtu = mtu; 3610 set_bit(CONF_MTU_DONE, &chan->conf_state); 3611 } 3612 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); 3613 3614 if (remote_efs) { 3615 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3616 efs.stype != L2CAP_SERV_NOTRAFIC && 3617 efs.stype != chan->local_stype) { 3618 3619 result = L2CAP_CONF_UNACCEPT; 3620 3621 if (chan->num_conf_req >= 1) 3622 return -ECONNREFUSED; 3623 3624 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3625 sizeof(efs), 3626 (unsigned long) &efs, endptr - ptr); 3627 } else { 3628 /* Send PENDING Conf Rsp */ 3629 result = L2CAP_CONF_PENDING; 3630 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 3631 } 3632 } 3633 3634 switch (rfc.mode) { 3635 case L2CAP_MODE_BASIC: 3636 chan->fcs = L2CAP_FCS_NONE; 3637 set_bit(CONF_MODE_DONE, &chan->conf_state); 3638 break; 3639 3640 case L2CAP_MODE_ERTM: 3641 if (!test_bit(CONF_EWS_RECV, &chan->conf_state)) 3642 chan->remote_tx_win = rfc.txwin_size; 3643 else 3644 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW; 3645 3646 chan->remote_max_tx = rfc.max_transmit; 3647 3648 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3649 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3650 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3651 rfc.max_pdu_size = cpu_to_le16(size); 3652 chan->remote_mps = size; 3653 3654 __l2cap_set_ertm_timeouts(chan, &rfc); 3655 3656 set_bit(CONF_MODE_DONE, &chan->conf_state); 3657 3658 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 3659 sizeof(rfc), (unsigned long) &rfc, endptr - ptr); 3660 3661 if (remote_efs && 3662 test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3663 chan->remote_id = efs.id; 3664 chan->remote_stype = efs.stype; 3665 chan->remote_msdu = le16_to_cpu(efs.msdu); 3666 chan->remote_flush_to = 3667 le32_to_cpu(efs.flush_to); 3668 chan->remote_acc_lat = 3669 le32_to_cpu(efs.acc_lat); 3670 chan->remote_sdu_itime = 3671 le32_to_cpu(efs.sdu_itime); 3672 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3673 sizeof(efs), 3674 (unsigned long) &efs, endptr - ptr); 3675 } 3676 break; 3677 3678 case L2CAP_MODE_STREAMING: 3679 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3680 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3681 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3682 rfc.max_pdu_size = cpu_to_le16(size); 3683 chan->remote_mps = size; 3684 3685 set_bit(CONF_MODE_DONE, &chan->conf_state); 3686 3687 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3688 (unsigned long) &rfc, endptr - ptr); 3689 3690 break; 3691 3692 default: 3693 result = L2CAP_CONF_UNACCEPT; 3694 3695 memset(&rfc, 0, sizeof(rfc)); 3696 rfc.mode = chan->mode; 3697 } 3698 3699 if (result == L2CAP_CONF_SUCCESS) 3700 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 3701 } 3702 rsp->scid = cpu_to_le16(chan->dcid); 3703 rsp->result = cpu_to_le16(result); 3704 rsp->flags = cpu_to_le16(0); 3705 3706 return ptr - data; 3707 } 3708 3709 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, 3710 void *data, size_t size, u16 *result) 3711 { 3712 struct l2cap_conf_req *req = data; 3713 void *ptr = req->data; 3714 void *endptr = data + size; 3715 void *rsp_end = rsp + len; 3716 int type, olen; 3717 unsigned long val; 3718 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3719 struct l2cap_conf_efs efs; 3720 3721 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); 3722 3723 while (len >= L2CAP_CONF_OPT_SIZE) { 3724 int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val); 3725 3726 if (ret < 0) 3727 break; 3728 len -= ret; 3729 3730 switch (type) { 3731 case L2CAP_CONF_MTU: 3732 if (olen != 2) 3733 break; 3734 if (val < L2CAP_DEFAULT_MIN_MTU) { 3735 *result = L2CAP_CONF_UNACCEPT; 3736 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3737 } else 3738 chan->imtu = val; 3739 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3740 endptr - ptr); 3741 break; 3742 3743 case L2CAP_CONF_FLUSH_TO: 3744 if (olen != 2) 3745 break; 3746 chan->flush_to = val; 3747 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, 3748 chan->flush_to, endptr - ptr); 3749 break; 3750 3751 case L2CAP_CONF_RFC: 3752 if (olen != sizeof(rfc)) 3753 break; 3754 memcpy(&rfc, (void *)val, olen); 3755 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && 3756 rfc.mode != chan->mode) 3757 return -ECONNREFUSED; 3758 chan->fcs = 0; 3759 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3760 (unsigned long) &rfc, endptr - ptr); 3761 break; 3762 3763 case L2CAP_CONF_EWS: 3764 if (olen != 2) 3765 break; 3766 chan->ack_win = min_t(u16, val, chan->ack_win); 3767 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3768 chan->tx_win, endptr - ptr); 3769 break; 3770 3771 case L2CAP_CONF_EFS: 3772 if (olen != sizeof(efs)) 3773 break; 3774 memcpy(&efs, (void *)val, olen); 3775 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3776 efs.stype != L2CAP_SERV_NOTRAFIC && 3777 efs.stype != chan->local_stype) 3778 return -ECONNREFUSED; 3779 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), 3780 (unsigned long) &efs, endptr - ptr); 3781 break; 3782 3783 case L2CAP_CONF_FCS: 3784 if (olen != 1) 3785 break; 3786 if (*result == L2CAP_CONF_PENDING) 3787 if (val == L2CAP_FCS_NONE) 3788 set_bit(CONF_RECV_NO_FCS, 3789 &chan->conf_state); 3790 break; 3791 } 3792 } 3793 3794 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode) 3795 return -ECONNREFUSED; 3796 3797 chan->mode = rfc.mode; 3798 3799 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) { 3800 switch (rfc.mode) { 3801 case L2CAP_MODE_ERTM: 3802 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 3803 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 3804 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3805 if (!test_bit(FLAG_EXT_CTRL, &chan->flags)) 3806 chan->ack_win = min_t(u16, chan->ack_win, 3807 rfc.txwin_size); 3808 3809 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3810 chan->local_msdu = le16_to_cpu(efs.msdu); 3811 chan->local_sdu_itime = 3812 le32_to_cpu(efs.sdu_itime); 3813 chan->local_acc_lat = le32_to_cpu(efs.acc_lat); 3814 chan->local_flush_to = 3815 le32_to_cpu(efs.flush_to); 3816 } 3817 break; 3818 3819 case L2CAP_MODE_STREAMING: 3820 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3821 } 3822 } 3823 3824 req->dcid = cpu_to_le16(chan->dcid); 3825 req->flags = cpu_to_le16(0); 3826 3827 return ptr - data; 3828 } 3829 3830 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, 3831 u16 result, u16 flags) 3832 { 3833 struct l2cap_conf_rsp *rsp = data; 3834 void *ptr = rsp->data; 3835 3836 BT_DBG("chan %p", chan); 3837 3838 rsp->scid = cpu_to_le16(chan->dcid); 3839 rsp->result = cpu_to_le16(result); 3840 rsp->flags = cpu_to_le16(flags); 3841 3842 return ptr - data; 3843 } 3844 3845 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) 3846 { 3847 struct l2cap_le_conn_rsp rsp; 3848 struct l2cap_conn *conn = chan->conn; 3849 3850 BT_DBG("chan %p", chan); 3851 3852 rsp.dcid = cpu_to_le16(chan->scid); 3853 rsp.mtu = cpu_to_le16(chan->imtu); 3854 rsp.mps = cpu_to_le16(chan->mps); 3855 rsp.credits = cpu_to_le16(chan->rx_credits); 3856 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3857 3858 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 3859 &rsp); 3860 } 3861 3862 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data) 3863 { 3864 int *result = data; 3865 3866 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 3867 return; 3868 3869 switch (chan->state) { 3870 case BT_CONNECT2: 3871 /* If channel still pending accept add to result */ 3872 (*result)++; 3873 return; 3874 case BT_CONNECTED: 3875 return; 3876 default: 3877 /* If not connected or pending accept it has been refused */ 3878 *result = -ECONNREFUSED; 3879 return; 3880 } 3881 } 3882 3883 struct l2cap_ecred_rsp_data { 3884 struct { 3885 struct l2cap_ecred_conn_rsp_hdr rsp; 3886 __le16 scid[L2CAP_ECRED_MAX_CID]; 3887 } __packed pdu; 3888 int count; 3889 }; 3890 3891 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data) 3892 { 3893 struct l2cap_ecred_rsp_data *rsp = data; 3894 struct l2cap_ecred_conn_rsp *rsp_flex = 3895 container_of(&rsp->pdu.rsp, struct l2cap_ecred_conn_rsp, hdr); 3896 3897 /* Check if channel for outgoing connection or if it wasn't deferred 3898 * since in those cases it must be skipped. 3899 */ 3900 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags) || 3901 !test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 3902 return; 3903 3904 /* Reset ident so only one response is sent */ 3905 chan->ident = 0; 3906 3907 /* Include all channels pending with the same ident */ 3908 if (!rsp->pdu.rsp.result) 3909 rsp_flex->dcid[rsp->count++] = cpu_to_le16(chan->scid); 3910 else 3911 l2cap_chan_del(chan, ECONNRESET); 3912 } 3913 3914 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) 3915 { 3916 struct l2cap_conn *conn = chan->conn; 3917 struct l2cap_ecred_rsp_data data; 3918 u16 id = chan->ident; 3919 int result = 0; 3920 3921 if (!id) 3922 return; 3923 3924 BT_DBG("chan %p id %d", chan, id); 3925 3926 memset(&data, 0, sizeof(data)); 3927 3928 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu); 3929 data.pdu.rsp.mps = cpu_to_le16(chan->mps); 3930 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits); 3931 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3932 3933 /* Verify that all channels are ready */ 3934 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result); 3935 3936 if (result > 0) 3937 return; 3938 3939 if (result < 0) 3940 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION); 3941 3942 /* Build response */ 3943 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data); 3944 3945 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP, 3946 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)), 3947 &data.pdu); 3948 } 3949 3950 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) 3951 { 3952 struct l2cap_conn_rsp rsp; 3953 struct l2cap_conn *conn = chan->conn; 3954 u8 buf[128]; 3955 u8 rsp_code; 3956 3957 rsp.scid = cpu_to_le16(chan->dcid); 3958 rsp.dcid = cpu_to_le16(chan->scid); 3959 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 3960 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 3961 rsp_code = L2CAP_CONN_RSP; 3962 3963 BT_DBG("chan %p rsp_code %u", chan, rsp_code); 3964 3965 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp); 3966 3967 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 3968 return; 3969 3970 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 3971 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 3972 chan->num_conf_req++; 3973 } 3974 3975 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) 3976 { 3977 int type, olen; 3978 unsigned long val; 3979 void *rsp_end = rsp + len; 3980 /* Use sane default values in case a misbehaving remote device 3981 * did not send an RFC or extended window size option. 3982 */ 3983 u16 txwin_ext = chan->ack_win; 3984 struct l2cap_conf_rfc rfc = { 3985 .mode = chan->mode, 3986 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO), 3987 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO), 3988 .max_pdu_size = cpu_to_le16(chan->imtu), 3989 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW), 3990 }; 3991 3992 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len); 3993 3994 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING)) 3995 return; 3996 3997 while (len >= L2CAP_CONF_OPT_SIZE) { 3998 int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val); 3999 4000 if (ret < 0) 4001 break; 4002 len -= ret; 4003 4004 switch (type) { 4005 case L2CAP_CONF_RFC: 4006 if (olen != sizeof(rfc)) 4007 break; 4008 memcpy(&rfc, (void *)val, olen); 4009 break; 4010 case L2CAP_CONF_EWS: 4011 if (olen != 2) 4012 break; 4013 txwin_ext = val; 4014 break; 4015 } 4016 } 4017 4018 switch (rfc.mode) { 4019 case L2CAP_MODE_ERTM: 4020 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 4021 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 4022 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4023 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 4024 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext); 4025 else 4026 chan->ack_win = min_t(u16, chan->ack_win, 4027 rfc.txwin_size); 4028 break; 4029 case L2CAP_MODE_STREAMING: 4030 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4031 } 4032 } 4033 4034 static inline int l2cap_command_rej(struct l2cap_conn *conn, 4035 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4036 u8 *data) 4037 { 4038 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 4039 4040 if (cmd_len < sizeof(*rej)) 4041 return -EPROTO; 4042 4043 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD) 4044 return 0; 4045 4046 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) && 4047 cmd->ident == conn->info_ident) { 4048 cancel_delayed_work(&conn->info_timer); 4049 4050 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4051 conn->info_ident = 0; 4052 4053 l2cap_conn_start(conn); 4054 } 4055 4056 return 0; 4057 } 4058 4059 /* Allocate and initialise a channel for an incoming connection. 4060 * 4061 * The channel inherits its configuration from @pchan and is linked into @conn 4062 * before ->new_connection() runs, so the conn list reference keeps it alive if 4063 * the callback exposes it (e.g. via the socket accept queue) before this 4064 * returns. The l2cap_chan_create() reference is taken over by the subsystem on 4065 * success and dropped here on failure. 4066 */ 4067 static struct l2cap_chan *l2cap_new_connection(struct l2cap_conn *conn, 4068 struct l2cap_chan *pchan) 4069 { 4070 struct l2cap_chan *chan; 4071 4072 chan = l2cap_chan_create(); 4073 if (!chan) 4074 return NULL; 4075 4076 l2cap_chan_set_defaults(chan, pchan); 4077 chan->ops = pchan->ops; 4078 4079 __l2cap_chan_add(conn, chan); 4080 4081 if (pchan->ops->new_connection && 4082 pchan->ops->new_connection(pchan, chan) < 0) { 4083 l2cap_chan_del(chan, 0); 4084 l2cap_chan_put(chan); 4085 return NULL; 4086 } 4087 4088 return chan; 4089 } 4090 4091 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, 4092 u8 *data, u8 rsp_code) 4093 { 4094 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 4095 struct l2cap_conn_rsp rsp; 4096 struct l2cap_chan *chan = NULL, *pchan = NULL; 4097 int result, status = L2CAP_CS_NO_INFO; 4098 4099 u16 dcid = 0, scid = __le16_to_cpu(req->scid); 4100 __le16 psm = req->psm; 4101 4102 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid); 4103 4104 /* Check if we have socket listening on psm */ 4105 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 4106 &conn->hcon->dst, ACL_LINK); 4107 if (!pchan) { 4108 result = L2CAP_CR_BAD_PSM; 4109 goto response; 4110 } 4111 4112 l2cap_chan_lock(pchan); 4113 4114 /* Check if the ACL is secure enough (if not SDP) */ 4115 if (psm != cpu_to_le16(L2CAP_PSM_SDP) && 4116 (!hci_conn_check_link_mode(conn->hcon) || 4117 !l2cap_check_enc_key_size(conn->hcon, pchan))) { 4118 conn->disc_reason = HCI_ERROR_AUTH_FAILURE; 4119 result = L2CAP_CR_SEC_BLOCK; 4120 goto response; 4121 } 4122 4123 result = L2CAP_CR_NO_MEM; 4124 4125 /* Check for valid dynamic CID range (as per Erratum 3253) */ 4126 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) { 4127 result = L2CAP_CR_INVALID_SCID; 4128 goto response; 4129 } 4130 4131 /* Check if we already have channel with that dcid */ 4132 if (__l2cap_get_chan_by_dcid(conn, scid)) { 4133 result = L2CAP_CR_SCID_IN_USE; 4134 goto response; 4135 } 4136 4137 chan = l2cap_new_connection(conn, pchan); 4138 if (!chan) 4139 goto response; 4140 4141 /* For certain devices (ex: HID mouse), support for authentication, 4142 * pairing and bonding is optional. For such devices, inorder to avoid 4143 * the ACL alive for too long after L2CAP disconnection, reset the ACL 4144 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect. 4145 */ 4146 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT; 4147 4148 bacpy(&chan->src, &conn->hcon->src); 4149 bacpy(&chan->dst, &conn->hcon->dst); 4150 chan->src_type = bdaddr_src_type(conn->hcon); 4151 chan->dst_type = bdaddr_dst_type(conn->hcon); 4152 chan->psm = psm; 4153 chan->dcid = scid; 4154 4155 dcid = chan->scid; 4156 4157 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 4158 4159 chan->ident = cmd->ident; 4160 4161 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) { 4162 if (l2cap_chan_check_security(chan, false)) { 4163 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 4164 l2cap_state_change(chan, BT_CONNECT2); 4165 result = L2CAP_CR_PEND; 4166 status = L2CAP_CS_AUTHOR_PEND; 4167 chan->ops->defer(chan); 4168 } else { 4169 l2cap_state_change(chan, BT_CONFIG); 4170 result = L2CAP_CR_SUCCESS; 4171 status = L2CAP_CS_NO_INFO; 4172 } 4173 } else { 4174 l2cap_state_change(chan, BT_CONNECT2); 4175 result = L2CAP_CR_PEND; 4176 status = L2CAP_CS_AUTHEN_PEND; 4177 } 4178 } else { 4179 l2cap_state_change(chan, BT_CONNECT2); 4180 result = L2CAP_CR_PEND; 4181 status = L2CAP_CS_NO_INFO; 4182 } 4183 4184 response: 4185 rsp.scid = cpu_to_le16(scid); 4186 rsp.dcid = cpu_to_le16(dcid); 4187 rsp.result = cpu_to_le16(result); 4188 rsp.status = cpu_to_le16(status); 4189 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); 4190 4191 if (!pchan) 4192 return; 4193 4194 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 4195 struct l2cap_info_req info; 4196 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4197 4198 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 4199 conn->info_ident = l2cap_get_ident(conn); 4200 4201 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 4202 4203 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 4204 sizeof(info), &info); 4205 } 4206 4207 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && 4208 result == L2CAP_CR_SUCCESS) { 4209 u8 buf[128]; 4210 set_bit(CONF_REQ_SENT, &chan->conf_state); 4211 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4212 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4213 chan->num_conf_req++; 4214 } 4215 4216 l2cap_chan_unlock(pchan); 4217 l2cap_chan_put(pchan); 4218 } 4219 4220 static int l2cap_connect_req(struct l2cap_conn *conn, 4221 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 4222 { 4223 if (cmd_len < sizeof(struct l2cap_conn_req)) 4224 return -EPROTO; 4225 4226 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP); 4227 return 0; 4228 } 4229 4230 static int l2cap_connect_create_rsp(struct l2cap_conn *conn, 4231 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4232 u8 *data) 4233 { 4234 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data; 4235 u16 scid, dcid, result, status; 4236 struct l2cap_chan *chan; 4237 u8 req[128]; 4238 int err; 4239 4240 if (cmd_len < sizeof(*rsp)) 4241 return -EPROTO; 4242 4243 scid = __le16_to_cpu(rsp->scid); 4244 dcid = __le16_to_cpu(rsp->dcid); 4245 result = __le16_to_cpu(rsp->result); 4246 status = __le16_to_cpu(rsp->status); 4247 4248 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START || 4249 dcid > L2CAP_CID_DYN_END)) 4250 return -EPROTO; 4251 4252 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", 4253 dcid, scid, result, status); 4254 4255 if (scid) { 4256 chan = __l2cap_get_chan_by_scid(conn, scid); 4257 if (!chan) 4258 return -EBADSLT; 4259 } else { 4260 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 4261 if (!chan) 4262 return -EBADSLT; 4263 } 4264 4265 chan = l2cap_chan_hold_unless_zero(chan); 4266 if (!chan) 4267 return -EBADSLT; 4268 4269 err = 0; 4270 4271 l2cap_chan_lock(chan); 4272 4273 switch (result) { 4274 case L2CAP_CR_SUCCESS: 4275 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 4276 err = -EBADSLT; 4277 break; 4278 } 4279 4280 l2cap_state_change(chan, BT_CONFIG); 4281 chan->ident = 0; 4282 chan->dcid = dcid; 4283 clear_bit(CONF_CONNECT_PEND, &chan->conf_state); 4284 4285 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 4286 break; 4287 4288 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4289 l2cap_build_conf_req(chan, req, sizeof(req)), req); 4290 chan->num_conf_req++; 4291 break; 4292 4293 case L2CAP_CR_PEND: 4294 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 4295 break; 4296 4297 default: 4298 l2cap_chan_del(chan, ECONNREFUSED); 4299 break; 4300 } 4301 4302 l2cap_chan_unlock(chan); 4303 l2cap_chan_put(chan); 4304 4305 return err; 4306 } 4307 4308 static inline void set_default_fcs(struct l2cap_chan *chan) 4309 { 4310 /* FCS is enabled only in ERTM or streaming mode, if one or both 4311 * sides request it. 4312 */ 4313 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING) 4314 chan->fcs = L2CAP_FCS_NONE; 4315 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) 4316 chan->fcs = L2CAP_FCS_CRC16; 4317 } 4318 4319 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data, 4320 u8 ident, u16 flags) 4321 { 4322 struct l2cap_conn *conn = chan->conn; 4323 4324 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident, 4325 flags); 4326 4327 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 4328 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 4329 4330 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP, 4331 l2cap_build_conf_rsp(chan, data, 4332 L2CAP_CONF_SUCCESS, flags), data); 4333 } 4334 4335 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident, 4336 u16 scid, u16 dcid) 4337 { 4338 struct l2cap_cmd_rej_cid rej; 4339 4340 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID); 4341 rej.scid = __cpu_to_le16(scid); 4342 rej.dcid = __cpu_to_le16(dcid); 4343 4344 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 4345 } 4346 4347 static inline int l2cap_config_req(struct l2cap_conn *conn, 4348 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4349 u8 *data) 4350 { 4351 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data; 4352 u16 dcid, flags; 4353 u8 rsp[64]; 4354 struct l2cap_chan *chan; 4355 int len, err = 0; 4356 4357 if (cmd_len < sizeof(*req)) 4358 return -EPROTO; 4359 4360 dcid = __le16_to_cpu(req->dcid); 4361 flags = __le16_to_cpu(req->flags); 4362 4363 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags); 4364 4365 chan = l2cap_get_chan_by_scid(conn, dcid); 4366 if (!chan) { 4367 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0); 4368 return 0; 4369 } 4370 4371 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && 4372 chan->state != BT_CONNECTED) { 4373 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, 4374 chan->dcid); 4375 goto unlock; 4376 } 4377 4378 /* Reject if config buffer is too small. */ 4379 len = cmd_len - sizeof(*req); 4380 if (chan->conf_len + len > sizeof(chan->conf_req)) { 4381 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4382 l2cap_build_conf_rsp(chan, rsp, 4383 L2CAP_CONF_REJECT, flags), rsp); 4384 goto unlock; 4385 } 4386 4387 /* Store config. */ 4388 memcpy(chan->conf_req + chan->conf_len, req->data, len); 4389 chan->conf_len += len; 4390 4391 if (flags & L2CAP_CONF_FLAG_CONTINUATION) { 4392 /* Incomplete config. Send empty response. */ 4393 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4394 l2cap_build_conf_rsp(chan, rsp, 4395 L2CAP_CONF_SUCCESS, flags), rsp); 4396 goto unlock; 4397 } 4398 4399 /* Complete config. */ 4400 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); 4401 if (len < 0) { 4402 l2cap_send_disconn_req(chan, ECONNRESET); 4403 goto unlock; 4404 } 4405 4406 chan->ident = cmd->ident; 4407 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); 4408 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP) 4409 chan->num_conf_rsp++; 4410 4411 /* Reset config buffer. */ 4412 chan->conf_len = 0; 4413 4414 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) 4415 goto unlock; 4416 4417 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 4418 set_default_fcs(chan); 4419 4420 if (chan->state != BT_CONNECTED) { 4421 if (chan->mode == L2CAP_MODE_ERTM || 4422 chan->mode == L2CAP_MODE_STREAMING) 4423 err = l2cap_ertm_init(chan); 4424 4425 if (err < 0) 4426 l2cap_send_disconn_req(chan, -err); 4427 else 4428 l2cap_chan_ready(chan); 4429 } 4430 4431 goto unlock; 4432 } 4433 4434 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { 4435 u8 buf[64]; 4436 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4437 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4438 chan->num_conf_req++; 4439 } 4440 4441 /* Got Conf Rsp PENDING from remote side and assume we sent 4442 Conf Rsp PENDING in the code above */ 4443 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) && 4444 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4445 4446 /* check compatibility */ 4447 4448 /* Send rsp for BR/EDR channel */ 4449 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags); 4450 } 4451 4452 unlock: 4453 l2cap_chan_unlock(chan); 4454 l2cap_chan_put(chan); 4455 return err; 4456 } 4457 4458 static inline int l2cap_config_rsp(struct l2cap_conn *conn, 4459 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4460 u8 *data) 4461 { 4462 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data; 4463 u16 scid, flags, result; 4464 struct l2cap_chan *chan; 4465 int len = cmd_len - sizeof(*rsp); 4466 int err = 0; 4467 4468 if (cmd_len < sizeof(*rsp)) 4469 return -EPROTO; 4470 4471 scid = __le16_to_cpu(rsp->scid); 4472 flags = __le16_to_cpu(rsp->flags); 4473 result = __le16_to_cpu(rsp->result); 4474 4475 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags, 4476 result, len); 4477 4478 chan = l2cap_get_chan_by_scid(conn, scid); 4479 if (!chan) 4480 return 0; 4481 4482 switch (result) { 4483 case L2CAP_CONF_SUCCESS: 4484 l2cap_conf_rfc_get(chan, rsp->data, len); 4485 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4486 break; 4487 4488 case L2CAP_CONF_PENDING: 4489 set_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4490 4491 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4492 char buf[64]; 4493 4494 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4495 buf, sizeof(buf), &result); 4496 if (len < 0) { 4497 l2cap_send_disconn_req(chan, ECONNRESET); 4498 goto done; 4499 } 4500 4501 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0); 4502 } 4503 goto done; 4504 4505 case L2CAP_CONF_UNKNOWN: 4506 case L2CAP_CONF_UNACCEPT: 4507 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) { 4508 char req[64]; 4509 4510 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { 4511 l2cap_send_disconn_req(chan, ECONNRESET); 4512 goto done; 4513 } 4514 4515 /* throw out any old stored conf requests */ 4516 result = L2CAP_CONF_SUCCESS; 4517 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4518 req, sizeof(req), &result); 4519 if (len < 0) { 4520 l2cap_send_disconn_req(chan, ECONNRESET); 4521 goto done; 4522 } 4523 4524 l2cap_send_cmd(conn, l2cap_get_ident(conn), 4525 L2CAP_CONF_REQ, len, req); 4526 chan->num_conf_req++; 4527 if (result != L2CAP_CONF_SUCCESS) 4528 goto done; 4529 break; 4530 } 4531 fallthrough; 4532 4533 default: 4534 l2cap_chan_set_err(chan, ECONNRESET); 4535 4536 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT); 4537 l2cap_send_disconn_req(chan, ECONNRESET); 4538 goto done; 4539 } 4540 4541 if (flags & L2CAP_CONF_FLAG_CONTINUATION) 4542 goto done; 4543 4544 set_bit(CONF_INPUT_DONE, &chan->conf_state); 4545 4546 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) { 4547 set_default_fcs(chan); 4548 4549 if (chan->mode == L2CAP_MODE_ERTM || 4550 chan->mode == L2CAP_MODE_STREAMING) 4551 err = l2cap_ertm_init(chan); 4552 4553 if (err < 0) 4554 l2cap_send_disconn_req(chan, -err); 4555 else 4556 l2cap_chan_ready(chan); 4557 } 4558 4559 done: 4560 l2cap_chan_unlock(chan); 4561 l2cap_chan_put(chan); 4562 return err; 4563 } 4564 4565 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, 4566 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4567 u8 *data) 4568 { 4569 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data; 4570 struct l2cap_disconn_rsp rsp; 4571 u16 dcid, scid; 4572 struct l2cap_chan *chan; 4573 4574 if (cmd_len != sizeof(*req)) 4575 return -EPROTO; 4576 4577 scid = __le16_to_cpu(req->scid); 4578 dcid = __le16_to_cpu(req->dcid); 4579 4580 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); 4581 4582 chan = l2cap_get_chan_by_scid(conn, dcid); 4583 if (!chan) { 4584 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); 4585 return 0; 4586 } 4587 4588 rsp.dcid = cpu_to_le16(chan->scid); 4589 rsp.scid = cpu_to_le16(chan->dcid); 4590 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); 4591 4592 chan->ops->set_shutdown(chan); 4593 4594 l2cap_chan_del(chan, ECONNRESET); 4595 4596 chan->ops->close(chan); 4597 4598 l2cap_chan_unlock(chan); 4599 l2cap_chan_put(chan); 4600 4601 return 0; 4602 } 4603 4604 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, 4605 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4606 u8 *data) 4607 { 4608 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data; 4609 u16 dcid, scid; 4610 struct l2cap_chan *chan; 4611 4612 if (cmd_len != sizeof(*rsp)) 4613 return -EPROTO; 4614 4615 scid = __le16_to_cpu(rsp->scid); 4616 dcid = __le16_to_cpu(rsp->dcid); 4617 4618 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); 4619 4620 chan = l2cap_get_chan_by_scid(conn, scid); 4621 if (!chan) { 4622 return 0; 4623 } 4624 4625 if (chan->state != BT_DISCONN) { 4626 l2cap_chan_unlock(chan); 4627 l2cap_chan_put(chan); 4628 return 0; 4629 } 4630 4631 l2cap_chan_del(chan, 0); 4632 4633 chan->ops->close(chan); 4634 4635 l2cap_chan_unlock(chan); 4636 l2cap_chan_put(chan); 4637 4638 return 0; 4639 } 4640 4641 static inline int l2cap_information_req(struct l2cap_conn *conn, 4642 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4643 u8 *data) 4644 { 4645 struct l2cap_info_req *req = (struct l2cap_info_req *) data; 4646 u16 type; 4647 4648 if (cmd_len != sizeof(*req)) 4649 return -EPROTO; 4650 4651 type = __le16_to_cpu(req->type); 4652 4653 BT_DBG("type 0x%4.4x", type); 4654 4655 if (type == L2CAP_IT_FEAT_MASK) { 4656 u8 buf[8]; 4657 u32 feat_mask = l2cap_feat_mask; 4658 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4659 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4660 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4661 if (!disable_ertm) 4662 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 4663 | L2CAP_FEAT_FCS; 4664 4665 put_unaligned_le32(feat_mask, rsp->data); 4666 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4667 buf); 4668 } else if (type == L2CAP_IT_FIXED_CHAN) { 4669 u8 buf[12]; 4670 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4671 4672 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4673 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4674 rsp->data[0] = conn->local_fixed_chan; 4675 memset(rsp->data + 1, 0, 7); 4676 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4677 buf); 4678 } else { 4679 struct l2cap_info_rsp rsp; 4680 rsp.type = cpu_to_le16(type); 4681 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP); 4682 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), 4683 &rsp); 4684 } 4685 4686 return 0; 4687 } 4688 4689 static inline int l2cap_information_rsp(struct l2cap_conn *conn, 4690 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4691 u8 *data) 4692 { 4693 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; 4694 u16 type, result; 4695 4696 if (cmd_len < sizeof(*rsp)) 4697 return -EPROTO; 4698 4699 type = __le16_to_cpu(rsp->type); 4700 result = __le16_to_cpu(rsp->result); 4701 4702 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result); 4703 4704 /* L2CAP Info req/rsp are unbound to channels, add extra checks */ 4705 if (cmd->ident != conn->info_ident || 4706 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 4707 return 0; 4708 4709 cancel_delayed_work(&conn->info_timer); 4710 4711 if (result != L2CAP_IR_SUCCESS) { 4712 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4713 conn->info_ident = 0; 4714 4715 l2cap_conn_start(conn); 4716 4717 return 0; 4718 } 4719 4720 switch (type) { 4721 case L2CAP_IT_FEAT_MASK: 4722 if (cmd_len >= sizeof(*rsp) + sizeof(u32)) 4723 conn->feat_mask = get_unaligned_le32(rsp->data); 4724 4725 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 4726 struct l2cap_info_req req; 4727 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4728 4729 conn->info_ident = l2cap_get_ident(conn); 4730 4731 l2cap_send_cmd(conn, conn->info_ident, 4732 L2CAP_INFO_REQ, sizeof(req), &req); 4733 } else { 4734 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4735 conn->info_ident = 0; 4736 4737 l2cap_conn_start(conn); 4738 } 4739 break; 4740 4741 case L2CAP_IT_FIXED_CHAN: 4742 if (cmd_len >= sizeof(*rsp) + sizeof(rsp->data[0])) 4743 conn->remote_fixed_chan = rsp->data[0]; 4744 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4745 conn->info_ident = 0; 4746 4747 l2cap_conn_start(conn); 4748 break; 4749 } 4750 4751 return 0; 4752 } 4753 4754 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 4755 struct l2cap_cmd_hdr *cmd, 4756 u16 cmd_len, u8 *data) 4757 { 4758 struct hci_conn *hcon = conn->hcon; 4759 struct l2cap_conn_param_update_req *req; 4760 struct l2cap_conn_param_update_rsp rsp; 4761 u16 min, max, latency, to_multiplier; 4762 int err; 4763 4764 if (hcon->role != HCI_ROLE_MASTER) 4765 return -EINVAL; 4766 4767 if (cmd_len != sizeof(struct l2cap_conn_param_update_req)) 4768 return -EPROTO; 4769 4770 req = (struct l2cap_conn_param_update_req *) data; 4771 min = __le16_to_cpu(req->min); 4772 max = __le16_to_cpu(req->max); 4773 latency = __le16_to_cpu(req->latency); 4774 to_multiplier = __le16_to_cpu(req->to_multiplier); 4775 4776 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x", 4777 min, max, latency, to_multiplier); 4778 4779 memset(&rsp, 0, sizeof(rsp)); 4780 4781 err = hci_check_conn_params(min, max, latency, to_multiplier); 4782 if (err) 4783 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 4784 else 4785 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 4786 4787 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 4788 sizeof(rsp), &rsp); 4789 4790 if (!err) 4791 hci_le_conn_update(hcon, min, max, latency, to_multiplier); 4792 4793 return 0; 4794 } 4795 4796 static int l2cap_le_connect_rsp(struct l2cap_conn *conn, 4797 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4798 u8 *data) 4799 { 4800 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data; 4801 struct hci_conn *hcon = conn->hcon; 4802 u16 dcid, mtu, mps, credits, result; 4803 struct l2cap_chan *chan; 4804 int err, sec_level; 4805 4806 if (cmd_len < sizeof(*rsp)) 4807 return -EPROTO; 4808 4809 dcid = __le16_to_cpu(rsp->dcid); 4810 mtu = __le16_to_cpu(rsp->mtu); 4811 mps = __le16_to_cpu(rsp->mps); 4812 credits = __le16_to_cpu(rsp->credits); 4813 result = __le16_to_cpu(rsp->result); 4814 4815 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 || 4816 dcid < L2CAP_CID_DYN_START || 4817 dcid > L2CAP_CID_LE_DYN_END)) 4818 return -EPROTO; 4819 4820 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", 4821 dcid, mtu, mps, credits, result); 4822 4823 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 4824 if (!chan) 4825 return -EBADSLT; 4826 4827 chan = l2cap_chan_hold_unless_zero(chan); 4828 if (!chan) 4829 return -EBADSLT; 4830 4831 err = 0; 4832 4833 l2cap_chan_lock(chan); 4834 4835 switch (result) { 4836 case L2CAP_CR_LE_SUCCESS: 4837 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 4838 err = -EBADSLT; 4839 break; 4840 } 4841 4842 chan->ident = 0; 4843 chan->dcid = dcid; 4844 chan->omtu = mtu; 4845 chan->remote_mps = mps; 4846 chan->tx_credits = credits; 4847 l2cap_chan_ready(chan); 4848 break; 4849 4850 case L2CAP_CR_LE_AUTHENTICATION: 4851 case L2CAP_CR_LE_ENCRYPTION: 4852 /* If we already have MITM protection we can't do 4853 * anything. 4854 */ 4855 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 4856 l2cap_chan_del(chan, ECONNREFUSED); 4857 break; 4858 } 4859 4860 sec_level = hcon->sec_level + 1; 4861 if (chan->sec_level < sec_level) 4862 chan->sec_level = sec_level; 4863 4864 /* We'll need to send a new Connect Request */ 4865 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags); 4866 4867 smp_conn_security(hcon, chan->sec_level); 4868 break; 4869 4870 default: 4871 l2cap_chan_del(chan, ECONNREFUSED); 4872 break; 4873 } 4874 4875 l2cap_chan_unlock(chan); 4876 l2cap_chan_put(chan); 4877 4878 return err; 4879 } 4880 4881 static void l2cap_put_ident(struct l2cap_conn *conn, u8 code, u8 id) 4882 { 4883 switch (code) { 4884 case L2CAP_COMMAND_REJ: 4885 case L2CAP_CONN_RSP: 4886 case L2CAP_CONF_RSP: 4887 case L2CAP_DISCONN_RSP: 4888 case L2CAP_ECHO_RSP: 4889 case L2CAP_INFO_RSP: 4890 case L2CAP_CONN_PARAM_UPDATE_RSP: 4891 case L2CAP_LE_CONN_RSP: 4892 case L2CAP_ECRED_CONN_RSP: 4893 case L2CAP_ECRED_RECONF_RSP: 4894 /* First do a lookup since the remote may send bogus ids that 4895 * would make ida_free to generate warnings. 4896 */ 4897 if (ida_find_first_range(&conn->tx_ida, id, id) >= 0) 4898 ida_free(&conn->tx_ida, id); 4899 } 4900 } 4901 4902 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, 4903 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4904 u8 *data) 4905 { 4906 int err = 0; 4907 4908 l2cap_put_ident(conn, cmd->code, cmd->ident); 4909 4910 switch (cmd->code) { 4911 case L2CAP_COMMAND_REJ: 4912 l2cap_command_rej(conn, cmd, cmd_len, data); 4913 break; 4914 4915 case L2CAP_CONN_REQ: 4916 err = l2cap_connect_req(conn, cmd, cmd_len, data); 4917 break; 4918 4919 case L2CAP_CONN_RSP: 4920 l2cap_connect_create_rsp(conn, cmd, cmd_len, data); 4921 break; 4922 4923 case L2CAP_CONF_REQ: 4924 err = l2cap_config_req(conn, cmd, cmd_len, data); 4925 break; 4926 4927 case L2CAP_CONF_RSP: 4928 l2cap_config_rsp(conn, cmd, cmd_len, data); 4929 break; 4930 4931 case L2CAP_DISCONN_REQ: 4932 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 4933 break; 4934 4935 case L2CAP_DISCONN_RSP: 4936 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 4937 break; 4938 4939 case L2CAP_ECHO_REQ: 4940 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data); 4941 break; 4942 4943 case L2CAP_ECHO_RSP: 4944 break; 4945 4946 case L2CAP_INFO_REQ: 4947 err = l2cap_information_req(conn, cmd, cmd_len, data); 4948 break; 4949 4950 case L2CAP_INFO_RSP: 4951 l2cap_information_rsp(conn, cmd, cmd_len, data); 4952 break; 4953 4954 default: 4955 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); 4956 err = -EINVAL; 4957 break; 4958 } 4959 4960 return err; 4961 } 4962 4963 static int l2cap_le_connect_req(struct l2cap_conn *conn, 4964 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4965 u8 *data) 4966 { 4967 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data; 4968 struct l2cap_le_conn_rsp rsp; 4969 struct l2cap_chan *chan, *pchan; 4970 u16 dcid, scid, credits, mtu, mps; 4971 __le16 psm; 4972 u8 result; 4973 4974 if (cmd_len != sizeof(*req)) 4975 return -EPROTO; 4976 4977 scid = __le16_to_cpu(req->scid); 4978 mtu = __le16_to_cpu(req->mtu); 4979 mps = __le16_to_cpu(req->mps); 4980 psm = req->psm; 4981 dcid = 0; 4982 credits = 0; 4983 4984 if (mtu < 23 || mps < 23) 4985 return -EPROTO; 4986 4987 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm), 4988 scid, mtu, mps); 4989 4990 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 4991 * page 1059: 4992 * 4993 * Valid range: 0x0001-0x00ff 4994 * 4995 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 4996 */ 4997 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 4998 result = L2CAP_CR_LE_BAD_PSM; 4999 chan = NULL; 5000 goto response; 5001 } 5002 5003 /* Check if we have socket listening on psm */ 5004 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5005 &conn->hcon->dst, LE_LINK); 5006 if (!pchan) { 5007 result = L2CAP_CR_LE_BAD_PSM; 5008 chan = NULL; 5009 goto response; 5010 } 5011 5012 l2cap_chan_lock(pchan); 5013 5014 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5015 SMP_ALLOW_STK)) { 5016 result = pchan->sec_level == BT_SECURITY_MEDIUM ? 5017 L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION; 5018 chan = NULL; 5019 goto response_unlock; 5020 } 5021 5022 /* Check if Key Size is sufficient for the security level */ 5023 if (!l2cap_check_enc_key_size(conn->hcon, pchan)) { 5024 result = L2CAP_CR_LE_BAD_KEY_SIZE; 5025 chan = NULL; 5026 goto response_unlock; 5027 } 5028 5029 /* Check for valid dynamic CID range */ 5030 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5031 result = L2CAP_CR_LE_INVALID_SCID; 5032 chan = NULL; 5033 goto response_unlock; 5034 } 5035 5036 /* Check if we already have channel with that dcid */ 5037 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5038 result = L2CAP_CR_LE_SCID_IN_USE; 5039 chan = NULL; 5040 goto response_unlock; 5041 } 5042 5043 chan = l2cap_new_connection(conn, pchan); 5044 if (!chan) { 5045 result = L2CAP_CR_LE_NO_MEM; 5046 goto response_unlock; 5047 } 5048 5049 bacpy(&chan->src, &conn->hcon->src); 5050 bacpy(&chan->dst, &conn->hcon->dst); 5051 chan->src_type = bdaddr_src_type(conn->hcon); 5052 chan->dst_type = bdaddr_dst_type(conn->hcon); 5053 chan->psm = psm; 5054 chan->dcid = scid; 5055 chan->omtu = mtu; 5056 chan->remote_mps = mps; 5057 5058 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits)); 5059 5060 dcid = chan->scid; 5061 credits = chan->rx_credits; 5062 5063 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 5064 5065 chan->ident = cmd->ident; 5066 5067 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 5068 l2cap_state_change(chan, BT_CONNECT2); 5069 /* The following result value is actually not defined 5070 * for LE CoC but we use it to let the function know 5071 * that it should bail out after doing its cleanup 5072 * instead of sending a response. 5073 */ 5074 result = L2CAP_CR_PEND; 5075 chan->ops->defer(chan); 5076 } else { 5077 l2cap_chan_ready(chan); 5078 result = L2CAP_CR_LE_SUCCESS; 5079 } 5080 5081 response_unlock: 5082 l2cap_chan_unlock(pchan); 5083 l2cap_chan_put(pchan); 5084 5085 if (result == L2CAP_CR_PEND) 5086 return 0; 5087 5088 response: 5089 if (chan) { 5090 rsp.mtu = cpu_to_le16(chan->imtu); 5091 rsp.mps = cpu_to_le16(chan->mps); 5092 } else { 5093 rsp.mtu = 0; 5094 rsp.mps = 0; 5095 } 5096 5097 rsp.dcid = cpu_to_le16(dcid); 5098 rsp.credits = cpu_to_le16(credits); 5099 rsp.result = cpu_to_le16(result); 5100 5101 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp); 5102 5103 return 0; 5104 } 5105 5106 static inline int l2cap_le_credits(struct l2cap_conn *conn, 5107 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5108 u8 *data) 5109 { 5110 struct l2cap_le_credits *pkt; 5111 struct l2cap_chan *chan; 5112 u16 cid, credits, max_credits; 5113 5114 if (cmd_len != sizeof(*pkt)) 5115 return -EPROTO; 5116 5117 pkt = (struct l2cap_le_credits *) data; 5118 cid = __le16_to_cpu(pkt->cid); 5119 credits = __le16_to_cpu(pkt->credits); 5120 5121 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits); 5122 5123 chan = l2cap_get_chan_by_dcid(conn, cid); 5124 if (!chan) 5125 return -EBADSLT; 5126 5127 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits; 5128 if (credits > max_credits) { 5129 BT_ERR("LE credits overflow"); 5130 l2cap_send_disconn_req(chan, ECONNRESET); 5131 5132 /* Return 0 so that we don't trigger an unnecessary 5133 * command reject packet. 5134 */ 5135 goto unlock; 5136 } 5137 5138 chan->tx_credits += credits; 5139 5140 /* Resume sending */ 5141 l2cap_le_flowctl_send(chan); 5142 5143 if (chan->tx_credits) 5144 chan->ops->resume(chan); 5145 5146 unlock: 5147 l2cap_chan_unlock(chan); 5148 l2cap_chan_put(chan); 5149 5150 return 0; 5151 } 5152 5153 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, 5154 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5155 u8 *data) 5156 { 5157 struct l2cap_ecred_conn_req *req = (void *) data; 5158 DEFINE_RAW_FLEX(struct l2cap_ecred_conn_rsp, pdu, dcid, L2CAP_ECRED_MAX_CID); 5159 struct l2cap_chan *chan, *pchan; 5160 u16 mtu, mps; 5161 __le16 psm; 5162 u8 result, rsp_len = 0; 5163 int i, num_scid = 0; 5164 bool defer = false; 5165 5166 if (!enable_ecred) 5167 return -EINVAL; 5168 5169 memset(pdu, 0, sizeof(*pdu)); 5170 5171 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) { 5172 result = L2CAP_CR_LE_INVALID_PARAMS; 5173 goto response; 5174 } 5175 5176 /* Check if there are no pending channels with the same ident */ 5177 __l2cap_chan_list_id(conn, cmd->ident, l2cap_ecred_list_defer, 5178 &num_scid); 5179 if (num_scid) { 5180 result = L2CAP_CR_LE_INVALID_PARAMS; 5181 goto response; 5182 } 5183 5184 cmd_len -= sizeof(*req); 5185 num_scid = cmd_len / sizeof(u16); 5186 5187 if (num_scid > L2CAP_ECRED_MAX_CID) { 5188 result = L2CAP_CR_LE_INVALID_PARAMS; 5189 goto response; 5190 } 5191 5192 /* Always respond with the same number of scids as in the request */ 5193 rsp_len = cmd_len; 5194 5195 mtu = __le16_to_cpu(req->mtu); 5196 mps = __le16_to_cpu(req->mps); 5197 5198 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) { 5199 result = L2CAP_CR_LE_INVALID_PARAMS; 5200 goto response; 5201 } 5202 5203 psm = req->psm; 5204 5205 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 5206 * page 1059: 5207 * 5208 * Valid range: 0x0001-0x00ff 5209 * 5210 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 5211 */ 5212 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 5213 result = L2CAP_CR_LE_BAD_PSM; 5214 goto response; 5215 } 5216 5217 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps); 5218 5219 /* Check if we have socket listening on psm */ 5220 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5221 &conn->hcon->dst, LE_LINK); 5222 if (!pchan) { 5223 result = L2CAP_CR_LE_BAD_PSM; 5224 goto response; 5225 } 5226 5227 l2cap_chan_lock(pchan); 5228 5229 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5230 SMP_ALLOW_STK)) { 5231 result = pchan->sec_level == BT_SECURITY_MEDIUM ? 5232 L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION; 5233 goto unlock; 5234 } 5235 5236 /* Check if the listening channel has set an output MTU then the 5237 * requested MTU shall be less than or equal to that value. 5238 */ 5239 if (pchan->omtu && mtu < pchan->omtu) { 5240 result = L2CAP_CR_LE_UNACCEPT_PARAMS; 5241 goto unlock; 5242 } 5243 5244 result = L2CAP_CR_LE_SUCCESS; 5245 5246 for (i = 0; i < num_scid; i++) { 5247 u16 scid = __le16_to_cpu(req->scid[i]); 5248 5249 BT_DBG("scid[%d] 0x%4.4x", i, scid); 5250 5251 pdu->dcid[i] = 0x0000; 5252 5253 /* Check for valid dynamic CID range */ 5254 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5255 result = L2CAP_CR_LE_INVALID_SCID; 5256 continue; 5257 } 5258 5259 /* Check if we already have channel with that dcid */ 5260 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5261 result = L2CAP_CR_LE_SCID_IN_USE; 5262 continue; 5263 } 5264 5265 chan = l2cap_new_connection(conn, pchan); 5266 if (!chan) { 5267 result = L2CAP_CR_LE_NO_MEM; 5268 continue; 5269 } 5270 5271 bacpy(&chan->src, &conn->hcon->src); 5272 bacpy(&chan->dst, &conn->hcon->dst); 5273 chan->src_type = bdaddr_src_type(conn->hcon); 5274 chan->dst_type = bdaddr_dst_type(conn->hcon); 5275 chan->psm = psm; 5276 chan->dcid = scid; 5277 chan->omtu = mtu; 5278 chan->remote_mps = mps; 5279 5280 l2cap_ecred_init(chan, __le16_to_cpu(req->credits)); 5281 5282 /* Init response */ 5283 if (!pdu->credits) { 5284 pdu->mtu = cpu_to_le16(chan->imtu); 5285 pdu->mps = cpu_to_le16(chan->mps); 5286 pdu->credits = cpu_to_le16(chan->rx_credits); 5287 } 5288 5289 pdu->dcid[i] = cpu_to_le16(chan->scid); 5290 5291 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 5292 5293 chan->ident = cmd->ident; 5294 chan->mode = L2CAP_MODE_EXT_FLOWCTL; 5295 5296 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 5297 l2cap_state_change(chan, BT_CONNECT2); 5298 defer = true; 5299 chan->ops->defer(chan); 5300 } else { 5301 l2cap_chan_ready(chan); 5302 } 5303 } 5304 5305 unlock: 5306 l2cap_chan_unlock(pchan); 5307 l2cap_chan_put(pchan); 5308 5309 response: 5310 pdu->result = cpu_to_le16(result); 5311 5312 if (defer) 5313 return 0; 5314 5315 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP, 5316 sizeof(*pdu) + rsp_len, pdu); 5317 5318 return 0; 5319 } 5320 5321 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 5322 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5323 u8 *data) 5324 { 5325 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 5326 struct hci_conn *hcon = conn->hcon; 5327 u16 mtu, mps, credits, result; 5328 struct l2cap_chan *chan, *tmp; 5329 int err = 0, sec_level; 5330 int i = 0; 5331 5332 if (cmd_len < sizeof(*rsp)) 5333 return -EPROTO; 5334 5335 mtu = __le16_to_cpu(rsp->mtu); 5336 mps = __le16_to_cpu(rsp->mps); 5337 credits = __le16_to_cpu(rsp->credits); 5338 result = __le16_to_cpu(rsp->result); 5339 5340 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits, 5341 result); 5342 5343 cmd_len -= sizeof(*rsp); 5344 5345 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 5346 struct l2cap_chan *orig; 5347 u16 dcid; 5348 5349 if (chan->ident != cmd->ident || 5350 chan->mode != L2CAP_MODE_EXT_FLOWCTL || 5351 chan->state == BT_CONNECTED) 5352 continue; 5353 5354 l2cap_chan_lock(chan); 5355 5356 /* Check that there is a dcid for each pending channel */ 5357 if (cmd_len < sizeof(dcid)) { 5358 l2cap_chan_del(chan, ECONNREFUSED); 5359 l2cap_chan_unlock(chan); 5360 continue; 5361 } 5362 5363 dcid = __le16_to_cpu(rsp->dcid[i++]); 5364 cmd_len -= sizeof(u16); 5365 5366 BT_DBG("dcid[%d] 0x%4.4x", i, dcid); 5367 5368 orig = __l2cap_get_chan_by_dcid(conn, dcid); 5369 5370 /* Check if dcid is already in use */ 5371 if (dcid && orig) { 5372 /* If a device receives a 5373 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an 5374 * already-assigned Destination CID, then both the 5375 * original channel and the new channel shall be 5376 * immediately discarded and not used. 5377 */ 5378 l2cap_chan_del(chan, ECONNREFUSED); 5379 l2cap_chan_unlock(chan); 5380 5381 /* Check that the dcid channel mode is 5382 * L2CAP_MODE_EXT_FLOWCTL since this procedure is only 5383 * valid for that mode and shouldn't disconnect a dcid 5384 * in other modes. 5385 */ 5386 if (orig->mode == L2CAP_MODE_EXT_FLOWCTL) { 5387 l2cap_chan_lock(orig); 5388 /* Disconnect the original channel as it may be 5389 * considered connected since dcid has already 5390 * been assigned; don't call l2cap_chan_close 5391 * directly since that could lead to 5392 * l2cap_chan_del and then removing the channel 5393 * from the list while we're iterating over it. 5394 */ 5395 __set_chan_timer(orig, 0); 5396 l2cap_chan_unlock(orig); 5397 } 5398 continue; 5399 } 5400 5401 switch (result) { 5402 case L2CAP_CR_LE_AUTHENTICATION: 5403 case L2CAP_CR_LE_ENCRYPTION: 5404 /* If we already have MITM protection we can't do 5405 * anything. 5406 */ 5407 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 5408 l2cap_chan_del(chan, ECONNREFUSED); 5409 break; 5410 } 5411 5412 sec_level = hcon->sec_level + 1; 5413 if (chan->sec_level < sec_level) 5414 chan->sec_level = sec_level; 5415 5416 /* We'll need to send a new Connect Request */ 5417 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags); 5418 5419 smp_conn_security(hcon, chan->sec_level); 5420 break; 5421 5422 case L2CAP_CR_LE_BAD_PSM: 5423 l2cap_chan_del(chan, ECONNREFUSED); 5424 break; 5425 5426 default: 5427 /* If dcid was not set it means channels was refused */ 5428 if (!dcid) { 5429 l2cap_chan_del(chan, ECONNREFUSED); 5430 break; 5431 } 5432 5433 chan->ident = 0; 5434 chan->dcid = dcid; 5435 chan->omtu = mtu; 5436 chan->remote_mps = mps; 5437 chan->tx_credits = credits; 5438 l2cap_chan_ready(chan); 5439 break; 5440 } 5441 5442 l2cap_chan_unlock(chan); 5443 } 5444 5445 return err; 5446 } 5447 5448 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn, 5449 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5450 u8 *data) 5451 { 5452 struct l2cap_ecred_reconf_req *req = (void *) data; 5453 struct l2cap_ecred_reconf_rsp rsp; 5454 u16 mtu, mps, result; 5455 struct l2cap_chan *chan[L2CAP_ECRED_MAX_CID] = {}; 5456 int i, num_scid; 5457 5458 if (!enable_ecred) 5459 return -EINVAL; 5460 5461 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) { 5462 result = L2CAP_RECONF_INVALID_CID; 5463 goto respond; 5464 } 5465 5466 mtu = __le16_to_cpu(req->mtu); 5467 mps = __le16_to_cpu(req->mps); 5468 5469 BT_DBG("mtu %u mps %u", mtu, mps); 5470 5471 if (mtu < L2CAP_ECRED_MIN_MTU) { 5472 result = L2CAP_RECONF_INVALID_PARAMS; 5473 goto respond; 5474 } 5475 5476 if (mps < L2CAP_ECRED_MIN_MPS) { 5477 result = L2CAP_RECONF_INVALID_PARAMS; 5478 goto respond; 5479 } 5480 5481 cmd_len -= sizeof(*req); 5482 num_scid = cmd_len / sizeof(u16); 5483 5484 if (num_scid > L2CAP_ECRED_MAX_CID) { 5485 result = L2CAP_RECONF_INVALID_PARAMS; 5486 goto respond; 5487 } 5488 5489 result = L2CAP_RECONF_SUCCESS; 5490 5491 /* Check if each SCID, MTU and MPS are valid */ 5492 for (i = 0; i < num_scid; i++) { 5493 u16 scid; 5494 5495 scid = __le16_to_cpu(req->scid[i]); 5496 if (!scid) { 5497 result = L2CAP_RECONF_INVALID_CID; 5498 goto respond; 5499 } 5500 5501 chan[i] = __l2cap_get_chan_by_dcid(conn, scid); 5502 if (!chan[i]) { 5503 result = L2CAP_RECONF_INVALID_CID; 5504 goto respond; 5505 } 5506 5507 /* The MTU field shall be greater than or equal to the greatest 5508 * current MTU size of these channels. 5509 */ 5510 if (chan[i]->omtu > mtu) { 5511 BT_ERR("chan %p decreased MTU %u -> %u", chan[i], 5512 chan[i]->omtu, mtu); 5513 result = L2CAP_RECONF_INVALID_MTU; 5514 goto respond; 5515 } 5516 5517 /* If more than one channel is being configured, the MPS field 5518 * shall be greater than or equal to the current MPS size of 5519 * each of these channels. If only one channel is being 5520 * configured, the MPS field may be less than the current MPS 5521 * of that channel. 5522 */ 5523 if (chan[i]->remote_mps > mps && num_scid > 1) { 5524 BT_ERR("chan %p decreased MPS %u -> %u", chan[i], 5525 chan[i]->remote_mps, mps); 5526 result = L2CAP_RECONF_INVALID_MPS; 5527 goto respond; 5528 } 5529 } 5530 5531 /* Commit the new MTU and MPS values after checking they are valid */ 5532 for (i = 0; i < num_scid; i++) { 5533 chan[i]->omtu = mtu; 5534 chan[i]->remote_mps = mps; 5535 } 5536 5537 respond: 5538 rsp.result = cpu_to_le16(result); 5539 5540 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp), 5541 &rsp); 5542 5543 return 0; 5544 } 5545 5546 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn, 5547 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5548 u8 *data) 5549 { 5550 struct l2cap_chan *chan, *tmp; 5551 struct l2cap_ecred_reconf_rsp *rsp = (void *)data; 5552 u16 result; 5553 5554 if (cmd_len < sizeof(*rsp)) 5555 return -EPROTO; 5556 5557 result = __le16_to_cpu(rsp->result); 5558 5559 BT_DBG("result 0x%4.4x", result); 5560 5561 if (!result) { 5562 list_for_each_entry(chan, &conn->chan_l, list) { 5563 if (chan->ident == cmd->ident) 5564 chan->ident = 0; 5565 } 5566 return 0; 5567 } 5568 5569 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 5570 if (chan->ident != cmd->ident) 5571 continue; 5572 5573 if (!l2cap_chan_hold_unless_zero(chan)) 5574 continue; 5575 l2cap_chan_lock(chan); 5576 5577 l2cap_chan_del(chan, ECONNRESET); 5578 5579 l2cap_chan_unlock(chan); 5580 l2cap_chan_put(chan); 5581 } 5582 5583 return 0; 5584 } 5585 5586 static inline int l2cap_le_command_rej(struct l2cap_conn *conn, 5587 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5588 u8 *data) 5589 { 5590 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 5591 struct l2cap_chan *chan; 5592 5593 if (cmd_len < sizeof(*rej)) 5594 return -EPROTO; 5595 5596 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 5597 if (!chan) 5598 goto done; 5599 5600 chan = l2cap_chan_hold_unless_zero(chan); 5601 if (!chan) 5602 goto done; 5603 5604 l2cap_chan_lock(chan); 5605 l2cap_chan_del(chan, ECONNREFUSED); 5606 l2cap_chan_unlock(chan); 5607 l2cap_chan_put(chan); 5608 5609 done: 5610 return 0; 5611 } 5612 5613 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn, 5614 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5615 u8 *data) 5616 { 5617 int err = 0; 5618 5619 l2cap_put_ident(conn, cmd->code, cmd->ident); 5620 5621 switch (cmd->code) { 5622 case L2CAP_COMMAND_REJ: 5623 l2cap_le_command_rej(conn, cmd, cmd_len, data); 5624 break; 5625 5626 case L2CAP_CONN_PARAM_UPDATE_REQ: 5627 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data); 5628 break; 5629 5630 case L2CAP_CONN_PARAM_UPDATE_RSP: 5631 break; 5632 5633 case L2CAP_LE_CONN_RSP: 5634 l2cap_le_connect_rsp(conn, cmd, cmd_len, data); 5635 break; 5636 5637 case L2CAP_LE_CONN_REQ: 5638 err = l2cap_le_connect_req(conn, cmd, cmd_len, data); 5639 break; 5640 5641 case L2CAP_LE_CREDITS: 5642 err = l2cap_le_credits(conn, cmd, cmd_len, data); 5643 break; 5644 5645 case L2CAP_ECRED_CONN_REQ: 5646 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data); 5647 break; 5648 5649 case L2CAP_ECRED_CONN_RSP: 5650 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data); 5651 break; 5652 5653 case L2CAP_ECRED_RECONF_REQ: 5654 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data); 5655 break; 5656 5657 case L2CAP_ECRED_RECONF_RSP: 5658 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data); 5659 break; 5660 5661 case L2CAP_DISCONN_REQ: 5662 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 5663 break; 5664 5665 case L2CAP_DISCONN_RSP: 5666 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 5667 break; 5668 5669 default: 5670 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code); 5671 err = -EINVAL; 5672 break; 5673 } 5674 5675 return err; 5676 } 5677 5678 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, 5679 struct sk_buff *skb) 5680 { 5681 struct hci_conn *hcon = conn->hcon; 5682 struct l2cap_cmd_hdr *cmd; 5683 u16 len; 5684 int err; 5685 5686 if (hcon->type != LE_LINK) 5687 goto drop; 5688 5689 if (skb->len < L2CAP_CMD_HDR_SIZE) 5690 goto drop; 5691 5692 cmd = (void *) skb->data; 5693 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 5694 5695 len = le16_to_cpu(cmd->len); 5696 5697 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident); 5698 5699 if (len != skb->len || !cmd->ident) { 5700 BT_DBG("corrupted command"); 5701 goto drop; 5702 } 5703 5704 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data); 5705 if (err) { 5706 struct l2cap_cmd_rej_unk rej; 5707 5708 BT_ERR("Wrong link type (%d)", err); 5709 5710 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 5711 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 5712 sizeof(rej), &rej); 5713 } 5714 5715 drop: 5716 kfree_skb(skb); 5717 } 5718 5719 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident) 5720 { 5721 struct l2cap_cmd_rej_unk rej; 5722 5723 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 5724 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 5725 } 5726 5727 static inline void l2cap_sig_send_mtu_rej(struct l2cap_conn *conn, u8 ident) 5728 { 5729 struct l2cap_cmd_rej_mtu rej; 5730 5731 rej.reason = cpu_to_le16(L2CAP_REJ_MTU_EXCEEDED); 5732 rej.max_mtu = cpu_to_le16(L2CAP_SIG_MTU); 5733 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 5734 } 5735 5736 static inline void l2cap_sig_channel(struct l2cap_conn *conn, 5737 struct sk_buff *skb) 5738 { 5739 struct hci_conn *hcon = conn->hcon; 5740 struct l2cap_cmd_hdr *cmd; 5741 int err; 5742 5743 l2cap_raw_recv(conn, skb); 5744 5745 if (hcon->type != ACL_LINK) 5746 goto drop; 5747 5748 /* 5749 * Bluetooth Core v5.4, Vol 3, Part A, Section 4: the BR/EDR 5750 * signaling channel has a fixed signaling MTU (MTUsig) whose 5751 * minimum and default is 48 octets. Section 4.1 says that on 5752 * an MTUExceeded command reject the identifier "shall match 5753 * the first request command in the L2CAP packet" and that 5754 * packets containing only response commands "shall be 5755 * silently discarded". 5756 * 5757 * Linux intentionally deviates from that prescription: 5758 * 5759 * 1. Silently discarding desynchronizes the peer. The 5760 * remote stack never learns its responses were dropped, 5761 * so any state machine waiting on a paired response 5762 * stalls until its own timer fires. 5763 * 5764 * 2. Locating "the first request command" requires walking 5765 * command headers past MTUsig, i.e. processing bytes 5766 * from a packet we have already decided is too large to 5767 * process. 5768 * 5769 * Reject every over-MTUsig signaling packet with one 5770 * L2CAP_REJ_MTU_EXCEEDED command reject. The reject's 5771 * reason field is what tells the peer that the whole packet 5772 * was discarded; the identifier value is informational, so 5773 * we use the identifier from the first command header, a 5774 * single fixed-offset byte read. 5775 */ 5776 if (skb->len > L2CAP_SIG_MTU) { 5777 u8 ident = skb->data[1]; 5778 5779 BT_DBG("signaling packet exceeds MTU: %u > %u", 5780 skb->len, L2CAP_SIG_MTU); 5781 l2cap_sig_send_mtu_rej(conn, ident); 5782 goto drop; 5783 } 5784 5785 while (skb->len >= L2CAP_CMD_HDR_SIZE) { 5786 u16 len; 5787 5788 cmd = (void *) skb->data; 5789 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 5790 5791 len = le16_to_cpu(cmd->len); 5792 5793 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, 5794 cmd->ident); 5795 5796 if (len > skb->len || !cmd->ident) { 5797 BT_DBG("corrupted command"); 5798 l2cap_sig_send_rej(conn, cmd->ident); 5799 skb_pull(skb, len > skb->len ? skb->len : len); 5800 continue; 5801 } 5802 5803 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); 5804 if (err) { 5805 BT_ERR("Wrong link type (%d)", err); 5806 l2cap_sig_send_rej(conn, cmd->ident); 5807 } 5808 5809 skb_pull(skb, len); 5810 } 5811 5812 if (skb->len > 0) { 5813 BT_DBG("corrupted command"); 5814 l2cap_sig_send_rej(conn, 0); 5815 } 5816 5817 drop: 5818 kfree_skb(skb); 5819 } 5820 5821 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb) 5822 { 5823 u16 our_fcs, rcv_fcs; 5824 int hdr_size; 5825 5826 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 5827 hdr_size = L2CAP_EXT_HDR_SIZE; 5828 else 5829 hdr_size = L2CAP_ENH_HDR_SIZE; 5830 5831 if (chan->fcs == L2CAP_FCS_CRC16) { 5832 skb_trim(skb, skb->len - L2CAP_FCS_SIZE); 5833 rcv_fcs = get_unaligned_le16(skb->data + skb->len); 5834 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size); 5835 5836 if (our_fcs != rcv_fcs) 5837 return -EBADMSG; 5838 } 5839 return 0; 5840 } 5841 5842 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan) 5843 { 5844 struct l2cap_ctrl control; 5845 5846 BT_DBG("chan %p", chan); 5847 5848 memset(&control, 0, sizeof(control)); 5849 control.sframe = 1; 5850 control.final = 1; 5851 control.reqseq = chan->buffer_seq; 5852 set_bit(CONN_SEND_FBIT, &chan->conn_state); 5853 5854 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5855 control.super = L2CAP_SUPER_RNR; 5856 l2cap_send_sframe(chan, &control); 5857 } 5858 5859 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 5860 chan->unacked_frames > 0) 5861 __set_retrans_timer(chan); 5862 5863 /* Send pending iframes */ 5864 l2cap_ertm_send(chan); 5865 5866 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 5867 test_bit(CONN_SEND_FBIT, &chan->conn_state)) { 5868 /* F-bit wasn't sent in an s-frame or i-frame yet, so 5869 * send it now. 5870 */ 5871 control.super = L2CAP_SUPER_RR; 5872 l2cap_send_sframe(chan, &control); 5873 } 5874 } 5875 5876 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag, 5877 struct sk_buff **last_frag) 5878 { 5879 /* skb->len reflects data in skb as well as all fragments 5880 * skb->data_len reflects only data in fragments 5881 */ 5882 if (!skb_has_frag_list(skb)) 5883 skb_shinfo(skb)->frag_list = new_frag; 5884 5885 new_frag->next = NULL; 5886 5887 (*last_frag)->next = new_frag; 5888 *last_frag = new_frag; 5889 5890 skb->len += new_frag->len; 5891 skb->data_len += new_frag->len; 5892 skb->truesize += new_frag->truesize; 5893 } 5894 5895 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, 5896 struct l2cap_ctrl *control) 5897 { 5898 int err = -EINVAL; 5899 5900 switch (control->sar) { 5901 case L2CAP_SAR_UNSEGMENTED: 5902 if (chan->sdu) 5903 break; 5904 5905 err = chan->ops->recv(chan, skb); 5906 break; 5907 5908 case L2CAP_SAR_START: 5909 if (chan->sdu) 5910 break; 5911 5912 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) 5913 break; 5914 5915 chan->sdu_len = get_unaligned_le16(skb->data); 5916 skb_pull(skb, L2CAP_SDULEN_SIZE); 5917 5918 if (chan->sdu_len > chan->imtu) { 5919 err = -EMSGSIZE; 5920 break; 5921 } 5922 5923 if (skb->len >= chan->sdu_len) 5924 break; 5925 5926 chan->sdu = skb; 5927 chan->sdu_last_frag = skb; 5928 5929 skb = NULL; 5930 err = 0; 5931 break; 5932 5933 case L2CAP_SAR_CONTINUE: 5934 if (!chan->sdu) 5935 break; 5936 5937 append_skb_frag(chan->sdu, skb, 5938 &chan->sdu_last_frag); 5939 skb = NULL; 5940 5941 if (chan->sdu->len >= chan->sdu_len) 5942 break; 5943 5944 err = 0; 5945 break; 5946 5947 case L2CAP_SAR_END: 5948 if (!chan->sdu) 5949 break; 5950 5951 append_skb_frag(chan->sdu, skb, 5952 &chan->sdu_last_frag); 5953 skb = NULL; 5954 5955 if (chan->sdu->len != chan->sdu_len) 5956 break; 5957 5958 err = chan->ops->recv(chan, chan->sdu); 5959 5960 if (!err) { 5961 /* Reassembly complete */ 5962 chan->sdu = NULL; 5963 chan->sdu_last_frag = NULL; 5964 chan->sdu_len = 0; 5965 } 5966 break; 5967 } 5968 5969 if (err) { 5970 kfree_skb(skb); 5971 kfree_skb(chan->sdu); 5972 chan->sdu = NULL; 5973 chan->sdu_last_frag = NULL; 5974 chan->sdu_len = 0; 5975 } 5976 5977 return err; 5978 } 5979 5980 static int l2cap_resegment(struct l2cap_chan *chan) 5981 { 5982 /* Placeholder */ 5983 return 0; 5984 } 5985 5986 void l2cap_chan_busy(struct l2cap_chan *chan, int busy) 5987 { 5988 u8 event; 5989 5990 if (chan->mode != L2CAP_MODE_ERTM) 5991 return; 5992 5993 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR; 5994 l2cap_tx(chan, NULL, NULL, event); 5995 } 5996 5997 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan) 5998 { 5999 int err = 0; 6000 /* Pass sequential frames to l2cap_reassemble_sdu() 6001 * until a gap is encountered. 6002 */ 6003 6004 BT_DBG("chan %p", chan); 6005 6006 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6007 struct sk_buff *skb; 6008 BT_DBG("Searching for skb with txseq %d (queue len %d)", 6009 chan->buffer_seq, skb_queue_len(&chan->srej_q)); 6010 6011 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq); 6012 6013 if (!skb) 6014 break; 6015 6016 skb_unlink(skb, &chan->srej_q); 6017 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 6018 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap); 6019 if (err) 6020 break; 6021 } 6022 6023 if (skb_queue_empty(&chan->srej_q)) { 6024 chan->rx_state = L2CAP_RX_STATE_RECV; 6025 l2cap_send_ack(chan); 6026 } 6027 6028 return err; 6029 } 6030 6031 static void l2cap_handle_srej(struct l2cap_chan *chan, 6032 struct l2cap_ctrl *control) 6033 { 6034 struct sk_buff *skb; 6035 6036 BT_DBG("chan %p, control %p", chan, control); 6037 6038 if (control->reqseq == chan->next_tx_seq) { 6039 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6040 l2cap_send_disconn_req(chan, ECONNRESET); 6041 return; 6042 } 6043 6044 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6045 6046 if (skb == NULL) { 6047 BT_DBG("Seq %d not available for retransmission", 6048 control->reqseq); 6049 return; 6050 } 6051 6052 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6053 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6054 l2cap_send_disconn_req(chan, ECONNRESET); 6055 return; 6056 } 6057 6058 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6059 6060 if (control->poll) { 6061 l2cap_pass_to_tx(chan, control); 6062 6063 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6064 l2cap_retransmit(chan, control); 6065 l2cap_ertm_send(chan); 6066 6067 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6068 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6069 chan->srej_save_reqseq = control->reqseq; 6070 } 6071 } else { 6072 l2cap_pass_to_tx_fbit(chan, control); 6073 6074 if (control->final) { 6075 if (chan->srej_save_reqseq != control->reqseq || 6076 !test_and_clear_bit(CONN_SREJ_ACT, 6077 &chan->conn_state)) 6078 l2cap_retransmit(chan, control); 6079 } else { 6080 l2cap_retransmit(chan, control); 6081 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6082 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6083 chan->srej_save_reqseq = control->reqseq; 6084 } 6085 } 6086 } 6087 } 6088 6089 static void l2cap_handle_rej(struct l2cap_chan *chan, 6090 struct l2cap_ctrl *control) 6091 { 6092 struct sk_buff *skb; 6093 6094 BT_DBG("chan %p, control %p", chan, control); 6095 6096 if (control->reqseq == chan->next_tx_seq) { 6097 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6098 l2cap_send_disconn_req(chan, ECONNRESET); 6099 return; 6100 } 6101 6102 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6103 6104 if (chan->max_tx && skb && 6105 bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6106 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6107 l2cap_send_disconn_req(chan, ECONNRESET); 6108 return; 6109 } 6110 6111 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6112 6113 l2cap_pass_to_tx(chan, control); 6114 6115 if (control->final) { 6116 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 6117 l2cap_retransmit_all(chan, control); 6118 } else { 6119 l2cap_retransmit_all(chan, control); 6120 l2cap_ertm_send(chan); 6121 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) 6122 set_bit(CONN_REJ_ACT, &chan->conn_state); 6123 } 6124 } 6125 6126 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq) 6127 { 6128 BT_DBG("chan %p, txseq %d", chan, txseq); 6129 6130 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq, 6131 chan->expected_tx_seq); 6132 6133 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 6134 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6135 chan->tx_win) { 6136 /* See notes below regarding "double poll" and 6137 * invalid packets. 6138 */ 6139 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6140 BT_DBG("Invalid/Ignore - after SREJ"); 6141 return L2CAP_TXSEQ_INVALID_IGNORE; 6142 } else { 6143 BT_DBG("Invalid - in window after SREJ sent"); 6144 return L2CAP_TXSEQ_INVALID; 6145 } 6146 } 6147 6148 if (chan->srej_list.head == txseq) { 6149 BT_DBG("Expected SREJ"); 6150 return L2CAP_TXSEQ_EXPECTED_SREJ; 6151 } 6152 6153 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) { 6154 BT_DBG("Duplicate SREJ - txseq already stored"); 6155 return L2CAP_TXSEQ_DUPLICATE_SREJ; 6156 } 6157 6158 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) { 6159 BT_DBG("Unexpected SREJ - not requested"); 6160 return L2CAP_TXSEQ_UNEXPECTED_SREJ; 6161 } 6162 } 6163 6164 if (chan->expected_tx_seq == txseq) { 6165 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6166 chan->tx_win) { 6167 BT_DBG("Invalid - txseq outside tx window"); 6168 return L2CAP_TXSEQ_INVALID; 6169 } else { 6170 BT_DBG("Expected"); 6171 return L2CAP_TXSEQ_EXPECTED; 6172 } 6173 } 6174 6175 if (__seq_offset(chan, txseq, chan->last_acked_seq) < 6176 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) { 6177 BT_DBG("Duplicate - expected_tx_seq later than txseq"); 6178 return L2CAP_TXSEQ_DUPLICATE; 6179 } 6180 6181 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) { 6182 /* A source of invalid packets is a "double poll" condition, 6183 * where delays cause us to send multiple poll packets. If 6184 * the remote stack receives and processes both polls, 6185 * sequence numbers can wrap around in such a way that a 6186 * resent frame has a sequence number that looks like new data 6187 * with a sequence gap. This would trigger an erroneous SREJ 6188 * request. 6189 * 6190 * Fortunately, this is impossible with a tx window that's 6191 * less than half of the maximum sequence number, which allows 6192 * invalid frames to be safely ignored. 6193 * 6194 * With tx window sizes greater than half of the tx window 6195 * maximum, the frame is invalid and cannot be ignored. This 6196 * causes a disconnect. 6197 */ 6198 6199 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6200 BT_DBG("Invalid/Ignore - txseq outside tx window"); 6201 return L2CAP_TXSEQ_INVALID_IGNORE; 6202 } else { 6203 BT_DBG("Invalid - txseq outside tx window"); 6204 return L2CAP_TXSEQ_INVALID; 6205 } 6206 } else { 6207 BT_DBG("Unexpected - txseq indicates missing frames"); 6208 return L2CAP_TXSEQ_UNEXPECTED; 6209 } 6210 } 6211 6212 static int l2cap_rx_state_recv(struct l2cap_chan *chan, 6213 struct l2cap_ctrl *control, 6214 struct sk_buff *skb, u8 event) 6215 { 6216 struct l2cap_ctrl local_control; 6217 int err = 0; 6218 bool skb_in_use = false; 6219 6220 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6221 event); 6222 6223 switch (event) { 6224 case L2CAP_EV_RECV_IFRAME: 6225 switch (l2cap_classify_txseq(chan, control->txseq)) { 6226 case L2CAP_TXSEQ_EXPECTED: 6227 l2cap_pass_to_tx(chan, control); 6228 6229 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6230 BT_DBG("Busy, discarding expected seq %d", 6231 control->txseq); 6232 break; 6233 } 6234 6235 chan->expected_tx_seq = __next_seq(chan, 6236 control->txseq); 6237 6238 chan->buffer_seq = chan->expected_tx_seq; 6239 skb_in_use = true; 6240 6241 /* l2cap_reassemble_sdu may free skb, hence invalidate 6242 * control, so make a copy in advance to use it after 6243 * l2cap_reassemble_sdu returns and to avoid the race 6244 * condition, for example: 6245 * 6246 * The current thread calls: 6247 * l2cap_reassemble_sdu 6248 * chan->ops->recv == l2cap_sock_recv_cb 6249 * __sock_queue_rcv_skb 6250 * Another thread calls: 6251 * bt_sock_recvmsg 6252 * skb_recv_datagram 6253 * skb_free_datagram 6254 * Then the current thread tries to access control, but 6255 * it was freed by skb_free_datagram. 6256 */ 6257 local_control = *control; 6258 err = l2cap_reassemble_sdu(chan, skb, control); 6259 if (err) 6260 break; 6261 6262 if (local_control.final) { 6263 if (!test_and_clear_bit(CONN_REJ_ACT, 6264 &chan->conn_state)) { 6265 local_control.final = 0; 6266 l2cap_retransmit_all(chan, &local_control); 6267 l2cap_ertm_send(chan); 6268 } 6269 } 6270 6271 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 6272 l2cap_send_ack(chan); 6273 break; 6274 case L2CAP_TXSEQ_UNEXPECTED: 6275 l2cap_pass_to_tx(chan, control); 6276 6277 /* Can't issue SREJ frames in the local busy state. 6278 * Drop this frame, it will be seen as missing 6279 * when local busy is exited. 6280 */ 6281 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6282 BT_DBG("Busy, discarding unexpected seq %d", 6283 control->txseq); 6284 break; 6285 } 6286 6287 /* There was a gap in the sequence, so an SREJ 6288 * must be sent for each missing frame. The 6289 * current frame is stored for later use. 6290 */ 6291 skb_queue_tail(&chan->srej_q, skb); 6292 skb_in_use = true; 6293 BT_DBG("Queued %p (queue len %d)", skb, 6294 skb_queue_len(&chan->srej_q)); 6295 6296 clear_bit(CONN_SREJ_ACT, &chan->conn_state); 6297 l2cap_seq_list_clear(&chan->srej_list); 6298 l2cap_send_srej(chan, control->txseq); 6299 6300 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT; 6301 break; 6302 case L2CAP_TXSEQ_DUPLICATE: 6303 l2cap_pass_to_tx(chan, control); 6304 break; 6305 case L2CAP_TXSEQ_INVALID_IGNORE: 6306 break; 6307 case L2CAP_TXSEQ_INVALID: 6308 default: 6309 l2cap_send_disconn_req(chan, ECONNRESET); 6310 break; 6311 } 6312 break; 6313 case L2CAP_EV_RECV_RR: 6314 l2cap_pass_to_tx(chan, control); 6315 if (control->final) { 6316 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6317 6318 if (!test_and_clear_bit(CONN_REJ_ACT, 6319 &chan->conn_state)) { 6320 control->final = 0; 6321 l2cap_retransmit_all(chan, control); 6322 } 6323 6324 l2cap_ertm_send(chan); 6325 } else if (control->poll) { 6326 l2cap_send_i_or_rr_or_rnr(chan); 6327 } else { 6328 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6329 &chan->conn_state) && 6330 chan->unacked_frames) 6331 __set_retrans_timer(chan); 6332 6333 l2cap_ertm_send(chan); 6334 } 6335 break; 6336 case L2CAP_EV_RECV_RNR: 6337 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6338 l2cap_pass_to_tx(chan, control); 6339 if (control && control->poll) { 6340 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6341 l2cap_send_rr_or_rnr(chan, 0); 6342 } 6343 __clear_retrans_timer(chan); 6344 l2cap_seq_list_clear(&chan->retrans_list); 6345 break; 6346 case L2CAP_EV_RECV_REJ: 6347 l2cap_handle_rej(chan, control); 6348 break; 6349 case L2CAP_EV_RECV_SREJ: 6350 l2cap_handle_srej(chan, control); 6351 break; 6352 default: 6353 break; 6354 } 6355 6356 if (skb && !skb_in_use) { 6357 BT_DBG("Freeing %p", skb); 6358 kfree_skb(skb); 6359 } 6360 6361 return err; 6362 } 6363 6364 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan, 6365 struct l2cap_ctrl *control, 6366 struct sk_buff *skb, u8 event) 6367 { 6368 int err = 0; 6369 u16 txseq = control->txseq; 6370 bool skb_in_use = false; 6371 6372 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6373 event); 6374 6375 switch (event) { 6376 case L2CAP_EV_RECV_IFRAME: 6377 switch (l2cap_classify_txseq(chan, txseq)) { 6378 case L2CAP_TXSEQ_EXPECTED: 6379 /* Keep frame for reassembly later */ 6380 l2cap_pass_to_tx(chan, control); 6381 skb_queue_tail(&chan->srej_q, skb); 6382 skb_in_use = true; 6383 BT_DBG("Queued %p (queue len %d)", skb, 6384 skb_queue_len(&chan->srej_q)); 6385 6386 chan->expected_tx_seq = __next_seq(chan, txseq); 6387 break; 6388 case L2CAP_TXSEQ_EXPECTED_SREJ: 6389 l2cap_seq_list_pop(&chan->srej_list); 6390 6391 l2cap_pass_to_tx(chan, control); 6392 skb_queue_tail(&chan->srej_q, skb); 6393 skb_in_use = true; 6394 BT_DBG("Queued %p (queue len %d)", skb, 6395 skb_queue_len(&chan->srej_q)); 6396 6397 err = l2cap_rx_queued_iframes(chan); 6398 if (err) 6399 break; 6400 6401 break; 6402 case L2CAP_TXSEQ_UNEXPECTED: 6403 /* Got a frame that can't be reassembled yet. 6404 * Save it for later, and send SREJs to cover 6405 * the missing frames. 6406 */ 6407 skb_queue_tail(&chan->srej_q, skb); 6408 skb_in_use = true; 6409 BT_DBG("Queued %p (queue len %d)", skb, 6410 skb_queue_len(&chan->srej_q)); 6411 6412 l2cap_pass_to_tx(chan, control); 6413 l2cap_send_srej(chan, control->txseq); 6414 break; 6415 case L2CAP_TXSEQ_UNEXPECTED_SREJ: 6416 /* This frame was requested with an SREJ, but 6417 * some expected retransmitted frames are 6418 * missing. Request retransmission of missing 6419 * SREJ'd frames. 6420 */ 6421 skb_queue_tail(&chan->srej_q, skb); 6422 skb_in_use = true; 6423 BT_DBG("Queued %p (queue len %d)", skb, 6424 skb_queue_len(&chan->srej_q)); 6425 6426 l2cap_pass_to_tx(chan, control); 6427 l2cap_send_srej_list(chan, control->txseq); 6428 break; 6429 case L2CAP_TXSEQ_DUPLICATE_SREJ: 6430 /* We've already queued this frame. Drop this copy. */ 6431 l2cap_pass_to_tx(chan, control); 6432 break; 6433 case L2CAP_TXSEQ_DUPLICATE: 6434 /* Expecting a later sequence number, so this frame 6435 * was already received. Ignore it completely. 6436 */ 6437 break; 6438 case L2CAP_TXSEQ_INVALID_IGNORE: 6439 break; 6440 case L2CAP_TXSEQ_INVALID: 6441 default: 6442 l2cap_send_disconn_req(chan, ECONNRESET); 6443 break; 6444 } 6445 break; 6446 case L2CAP_EV_RECV_RR: 6447 l2cap_pass_to_tx(chan, control); 6448 if (control->final) { 6449 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6450 6451 if (!test_and_clear_bit(CONN_REJ_ACT, 6452 &chan->conn_state)) { 6453 control->final = 0; 6454 l2cap_retransmit_all(chan, control); 6455 } 6456 6457 l2cap_ertm_send(chan); 6458 } else if (control->poll) { 6459 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6460 &chan->conn_state) && 6461 chan->unacked_frames) { 6462 __set_retrans_timer(chan); 6463 } 6464 6465 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6466 l2cap_send_srej_tail(chan); 6467 } else { 6468 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6469 &chan->conn_state) && 6470 chan->unacked_frames) 6471 __set_retrans_timer(chan); 6472 6473 l2cap_send_ack(chan); 6474 } 6475 break; 6476 case L2CAP_EV_RECV_RNR: 6477 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6478 l2cap_pass_to_tx(chan, control); 6479 if (control->poll) { 6480 l2cap_send_srej_tail(chan); 6481 } else { 6482 struct l2cap_ctrl rr_control; 6483 memset(&rr_control, 0, sizeof(rr_control)); 6484 rr_control.sframe = 1; 6485 rr_control.super = L2CAP_SUPER_RR; 6486 rr_control.reqseq = chan->buffer_seq; 6487 l2cap_send_sframe(chan, &rr_control); 6488 } 6489 6490 break; 6491 case L2CAP_EV_RECV_REJ: 6492 l2cap_handle_rej(chan, control); 6493 break; 6494 case L2CAP_EV_RECV_SREJ: 6495 l2cap_handle_srej(chan, control); 6496 break; 6497 } 6498 6499 if (skb && !skb_in_use) { 6500 BT_DBG("Freeing %p", skb); 6501 kfree_skb(skb); 6502 } 6503 6504 return err; 6505 } 6506 6507 static int l2cap_finish_move(struct l2cap_chan *chan) 6508 { 6509 BT_DBG("chan %p", chan); 6510 6511 chan->rx_state = L2CAP_RX_STATE_RECV; 6512 chan->conn->mtu = chan->conn->hcon->mtu; 6513 6514 return l2cap_resegment(chan); 6515 } 6516 6517 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan, 6518 struct l2cap_ctrl *control, 6519 struct sk_buff *skb, u8 event) 6520 { 6521 int err; 6522 6523 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6524 event); 6525 6526 if (!control->poll) 6527 return -EPROTO; 6528 6529 l2cap_process_reqseq(chan, control->reqseq); 6530 6531 if (!skb_queue_empty(&chan->tx_q)) 6532 chan->tx_send_head = skb_peek(&chan->tx_q); 6533 else 6534 chan->tx_send_head = NULL; 6535 6536 /* Rewind next_tx_seq to the point expected 6537 * by the receiver. 6538 */ 6539 chan->next_tx_seq = control->reqseq; 6540 chan->unacked_frames = 0; 6541 6542 err = l2cap_finish_move(chan); 6543 if (err) 6544 return err; 6545 6546 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6547 l2cap_send_i_or_rr_or_rnr(chan); 6548 6549 if (event == L2CAP_EV_RECV_IFRAME) 6550 return -EPROTO; 6551 6552 return l2cap_rx_state_recv(chan, control, NULL, event); 6553 } 6554 6555 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, 6556 struct l2cap_ctrl *control, 6557 struct sk_buff *skb, u8 event) 6558 { 6559 int err; 6560 6561 if (!control->final) 6562 return -EPROTO; 6563 6564 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6565 6566 chan->rx_state = L2CAP_RX_STATE_RECV; 6567 l2cap_process_reqseq(chan, control->reqseq); 6568 6569 if (!skb_queue_empty(&chan->tx_q)) 6570 chan->tx_send_head = skb_peek(&chan->tx_q); 6571 else 6572 chan->tx_send_head = NULL; 6573 6574 /* Rewind next_tx_seq to the point expected 6575 * by the receiver. 6576 */ 6577 chan->next_tx_seq = control->reqseq; 6578 chan->unacked_frames = 0; 6579 chan->conn->mtu = chan->conn->hcon->mtu; 6580 6581 err = l2cap_resegment(chan); 6582 6583 if (!err) 6584 err = l2cap_rx_state_recv(chan, control, skb, event); 6585 6586 return err; 6587 } 6588 6589 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq) 6590 { 6591 /* Make sure reqseq is for a packet that has been sent but not acked */ 6592 u16 unacked; 6593 6594 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq); 6595 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked; 6596 } 6597 6598 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 6599 struct sk_buff *skb, u8 event) 6600 { 6601 int err = 0; 6602 6603 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan, 6604 control, skb, event, chan->rx_state); 6605 6606 if (__valid_reqseq(chan, control->reqseq)) { 6607 switch (chan->rx_state) { 6608 case L2CAP_RX_STATE_RECV: 6609 err = l2cap_rx_state_recv(chan, control, skb, event); 6610 break; 6611 case L2CAP_RX_STATE_SREJ_SENT: 6612 err = l2cap_rx_state_srej_sent(chan, control, skb, 6613 event); 6614 break; 6615 case L2CAP_RX_STATE_WAIT_P: 6616 err = l2cap_rx_state_wait_p(chan, control, skb, event); 6617 break; 6618 case L2CAP_RX_STATE_WAIT_F: 6619 err = l2cap_rx_state_wait_f(chan, control, skb, event); 6620 break; 6621 default: 6622 /* shut it down */ 6623 break; 6624 } 6625 } else { 6626 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d", 6627 control->reqseq, chan->next_tx_seq, 6628 chan->expected_ack_seq); 6629 l2cap_send_disconn_req(chan, ECONNRESET); 6630 } 6631 6632 return err; 6633 } 6634 6635 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 6636 struct sk_buff *skb) 6637 { 6638 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store 6639 * the txseq field in advance to use it after l2cap_reassemble_sdu 6640 * returns and to avoid the race condition, for example: 6641 * 6642 * The current thread calls: 6643 * l2cap_reassemble_sdu 6644 * chan->ops->recv == l2cap_sock_recv_cb 6645 * __sock_queue_rcv_skb 6646 * Another thread calls: 6647 * bt_sock_recvmsg 6648 * skb_recv_datagram 6649 * skb_free_datagram 6650 * Then the current thread tries to access control, but it was freed by 6651 * skb_free_datagram. 6652 */ 6653 u16 txseq = control->txseq; 6654 6655 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, 6656 chan->rx_state); 6657 6658 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) { 6659 l2cap_pass_to_tx(chan, control); 6660 6661 BT_DBG("buffer_seq %u->%u", chan->buffer_seq, 6662 __next_seq(chan, chan->buffer_seq)); 6663 6664 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 6665 6666 l2cap_reassemble_sdu(chan, skb, control); 6667 } else { 6668 if (chan->sdu) { 6669 kfree_skb(chan->sdu); 6670 chan->sdu = NULL; 6671 } 6672 chan->sdu_last_frag = NULL; 6673 chan->sdu_len = 0; 6674 6675 if (skb) { 6676 BT_DBG("Freeing %p", skb); 6677 kfree_skb(skb); 6678 } 6679 } 6680 6681 chan->last_acked_seq = txseq; 6682 chan->expected_tx_seq = __next_seq(chan, txseq); 6683 6684 return 0; 6685 } 6686 6687 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 6688 { 6689 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap; 6690 u16 len; 6691 u8 event; 6692 6693 __unpack_control(chan, skb); 6694 6695 len = skb->len; 6696 6697 /* 6698 * We can just drop the corrupted I-frame here. 6699 * Receiver will miss it and start proper recovery 6700 * procedures and ask for retransmission. 6701 */ 6702 if (l2cap_check_fcs(chan, skb)) 6703 goto drop; 6704 6705 if (!control->sframe && control->sar == L2CAP_SAR_START) 6706 len -= L2CAP_SDULEN_SIZE; 6707 6708 if (chan->fcs == L2CAP_FCS_CRC16) 6709 len -= L2CAP_FCS_SIZE; 6710 6711 if (len > chan->mps) { 6712 l2cap_send_disconn_req(chan, ECONNRESET); 6713 goto drop; 6714 } 6715 6716 if (chan->ops->filter) { 6717 if (chan->ops->filter(chan, skb)) 6718 goto drop; 6719 } 6720 6721 if (!control->sframe) { 6722 int err; 6723 6724 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d", 6725 control->sar, control->reqseq, control->final, 6726 control->txseq); 6727 6728 /* Validate F-bit - F=0 always valid, F=1 only 6729 * valid in TX WAIT_F 6730 */ 6731 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F) 6732 goto drop; 6733 6734 if (chan->mode != L2CAP_MODE_STREAMING) { 6735 event = L2CAP_EV_RECV_IFRAME; 6736 err = l2cap_rx(chan, control, skb, event); 6737 } else { 6738 err = l2cap_stream_rx(chan, control, skb); 6739 } 6740 6741 if (err) 6742 l2cap_send_disconn_req(chan, ECONNRESET); 6743 } else { 6744 const u8 rx_func_to_event[4] = { 6745 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ, 6746 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ 6747 }; 6748 6749 /* Only I-frames are expected in streaming mode */ 6750 if (chan->mode == L2CAP_MODE_STREAMING) 6751 goto drop; 6752 6753 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d", 6754 control->reqseq, control->final, control->poll, 6755 control->super); 6756 6757 if (len != 0) { 6758 BT_ERR("Trailing bytes: %d in sframe", len); 6759 l2cap_send_disconn_req(chan, ECONNRESET); 6760 goto drop; 6761 } 6762 6763 /* Validate F and P bits */ 6764 if (control->final && (control->poll || 6765 chan->tx_state != L2CAP_TX_STATE_WAIT_F)) 6766 goto drop; 6767 6768 event = rx_func_to_event[control->super]; 6769 if (l2cap_rx(chan, control, skb, event)) 6770 l2cap_send_disconn_req(chan, ECONNRESET); 6771 } 6772 6773 return 0; 6774 6775 drop: 6776 kfree_skb(skb); 6777 return 0; 6778 } 6779 6780 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan) 6781 { 6782 struct l2cap_conn *conn = chan->conn; 6783 struct l2cap_le_credits pkt; 6784 u16 return_credits = l2cap_le_rx_credits(chan); 6785 int ident; 6786 6787 if (chan->mode != L2CAP_MODE_LE_FLOWCTL && 6788 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 6789 return; 6790 6791 if (chan->rx_credits >= return_credits) 6792 return; 6793 6794 return_credits -= chan->rx_credits; 6795 6796 BT_DBG("chan %p returning %u credits to sender", chan, return_credits); 6797 6798 chan->rx_credits += return_credits; 6799 6800 pkt.cid = cpu_to_le16(chan->scid); 6801 pkt.credits = cpu_to_le16(return_credits); 6802 6803 ident = l2cap_get_ident(conn); 6804 6805 l2cap_send_cmd(conn, ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); 6806 6807 /* L2CAP_LE_CREDITS has no response so the ident is never released by 6808 * l2cap_put_ident() - release it right away, otherwise the tx_ida 6809 * range is exhausted after 254 packets and from then on credits are 6810 * sent with the invalid ident 0, which some remote stacks ignore, 6811 * stalling the channel. 6812 */ 6813 if (ident > 0) 6814 ida_free(&conn->tx_ida, ident); 6815 } 6816 6817 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail) 6818 { 6819 if (chan->rx_avail == rx_avail) 6820 return; 6821 6822 BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail); 6823 6824 chan->rx_avail = rx_avail; 6825 6826 if (chan->state == BT_CONNECTED) 6827 l2cap_chan_le_send_credits(chan); 6828 } 6829 6830 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb) 6831 { 6832 int err; 6833 6834 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len); 6835 6836 /* Wait recv to confirm reception before updating the credits */ 6837 err = chan->ops->recv(chan, skb); 6838 6839 if (err < 0 && chan->rx_avail != -1) { 6840 BT_ERR("Queueing received LE L2CAP data failed"); 6841 l2cap_send_disconn_req(chan, ECONNRESET); 6842 return err; 6843 } 6844 6845 /* Update credits whenever an SDU is received */ 6846 l2cap_chan_le_send_credits(chan); 6847 6848 return err; 6849 } 6850 6851 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 6852 { 6853 int err; 6854 6855 if (!chan->rx_credits) { 6856 BT_ERR("No credits to receive LE L2CAP data"); 6857 l2cap_send_disconn_req(chan, ECONNRESET); 6858 return -ENOBUFS; 6859 } 6860 6861 if (skb->len > chan->imtu) { 6862 BT_ERR("Too big LE L2CAP PDU: len %u > %u", skb->len, 6863 chan->imtu); 6864 l2cap_send_disconn_req(chan, ECONNRESET); 6865 return -ENOBUFS; 6866 } 6867 6868 if (skb->len > chan->mps) { 6869 BT_ERR("Too big LE L2CAP MPS: len %u > %u", skb->len, 6870 chan->mps); 6871 l2cap_send_disconn_req(chan, ECONNRESET); 6872 return -ENOBUFS; 6873 } 6874 6875 chan->rx_credits--; 6876 BT_DBG("chan %p: rx_credits %u -> %u", 6877 chan, chan->rx_credits + 1, chan->rx_credits); 6878 6879 /* Update if remote had run out of credits, this should only happens 6880 * if the remote is not using the entire MPS. 6881 */ 6882 if (!chan->rx_credits) 6883 l2cap_chan_le_send_credits(chan); 6884 6885 err = 0; 6886 6887 if (!chan->sdu) { 6888 u16 sdu_len; 6889 6890 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) { 6891 err = -EINVAL; 6892 goto failed; 6893 } 6894 6895 sdu_len = get_unaligned_le16(skb->data); 6896 skb_pull(skb, L2CAP_SDULEN_SIZE); 6897 6898 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u", 6899 sdu_len, skb->len, chan->imtu); 6900 6901 if (sdu_len > chan->imtu) { 6902 BT_ERR("Too big LE L2CAP SDU length: len %u > %u", 6903 sdu_len, chan->imtu); 6904 l2cap_send_disconn_req(chan, ECONNRESET); 6905 err = -EMSGSIZE; 6906 goto failed; 6907 } 6908 6909 if (skb->len > sdu_len) { 6910 BT_ERR("Too much LE L2CAP data received"); 6911 err = -EINVAL; 6912 goto failed; 6913 } 6914 6915 if (skb->len == sdu_len) 6916 return l2cap_ecred_recv(chan, skb); 6917 6918 chan->sdu = skb; 6919 chan->sdu_len = sdu_len; 6920 chan->sdu_last_frag = skb; 6921 6922 /* Detect if remote is not able to use the selected MPS */ 6923 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) { 6924 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE; 6925 6926 /* Adjust the number of credits */ 6927 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len); 6928 chan->mps = mps_len; 6929 l2cap_chan_le_send_credits(chan); 6930 } 6931 6932 return 0; 6933 } 6934 6935 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u", 6936 chan->sdu->len, skb->len, chan->sdu_len); 6937 6938 if (chan->sdu->len + skb->len > chan->sdu_len) { 6939 BT_ERR("Too much LE L2CAP data received"); 6940 l2cap_send_disconn_req(chan, ECONNRESET); 6941 err = -EINVAL; 6942 goto failed; 6943 } 6944 6945 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag); 6946 skb = NULL; 6947 6948 if (chan->sdu->len == chan->sdu_len) { 6949 err = l2cap_ecred_recv(chan, chan->sdu); 6950 if (!err) { 6951 chan->sdu = NULL; 6952 chan->sdu_last_frag = NULL; 6953 chan->sdu_len = 0; 6954 } 6955 } 6956 6957 failed: 6958 if (err) { 6959 kfree_skb(skb); 6960 kfree_skb(chan->sdu); 6961 chan->sdu = NULL; 6962 chan->sdu_last_frag = NULL; 6963 chan->sdu_len = 0; 6964 } 6965 6966 /* We can't return an error here since we took care of the skb 6967 * freeing internally. An error return would cause the caller to 6968 * do a double-free of the skb. 6969 */ 6970 return 0; 6971 } 6972 6973 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid, 6974 struct sk_buff *skb) 6975 { 6976 struct l2cap_chan *chan; 6977 6978 chan = l2cap_get_chan_by_scid(conn, cid); 6979 if (!chan) { 6980 BT_DBG("unknown cid 0x%4.4x", cid); 6981 /* Drop packet and return */ 6982 kfree_skb(skb); 6983 return; 6984 } 6985 6986 BT_DBG("chan %p, len %d", chan, skb->len); 6987 6988 /* If we receive data on a fixed channel before the info req/rsp 6989 * procedure is done simply assume that the channel is supported 6990 * and mark it as ready. 6991 */ 6992 if (chan->chan_type == L2CAP_CHAN_FIXED) 6993 l2cap_chan_ready(chan); 6994 6995 if (chan->state != BT_CONNECTED) 6996 goto drop; 6997 6998 switch (chan->mode) { 6999 case L2CAP_MODE_LE_FLOWCTL: 7000 case L2CAP_MODE_EXT_FLOWCTL: 7001 if (l2cap_ecred_data_rcv(chan, skb) < 0) 7002 goto drop; 7003 7004 goto done; 7005 7006 case L2CAP_MODE_BASIC: 7007 /* If socket recv buffers overflows we drop data here 7008 * which is *bad* because L2CAP has to be reliable. 7009 * But we don't have any other choice. L2CAP doesn't 7010 * provide flow control mechanism. */ 7011 7012 if (chan->imtu < skb->len) { 7013 BT_ERR("Dropping L2CAP data: receive buffer overflow"); 7014 goto drop; 7015 } 7016 7017 if (!chan->ops->recv(chan, skb)) 7018 goto done; 7019 break; 7020 7021 case L2CAP_MODE_ERTM: 7022 case L2CAP_MODE_STREAMING: 7023 l2cap_data_rcv(chan, skb); 7024 goto done; 7025 7026 default: 7027 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode); 7028 break; 7029 } 7030 7031 drop: 7032 kfree_skb(skb); 7033 7034 done: 7035 l2cap_chan_unlock(chan); 7036 l2cap_chan_put(chan); 7037 } 7038 7039 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, 7040 struct sk_buff *skb) 7041 { 7042 struct hci_conn *hcon = conn->hcon; 7043 struct l2cap_chan *chan; 7044 7045 if (hcon->type != ACL_LINK) 7046 goto free_skb; 7047 7048 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst, 7049 ACL_LINK); 7050 if (!chan) 7051 goto free_skb; 7052 7053 BT_DBG("chan %p, len %d", chan, skb->len); 7054 7055 l2cap_chan_lock(chan); 7056 7057 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 7058 goto drop; 7059 7060 if (chan->imtu < skb->len) 7061 goto drop; 7062 7063 /* Store remote BD_ADDR and PSM for msg_name */ 7064 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst); 7065 bt_cb(skb)->l2cap.psm = psm; 7066 7067 if (!chan->ops->recv(chan, skb)) { 7068 l2cap_chan_unlock(chan); 7069 l2cap_chan_put(chan); 7070 return; 7071 } 7072 7073 drop: 7074 l2cap_chan_unlock(chan); 7075 l2cap_chan_put(chan); 7076 free_skb: 7077 kfree_skb(skb); 7078 } 7079 7080 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb) 7081 { 7082 struct l2cap_hdr *lh = (void *) skb->data; 7083 struct hci_conn *hcon = conn->hcon; 7084 u16 cid, len; 7085 __le16 psm; 7086 7087 if (hcon->state != BT_CONNECTED) { 7088 BT_DBG("queueing pending rx skb"); 7089 skb_queue_tail(&conn->pending_rx, skb); 7090 return; 7091 } 7092 7093 skb_pull(skb, L2CAP_HDR_SIZE); 7094 cid = __le16_to_cpu(lh->cid); 7095 len = __le16_to_cpu(lh->len); 7096 7097 if (len != skb->len) { 7098 kfree_skb(skb); 7099 return; 7100 } 7101 7102 /* Since we can't actively block incoming LE connections we must 7103 * at least ensure that we ignore incoming data from them. 7104 */ 7105 if (hcon->type == LE_LINK && 7106 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst, 7107 bdaddr_dst_type(hcon))) { 7108 kfree_skb(skb); 7109 return; 7110 } 7111 7112 BT_DBG("len %d, cid 0x%4.4x", len, cid); 7113 7114 switch (cid) { 7115 case L2CAP_CID_SIGNALING: 7116 l2cap_sig_channel(conn, skb); 7117 break; 7118 7119 case L2CAP_CID_CONN_LESS: 7120 if (skb->len < L2CAP_PSMLEN_SIZE) { 7121 kfree_skb(skb); 7122 break; 7123 } 7124 7125 psm = get_unaligned((__le16 *) skb->data); 7126 skb_pull(skb, L2CAP_PSMLEN_SIZE); 7127 l2cap_conless_channel(conn, psm, skb); 7128 break; 7129 7130 case L2CAP_CID_LE_SIGNALING: 7131 l2cap_le_sig_channel(conn, skb); 7132 break; 7133 7134 default: 7135 l2cap_data_channel(conn, cid, skb); 7136 break; 7137 } 7138 } 7139 7140 static void process_pending_rx(struct work_struct *work) 7141 { 7142 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 7143 pending_rx_work); 7144 struct sk_buff *skb; 7145 7146 BT_DBG(""); 7147 7148 mutex_lock(&conn->lock); 7149 7150 while ((skb = skb_dequeue(&conn->pending_rx))) 7151 l2cap_recv_frame(conn, skb); 7152 7153 mutex_unlock(&conn->lock); 7154 } 7155 7156 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) 7157 __must_hold(&hcon->hdev->lock) 7158 { 7159 struct l2cap_conn *conn = hcon->l2cap_data; 7160 struct hci_chan *hchan; 7161 7162 if (conn) 7163 return conn; 7164 7165 hchan = hci_chan_create(hcon); 7166 if (!hchan) 7167 return NULL; 7168 7169 conn = kzalloc_obj(*conn); 7170 if (!conn) { 7171 hci_chan_del(hchan); 7172 return NULL; 7173 } 7174 7175 kref_init(&conn->ref); 7176 conn->hchan = hchan; 7177 7178 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); 7179 7180 conn->mtu = hcon->mtu; 7181 conn->feat_mask = 0; 7182 7183 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; 7184 7185 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) && 7186 (bredr_sc_enabled(hcon->hdev) || 7187 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP))) 7188 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR; 7189 7190 mutex_init(&conn->lock); 7191 7192 INIT_LIST_HEAD(&conn->chan_l); 7193 INIT_LIST_HEAD(&conn->users); 7194 7195 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout); 7196 ida_init(&conn->tx_ida); 7197 7198 skb_queue_head_init(&conn->pending_rx); 7199 INIT_WORK(&conn->pending_rx_work, process_pending_rx); 7200 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr); 7201 7202 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 7203 7204 spin_lock(&hcon->proto_lock); 7205 conn->hcon = hci_conn_get(hcon); 7206 hcon->l2cap_data = conn; 7207 spin_unlock(&hcon->proto_lock); 7208 7209 return conn; 7210 } 7211 7212 static bool is_valid_psm(u16 psm, u8 dst_type) 7213 { 7214 if (!psm) 7215 return false; 7216 7217 if (bdaddr_type_is_le(dst_type)) 7218 return (psm <= 0x00ff); 7219 7220 /* PSM must be odd and lsb of upper byte must be 0 */ 7221 return ((psm & 0x0101) == 0x0001); 7222 } 7223 7224 struct l2cap_chan_data { 7225 struct l2cap_chan *chan; 7226 struct pid *pid; 7227 int count; 7228 }; 7229 7230 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data) 7231 { 7232 struct l2cap_chan_data *d = data; 7233 struct pid *pid; 7234 7235 if (chan == d->chan) 7236 return; 7237 7238 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags)) 7239 return; 7240 7241 pid = chan->ops->get_peer_pid(chan); 7242 7243 /* Only count deferred channels with the same PID/PSM */ 7244 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident || 7245 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 7246 return; 7247 7248 d->count++; 7249 } 7250 7251 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, 7252 bdaddr_t *dst, u8 dst_type, u16 timeout) 7253 { 7254 struct l2cap_conn *conn; 7255 struct hci_conn *hcon; 7256 struct hci_dev *hdev; 7257 int err; 7258 7259 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src, 7260 dst, dst_type, __le16_to_cpu(psm), chan->mode); 7261 7262 hdev = hci_get_route(dst, &chan->src, chan->src_type); 7263 if (!hdev) 7264 return -EHOSTUNREACH; 7265 7266 hci_dev_lock(hdev); 7267 7268 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid && 7269 chan->chan_type != L2CAP_CHAN_RAW) { 7270 err = -EINVAL; 7271 goto done; 7272 } 7273 7274 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) { 7275 err = -EINVAL; 7276 goto done; 7277 } 7278 7279 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) { 7280 err = -EINVAL; 7281 goto done; 7282 } 7283 7284 switch (chan->mode) { 7285 case L2CAP_MODE_BASIC: 7286 break; 7287 case L2CAP_MODE_LE_FLOWCTL: 7288 break; 7289 case L2CAP_MODE_EXT_FLOWCTL: 7290 if (!enable_ecred) { 7291 err = -EOPNOTSUPP; 7292 goto done; 7293 } 7294 break; 7295 case L2CAP_MODE_ERTM: 7296 case L2CAP_MODE_STREAMING: 7297 if (!disable_ertm) 7298 break; 7299 fallthrough; 7300 default: 7301 err = -EOPNOTSUPP; 7302 goto done; 7303 } 7304 7305 switch (chan->state) { 7306 case BT_CONNECT: 7307 case BT_CONNECT2: 7308 case BT_CONFIG: 7309 /* Already connecting */ 7310 err = 0; 7311 goto done; 7312 7313 case BT_CONNECTED: 7314 /* Already connected */ 7315 err = -EISCONN; 7316 goto done; 7317 7318 case BT_OPEN: 7319 case BT_BOUND: 7320 /* Can connect */ 7321 break; 7322 7323 default: 7324 err = -EBADFD; 7325 goto done; 7326 } 7327 7328 /* Set destination address and psm */ 7329 bacpy(&chan->dst, dst); 7330 chan->dst_type = dst_type; 7331 7332 chan->psm = psm; 7333 chan->dcid = cid; 7334 7335 if (bdaddr_type_is_le(dst_type)) { 7336 /* Convert from L2CAP channel address type to HCI address type 7337 */ 7338 if (dst_type == BDADDR_LE_PUBLIC) 7339 dst_type = ADDR_LE_DEV_PUBLIC; 7340 else 7341 dst_type = ADDR_LE_DEV_RANDOM; 7342 7343 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7344 hcon = hci_connect_le(hdev, dst, dst_type, false, 7345 chan->sec_level, timeout, 7346 HCI_ROLE_SLAVE, 0, 0); 7347 else 7348 hcon = hci_connect_le_scan(hdev, dst, dst_type, 7349 chan->sec_level, timeout, 7350 CONN_REASON_L2CAP_CHAN); 7351 7352 } else { 7353 u8 auth_type = l2cap_get_auth_type(chan); 7354 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type, 7355 CONN_REASON_L2CAP_CHAN, timeout); 7356 } 7357 7358 if (IS_ERR(hcon)) { 7359 err = PTR_ERR(hcon); 7360 goto done; 7361 } 7362 7363 lockdep_assert_held(&hcon->hdev->lock); 7364 7365 conn = l2cap_conn_add(hcon); 7366 if (!conn) { 7367 hci_conn_drop(hcon); 7368 err = -ENOMEM; 7369 goto done; 7370 } 7371 7372 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 7373 struct l2cap_chan_data data; 7374 7375 data.chan = chan; 7376 data.pid = chan->ops->get_peer_pid(chan); 7377 data.count = 1; 7378 7379 l2cap_chan_list(conn, l2cap_chan_by_pid, &data); 7380 7381 /* Check if there isn't too many channels being connected */ 7382 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) { 7383 hci_conn_drop(hcon); 7384 err = -EPROTO; 7385 goto done; 7386 } 7387 } 7388 7389 mutex_lock(&conn->lock); 7390 l2cap_chan_lock(chan); 7391 7392 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) { 7393 hci_conn_drop(hcon); 7394 err = -EBUSY; 7395 goto chan_unlock; 7396 } 7397 7398 /* Update source addr of the socket */ 7399 bacpy(&chan->src, &hcon->src); 7400 chan->src_type = bdaddr_src_type(hcon); 7401 7402 __l2cap_chan_add(conn, chan); 7403 7404 /* l2cap_chan_add takes its own ref so we can drop this one */ 7405 hci_conn_drop(hcon); 7406 7407 l2cap_state_change(chan, BT_CONNECT); 7408 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 7409 7410 /* Release chan->sport so that it can be reused by other 7411 * sockets (as it's only used for listening sockets). 7412 */ 7413 write_lock(&chan_list_lock); 7414 chan->sport = 0; 7415 write_unlock(&chan_list_lock); 7416 7417 if (hcon->state == BT_CONNECTED) { 7418 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 7419 __clear_chan_timer(chan); 7420 if (l2cap_chan_check_security(chan, true)) 7421 l2cap_state_change(chan, BT_CONNECTED); 7422 } else 7423 l2cap_do_start(chan); 7424 } 7425 7426 err = 0; 7427 7428 chan_unlock: 7429 l2cap_chan_unlock(chan); 7430 mutex_unlock(&conn->lock); 7431 done: 7432 hci_dev_unlock(hdev); 7433 hci_dev_put(hdev); 7434 return err; 7435 } 7436 EXPORT_SYMBOL_GPL(l2cap_chan_connect); 7437 7438 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan) 7439 { 7440 struct l2cap_conn *conn = chan->conn; 7441 DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); 7442 7443 pdu->mtu = cpu_to_le16(chan->imtu); 7444 pdu->mps = cpu_to_le16(chan->mps); 7445 pdu->scid[0] = cpu_to_le16(chan->scid); 7446 7447 chan->ident = l2cap_get_ident(conn); 7448 7449 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, 7450 struct_size(pdu, scid, 1), pdu); 7451 } 7452 7453 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu) 7454 { 7455 if (chan->imtu > mtu) 7456 return -EINVAL; 7457 7458 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu); 7459 7460 chan->imtu = mtu; 7461 7462 l2cap_ecred_reconfigure(chan); 7463 7464 return 0; 7465 } 7466 7467 /* ---- L2CAP interface with lower layer (HCI) ---- */ 7468 7469 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr) 7470 { 7471 int exact = 0, lm1 = 0, lm2 = 0; 7472 struct l2cap_chan *c; 7473 7474 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 7475 7476 /* Find listening sockets and check their link_mode */ 7477 read_lock(&chan_list_lock); 7478 list_for_each_entry(c, &chan_list, global_l) { 7479 if (c->state != BT_LISTEN) 7480 continue; 7481 7482 if (!bacmp(&c->src, &hdev->bdaddr)) { 7483 lm1 |= HCI_LM_ACCEPT; 7484 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 7485 lm1 |= HCI_LM_MASTER; 7486 exact++; 7487 } else if (!bacmp(&c->src, BDADDR_ANY)) { 7488 lm2 |= HCI_LM_ACCEPT; 7489 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 7490 lm2 |= HCI_LM_MASTER; 7491 } 7492 } 7493 read_unlock(&chan_list_lock); 7494 7495 return exact ? lm1 : lm2; 7496 } 7497 7498 /* Find the next fixed channel in BT_LISTEN state, continue iteration 7499 * from an existing channel in the list or from the beginning of the 7500 * global list (by passing NULL as first parameter). 7501 */ 7502 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, 7503 struct hci_conn *hcon) 7504 { 7505 u8 src_type = bdaddr_src_type(hcon); 7506 7507 read_lock(&chan_list_lock); 7508 7509 if (c) 7510 c = list_next_entry(c, global_l); 7511 else 7512 c = list_entry(chan_list.next, typeof(*c), global_l); 7513 7514 list_for_each_entry_from(c, &chan_list, global_l) { 7515 if (c->chan_type != L2CAP_CHAN_FIXED) 7516 continue; 7517 if (c->state != BT_LISTEN) 7518 continue; 7519 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY)) 7520 continue; 7521 if (src_type != c->src_type) 7522 continue; 7523 7524 c = l2cap_chan_hold_unless_zero(c); 7525 read_unlock(&chan_list_lock); 7526 return c; 7527 } 7528 7529 read_unlock(&chan_list_lock); 7530 7531 return NULL; 7532 } 7533 7534 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) 7535 __must_hold(&hcon->hdev->lock) 7536 { 7537 struct hci_dev *hdev = hcon->hdev; 7538 struct l2cap_conn *conn; 7539 struct l2cap_chan *pchan; 7540 u8 dst_type; 7541 7542 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 7543 return; 7544 7545 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); 7546 7547 if (status) { 7548 l2cap_conn_del(hcon, bt_to_errno(status)); 7549 return; 7550 } 7551 7552 conn = l2cap_conn_add(hcon); 7553 if (!conn) 7554 return; 7555 7556 dst_type = bdaddr_dst_type(hcon); 7557 7558 /* If device is blocked, do not create channels for it */ 7559 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type)) 7560 return; 7561 7562 /* Find fixed channels and notify them of the new connection. We 7563 * use multiple individual lookups, continuing each time where 7564 * we left off, because the list lock would prevent calling the 7565 * potentially sleeping l2cap_chan_lock() function. 7566 */ 7567 pchan = l2cap_global_fixed_chan(NULL, hcon); 7568 while (pchan) { 7569 struct l2cap_chan *chan, *next; 7570 7571 /* Client fixed channels should override server ones */ 7572 if (__l2cap_get_chan_by_dcid(conn, pchan->scid)) 7573 goto next; 7574 7575 l2cap_chan_lock(pchan); 7576 chan = l2cap_new_connection(conn, pchan); 7577 if (chan) { 7578 bacpy(&chan->src, &hcon->src); 7579 bacpy(&chan->dst, &hcon->dst); 7580 chan->src_type = bdaddr_src_type(hcon); 7581 chan->dst_type = dst_type; 7582 } 7583 7584 l2cap_chan_unlock(pchan); 7585 next: 7586 next = l2cap_global_fixed_chan(pchan, hcon); 7587 l2cap_chan_put(pchan); 7588 pchan = next; 7589 } 7590 7591 l2cap_conn_ready(conn); 7592 } 7593 7594 int l2cap_disconn_ind(struct hci_conn *hcon) 7595 { 7596 struct l2cap_conn *conn; 7597 int ret = HCI_ERROR_REMOTE_USER_TERM; 7598 7599 BT_DBG("hcon %p", hcon); 7600 7601 spin_lock(&hcon->proto_lock); 7602 conn = hcon->l2cap_data; 7603 if (conn) 7604 ret = conn->disc_reason; 7605 spin_unlock(&hcon->proto_lock); 7606 7607 return ret; 7608 } 7609 7610 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) 7611 __must_hold(&hcon->hdev->lock) 7612 { 7613 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 7614 return; 7615 7616 BT_DBG("hcon %p reason %d", hcon, reason); 7617 7618 l2cap_conn_del(hcon, bt_to_errno(reason)); 7619 } 7620 7621 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt) 7622 { 7623 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 7624 return; 7625 7626 if (encrypt == 0x00) { 7627 if (chan->sec_level == BT_SECURITY_MEDIUM) { 7628 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT); 7629 } else if (chan->sec_level == BT_SECURITY_HIGH || 7630 chan->sec_level == BT_SECURITY_FIPS) 7631 l2cap_chan_close(chan, ECONNREFUSED); 7632 } else { 7633 if (chan->sec_level == BT_SECURITY_MEDIUM) 7634 __clear_chan_timer(chan); 7635 } 7636 } 7637 7638 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 7639 __must_hold(&hcon->hdev->lock) 7640 { 7641 struct l2cap_conn *conn = hcon->l2cap_data; 7642 struct l2cap_chan *chan; 7643 7644 if (!conn) 7645 return; 7646 7647 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt); 7648 7649 mutex_lock(&conn->lock); 7650 7651 list_for_each_entry(chan, &conn->chan_l, list) { 7652 l2cap_chan_lock(chan); 7653 7654 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid, 7655 state_to_string(chan->state)); 7656 7657 if (!status && encrypt) 7658 chan->sec_level = hcon->sec_level; 7659 7660 if (!__l2cap_no_conn_pending(chan)) { 7661 l2cap_chan_unlock(chan); 7662 continue; 7663 } 7664 7665 if (!status && (chan->state == BT_CONNECTED || 7666 chan->state == BT_CONFIG)) { 7667 chan->ops->resume(chan); 7668 l2cap_check_encryption(chan, encrypt); 7669 l2cap_chan_unlock(chan); 7670 continue; 7671 } 7672 7673 if (chan->state == BT_CONNECT) { 7674 if (!status && l2cap_check_enc_key_size(hcon, chan)) 7675 l2cap_start_connection(chan); 7676 else 7677 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 7678 } else if (chan->state == BT_CONNECT2 && 7679 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL || 7680 chan->mode == L2CAP_MODE_LE_FLOWCTL)) { 7681 struct l2cap_conn_rsp rsp; 7682 __u16 res, stat; 7683 7684 if (!status && l2cap_check_enc_key_size(hcon, chan)) { 7685 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 7686 res = L2CAP_CR_PEND; 7687 stat = L2CAP_CS_AUTHOR_PEND; 7688 chan->ops->defer(chan); 7689 } else { 7690 l2cap_state_change(chan, BT_CONFIG); 7691 res = L2CAP_CR_SUCCESS; 7692 stat = L2CAP_CS_NO_INFO; 7693 } 7694 } else { 7695 l2cap_state_change(chan, BT_DISCONN); 7696 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 7697 res = L2CAP_CR_SEC_BLOCK; 7698 stat = L2CAP_CS_NO_INFO; 7699 } 7700 7701 rsp.scid = cpu_to_le16(chan->dcid); 7702 rsp.dcid = cpu_to_le16(chan->scid); 7703 rsp.result = cpu_to_le16(res); 7704 rsp.status = cpu_to_le16(stat); 7705 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 7706 sizeof(rsp), &rsp); 7707 7708 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) && 7709 res == L2CAP_CR_SUCCESS) { 7710 char buf[128]; 7711 set_bit(CONF_REQ_SENT, &chan->conf_state); 7712 l2cap_send_cmd(conn, l2cap_get_ident(conn), 7713 L2CAP_CONF_REQ, 7714 l2cap_build_conf_req(chan, buf, sizeof(buf)), 7715 buf); 7716 chan->num_conf_req++; 7717 } 7718 } 7719 7720 l2cap_chan_unlock(chan); 7721 } 7722 7723 mutex_unlock(&conn->lock); 7724 } 7725 7726 /* Append fragment into frame respecting the maximum len of rx_skb */ 7727 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb, 7728 u16 len) 7729 { 7730 if (!conn->rx_skb) { 7731 /* Allocate skb for the complete frame (with header) */ 7732 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL); 7733 if (!conn->rx_skb) 7734 return -ENOMEM; 7735 /* Init rx_len */ 7736 conn->rx_len = len; 7737 7738 skb_set_delivery_time(conn->rx_skb, skb->tstamp, 7739 skb->tstamp_type); 7740 } 7741 7742 /* Copy as much as the rx_skb can hold */ 7743 len = min_t(u16, len, skb->len); 7744 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len); 7745 skb_pull(skb, len); 7746 conn->rx_len -= len; 7747 7748 return len; 7749 } 7750 7751 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb) 7752 { 7753 struct sk_buff *rx_skb; 7754 int len; 7755 7756 /* Append just enough to complete the header */ 7757 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len); 7758 7759 /* If header could not be read just continue */ 7760 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE) 7761 return len; 7762 7763 rx_skb = conn->rx_skb; 7764 len = get_unaligned_le16(rx_skb->data); 7765 7766 /* Check if rx_skb has enough space to received all fragments */ 7767 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) { 7768 /* Update expected len */ 7769 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE); 7770 return L2CAP_LEN_SIZE; 7771 } 7772 7773 /* Reset conn->rx_skb since it will need to be reallocated in order to 7774 * fit all fragments. 7775 */ 7776 conn->rx_skb = NULL; 7777 7778 /* Reallocates rx_skb using the exact expected length */ 7779 len = l2cap_recv_frag(conn, rx_skb, 7780 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE)); 7781 kfree_skb(rx_skb); 7782 7783 return len; 7784 } 7785 7786 static void l2cap_recv_reset(struct l2cap_conn *conn) 7787 { 7788 kfree_skb(conn->rx_skb); 7789 conn->rx_skb = NULL; 7790 conn->rx_len = 0; 7791 } 7792 7793 struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c) 7794 { 7795 if (!c) 7796 return NULL; 7797 7798 BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref)); 7799 7800 if (!kref_get_unless_zero(&c->ref)) 7801 return NULL; 7802 7803 return c; 7804 } 7805 EXPORT_SYMBOL(l2cap_conn_hold_unless_zero); 7806 7807 int l2cap_recv_acldata(struct hci_dev *hdev, u16 handle, 7808 struct sk_buff *skb, u16 flags) 7809 { 7810 struct hci_conn *hcon; 7811 struct l2cap_conn *conn; 7812 int len; 7813 7814 /* Lock hdev for hci_conn, and race on l2cap_data vs. l2cap_conn_del */ 7815 hci_dev_lock(hdev); 7816 7817 hcon = hci_conn_hash_lookup_handle(hdev, handle); 7818 if (!hcon) { 7819 hci_dev_unlock(hdev); 7820 kfree_skb(skb); 7821 return -ENOENT; 7822 } 7823 7824 lockdep_assert_held(&hcon->hdev->lock); 7825 7826 hci_conn_enter_active_mode(hcon, BT_POWER_FORCE_ACTIVE_OFF); 7827 7828 conn = hcon->l2cap_data; 7829 7830 if (!conn) 7831 conn = l2cap_conn_add(hcon); 7832 7833 conn = l2cap_conn_hold_unless_zero(conn); 7834 hcon = NULL; 7835 7836 hci_dev_unlock(hdev); 7837 7838 if (!conn) { 7839 kfree_skb(skb); 7840 return -EINVAL; 7841 } 7842 7843 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); 7844 7845 mutex_lock(&conn->lock); 7846 7847 switch (flags) { 7848 case ACL_START: 7849 case ACL_START_NO_FLUSH: 7850 case ACL_COMPLETE: 7851 if (conn->rx_skb) { 7852 BT_ERR("Unexpected start frame (len %d)", skb->len); 7853 l2cap_recv_reset(conn); 7854 l2cap_conn_unreliable(conn, ECOMM); 7855 } 7856 7857 /* Start fragment may not contain the L2CAP length so just 7858 * copy the initial byte when that happens and use conn->mtu as 7859 * expected length. 7860 */ 7861 if (skb->len < L2CAP_LEN_SIZE) { 7862 l2cap_recv_frag(conn, skb, conn->mtu); 7863 break; 7864 } 7865 7866 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE; 7867 7868 if (len == skb->len) { 7869 /* Complete frame received */ 7870 l2cap_recv_frame(conn, skb); 7871 goto unlock; 7872 } 7873 7874 BT_DBG("Start: total len %d, frag len %u", len, skb->len); 7875 7876 if (skb->len > len) { 7877 BT_ERR("Frame is too long (len %u, expected len %d)", 7878 skb->len, len); 7879 /* PTS test cases L2CAP/COS/CED/BI-14-C and BI-15-C 7880 * (Multiple Signaling Command in one PDU, Data 7881 * Truncated, BR/EDR) send a C-frame to the IUT with 7882 * PDU Length set to 8 and Channel ID set to the 7883 * correct signaling channel for the logical link. 7884 * The Information payload contains one L2CAP_ECHO_REQ 7885 * packet with Data Length set to 0 with 0 octets of 7886 * echo data and one invalid command packet due to 7887 * data truncated in PDU but present in HCI packet. 7888 * 7889 * Shorter the socket buffer to the PDU length to 7890 * allow to process valid commands from the PDU before 7891 * setting the socket unreliable. 7892 */ 7893 skb->len = len; 7894 l2cap_recv_frame(conn, skb); 7895 l2cap_conn_unreliable(conn, ECOMM); 7896 goto unlock; 7897 } 7898 7899 /* Append fragment into frame (with header) */ 7900 if (l2cap_recv_frag(conn, skb, len) < 0) 7901 goto drop; 7902 7903 break; 7904 7905 case ACL_CONT: 7906 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len); 7907 7908 if (!conn->rx_skb) { 7909 BT_ERR("Unexpected continuation frame (len %d)", skb->len); 7910 l2cap_conn_unreliable(conn, ECOMM); 7911 goto drop; 7912 } 7913 7914 /* Complete the L2CAP length if it has not been read */ 7915 if (conn->rx_skb->len < L2CAP_LEN_SIZE) { 7916 if (l2cap_recv_len(conn, skb) < 0) { 7917 l2cap_conn_unreliable(conn, ECOMM); 7918 goto drop; 7919 } 7920 7921 /* Header still could not be read just continue */ 7922 if (conn->rx_skb->len < L2CAP_LEN_SIZE) 7923 break; 7924 } 7925 7926 if (skb->len > conn->rx_len) { 7927 BT_ERR("Fragment is too long (len %u, expected %u)", 7928 skb->len, conn->rx_len); 7929 l2cap_recv_reset(conn); 7930 l2cap_conn_unreliable(conn, ECOMM); 7931 goto drop; 7932 } 7933 7934 /* Append fragment into frame (with header) */ 7935 l2cap_recv_frag(conn, skb, skb->len); 7936 7937 if (!conn->rx_len) { 7938 /* Complete frame received. l2cap_recv_frame 7939 * takes ownership of the skb so set the global 7940 * rx_skb pointer to NULL first. 7941 */ 7942 struct sk_buff *rx_skb = conn->rx_skb; 7943 conn->rx_skb = NULL; 7944 l2cap_recv_frame(conn, rx_skb); 7945 } 7946 break; 7947 } 7948 7949 drop: 7950 kfree_skb(skb); 7951 unlock: 7952 mutex_unlock(&conn->lock); 7953 l2cap_conn_put(conn); 7954 return 0; 7955 } 7956 7957 static struct hci_cb l2cap_cb = { 7958 .name = "L2CAP", 7959 .connect_cfm = l2cap_connect_cfm, 7960 .disconn_cfm = l2cap_disconn_cfm, 7961 .security_cfm = l2cap_security_cfm, 7962 }; 7963 7964 static int l2cap_debugfs_show(struct seq_file *f, void *p) 7965 { 7966 struct l2cap_chan *c; 7967 7968 read_lock(&chan_list_lock); 7969 7970 list_for_each_entry(c, &chan_list, global_l) { 7971 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n", 7972 &c->src, c->src_type, &c->dst, c->dst_type, 7973 c->state, __le16_to_cpu(c->psm), 7974 c->scid, c->dcid, c->imtu, c->omtu, 7975 c->sec_level, c->mode); 7976 } 7977 7978 read_unlock(&chan_list_lock); 7979 7980 return 0; 7981 } 7982 7983 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs); 7984 7985 static struct dentry *l2cap_debugfs; 7986 7987 int __init l2cap_init(void) 7988 { 7989 int err; 7990 7991 err = l2cap_init_sockets(); 7992 if (err < 0) 7993 return err; 7994 7995 hci_register_cb(&l2cap_cb); 7996 7997 if (IS_ERR_OR_NULL(bt_debugfs)) 7998 return 0; 7999 8000 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs, 8001 NULL, &l2cap_debugfs_fops); 8002 8003 return 0; 8004 } 8005 8006 void l2cap_exit(void) 8007 { 8008 debugfs_remove(l2cap_debugfs); 8009 hci_unregister_cb(&l2cap_cb); 8010 l2cap_cleanup_sockets(); 8011 } 8012 8013 module_param(disable_ertm, bool, 0644); 8014 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode"); 8015 8016 module_param(enable_ecred, bool, 0644); 8017 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode"); 8018