1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 6 Copyright (C) 2010 Google Inc. 7 Copyright (C) 2011 ProFUSION Embedded Systems 8 9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth L2CAP sockets. */ 26 27 #include <linux/module.h> 28 #include <linux/export.h> 29 #include <linux/filter.h> 30 #include <linux/sched/signal.h> 31 #include <linux/uio.h> 32 33 #include <net/bluetooth/bluetooth.h> 34 #include <net/bluetooth/hci_core.h> 35 #include <net/bluetooth/l2cap.h> 36 37 #include "smp.h" 38 39 static struct bt_sock_list l2cap_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock) 41 }; 42 43 static const struct proto_ops l2cap_sock_ops; 44 static void l2cap_sock_init(struct sock *sk, struct sock *parent); 45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 46 int proto, gfp_t prio, int kern, 47 struct l2cap_chan *chan); 48 static void l2cap_sock_cleanup_listen(struct sock *parent); 49 50 bool l2cap_is_socket(struct socket *sock) 51 { 52 return sock && sock->ops == &l2cap_sock_ops; 53 } 54 EXPORT_SYMBOL(l2cap_is_socket); 55 56 static int l2cap_validate_bredr_psm(u16 psm) 57 { 58 /* PSM must be odd and lsb of upper byte must be 0 */ 59 if ((psm & 0x0101) != 0x0001) 60 return -EINVAL; 61 62 /* Restrict usage of well-known PSMs */ 63 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 64 return -EACCES; 65 66 return 0; 67 } 68 69 static int l2cap_validate_le_psm(u16 psm) 70 { 71 /* Valid LE_PSM ranges are defined only until 0x00ff */ 72 if (psm > L2CAP_PSM_LE_DYN_END) 73 return -EINVAL; 74 75 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */ 76 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 77 return -EACCES; 78 79 return 0; 80 } 81 82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen) 83 { 84 struct sock *sk = sock->sk; 85 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 86 struct sockaddr_l2 la; 87 int len, err = 0; 88 89 BT_DBG("sk %p", sk); 90 91 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 92 addr->sa_family != AF_BLUETOOTH) 93 return -EINVAL; 94 95 memset(&la, 0, sizeof(la)); 96 len = min_t(unsigned int, sizeof(la), alen); 97 memcpy(&la, addr, len); 98 99 if (la.l2_cid && la.l2_psm) 100 return -EINVAL; 101 102 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 103 return -EINVAL; 104 105 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 106 /* We only allow ATT user space socket */ 107 if (la.l2_cid && 108 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 109 return -EINVAL; 110 } 111 112 lock_sock(sk); 113 114 if (sk->sk_state != BT_OPEN) { 115 err = -EBADFD; 116 goto done; 117 } 118 119 if (la.l2_psm) { 120 __u16 psm = __le16_to_cpu(la.l2_psm); 121 122 if (la.l2_bdaddr_type == BDADDR_BREDR) 123 err = l2cap_validate_bredr_psm(psm); 124 else 125 err = l2cap_validate_le_psm(psm); 126 127 if (err) 128 goto done; 129 } 130 131 bacpy(&chan->src, &la.l2_bdaddr); 132 chan->src_type = la.l2_bdaddr_type; 133 134 if (la.l2_cid) 135 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid)); 136 else 137 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm); 138 139 if (err < 0) 140 goto done; 141 142 switch (chan->chan_type) { 143 case L2CAP_CHAN_CONN_LESS: 144 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP) 145 chan->sec_level = BT_SECURITY_SDP; 146 break; 147 case L2CAP_CHAN_CONN_ORIENTED: 148 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP || 149 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM) 150 chan->sec_level = BT_SECURITY_SDP; 151 break; 152 case L2CAP_CHAN_RAW: 153 chan->sec_level = BT_SECURITY_SDP; 154 break; 155 case L2CAP_CHAN_FIXED: 156 /* Fixed channels default to the L2CAP core not holding a 157 * hci_conn reference for them. For fixed channels mapping to 158 * L2CAP sockets we do want to hold a reference so set the 159 * appropriate flag to request it. 160 */ 161 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags); 162 break; 163 } 164 165 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 166 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 167 */ 168 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 169 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 170 chan->mode = L2CAP_MODE_LE_FLOWCTL; 171 172 chan->state = BT_BOUND; 173 sk->sk_state = BT_BOUND; 174 175 done: 176 release_sock(sk); 177 return err; 178 } 179 180 static int l2cap_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 181 int alen, int flags) 182 { 183 struct sock *sk = sock->sk; 184 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 185 struct sockaddr_l2 la; 186 int len, err = 0; 187 bool zapped; 188 189 BT_DBG("sk %p", sk); 190 191 lock_sock(sk); 192 zapped = sock_flag(sk, SOCK_ZAPPED); 193 release_sock(sk); 194 195 if (zapped) 196 return -EINVAL; 197 198 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 199 addr->sa_family != AF_BLUETOOTH) 200 return -EINVAL; 201 202 memset(&la, 0, sizeof(la)); 203 len = min_t(unsigned int, sizeof(la), alen); 204 memcpy(&la, addr, len); 205 206 if (la.l2_cid && la.l2_psm) 207 return -EINVAL; 208 209 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 210 return -EINVAL; 211 212 /* Check that the socket wasn't bound to something that 213 * conflicts with the address given to connect(). If chan->src 214 * is BDADDR_ANY it means bind() was never used, in which case 215 * chan->src_type and la.l2_bdaddr_type do not need to match. 216 */ 217 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) && 218 bdaddr_type_is_le(la.l2_bdaddr_type)) { 219 /* Old user space versions will try to incorrectly bind 220 * the ATT socket using BDADDR_BREDR. We need to accept 221 * this and fix up the source address type only when 222 * both the source CID and destination CID indicate 223 * ATT. Anything else is an invalid combination. 224 */ 225 if (chan->scid != L2CAP_CID_ATT || 226 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 227 return -EINVAL; 228 229 /* We don't have the hdev available here to make a 230 * better decision on random vs public, but since all 231 * user space versions that exhibit this issue anyway do 232 * not support random local addresses assuming public 233 * here is good enough. 234 */ 235 chan->src_type = BDADDR_LE_PUBLIC; 236 } 237 238 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR) 239 return -EINVAL; 240 241 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 242 /* We only allow ATT user space socket */ 243 if (la.l2_cid && 244 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 245 return -EINVAL; 246 } 247 248 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 249 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 250 */ 251 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 252 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 253 chan->mode = L2CAP_MODE_LE_FLOWCTL; 254 255 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid), 256 &la.l2_bdaddr, la.l2_bdaddr_type, 257 READ_ONCE(sk->sk_sndtimeo)); 258 if (err) 259 return err; 260 261 lock_sock(sk); 262 263 err = bt_sock_wait_state(sk, BT_CONNECTED, 264 sock_sndtimeo(sk, flags & O_NONBLOCK)); 265 266 release_sock(sk); 267 268 return err; 269 } 270 271 static int l2cap_sock_listen(struct socket *sock, int backlog) 272 { 273 struct sock *sk = sock->sk; 274 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 275 int err = 0; 276 277 BT_DBG("sk %p backlog %d", sk, backlog); 278 279 lock_sock(sk); 280 281 if (sk->sk_state != BT_BOUND) { 282 err = -EBADFD; 283 goto done; 284 } 285 286 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) { 287 err = -EINVAL; 288 goto done; 289 } 290 291 switch (chan->mode) { 292 case L2CAP_MODE_BASIC: 293 case L2CAP_MODE_LE_FLOWCTL: 294 break; 295 case L2CAP_MODE_EXT_FLOWCTL: 296 if (!enable_ecred) { 297 err = -EOPNOTSUPP; 298 goto done; 299 } 300 break; 301 case L2CAP_MODE_ERTM: 302 case L2CAP_MODE_STREAMING: 303 if (!disable_ertm) 304 break; 305 fallthrough; 306 default: 307 err = -EOPNOTSUPP; 308 goto done; 309 } 310 311 sk->sk_max_ack_backlog = backlog; 312 sk->sk_ack_backlog = 0; 313 314 /* Listening channels need to use nested locking in order not to 315 * cause lockdep warnings when the created child channels end up 316 * being locked in the same thread as the parent channel. 317 */ 318 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); 319 320 chan->state = BT_LISTEN; 321 sk->sk_state = BT_LISTEN; 322 323 done: 324 release_sock(sk); 325 return err; 326 } 327 328 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, 329 struct proto_accept_arg *arg) 330 { 331 DEFINE_WAIT_FUNC(wait, woken_wake_function); 332 struct sock *sk = sock->sk, *nsk; 333 long timeo; 334 int err = 0; 335 336 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 337 338 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 339 340 BT_DBG("sk %p timeo %ld", sk, timeo); 341 342 /* Wait for an incoming connection. (wake-one). */ 343 add_wait_queue_exclusive(sk_sleep(sk), &wait); 344 while (1) { 345 if (sk->sk_state != BT_LISTEN) { 346 err = -EBADFD; 347 break; 348 } 349 350 nsk = bt_accept_dequeue(sk, newsock); 351 if (nsk) { 352 /* Drop the bridging ref from bt_accept_dequeue(); 353 * the grafted socket keeps nsk alive from here. 354 */ 355 sock_put(nsk); 356 break; 357 } 358 359 if (!timeo) { 360 err = -EAGAIN; 361 break; 362 } 363 364 if (signal_pending(current)) { 365 err = sock_intr_errno(timeo); 366 break; 367 } 368 369 release_sock(sk); 370 371 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 372 373 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 374 } 375 remove_wait_queue(sk_sleep(sk), &wait); 376 377 if (err) 378 goto done; 379 380 newsock->state = SS_CONNECTED; 381 382 BT_DBG("new socket %p", nsk); 383 384 done: 385 release_sock(sk); 386 return err; 387 } 388 389 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, 390 int peer) 391 { 392 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr; 393 struct sock *sk = sock->sk; 394 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 395 396 BT_DBG("sock %p, sk %p", sock, sk); 397 398 if (peer && sk->sk_state != BT_CONNECTED && 399 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 && 400 sk->sk_state != BT_CONFIG) 401 return -ENOTCONN; 402 403 memset(la, 0, sizeof(struct sockaddr_l2)); 404 addr->sa_family = AF_BLUETOOTH; 405 406 la->l2_psm = chan->psm; 407 408 if (peer) { 409 bacpy(&la->l2_bdaddr, &chan->dst); 410 la->l2_cid = cpu_to_le16(chan->dcid); 411 la->l2_bdaddr_type = chan->dst_type; 412 } else { 413 bacpy(&la->l2_bdaddr, &chan->src); 414 la->l2_cid = cpu_to_le16(chan->scid); 415 la->l2_bdaddr_type = chan->src_type; 416 } 417 418 return sizeof(struct sockaddr_l2); 419 } 420 421 static int l2cap_get_mode(struct l2cap_chan *chan) 422 { 423 switch (chan->mode) { 424 case L2CAP_MODE_BASIC: 425 return BT_MODE_BASIC; 426 case L2CAP_MODE_ERTM: 427 return BT_MODE_ERTM; 428 case L2CAP_MODE_STREAMING: 429 return BT_MODE_STREAMING; 430 case L2CAP_MODE_LE_FLOWCTL: 431 return BT_MODE_LE_FLOWCTL; 432 case L2CAP_MODE_EXT_FLOWCTL: 433 return BT_MODE_EXT_FLOWCTL; 434 } 435 436 return -EINVAL; 437 } 438 439 static struct l2cap_conn *l2cap_chan_conn(struct l2cap_chan *chan) 440 { 441 lockdep_assert_held(&chan->lock); 442 443 /* l2cap_conn_del() sets FLAG_DEL while holding chan->lock before 444 * conn->hcon is deleted. If not set and conn is non-NULL, conn->hcon 445 * remains alive during this chan->lock critical section. 446 */ 447 if (test_bit(FLAG_DEL, &chan->flags)) 448 return NULL; 449 450 return chan->conn; 451 } 452 453 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, 454 sockopt_t *sopt) 455 { 456 struct sock *sk = sock->sk; 457 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 458 struct l2cap_conn *conn; 459 struct l2cap_options opts; 460 struct l2cap_conninfo cinfo; 461 int err = 0; 462 size_t len; 463 u32 opt; 464 465 BT_DBG("sk %p", sk); 466 467 len = sopt->optlen; 468 469 l2cap_chan_lock(chan); 470 lock_sock(sk); 471 472 switch (optname) { 473 case L2CAP_OPTIONS: 474 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since 475 * legacy ATT code depends on getsockopt for 476 * L2CAP_OPTIONS we need to let this pass. 477 */ 478 if (bdaddr_type_is_le(chan->src_type) && 479 chan->scid != L2CAP_CID_ATT) { 480 err = -EINVAL; 481 break; 482 } 483 484 /* Only BR/EDR modes are supported here */ 485 switch (chan->mode) { 486 case L2CAP_MODE_BASIC: 487 case L2CAP_MODE_ERTM: 488 case L2CAP_MODE_STREAMING: 489 break; 490 default: 491 err = -EINVAL; 492 break; 493 } 494 495 if (err < 0) 496 break; 497 498 memset(&opts, 0, sizeof(opts)); 499 opts.imtu = chan->imtu; 500 opts.omtu = chan->omtu; 501 opts.flush_to = chan->flush_to; 502 opts.mode = chan->mode; 503 opts.fcs = chan->fcs; 504 opts.max_tx = chan->max_tx; 505 opts.txwin_size = chan->tx_win; 506 507 BT_DBG("mode 0x%2.2x", chan->mode); 508 509 len = min(len, sizeof(opts)); 510 if (copy_to_iter(&opts, len, &sopt->iter_out) != len) 511 err = -EFAULT; 512 513 break; 514 515 case L2CAP_LM: 516 switch (chan->sec_level) { 517 case BT_SECURITY_LOW: 518 opt = L2CAP_LM_AUTH; 519 break; 520 case BT_SECURITY_MEDIUM: 521 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT; 522 break; 523 case BT_SECURITY_HIGH: 524 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 525 L2CAP_LM_SECURE; 526 break; 527 case BT_SECURITY_FIPS: 528 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 529 L2CAP_LM_SECURE | L2CAP_LM_FIPS; 530 break; 531 default: 532 opt = 0; 533 break; 534 } 535 536 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags)) 537 opt |= L2CAP_LM_MASTER; 538 539 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 540 opt |= L2CAP_LM_RELIABLE; 541 542 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 543 sizeof(opt)) 544 err = -EFAULT; 545 546 break; 547 548 case L2CAP_CONNINFO: 549 if (sk->sk_state != BT_CONNECTED && 550 !(sk->sk_state == BT_CONNECT2 && 551 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 552 err = -ENOTCONN; 553 break; 554 } 555 556 conn = l2cap_chan_conn(chan); 557 if (!conn) { 558 err = -ENOTCONN; 559 break; 560 } 561 562 memset(&cinfo, 0, sizeof(cinfo)); 563 cinfo.hci_handle = conn->hcon->handle; 564 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 565 566 len = min(len, sizeof(cinfo)); 567 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 568 err = -EFAULT; 569 570 break; 571 572 default: 573 err = -ENOPROTOOPT; 574 break; 575 } 576 577 release_sock(sk); 578 l2cap_chan_unlock(chan); 579 580 return err; 581 } 582 583 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, 584 sockopt_t *sopt) 585 { 586 struct sock *sk = sock->sk; 587 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 588 struct l2cap_conn *conn; 589 struct bt_security sec; 590 struct bt_power pwr; 591 int len, mode, err = 0; 592 u32 opt; 593 u16 mtu; 594 u8 mval; 595 596 BT_DBG("sk %p", sk); 597 598 if (level == SOL_L2CAP) 599 return l2cap_sock_getsockopt_old(sock, optname, sopt); 600 601 if (level != SOL_BLUETOOTH) 602 return -ENOPROTOOPT; 603 604 len = sopt->optlen; 605 606 l2cap_chan_lock(chan); 607 lock_sock(sk); 608 609 switch (optname) { 610 case BT_SECURITY: 611 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 612 chan->chan_type != L2CAP_CHAN_FIXED && 613 chan->chan_type != L2CAP_CHAN_RAW) { 614 err = -EINVAL; 615 break; 616 } 617 618 conn = l2cap_chan_conn(chan); 619 620 memset(&sec, 0, sizeof(sec)); 621 if (conn) { 622 sec.level = conn->hcon->sec_level; 623 624 if (sk->sk_state == BT_CONNECTED) 625 sec.key_size = conn->hcon->enc_key_size; 626 } else { 627 sec.level = chan->sec_level; 628 } 629 630 len = min_t(unsigned int, len, sizeof(sec)); 631 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 632 err = -EFAULT; 633 634 break; 635 636 case BT_DEFER_SETUP: 637 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 638 err = -EINVAL; 639 break; 640 } 641 642 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 643 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 644 sizeof(opt)) 645 err = -EFAULT; 646 647 break; 648 649 case BT_FLUSHABLE: 650 opt = test_bit(FLAG_FLUSHABLE, &chan->flags); 651 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 652 sizeof(opt)) 653 err = -EFAULT; 654 655 break; 656 657 case BT_POWER: 658 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM 659 && sk->sk_type != SOCK_RAW) { 660 err = -EINVAL; 661 break; 662 } 663 664 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 665 666 len = min_t(unsigned int, len, sizeof(pwr)); 667 if (copy_to_iter(&pwr, len, &sopt->iter_out) != len) 668 err = -EFAULT; 669 670 break; 671 672 case BT_CHANNEL_POLICY: 673 opt = chan->chan_policy; 674 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 675 sizeof(opt)) 676 err = -EFAULT; 677 break; 678 679 case BT_SNDMTU: 680 if (!bdaddr_type_is_le(chan->src_type)) { 681 err = -EINVAL; 682 break; 683 } 684 685 if (sk->sk_state != BT_CONNECTED) { 686 err = -ENOTCONN; 687 break; 688 } 689 690 mtu = chan->omtu; 691 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 692 sizeof(mtu)) 693 err = -EFAULT; 694 break; 695 696 case BT_RCVMTU: 697 if (!bdaddr_type_is_le(chan->src_type)) { 698 err = -EINVAL; 699 break; 700 } 701 702 mtu = chan->imtu; 703 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 704 sizeof(mtu)) 705 err = -EFAULT; 706 break; 707 708 case BT_PHY: 709 conn = l2cap_chan_conn(chan); 710 711 if (sk->sk_state != BT_CONNECTED || !conn) { 712 err = -ENOTCONN; 713 break; 714 } 715 716 opt = hci_conn_get_phy(conn->hcon); 717 718 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 719 sizeof(opt)) 720 err = -EFAULT; 721 break; 722 723 case BT_MODE: 724 if (!enable_ecred) { 725 err = -ENOPROTOOPT; 726 break; 727 } 728 729 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 730 err = -EINVAL; 731 break; 732 } 733 734 mode = l2cap_get_mode(chan); 735 if (mode < 0) { 736 err = mode; 737 break; 738 } 739 740 mval = mode; 741 if (copy_to_iter(&mval, sizeof(mval), &sopt->iter_out) != 742 sizeof(mval)) 743 err = -EFAULT; 744 break; 745 746 default: 747 err = -ENOPROTOOPT; 748 break; 749 } 750 751 release_sock(sk); 752 l2cap_chan_unlock(chan); 753 return err; 754 } 755 756 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu) 757 { 758 switch (chan->scid) { 759 case L2CAP_CID_ATT: 760 if (mtu && mtu < L2CAP_LE_MIN_MTU) 761 return false; 762 break; 763 764 default: 765 if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU) 766 return false; 767 } 768 769 return true; 770 } 771 772 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 773 sockptr_t optval, unsigned int optlen) 774 { 775 struct sock *sk = sock->sk; 776 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 777 struct l2cap_options opts; 778 int err = 0; 779 u32 opt; 780 781 BT_DBG("sk %p", sk); 782 783 l2cap_chan_lock(chan); 784 lock_sock(sk); 785 786 switch (optname) { 787 case L2CAP_OPTIONS: 788 if (bdaddr_type_is_le(chan->src_type)) { 789 err = -EINVAL; 790 break; 791 } 792 793 if (sk->sk_state == BT_CONNECTED) { 794 err = -EINVAL; 795 break; 796 } 797 798 opts.imtu = chan->imtu; 799 opts.omtu = chan->omtu; 800 opts.flush_to = chan->flush_to; 801 opts.mode = chan->mode; 802 opts.fcs = chan->fcs; 803 opts.max_tx = chan->max_tx; 804 opts.txwin_size = chan->tx_win; 805 806 err = copy_safe_from_sockptr(&opts, sizeof(opts), optval, 807 optlen); 808 if (err) 809 break; 810 811 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { 812 err = -EINVAL; 813 break; 814 } 815 816 if (!l2cap_valid_mtu(chan, opts.imtu)) { 817 err = -EINVAL; 818 break; 819 } 820 821 /* Only BR/EDR modes are supported here */ 822 switch (opts.mode) { 823 case L2CAP_MODE_BASIC: 824 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 825 break; 826 case L2CAP_MODE_ERTM: 827 case L2CAP_MODE_STREAMING: 828 if (!disable_ertm) 829 break; 830 fallthrough; 831 default: 832 err = -EINVAL; 833 break; 834 } 835 836 if (err < 0) 837 break; 838 839 chan->mode = opts.mode; 840 841 BT_DBG("mode 0x%2.2x", chan->mode); 842 843 chan->imtu = opts.imtu; 844 chan->omtu = opts.omtu; 845 chan->fcs = opts.fcs; 846 chan->max_tx = opts.max_tx; 847 chan->tx_win = opts.txwin_size; 848 chan->flush_to = opts.flush_to; 849 break; 850 851 case L2CAP_LM: 852 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 853 if (err) 854 break; 855 856 if (opt & L2CAP_LM_FIPS) { 857 err = -EINVAL; 858 break; 859 } 860 861 if (opt & L2CAP_LM_AUTH) 862 chan->sec_level = BT_SECURITY_LOW; 863 if (opt & L2CAP_LM_ENCRYPT) 864 chan->sec_level = BT_SECURITY_MEDIUM; 865 if (opt & L2CAP_LM_SECURE) 866 chan->sec_level = BT_SECURITY_HIGH; 867 868 if (opt & L2CAP_LM_MASTER) 869 set_bit(FLAG_ROLE_SWITCH, &chan->flags); 870 else 871 clear_bit(FLAG_ROLE_SWITCH, &chan->flags); 872 873 if (opt & L2CAP_LM_RELIABLE) 874 set_bit(FLAG_FORCE_RELIABLE, &chan->flags); 875 else 876 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags); 877 break; 878 879 default: 880 err = -ENOPROTOOPT; 881 break; 882 } 883 884 release_sock(sk); 885 l2cap_chan_unlock(chan); 886 return err; 887 } 888 889 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode) 890 { 891 switch (mode) { 892 case BT_MODE_BASIC: 893 if (bdaddr_type_is_le(chan->src_type)) 894 return -EINVAL; 895 mode = L2CAP_MODE_BASIC; 896 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 897 break; 898 case BT_MODE_ERTM: 899 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 900 return -EINVAL; 901 mode = L2CAP_MODE_ERTM; 902 break; 903 case BT_MODE_STREAMING: 904 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 905 return -EINVAL; 906 mode = L2CAP_MODE_STREAMING; 907 break; 908 case BT_MODE_LE_FLOWCTL: 909 if (!bdaddr_type_is_le(chan->src_type)) 910 return -EINVAL; 911 mode = L2CAP_MODE_LE_FLOWCTL; 912 break; 913 case BT_MODE_EXT_FLOWCTL: 914 /* TODO: Add support for ECRED PDUs to BR/EDR */ 915 if (!bdaddr_type_is_le(chan->src_type)) 916 return -EINVAL; 917 mode = L2CAP_MODE_EXT_FLOWCTL; 918 break; 919 default: 920 return -EINVAL; 921 } 922 923 chan->mode = mode; 924 925 return 0; 926 } 927 928 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 929 sockptr_t optval, unsigned int optlen) 930 { 931 struct sock *sk = sock->sk; 932 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 933 struct bt_security sec; 934 struct bt_power pwr; 935 struct l2cap_conn *conn; 936 int err = 0; 937 u32 opt, phys; 938 u16 mtu; 939 u8 mode; 940 941 BT_DBG("sk %p", sk); 942 943 if (level == SOL_L2CAP) 944 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen); 945 946 if (level != SOL_BLUETOOTH) 947 return -ENOPROTOOPT; 948 949 l2cap_chan_lock(chan); 950 lock_sock(sk); 951 952 switch (optname) { 953 case BT_SECURITY: 954 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 955 chan->chan_type != L2CAP_CHAN_FIXED && 956 chan->chan_type != L2CAP_CHAN_RAW) { 957 err = -EINVAL; 958 break; 959 } 960 961 sec.level = BT_SECURITY_LOW; 962 963 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 964 if (err) 965 break; 966 967 if (sec.level < BT_SECURITY_LOW || 968 sec.level > BT_SECURITY_FIPS) { 969 err = -EINVAL; 970 break; 971 } 972 973 chan->sec_level = sec.level; 974 975 conn = l2cap_chan_conn(chan); 976 if (!conn) 977 break; 978 979 /* change security for LE channels */ 980 if (chan->scid == L2CAP_CID_ATT) { 981 if (smp_conn_security(conn->hcon, sec.level)) { 982 err = -EINVAL; 983 break; 984 } 985 986 set_bit(FLAG_PENDING_SECURITY, &chan->flags); 987 sk->sk_state = BT_CONFIG; 988 chan->state = BT_CONFIG; 989 990 /* or for ACL link */ 991 } else if ((sk->sk_state == BT_CONNECT2 && 992 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) || 993 sk->sk_state == BT_CONNECTED) { 994 if (!l2cap_chan_check_security(chan, true)) 995 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 996 else 997 sk->sk_state_change(sk); 998 } else { 999 err = -EINVAL; 1000 } 1001 break; 1002 1003 case BT_DEFER_SETUP: 1004 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1005 err = -EINVAL; 1006 break; 1007 } 1008 1009 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1010 if (err) 1011 break; 1012 1013 if (opt) { 1014 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1015 set_bit(FLAG_DEFER_SETUP, &chan->flags); 1016 } else { 1017 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1018 clear_bit(FLAG_DEFER_SETUP, &chan->flags); 1019 } 1020 break; 1021 1022 case BT_FLUSHABLE: 1023 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1024 if (err) 1025 break; 1026 1027 if (opt > BT_FLUSHABLE_ON) { 1028 err = -EINVAL; 1029 break; 1030 } 1031 1032 if (opt == BT_FLUSHABLE_OFF) { 1033 conn = l2cap_chan_conn(chan); 1034 1035 /* proceed further only when we have l2cap_conn and 1036 No Flush support in the LM */ 1037 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) { 1038 err = -EINVAL; 1039 break; 1040 } 1041 } 1042 1043 if (opt) 1044 set_bit(FLAG_FLUSHABLE, &chan->flags); 1045 else 1046 clear_bit(FLAG_FLUSHABLE, &chan->flags); 1047 break; 1048 1049 case BT_POWER: 1050 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 1051 chan->chan_type != L2CAP_CHAN_RAW) { 1052 err = -EINVAL; 1053 break; 1054 } 1055 1056 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; 1057 1058 err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen); 1059 if (err) 1060 break; 1061 1062 if (pwr.force_active) 1063 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1064 else 1065 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1066 break; 1067 1068 case BT_CHANNEL_POLICY: 1069 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1070 if (err) 1071 break; 1072 1073 err = -EOPNOTSUPP; 1074 break; 1075 1076 case BT_SNDMTU: 1077 if (!bdaddr_type_is_le(chan->src_type)) { 1078 err = -EINVAL; 1079 break; 1080 } 1081 1082 /* Only allow setting output MTU when not connected */ 1083 if (sk->sk_state == BT_CONNECTED) { 1084 err = -EISCONN; 1085 break; 1086 } 1087 1088 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1089 if (err) 1090 break; 1091 1092 chan->omtu = mtu; 1093 break; 1094 1095 case BT_RCVMTU: 1096 if (!bdaddr_type_is_le(chan->src_type)) { 1097 err = -EINVAL; 1098 break; 1099 } 1100 1101 if (chan->mode == L2CAP_MODE_LE_FLOWCTL && 1102 sk->sk_state == BT_CONNECTED) { 1103 err = -EISCONN; 1104 break; 1105 } 1106 1107 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1108 if (err) 1109 break; 1110 1111 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && 1112 sk->sk_state == BT_CONNECTED) 1113 err = l2cap_chan_reconfigure(chan, mtu); 1114 else 1115 chan->imtu = mtu; 1116 1117 break; 1118 1119 case BT_PHY: 1120 conn = l2cap_chan_conn(chan); 1121 if (sk->sk_state != BT_CONNECTED || !conn) { 1122 err = -ENOTCONN; 1123 break; 1124 } 1125 1126 err = copy_safe_from_sockptr(&phys, sizeof(phys), optval, 1127 optlen); 1128 if (err) 1129 break; 1130 1131 err = hci_conn_set_phy(conn->hcon, phys); 1132 break; 1133 1134 case BT_MODE: 1135 if (!enable_ecred) { 1136 err = -ENOPROTOOPT; 1137 break; 1138 } 1139 1140 BT_DBG("sk->sk_state %u", sk->sk_state); 1141 1142 if (sk->sk_state != BT_BOUND) { 1143 err = -EINVAL; 1144 break; 1145 } 1146 1147 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1148 err = -EINVAL; 1149 break; 1150 } 1151 1152 err = copy_safe_from_sockptr(&mode, sizeof(mode), optval, 1153 optlen); 1154 if (err) 1155 break; 1156 1157 BT_DBG("mode %u", mode); 1158 1159 err = l2cap_set_mode(chan, mode); 1160 if (err) 1161 break; 1162 1163 BT_DBG("mode 0x%2.2x", chan->mode); 1164 1165 break; 1166 1167 default: 1168 err = -ENOPROTOOPT; 1169 break; 1170 } 1171 1172 release_sock(sk); 1173 l2cap_chan_unlock(chan); 1174 return err; 1175 } 1176 1177 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1178 size_t len) 1179 { 1180 struct sock *sk = sock->sk; 1181 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1182 struct sockcm_cookie sockc; 1183 int err; 1184 1185 BT_DBG("sock %p, sk %p", sock, sk); 1186 1187 err = sock_error(sk); 1188 if (err) 1189 return err; 1190 1191 if (msg->msg_flags & MSG_OOB) 1192 return -EOPNOTSUPP; 1193 1194 if (sk->sk_state != BT_CONNECTED) 1195 return -ENOTCONN; 1196 1197 hci_sockcm_init(&sockc, sk); 1198 1199 if (msg->msg_controllen) { 1200 err = sock_cmsg_send(sk, msg, &sockc); 1201 if (err) 1202 return err; 1203 } 1204 1205 lock_sock(sk); 1206 err = bt_sock_wait_ready(sk, msg->msg_flags); 1207 release_sock(sk); 1208 if (err) 1209 return err; 1210 1211 l2cap_chan_lock(chan); 1212 err = l2cap_chan_send(chan, msg, len, &sockc); 1213 l2cap_chan_unlock(chan); 1214 1215 return err; 1216 } 1217 1218 static void l2cap_publish_rx_avail(struct l2cap_chan *chan) 1219 { 1220 struct sock *sk = chan->data; 1221 ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc); 1222 int expected_skbs, skb_overhead; 1223 1224 if (avail <= 0) { 1225 l2cap_chan_rx_avail(chan, 0); 1226 return; 1227 } 1228 1229 if (!chan->mps) { 1230 l2cap_chan_rx_avail(chan, -1); 1231 return; 1232 } 1233 1234 /* Correct available memory by estimated sk_buff overhead. 1235 * This is significant due to small transfer sizes. However, accept 1236 * at least one full packet if receive space is non-zero. 1237 */ 1238 expected_skbs = DIV_ROUND_UP(avail, chan->mps); 1239 skb_overhead = expected_skbs * sizeof(struct sk_buff); 1240 if (skb_overhead < avail) 1241 l2cap_chan_rx_avail(chan, avail - skb_overhead); 1242 else 1243 l2cap_chan_rx_avail(chan, -1); 1244 } 1245 1246 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1247 size_t len, int flags) 1248 { 1249 struct sock *sk = sock->sk; 1250 struct l2cap_pinfo *pi = l2cap_pi(sk); 1251 int err; 1252 1253 if (unlikely(flags & MSG_ERRQUEUE)) 1254 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 1255 BT_SCM_ERROR); 1256 1257 lock_sock(sk); 1258 1259 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP, 1260 &bt_sk(sk)->flags)) { 1261 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 1262 sk->sk_state = BT_CONNECTED; 1263 pi->chan->state = BT_CONNECTED; 1264 __l2cap_ecred_conn_rsp_defer(pi->chan); 1265 } else if (bdaddr_type_is_le(pi->chan->src_type)) { 1266 sk->sk_state = BT_CONNECTED; 1267 pi->chan->state = BT_CONNECTED; 1268 __l2cap_le_connect_rsp_defer(pi->chan); 1269 } else { 1270 sk->sk_state = BT_CONFIG; 1271 pi->chan->state = BT_CONFIG; 1272 __l2cap_connect_rsp_defer(pi->chan); 1273 } 1274 1275 err = 0; 1276 goto done; 1277 } 1278 1279 release_sock(sk); 1280 1281 if (sock->type == SOCK_STREAM) 1282 err = bt_sock_stream_recvmsg(sock, msg, len, flags); 1283 else 1284 err = bt_sock_recvmsg(sock, msg, len, flags); 1285 1286 if (pi->chan->mode != L2CAP_MODE_ERTM && 1287 pi->chan->mode != L2CAP_MODE_LE_FLOWCTL && 1288 pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL) 1289 return err; 1290 1291 lock_sock(sk); 1292 1293 l2cap_publish_rx_avail(pi->chan); 1294 1295 /* Attempt to put pending rx data in the socket buffer */ 1296 while (!list_empty(&pi->rx_busy)) { 1297 struct l2cap_rx_busy *rx_busy = 1298 list_first_entry(&pi->rx_busy, 1299 struct l2cap_rx_busy, 1300 list); 1301 if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0) 1302 goto done; 1303 list_del(&rx_busy->list); 1304 kfree(rx_busy); 1305 } 1306 1307 /* Restore data flow when half of the receive buffer is 1308 * available. This avoids resending large numbers of 1309 * frames. 1310 */ 1311 if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) && 1312 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1) 1313 l2cap_chan_busy(pi->chan, 0); 1314 1315 done: 1316 release_sock(sk); 1317 return err; 1318 } 1319 1320 /* Release the sock's ref on chan and clear the pointer so that the ref is 1321 * dropped exactly once even if both l2cap_sock_kill() and 1322 * l2cap_sock_destruct() run. Setting chan->data to NULL first stops any other 1323 * task from dereferencing the now-dead sock pointer. 1324 */ 1325 static void l2cap_sock_put_chan(struct sock *sk) 1326 { 1327 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1328 1329 if (!chan) 1330 return; 1331 1332 chan->data = NULL; 1333 l2cap_pi(sk)->chan = NULL; 1334 l2cap_chan_put(chan); 1335 } 1336 1337 /* Kill socket (only if zapped and orphan) 1338 * Must be called on unlocked socket, with l2cap channel lock. 1339 */ 1340 static void l2cap_sock_kill(struct sock *sk) 1341 { 1342 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 1343 return; 1344 1345 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); 1346 1347 /* Take lock to synchronize against access without owning sk->sk_socket, 1348 * eg. in l2cap_sock_cleanup_listen(). proto_ops etc. don't need lock. 1349 */ 1350 lock_sock(sk); 1351 l2cap_sock_put_chan(sk); 1352 release_sock(sk); 1353 1354 /* Kill poor orphan */ 1355 sock_set_flag(sk, SOCK_DEAD); 1356 sock_put(sk); 1357 } 1358 1359 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan) 1360 { 1361 DECLARE_WAITQUEUE(wait, current); 1362 int err = 0; 1363 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1364 /* Timeout to prevent infinite loop */ 1365 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT; 1366 1367 add_wait_queue(sk_sleep(sk), &wait); 1368 set_current_state(TASK_INTERRUPTIBLE); 1369 do { 1370 BT_DBG("Waiting for %d ACKs, timeout %04d ms", 1371 chan->unacked_frames, time_after(jiffies, timeout) ? 0 : 1372 jiffies_to_msecs(timeout - jiffies)); 1373 1374 if (!timeo) 1375 timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1376 1377 if (signal_pending(current)) { 1378 err = sock_intr_errno(timeo); 1379 break; 1380 } 1381 1382 release_sock(sk); 1383 timeo = schedule_timeout(timeo); 1384 lock_sock(sk); 1385 set_current_state(TASK_INTERRUPTIBLE); 1386 1387 err = sock_error(sk); 1388 if (err) 1389 break; 1390 1391 if (time_after(jiffies, timeout)) { 1392 err = -ENOLINK; 1393 break; 1394 } 1395 1396 } while (chan->unacked_frames > 0 && 1397 chan->state == BT_CONNECTED); 1398 1399 set_current_state(TASK_RUNNING); 1400 remove_wait_queue(sk_sleep(sk), &wait); 1401 return err; 1402 } 1403 1404 static int l2cap_sock_shutdown(struct socket *sock, int how) 1405 __context_unsafe(/* complex chan->conn locking */) 1406 { 1407 struct sock *sk = sock->sk; 1408 struct l2cap_chan *chan; 1409 struct l2cap_conn *conn; 1410 int err = 0; 1411 1412 BT_DBG("sock %p, sk %p, how %d", sock, sk, how); 1413 1414 /* 'how' parameter is mapped to sk_shutdown as follows: 1415 * SHUT_RD (0) --> RCV_SHUTDOWN (1) 1416 * SHUT_WR (1) --> SEND_SHUTDOWN (2) 1417 * SHUT_RDWR (2) --> SHUTDOWN_MASK (3) 1418 */ 1419 how++; 1420 1421 if (!sk) 1422 return 0; 1423 1424 lock_sock(sk); 1425 1426 if ((sk->sk_shutdown & how) == how) 1427 goto shutdown_already; 1428 1429 BT_DBG("Handling sock shutdown"); 1430 1431 /* prevent sk structure from being freed whilst unlocked */ 1432 sock_hold(sk); 1433 1434 /* prevent chan structure from being freed whilst unlocked */ 1435 chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); 1436 if (!chan) 1437 goto shutdown_already; 1438 1439 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1440 1441 if (chan->mode == L2CAP_MODE_ERTM && 1442 chan->unacked_frames > 0 && 1443 chan->state == BT_CONNECTED) { 1444 err = __l2cap_wait_ack(sk, chan); 1445 1446 /* After waiting for ACKs, check whether shutdown 1447 * has already been actioned to close the L2CAP 1448 * link such as by l2cap_disconnection_req(). 1449 */ 1450 if ((sk->sk_shutdown & how) == how) 1451 goto shutdown_matched; 1452 } 1453 1454 /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN 1455 * is already set 1456 */ 1457 if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) { 1458 sk->sk_shutdown |= RCV_SHUTDOWN; 1459 if ((sk->sk_shutdown & how) == how) 1460 goto shutdown_matched; 1461 } 1462 1463 sk->sk_shutdown |= SEND_SHUTDOWN; 1464 release_sock(sk); 1465 1466 l2cap_chan_lock(chan); 1467 /* prevent conn structure from being freed */ 1468 conn = l2cap_conn_hold_unless_zero(chan->conn); 1469 l2cap_chan_unlock(chan); 1470 1471 if (conn) 1472 /* mutex lock must be taken before l2cap_chan_lock() */ 1473 mutex_lock(&conn->lock); 1474 1475 l2cap_chan_lock(chan); 1476 l2cap_chan_close(chan, 0); 1477 l2cap_chan_unlock(chan); 1478 1479 if (conn) { 1480 mutex_unlock(&conn->lock); 1481 l2cap_conn_put(conn); 1482 } 1483 1484 lock_sock(sk); 1485 1486 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1487 !(current->flags & PF_EXITING)) 1488 err = bt_sock_wait_state(sk, BT_CLOSED, 1489 sk->sk_lingertime); 1490 1491 shutdown_matched: 1492 l2cap_chan_put(chan); 1493 sock_put(sk); 1494 1495 shutdown_already: 1496 if (!err && sk->sk_err) 1497 err = -sk->sk_err; 1498 1499 release_sock(sk); 1500 1501 BT_DBG("Sock shutdown complete err: %d", err); 1502 1503 return err; 1504 } 1505 1506 static int l2cap_sock_release(struct socket *sock) 1507 { 1508 struct sock *sk = sock->sk; 1509 int err; 1510 struct l2cap_chan *chan; 1511 1512 BT_DBG("sock %p, sk %p", sock, sk); 1513 1514 if (!sk) 1515 return 0; 1516 1517 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 1518 l2cap_sock_cleanup_listen(sk); 1519 release_sock(sk); 1520 1521 bt_sock_unlink(&l2cap_sk_list, sk); 1522 1523 err = l2cap_sock_shutdown(sock, SHUT_RDWR); 1524 chan = l2cap_pi(sk)->chan; 1525 1526 l2cap_chan_hold(chan); 1527 l2cap_chan_lock(chan); 1528 1529 sock_orphan(sk); 1530 l2cap_sock_kill(sk); 1531 1532 l2cap_chan_unlock(chan); 1533 l2cap_chan_put(chan); 1534 1535 return err; 1536 } 1537 1538 static void l2cap_sock_cleanup_listen(struct sock *parent) 1539 { 1540 struct sock *sk; 1541 1542 BT_DBG("parent %p state %s", parent, 1543 state_to_string(parent->sk_state)); 1544 1545 /* Close not yet accepted channels. 1546 * 1547 * bt_accept_dequeue() returns sk with its temporary queue-walk 1548 * reference held, so a concurrent l2cap_conn_del() 1549 * -> l2cap_sock_kill() cannot free sk under us. 1550 * 1551 * cleanup_listen() runs under the parent sk lock, so unlike 1552 * l2cap_sock_shutdown() we must NOT take conn->lock here: that would 1553 * establish sk_lock -> conn->lock and invert the established 1554 * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock). 1555 * 1556 * Instead, briefly take the child sk lock to synchronize vs. 1557 * l2cap_sock_kill that puts l2cap_pi(sk)->chan. We then drop the sk 1558 * lock before taking chan->lock, so sk and chan locks are never held 1559 * together. 1560 * 1561 * Since we cannot call l2cap_chan_close() without conn->lock, 1562 * schedule l2cap_chan_timeout to close the channel; it already 1563 * acquires conn->lock -> chan->lock in the correct order. 1564 */ 1565 while ((sk = bt_accept_dequeue(parent, NULL))) { 1566 struct l2cap_chan *chan; 1567 1568 lock_sock_nested(sk, L2CAP_NESTING_NORMAL); 1569 chan = l2cap_pi(sk)->chan; 1570 if (chan) 1571 l2cap_chan_hold(chan); 1572 release_sock(sk); 1573 if (!chan) { 1574 /* Already torn down */ 1575 sock_put(sk); 1576 continue; 1577 } 1578 1579 BT_DBG("child chan %p state %s", chan, 1580 state_to_string(chan->state)); 1581 1582 l2cap_chan_lock(chan); 1583 /* Since we cannot call l2cap_chan_close() without 1584 * conn->lock, schedule its timer to trigger the close 1585 * and cleanup of this channel. 1586 */ 1587 if (chan->conn) 1588 __set_chan_timer(chan, 0); 1589 l2cap_chan_unlock(chan); 1590 1591 l2cap_chan_put(chan); 1592 sock_put(sk); 1593 } 1594 } 1595 1596 static int l2cap_sock_new_connection_cb(struct l2cap_chan *chan, 1597 struct l2cap_chan *new_chan) 1598 { 1599 struct sock *sk, *parent = chan->data; 1600 1601 if (!parent) 1602 return -EINVAL; 1603 1604 lock_sock(parent); 1605 1606 if (parent->sk_state != BT_LISTEN) { 1607 release_sock(parent); 1608 return -EINVAL; 1609 } 1610 1611 /* Check for backlog size */ 1612 if (sk_acceptq_is_full(parent)) { 1613 BT_DBG("backlog full %d", parent->sk_ack_backlog); 1614 release_sock(parent); 1615 return -ENOBUFS; 1616 } 1617 1618 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, 1619 GFP_ATOMIC, 0, new_chan); 1620 if (!sk) { 1621 release_sock(parent); 1622 return -ENOMEM; 1623 } 1624 1625 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP); 1626 1627 l2cap_sock_init(sk, parent); 1628 1629 /* The conn list reference taken by l2cap_new_connection() keeps new_chan 1630 * alive once release_sock() lets another task free this socket. 1631 */ 1632 bt_accept_enqueue(parent, sk, false); 1633 1634 release_sock(parent); 1635 1636 return 0; 1637 } 1638 1639 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 1640 { 1641 struct sock *sk; 1642 struct l2cap_pinfo *pi; 1643 int err; 1644 1645 sk = chan->data; 1646 if (!sk) 1647 return -ENXIO; 1648 1649 pi = l2cap_pi(sk); 1650 lock_sock(sk); 1651 if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) { 1652 err = -ENOMEM; 1653 goto done; 1654 } 1655 1656 if (chan->mode != L2CAP_MODE_ERTM && 1657 chan->mode != L2CAP_MODE_STREAMING && 1658 chan->mode != L2CAP_MODE_LE_FLOWCTL && 1659 chan->mode != L2CAP_MODE_EXT_FLOWCTL) { 1660 /* Even if no filter is attached, we could potentially 1661 * get errors from security modules, etc. 1662 */ 1663 err = sk_filter(sk, skb); 1664 if (err) 1665 goto done; 1666 } 1667 1668 err = __sock_queue_rcv_skb(sk, skb); 1669 1670 l2cap_publish_rx_avail(chan); 1671 1672 /* For ERTM and LE, handle a skb that doesn't fit into the recv 1673 * buffer. This is important to do because the data frames 1674 * have already been acked, so the skb cannot be discarded. 1675 * 1676 * Notify the l2cap core that the buffer is full, so the 1677 * LOCAL_BUSY state is entered and no more frames are 1678 * acked and reassembled until there is buffer space 1679 * available. 1680 */ 1681 if (err < 0 && 1682 (chan->mode == L2CAP_MODE_ERTM || 1683 chan->mode == L2CAP_MODE_LE_FLOWCTL || 1684 chan->mode == L2CAP_MODE_EXT_FLOWCTL)) { 1685 struct l2cap_rx_busy *rx_busy = kmalloc_obj(*rx_busy); 1686 if (!rx_busy) { 1687 err = -ENOMEM; 1688 goto done; 1689 } 1690 rx_busy->skb = skb; 1691 list_add_tail(&rx_busy->list, &pi->rx_busy); 1692 l2cap_chan_busy(chan, 1); 1693 err = 0; 1694 } 1695 1696 done: 1697 release_sock(sk); 1698 1699 return err; 1700 } 1701 1702 static void l2cap_sock_close_cb(struct l2cap_chan *chan) 1703 { 1704 struct sock *sk = chan->data; 1705 1706 if (!sk) 1707 return; 1708 1709 l2cap_sock_kill(sk); 1710 } 1711 1712 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) 1713 { 1714 struct sock *sk = chan->data; 1715 struct sock *parent; 1716 1717 if (!sk) 1718 return; 1719 1720 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1721 1722 /* This callback can be called both for server (BT_LISTEN) 1723 * sockets as well as "normal" ones. To avoid lockdep warnings 1724 * with child socket locking (through l2cap_sock_cleanup_listen) 1725 * we need separation into separate nesting levels. The simplest 1726 * way to accomplish this is to inherit the nesting level used 1727 * for the channel. 1728 */ 1729 lock_sock_nested(sk, atomic_read(&chan->nesting)); 1730 1731 parent = bt_sk(sk)->parent; 1732 1733 switch (chan->state) { 1734 case BT_OPEN: 1735 case BT_BOUND: 1736 case BT_CLOSED: 1737 break; 1738 case BT_LISTEN: 1739 l2cap_sock_cleanup_listen(sk); 1740 sk->sk_state = BT_CLOSED; 1741 chan->state = BT_CLOSED; 1742 1743 break; 1744 default: 1745 sk->sk_state = BT_CLOSED; 1746 chan->state = BT_CLOSED; 1747 1748 sk->sk_err = err; 1749 1750 if (parent) { 1751 bt_accept_unlink(sk); 1752 parent->sk_data_ready(parent); 1753 } else { 1754 sk->sk_state_change(sk); 1755 } 1756 1757 break; 1758 } 1759 release_sock(sk); 1760 1761 /* Only zap after cleanup to avoid use after free race */ 1762 sock_set_flag(sk, SOCK_ZAPPED); 1763 1764 } 1765 1766 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, 1767 int err) 1768 { 1769 struct sock *sk = chan->data; 1770 1771 if (!sk) 1772 return; 1773 1774 lock_sock(sk); 1775 1776 sk->sk_state = state; 1777 1778 if (err) 1779 sk->sk_err = err; 1780 1781 release_sock(sk); 1782 } 1783 1784 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, 1785 unsigned long hdr_len, 1786 unsigned long len, int nb) 1787 { 1788 struct sock *sk = chan->data; 1789 struct sk_buff *skb; 1790 int err; 1791 1792 l2cap_chan_unlock(chan); 1793 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err); 1794 l2cap_chan_lock(chan); 1795 1796 if (!skb) 1797 return ERR_PTR(err); 1798 1799 /* Channel lock is released before requesting new skb and then 1800 * reacquired thus we need to recheck channel state. 1801 */ 1802 if (chan->state != BT_CONNECTED) { 1803 kfree_skb(skb); 1804 return ERR_PTR(-ENOTCONN); 1805 } 1806 1807 skb->priority = READ_ONCE(sk->sk_priority); 1808 1809 bt_cb(skb)->l2cap.chan = chan; 1810 1811 return skb; 1812 } 1813 1814 static void l2cap_sock_ready_cb(struct l2cap_chan *chan) 1815 { 1816 struct sock *sk = chan->data; 1817 struct sock *parent; 1818 1819 if (!sk) 1820 return; 1821 1822 lock_sock(sk); 1823 1824 parent = bt_sk(sk)->parent; 1825 1826 BT_DBG("sk %p, parent %p", sk, parent); 1827 1828 sk->sk_state = BT_CONNECTED; 1829 sk->sk_state_change(sk); 1830 1831 if (parent) 1832 parent->sk_data_ready(parent); 1833 1834 release_sock(sk); 1835 } 1836 1837 static void l2cap_sock_defer_cb(struct l2cap_chan *chan) 1838 { 1839 struct sock *parent, *sk = chan->data; 1840 1841 lock_sock(sk); 1842 1843 parent = bt_sk(sk)->parent; 1844 if (parent) 1845 parent->sk_data_ready(parent); 1846 1847 release_sock(sk); 1848 } 1849 1850 static void l2cap_sock_resume_cb(struct l2cap_chan *chan) 1851 { 1852 struct sock *sk = chan->data; 1853 1854 if (!sk) 1855 return; 1856 1857 lock_sock(sk); 1858 1859 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) { 1860 sk->sk_state = BT_CONNECTED; 1861 chan->state = BT_CONNECTED; 1862 } 1863 1864 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1865 sk->sk_state_change(sk); 1866 1867 release_sock(sk); 1868 } 1869 1870 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan) 1871 { 1872 struct sock *sk = chan->data; 1873 1874 lock_sock(sk); 1875 sk->sk_shutdown = SHUTDOWN_MASK; 1876 release_sock(sk); 1877 } 1878 1879 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan) 1880 { 1881 struct sock *sk = chan->data; 1882 1883 if (!sk) 1884 return 0; 1885 1886 return READ_ONCE(sk->sk_sndtimeo); 1887 } 1888 1889 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan) 1890 { 1891 struct sock *sk = chan->data; 1892 1893 return sk->sk_peer_pid; 1894 } 1895 1896 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) 1897 { 1898 struct sock *sk = chan->data; 1899 1900 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1901 sk->sk_state_change(sk); 1902 } 1903 1904 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) 1905 { 1906 struct sock *sk = chan->data; 1907 1908 switch (chan->mode) { 1909 case L2CAP_MODE_ERTM: 1910 case L2CAP_MODE_STREAMING: 1911 return sk_filter(sk, skb); 1912 } 1913 1914 return 0; 1915 } 1916 1917 static const struct l2cap_ops l2cap_chan_ops = { 1918 .name = "L2CAP Socket Interface", 1919 .new_connection = l2cap_sock_new_connection_cb, 1920 .recv = l2cap_sock_recv_cb, 1921 .close = l2cap_sock_close_cb, 1922 .teardown = l2cap_sock_teardown_cb, 1923 .state_change = l2cap_sock_state_change_cb, 1924 .ready = l2cap_sock_ready_cb, 1925 .defer = l2cap_sock_defer_cb, 1926 .resume = l2cap_sock_resume_cb, 1927 .suspend = l2cap_sock_suspend_cb, 1928 .set_shutdown = l2cap_sock_set_shutdown_cb, 1929 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, 1930 .get_peer_pid = l2cap_sock_get_peer_pid_cb, 1931 .alloc_skb = l2cap_sock_alloc_skb_cb, 1932 .filter = l2cap_sock_filter, 1933 }; 1934 1935 static void l2cap_sock_destruct(struct sock *sk) 1936 { 1937 struct l2cap_rx_busy *rx_busy, *next; 1938 1939 BT_DBG("sk %p", sk); 1940 1941 l2cap_sock_put_chan(sk); 1942 1943 list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) { 1944 kfree_skb(rx_busy->skb); 1945 list_del(&rx_busy->list); 1946 kfree(rx_busy); 1947 } 1948 1949 skb_queue_purge(&sk->sk_receive_queue); 1950 skb_queue_purge(&sk->sk_write_queue); 1951 skb_queue_purge(&sk->sk_error_queue); 1952 } 1953 1954 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name, 1955 int *msg_namelen) 1956 { 1957 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name); 1958 1959 memset(la, 0, sizeof(struct sockaddr_l2)); 1960 la->l2_family = AF_BLUETOOTH; 1961 la->l2_psm = bt_cb(skb)->l2cap.psm; 1962 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr); 1963 1964 *msg_namelen = sizeof(struct sockaddr_l2); 1965 } 1966 1967 static void l2cap_sock_init(struct sock *sk, struct sock *parent) 1968 { 1969 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1970 1971 BT_DBG("sk %p", sk); 1972 1973 if (parent) { 1974 sk->sk_type = parent->sk_type; 1975 bt_sk(sk)->flags = bt_sk(parent)->flags; 1976 1977 /* Channel configuration is inherited from the parent by 1978 * l2cap_new_connection(). 1979 */ 1980 security_sk_clone(parent, sk); 1981 } else { 1982 switch (sk->sk_type) { 1983 case SOCK_RAW: 1984 chan->chan_type = L2CAP_CHAN_RAW; 1985 break; 1986 case SOCK_DGRAM: 1987 chan->chan_type = L2CAP_CHAN_CONN_LESS; 1988 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name; 1989 break; 1990 case SOCK_SEQPACKET: 1991 case SOCK_STREAM: 1992 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED; 1993 break; 1994 } 1995 1996 chan->imtu = L2CAP_DEFAULT_MTU; 1997 chan->omtu = 0; 1998 if (!disable_ertm && sk->sk_type == SOCK_STREAM) { 1999 chan->mode = L2CAP_MODE_ERTM; 2000 set_bit(CONF_STATE2_DEVICE, &chan->conf_state); 2001 } else { 2002 chan->mode = L2CAP_MODE_BASIC; 2003 } 2004 2005 l2cap_chan_set_defaults(chan, NULL); 2006 } 2007 2008 /* Default config options */ 2009 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 2010 2011 chan->data = sk; 2012 chan->ops = &l2cap_chan_ops; 2013 2014 l2cap_publish_rx_avail(chan); 2015 } 2016 2017 static struct proto l2cap_proto = { 2018 .name = "L2CAP", 2019 .owner = THIS_MODULE, 2020 .obj_size = sizeof(struct l2cap_pinfo) 2021 }; 2022 2023 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 2024 int proto, gfp_t prio, int kern, 2025 struct l2cap_chan *chan) 2026 { 2027 struct sock *sk; 2028 2029 sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern); 2030 if (!sk) 2031 return NULL; 2032 2033 sk->sk_destruct = l2cap_sock_destruct; 2034 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT; 2035 2036 INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy); 2037 2038 /* The sock takes ownership of the caller's reference on chan. */ 2039 l2cap_pi(sk)->chan = chan; 2040 2041 return sk; 2042 } 2043 2044 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol, 2045 int kern) 2046 { 2047 struct sock *sk; 2048 struct l2cap_chan *chan; 2049 2050 BT_DBG("sock %p", sock); 2051 2052 sock->state = SS_UNCONNECTED; 2053 2054 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM && 2055 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW) 2056 return -ESOCKTNOSUPPORT; 2057 2058 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) 2059 return -EPERM; 2060 2061 sock->ops = &l2cap_sock_ops; 2062 2063 chan = l2cap_chan_create(); 2064 if (!chan) 2065 return -ENOMEM; 2066 2067 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern, chan); 2068 if (!sk) { 2069 l2cap_chan_put(chan); 2070 return -ENOMEM; 2071 } 2072 2073 l2cap_sock_init(sk, NULL); 2074 bt_sock_link(&l2cap_sk_list, sk); 2075 return 0; 2076 } 2077 2078 static const struct proto_ops l2cap_sock_ops = { 2079 .family = PF_BLUETOOTH, 2080 .owner = THIS_MODULE, 2081 .release = l2cap_sock_release, 2082 .bind = l2cap_sock_bind, 2083 .connect = l2cap_sock_connect, 2084 .listen = l2cap_sock_listen, 2085 .accept = l2cap_sock_accept, 2086 .getname = l2cap_sock_getname, 2087 .sendmsg = l2cap_sock_sendmsg, 2088 .recvmsg = l2cap_sock_recvmsg, 2089 .poll = bt_sock_poll, 2090 .ioctl = bt_sock_ioctl, 2091 .gettstamp = sock_gettstamp, 2092 .mmap = sock_no_mmap, 2093 .socketpair = sock_no_socketpair, 2094 .shutdown = l2cap_sock_shutdown, 2095 .setsockopt = l2cap_sock_setsockopt, 2096 .getsockopt_iter = l2cap_sock_getsockopt 2097 }; 2098 2099 static const struct net_proto_family l2cap_sock_family_ops = { 2100 .family = PF_BLUETOOTH, 2101 .owner = THIS_MODULE, 2102 .create = l2cap_sock_create, 2103 }; 2104 2105 int __init l2cap_init_sockets(void) 2106 { 2107 int err; 2108 2109 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr)); 2110 2111 err = proto_register(&l2cap_proto, 0); 2112 if (err < 0) 2113 return err; 2114 2115 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops); 2116 if (err < 0) { 2117 BT_ERR("L2CAP socket registration failed"); 2118 goto error; 2119 } 2120 2121 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list, 2122 NULL); 2123 if (err < 0) { 2124 BT_ERR("Failed to create L2CAP proc file"); 2125 bt_sock_unregister(BTPROTO_L2CAP); 2126 goto error; 2127 } 2128 2129 BT_INFO("L2CAP socket layer initialized"); 2130 2131 return 0; 2132 2133 error: 2134 proto_unregister(&l2cap_proto); 2135 return err; 2136 } 2137 2138 void l2cap_cleanup_sockets(void) 2139 { 2140 bt_procfs_cleanup(&init_net, "l2cap"); 2141 bt_sock_unregister(BTPROTO_L2CAP); 2142 proto_unregister(&l2cap_proto); 2143 } 2144