1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 6 Copyright (C) 2010 Google Inc. 7 Copyright (C) 2011 ProFUSION Embedded Systems 8 9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth L2CAP sockets. */ 26 27 #include <linux/module.h> 28 #include <linux/export.h> 29 #include <linux/filter.h> 30 #include <linux/sched/signal.h> 31 #include <linux/uio.h> 32 33 #include <net/bluetooth/bluetooth.h> 34 #include <net/bluetooth/hci_core.h> 35 #include <net/bluetooth/l2cap.h> 36 37 #include "smp.h" 38 39 static struct bt_sock_list l2cap_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock) 41 }; 42 43 static const struct proto_ops l2cap_sock_ops; 44 static void l2cap_sock_init(struct sock *sk, struct sock *parent); 45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 46 int proto, gfp_t prio, int kern, 47 struct l2cap_chan *chan); 48 static void l2cap_sock_cleanup_listen(struct sock *parent); 49 50 bool l2cap_is_socket(struct socket *sock) 51 { 52 return sock && sock->ops == &l2cap_sock_ops; 53 } 54 EXPORT_SYMBOL(l2cap_is_socket); 55 56 static int l2cap_validate_bredr_psm(u16 psm) 57 { 58 /* PSM must be odd and lsb of upper byte must be 0 */ 59 if ((psm & 0x0101) != 0x0001) 60 return -EINVAL; 61 62 /* Restrict usage of well-known PSMs */ 63 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 64 return -EACCES; 65 66 return 0; 67 } 68 69 static int l2cap_validate_le_psm(u16 psm) 70 { 71 /* Valid LE_PSM ranges are defined only until 0x00ff */ 72 if (psm > L2CAP_PSM_LE_DYN_END) 73 return -EINVAL; 74 75 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */ 76 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 77 return -EACCES; 78 79 return 0; 80 } 81 82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen) 83 { 84 struct sock *sk = sock->sk; 85 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 86 struct sockaddr_l2 la; 87 int len, err = 0; 88 89 BT_DBG("sk %p", sk); 90 91 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 92 addr->sa_family != AF_BLUETOOTH) 93 return -EINVAL; 94 95 memset(&la, 0, sizeof(la)); 96 len = min_t(unsigned int, sizeof(la), alen); 97 memcpy(&la, addr, len); 98 99 if (la.l2_cid && la.l2_psm) 100 return -EINVAL; 101 102 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 103 return -EINVAL; 104 105 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 106 /* We only allow ATT user space socket */ 107 if (la.l2_cid && 108 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 109 return -EINVAL; 110 } 111 112 l2cap_chan_lock(chan); 113 lock_sock(sk); 114 115 if (sk->sk_state != BT_OPEN) { 116 err = -EBADFD; 117 goto done; 118 } 119 120 if (la.l2_psm) { 121 __u16 psm = __le16_to_cpu(la.l2_psm); 122 123 if (la.l2_bdaddr_type == BDADDR_BREDR) 124 err = l2cap_validate_bredr_psm(psm); 125 else 126 err = l2cap_validate_le_psm(psm); 127 128 if (err) 129 goto done; 130 } 131 132 bacpy(&chan->src, &la.l2_bdaddr); 133 chan->src_type = la.l2_bdaddr_type; 134 135 if (la.l2_cid) 136 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid)); 137 else 138 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm); 139 140 if (err < 0) 141 goto done; 142 143 switch (chan->chan_type) { 144 case L2CAP_CHAN_CONN_LESS: 145 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP) 146 chan->sec_level = BT_SECURITY_SDP; 147 break; 148 case L2CAP_CHAN_CONN_ORIENTED: 149 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP || 150 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM) 151 chan->sec_level = BT_SECURITY_SDP; 152 break; 153 case L2CAP_CHAN_RAW: 154 chan->sec_level = BT_SECURITY_SDP; 155 break; 156 case L2CAP_CHAN_FIXED: 157 /* Fixed channels default to the L2CAP core not holding a 158 * hci_conn reference for them. For fixed channels mapping to 159 * L2CAP sockets we do want to hold a reference so set the 160 * appropriate flag to request it. 161 */ 162 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags); 163 break; 164 } 165 166 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 167 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 168 */ 169 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 170 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 171 chan->mode = L2CAP_MODE_LE_FLOWCTL; 172 173 chan->state = BT_BOUND; 174 sk->sk_state = BT_BOUND; 175 176 done: 177 release_sock(sk); 178 l2cap_chan_unlock(chan); 179 return err; 180 } 181 182 static int l2cap_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 183 int alen, int flags) 184 { 185 struct sock *sk = sock->sk; 186 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 187 struct sockaddr_l2 la; 188 int len, err = 0; 189 bool zapped; 190 191 BT_DBG("sk %p", sk); 192 193 lock_sock(sk); 194 zapped = sock_flag(sk, SOCK_ZAPPED); 195 release_sock(sk); 196 197 if (zapped) 198 return -EINVAL; 199 200 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 201 addr->sa_family != AF_BLUETOOTH) 202 return -EINVAL; 203 204 memset(&la, 0, sizeof(la)); 205 len = min_t(unsigned int, sizeof(la), alen); 206 memcpy(&la, addr, len); 207 208 if (la.l2_cid && la.l2_psm) 209 return -EINVAL; 210 211 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 212 return -EINVAL; 213 214 /* Check that the socket wasn't bound to something that 215 * conflicts with the address given to connect(). If chan->src 216 * is BDADDR_ANY it means bind() was never used, in which case 217 * chan->src_type and la.l2_bdaddr_type do not need to match. 218 */ 219 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) && 220 bdaddr_type_is_le(la.l2_bdaddr_type)) { 221 /* Old user space versions will try to incorrectly bind 222 * the ATT socket using BDADDR_BREDR. We need to accept 223 * this and fix up the source address type only when 224 * both the source CID and destination CID indicate 225 * ATT. Anything else is an invalid combination. 226 */ 227 if (chan->scid != L2CAP_CID_ATT || 228 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 229 return -EINVAL; 230 231 /* We don't have the hdev available here to make a 232 * better decision on random vs public, but since all 233 * user space versions that exhibit this issue anyway do 234 * not support random local addresses assuming public 235 * here is good enough. 236 */ 237 chan->src_type = BDADDR_LE_PUBLIC; 238 } 239 240 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR) 241 return -EINVAL; 242 243 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 244 /* We only allow ATT user space socket */ 245 if (la.l2_cid && 246 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 247 return -EINVAL; 248 } 249 250 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 251 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 252 */ 253 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 254 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 255 chan->mode = L2CAP_MODE_LE_FLOWCTL; 256 257 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid), 258 &la.l2_bdaddr, la.l2_bdaddr_type, 259 READ_ONCE(sk->sk_sndtimeo)); 260 if (err) 261 return err; 262 263 lock_sock(sk); 264 265 err = bt_sock_wait_state(sk, BT_CONNECTED, 266 sock_sndtimeo(sk, flags & O_NONBLOCK)); 267 268 release_sock(sk); 269 270 return err; 271 } 272 273 static int l2cap_sock_listen(struct socket *sock, int backlog) 274 { 275 struct sock *sk = sock->sk; 276 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 277 int err = 0; 278 279 BT_DBG("sk %p backlog %d", sk, backlog); 280 281 lock_sock(sk); 282 283 if (sk->sk_state != BT_BOUND) { 284 err = -EBADFD; 285 goto done; 286 } 287 288 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) { 289 err = -EINVAL; 290 goto done; 291 } 292 293 switch (chan->mode) { 294 case L2CAP_MODE_BASIC: 295 case L2CAP_MODE_LE_FLOWCTL: 296 break; 297 case L2CAP_MODE_EXT_FLOWCTL: 298 if (!enable_ecred) { 299 err = -EOPNOTSUPP; 300 goto done; 301 } 302 break; 303 case L2CAP_MODE_ERTM: 304 case L2CAP_MODE_STREAMING: 305 if (!disable_ertm) 306 break; 307 fallthrough; 308 default: 309 err = -EOPNOTSUPP; 310 goto done; 311 } 312 313 sk->sk_max_ack_backlog = backlog; 314 sk->sk_ack_backlog = 0; 315 316 /* Listening channels need to use nested locking in order not to 317 * cause lockdep warnings when the created child channels end up 318 * being locked in the same thread as the parent channel. 319 */ 320 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); 321 322 chan->state = BT_LISTEN; 323 sk->sk_state = BT_LISTEN; 324 325 done: 326 release_sock(sk); 327 return err; 328 } 329 330 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, 331 struct proto_accept_arg *arg) 332 { 333 DEFINE_WAIT_FUNC(wait, woken_wake_function); 334 struct sock *sk = sock->sk, *nsk; 335 long timeo; 336 int err = 0; 337 338 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 339 340 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 341 342 BT_DBG("sk %p timeo %ld", sk, timeo); 343 344 /* Wait for an incoming connection. (wake-one). */ 345 add_wait_queue_exclusive(sk_sleep(sk), &wait); 346 while (1) { 347 if (sk->sk_state != BT_LISTEN) { 348 err = -EBADFD; 349 break; 350 } 351 352 nsk = bt_accept_dequeue(sk, newsock); 353 if (nsk) { 354 /* Drop the bridging ref from bt_accept_dequeue(); 355 * the grafted socket keeps nsk alive from here. 356 */ 357 sock_put(nsk); 358 break; 359 } 360 361 if (!timeo) { 362 err = -EAGAIN; 363 break; 364 } 365 366 if (signal_pending(current)) { 367 err = sock_intr_errno(timeo); 368 break; 369 } 370 371 release_sock(sk); 372 373 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 374 375 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 376 } 377 remove_wait_queue(sk_sleep(sk), &wait); 378 379 if (err) 380 goto done; 381 382 newsock->state = SS_CONNECTED; 383 384 BT_DBG("new socket %p", nsk); 385 386 done: 387 release_sock(sk); 388 return err; 389 } 390 391 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, 392 int peer) 393 { 394 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr; 395 struct sock *sk = sock->sk; 396 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 397 398 BT_DBG("sock %p, sk %p", sock, sk); 399 400 if (peer && sk->sk_state != BT_CONNECTED && 401 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 && 402 sk->sk_state != BT_CONFIG) 403 return -ENOTCONN; 404 405 memset(la, 0, sizeof(struct sockaddr_l2)); 406 addr->sa_family = AF_BLUETOOTH; 407 408 la->l2_psm = chan->psm; 409 410 if (peer) { 411 bacpy(&la->l2_bdaddr, &chan->dst); 412 la->l2_cid = cpu_to_le16(chan->dcid); 413 la->l2_bdaddr_type = chan->dst_type; 414 } else { 415 bacpy(&la->l2_bdaddr, &chan->src); 416 la->l2_cid = cpu_to_le16(chan->scid); 417 la->l2_bdaddr_type = chan->src_type; 418 } 419 420 return sizeof(struct sockaddr_l2); 421 } 422 423 static int l2cap_get_mode(struct l2cap_chan *chan) 424 { 425 switch (chan->mode) { 426 case L2CAP_MODE_BASIC: 427 return BT_MODE_BASIC; 428 case L2CAP_MODE_ERTM: 429 return BT_MODE_ERTM; 430 case L2CAP_MODE_STREAMING: 431 return BT_MODE_STREAMING; 432 case L2CAP_MODE_LE_FLOWCTL: 433 return BT_MODE_LE_FLOWCTL; 434 case L2CAP_MODE_EXT_FLOWCTL: 435 return BT_MODE_EXT_FLOWCTL; 436 } 437 438 return -EINVAL; 439 } 440 441 static struct l2cap_conn *l2cap_chan_conn(struct l2cap_chan *chan) 442 { 443 lockdep_assert_held(&chan->lock); 444 445 /* l2cap_conn_del() sets FLAG_DEL while holding chan->lock before 446 * conn->hcon is deleted. If not set and conn is non-NULL, conn->hcon 447 * remains alive during this chan->lock critical section. 448 */ 449 if (test_bit(FLAG_DEL, &chan->flags)) 450 return NULL; 451 452 return chan->conn; 453 } 454 455 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, 456 sockopt_t *sopt) 457 { 458 struct sock *sk = sock->sk; 459 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 460 struct l2cap_conn *conn; 461 struct l2cap_options opts; 462 struct l2cap_conninfo cinfo; 463 int err = 0; 464 size_t len; 465 u32 opt; 466 467 BT_DBG("sk %p", sk); 468 469 len = sopt->optlen; 470 471 l2cap_chan_lock(chan); 472 lock_sock(sk); 473 474 switch (optname) { 475 case L2CAP_OPTIONS: 476 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since 477 * legacy ATT code depends on getsockopt for 478 * L2CAP_OPTIONS we need to let this pass. 479 */ 480 if (bdaddr_type_is_le(chan->src_type) && 481 chan->scid != L2CAP_CID_ATT) { 482 err = -EINVAL; 483 break; 484 } 485 486 /* Only BR/EDR modes are supported here */ 487 switch (chan->mode) { 488 case L2CAP_MODE_BASIC: 489 case L2CAP_MODE_ERTM: 490 case L2CAP_MODE_STREAMING: 491 break; 492 default: 493 err = -EINVAL; 494 break; 495 } 496 497 if (err < 0) 498 break; 499 500 memset(&opts, 0, sizeof(opts)); 501 opts.imtu = chan->imtu; 502 opts.omtu = chan->omtu; 503 opts.flush_to = chan->flush_to; 504 opts.mode = chan->mode; 505 opts.fcs = chan->fcs; 506 opts.max_tx = chan->max_tx; 507 opts.txwin_size = chan->tx_win; 508 509 BT_DBG("mode 0x%2.2x", chan->mode); 510 511 len = min(len, sizeof(opts)); 512 if (copy_to_iter(&opts, len, &sopt->iter_out) != len) 513 err = -EFAULT; 514 515 break; 516 517 case L2CAP_LM: 518 switch (chan->sec_level) { 519 case BT_SECURITY_LOW: 520 opt = L2CAP_LM_AUTH; 521 break; 522 case BT_SECURITY_MEDIUM: 523 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT; 524 break; 525 case BT_SECURITY_HIGH: 526 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 527 L2CAP_LM_SECURE; 528 break; 529 case BT_SECURITY_FIPS: 530 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 531 L2CAP_LM_SECURE | L2CAP_LM_FIPS; 532 break; 533 default: 534 opt = 0; 535 break; 536 } 537 538 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags)) 539 opt |= L2CAP_LM_MASTER; 540 541 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 542 opt |= L2CAP_LM_RELIABLE; 543 544 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 545 sizeof(opt)) 546 err = -EFAULT; 547 548 break; 549 550 case L2CAP_CONNINFO: 551 if (sk->sk_state != BT_CONNECTED && 552 !(sk->sk_state == BT_CONNECT2 && 553 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 554 err = -ENOTCONN; 555 break; 556 } 557 558 conn = l2cap_chan_conn(chan); 559 if (!conn) { 560 err = -ENOTCONN; 561 break; 562 } 563 564 memset(&cinfo, 0, sizeof(cinfo)); 565 cinfo.hci_handle = conn->hcon->handle; 566 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3); 567 568 len = min(len, sizeof(cinfo)); 569 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 570 err = -EFAULT; 571 572 break; 573 574 default: 575 err = -ENOPROTOOPT; 576 break; 577 } 578 579 release_sock(sk); 580 l2cap_chan_unlock(chan); 581 582 return err; 583 } 584 585 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, 586 sockopt_t *sopt) 587 { 588 struct sock *sk = sock->sk; 589 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 590 struct l2cap_conn *conn; 591 struct bt_security sec; 592 struct bt_power pwr; 593 int len, mode, err = 0; 594 u32 opt; 595 u16 mtu; 596 u8 mval; 597 598 BT_DBG("sk %p", sk); 599 600 if (level == SOL_L2CAP) 601 return l2cap_sock_getsockopt_old(sock, optname, sopt); 602 603 if (level != SOL_BLUETOOTH) 604 return -ENOPROTOOPT; 605 606 len = sopt->optlen; 607 608 l2cap_chan_lock(chan); 609 lock_sock(sk); 610 611 switch (optname) { 612 case BT_SECURITY: 613 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 614 chan->chan_type != L2CAP_CHAN_FIXED && 615 chan->chan_type != L2CAP_CHAN_RAW) { 616 err = -EINVAL; 617 break; 618 } 619 620 conn = l2cap_chan_conn(chan); 621 622 memset(&sec, 0, sizeof(sec)); 623 if (conn) { 624 sec.level = conn->hcon->sec_level; 625 626 if (sk->sk_state == BT_CONNECTED) 627 sec.key_size = conn->hcon->enc_key_size; 628 } else { 629 sec.level = chan->sec_level; 630 } 631 632 len = min_t(unsigned int, len, sizeof(sec)); 633 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 634 err = -EFAULT; 635 636 break; 637 638 case BT_DEFER_SETUP: 639 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 640 err = -EINVAL; 641 break; 642 } 643 644 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 645 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 646 sizeof(opt)) 647 err = -EFAULT; 648 649 break; 650 651 case BT_FLUSHABLE: 652 opt = test_bit(FLAG_FLUSHABLE, &chan->flags); 653 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 654 sizeof(opt)) 655 err = -EFAULT; 656 657 break; 658 659 case BT_POWER: 660 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM 661 && sk->sk_type != SOCK_RAW) { 662 err = -EINVAL; 663 break; 664 } 665 666 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 667 668 len = min_t(unsigned int, len, sizeof(pwr)); 669 if (copy_to_iter(&pwr, len, &sopt->iter_out) != len) 670 err = -EFAULT; 671 672 break; 673 674 case BT_CHANNEL_POLICY: 675 opt = chan->chan_policy; 676 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 677 sizeof(opt)) 678 err = -EFAULT; 679 break; 680 681 case BT_SNDMTU: 682 if (!bdaddr_type_is_le(chan->src_type)) { 683 err = -EINVAL; 684 break; 685 } 686 687 if (sk->sk_state != BT_CONNECTED) { 688 err = -ENOTCONN; 689 break; 690 } 691 692 mtu = chan->omtu; 693 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 694 sizeof(mtu)) 695 err = -EFAULT; 696 break; 697 698 case BT_RCVMTU: 699 if (!bdaddr_type_is_le(chan->src_type)) { 700 err = -EINVAL; 701 break; 702 } 703 704 mtu = chan->imtu; 705 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 706 sizeof(mtu)) 707 err = -EFAULT; 708 break; 709 710 case BT_PHY: 711 conn = l2cap_chan_conn(chan); 712 713 if (sk->sk_state != BT_CONNECTED || !conn) { 714 err = -ENOTCONN; 715 break; 716 } 717 718 opt = hci_conn_get_phy(conn->hcon); 719 720 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 721 sizeof(opt)) 722 err = -EFAULT; 723 break; 724 725 case BT_MODE: 726 if (!enable_ecred) { 727 err = -ENOPROTOOPT; 728 break; 729 } 730 731 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 732 err = -EINVAL; 733 break; 734 } 735 736 mode = l2cap_get_mode(chan); 737 if (mode < 0) { 738 err = mode; 739 break; 740 } 741 742 mval = mode; 743 if (copy_to_iter(&mval, sizeof(mval), &sopt->iter_out) != 744 sizeof(mval)) 745 err = -EFAULT; 746 break; 747 748 default: 749 err = -ENOPROTOOPT; 750 break; 751 } 752 753 release_sock(sk); 754 l2cap_chan_unlock(chan); 755 return err; 756 } 757 758 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu) 759 { 760 switch (chan->scid) { 761 case L2CAP_CID_ATT: 762 if (mtu && mtu < L2CAP_LE_MIN_MTU) 763 return false; 764 break; 765 766 default: 767 if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU) 768 return false; 769 } 770 771 return true; 772 } 773 774 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 775 sockptr_t optval, unsigned int optlen) 776 { 777 struct sock *sk = sock->sk; 778 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 779 struct l2cap_options opts; 780 int err = 0; 781 u32 opt; 782 783 BT_DBG("sk %p", sk); 784 785 l2cap_chan_lock(chan); 786 lock_sock(sk); 787 788 switch (optname) { 789 case L2CAP_OPTIONS: 790 if (bdaddr_type_is_le(chan->src_type)) { 791 err = -EINVAL; 792 break; 793 } 794 795 if (sk->sk_state == BT_CONNECTED) { 796 err = -EINVAL; 797 break; 798 } 799 800 opts.imtu = chan->imtu; 801 opts.omtu = chan->omtu; 802 opts.flush_to = chan->flush_to; 803 opts.mode = chan->mode; 804 opts.fcs = chan->fcs; 805 opts.max_tx = chan->max_tx; 806 opts.txwin_size = chan->tx_win; 807 808 err = copy_safe_from_sockptr(&opts, sizeof(opts), optval, 809 optlen); 810 if (err) 811 break; 812 813 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { 814 err = -EINVAL; 815 break; 816 } 817 818 /* A zero TxWindow is invalid, use the default instead */ 819 if (!opts.txwin_size) 820 opts.txwin_size = L2CAP_DEFAULT_TX_WINDOW; 821 822 if (!l2cap_valid_mtu(chan, opts.imtu)) { 823 err = -EINVAL; 824 break; 825 } 826 827 /* Only BR/EDR modes are supported here */ 828 switch (opts.mode) { 829 case L2CAP_MODE_BASIC: 830 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 831 break; 832 case L2CAP_MODE_ERTM: 833 case L2CAP_MODE_STREAMING: 834 if (!disable_ertm) 835 break; 836 fallthrough; 837 default: 838 err = -EINVAL; 839 break; 840 } 841 842 if (err < 0) 843 break; 844 845 chan->mode = opts.mode; 846 847 BT_DBG("mode 0x%2.2x", chan->mode); 848 849 chan->imtu = opts.imtu; 850 chan->omtu = opts.omtu; 851 chan->fcs = opts.fcs; 852 chan->max_tx = opts.max_tx; 853 chan->tx_win = opts.txwin_size; 854 chan->flush_to = opts.flush_to; 855 break; 856 857 case L2CAP_LM: 858 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 859 if (err) 860 break; 861 862 if (opt & L2CAP_LM_FIPS) { 863 err = -EINVAL; 864 break; 865 } 866 867 if (opt & L2CAP_LM_AUTH) 868 chan->sec_level = BT_SECURITY_LOW; 869 if (opt & L2CAP_LM_ENCRYPT) 870 chan->sec_level = BT_SECURITY_MEDIUM; 871 if (opt & L2CAP_LM_SECURE) 872 chan->sec_level = BT_SECURITY_HIGH; 873 874 assign_bit(FLAG_ROLE_SWITCH, &chan->flags, 875 opt & L2CAP_LM_MASTER); 876 877 assign_bit(FLAG_FORCE_RELIABLE, &chan->flags, 878 opt & L2CAP_LM_RELIABLE); 879 break; 880 881 default: 882 err = -ENOPROTOOPT; 883 break; 884 } 885 886 release_sock(sk); 887 l2cap_chan_unlock(chan); 888 return err; 889 } 890 891 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode) 892 { 893 switch (mode) { 894 case BT_MODE_BASIC: 895 if (bdaddr_type_is_le(chan->src_type)) 896 return -EINVAL; 897 mode = L2CAP_MODE_BASIC; 898 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 899 break; 900 case BT_MODE_ERTM: 901 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 902 return -EINVAL; 903 mode = L2CAP_MODE_ERTM; 904 break; 905 case BT_MODE_STREAMING: 906 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 907 return -EINVAL; 908 mode = L2CAP_MODE_STREAMING; 909 break; 910 case BT_MODE_LE_FLOWCTL: 911 if (!bdaddr_type_is_le(chan->src_type)) 912 return -EINVAL; 913 mode = L2CAP_MODE_LE_FLOWCTL; 914 break; 915 case BT_MODE_EXT_FLOWCTL: 916 /* TODO: Add support for ECRED PDUs to BR/EDR */ 917 if (!bdaddr_type_is_le(chan->src_type)) 918 return -EINVAL; 919 mode = L2CAP_MODE_EXT_FLOWCTL; 920 break; 921 default: 922 return -EINVAL; 923 } 924 925 chan->mode = mode; 926 927 return 0; 928 } 929 930 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 931 sockptr_t optval, unsigned int optlen) 932 { 933 struct sock *sk = sock->sk; 934 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 935 struct bt_security sec; 936 struct bt_power pwr; 937 struct l2cap_conn *conn; 938 int err = 0; 939 u32 opt, phys; 940 u16 mtu; 941 u8 mode; 942 943 BT_DBG("sk %p", sk); 944 945 if (level == SOL_L2CAP) 946 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen); 947 948 if (level != SOL_BLUETOOTH) 949 return -ENOPROTOOPT; 950 951 l2cap_chan_lock(chan); 952 lock_sock(sk); 953 954 switch (optname) { 955 case BT_SECURITY: 956 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 957 chan->chan_type != L2CAP_CHAN_FIXED && 958 chan->chan_type != L2CAP_CHAN_RAW) { 959 err = -EINVAL; 960 break; 961 } 962 963 sec.level = BT_SECURITY_LOW; 964 965 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 966 if (err) 967 break; 968 969 if (sec.level < BT_SECURITY_LOW || 970 sec.level > BT_SECURITY_FIPS) { 971 err = -EINVAL; 972 break; 973 } 974 975 chan->sec_level = sec.level; 976 977 conn = l2cap_chan_conn(chan); 978 if (!conn) 979 break; 980 981 /* change security for LE channels */ 982 if (chan->scid == L2CAP_CID_ATT) { 983 if (smp_conn_security(conn->hcon, sec.level)) { 984 err = -EINVAL; 985 break; 986 } 987 988 set_bit(FLAG_PENDING_SECURITY, &chan->flags); 989 sk->sk_state = BT_CONFIG; 990 chan->state = BT_CONFIG; 991 992 /* or for ACL link */ 993 } else if ((sk->sk_state == BT_CONNECT2 && 994 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) || 995 sk->sk_state == BT_CONNECTED) { 996 if (!l2cap_chan_check_security(chan, true)) 997 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 998 else 999 sk->sk_state_change(sk); 1000 } else { 1001 err = -EINVAL; 1002 } 1003 break; 1004 1005 case BT_DEFER_SETUP: 1006 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1007 err = -EINVAL; 1008 break; 1009 } 1010 1011 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1012 if (err) 1013 break; 1014 1015 if (opt) { 1016 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1017 set_bit(FLAG_DEFER_SETUP, &chan->flags); 1018 } else { 1019 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1020 clear_bit(FLAG_DEFER_SETUP, &chan->flags); 1021 } 1022 break; 1023 1024 case BT_FLUSHABLE: 1025 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1026 if (err) 1027 break; 1028 1029 if (opt > BT_FLUSHABLE_ON) { 1030 err = -EINVAL; 1031 break; 1032 } 1033 1034 if (opt == BT_FLUSHABLE_OFF) { 1035 conn = l2cap_chan_conn(chan); 1036 1037 /* proceed further only when we have l2cap_conn and 1038 No Flush support in the LM */ 1039 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) { 1040 err = -EINVAL; 1041 break; 1042 } 1043 } 1044 1045 assign_bit(FLAG_FLUSHABLE, &chan->flags, opt); 1046 break; 1047 1048 case BT_POWER: 1049 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 1050 chan->chan_type != L2CAP_CHAN_RAW) { 1051 err = -EINVAL; 1052 break; 1053 } 1054 1055 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; 1056 1057 err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen); 1058 if (err) 1059 break; 1060 1061 assign_bit(FLAG_FORCE_ACTIVE, &chan->flags, pwr.force_active); 1062 break; 1063 1064 case BT_CHANNEL_POLICY: 1065 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1066 if (err) 1067 break; 1068 1069 err = -EOPNOTSUPP; 1070 break; 1071 1072 case BT_SNDMTU: 1073 if (!bdaddr_type_is_le(chan->src_type)) { 1074 err = -EINVAL; 1075 break; 1076 } 1077 1078 /* Only allow setting output MTU when not connected */ 1079 if (sk->sk_state == BT_CONNECTED) { 1080 err = -EISCONN; 1081 break; 1082 } 1083 1084 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1085 if (err) 1086 break; 1087 1088 chan->omtu = mtu; 1089 break; 1090 1091 case BT_RCVMTU: 1092 if (!bdaddr_type_is_le(chan->src_type)) { 1093 err = -EINVAL; 1094 break; 1095 } 1096 1097 if (chan->mode == L2CAP_MODE_LE_FLOWCTL && 1098 sk->sk_state == BT_CONNECTED) { 1099 err = -EISCONN; 1100 break; 1101 } 1102 1103 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1104 if (err) 1105 break; 1106 1107 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && 1108 sk->sk_state == BT_CONNECTED) 1109 err = l2cap_chan_reconfigure(chan, mtu); 1110 else 1111 chan->imtu = mtu; 1112 1113 break; 1114 1115 case BT_PHY: 1116 conn = l2cap_chan_conn(chan); 1117 if (sk->sk_state != BT_CONNECTED || !conn) { 1118 err = -ENOTCONN; 1119 break; 1120 } 1121 1122 err = copy_safe_from_sockptr(&phys, sizeof(phys), optval, 1123 optlen); 1124 if (err) 1125 break; 1126 1127 err = hci_conn_set_phy(conn->hcon, phys); 1128 break; 1129 1130 case BT_MODE: 1131 if (!enable_ecred) { 1132 err = -ENOPROTOOPT; 1133 break; 1134 } 1135 1136 BT_DBG("sk->sk_state %u", sk->sk_state); 1137 1138 if (sk->sk_state != BT_BOUND) { 1139 err = -EINVAL; 1140 break; 1141 } 1142 1143 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1144 err = -EINVAL; 1145 break; 1146 } 1147 1148 err = copy_safe_from_sockptr(&mode, sizeof(mode), optval, 1149 optlen); 1150 if (err) 1151 break; 1152 1153 BT_DBG("mode %u", mode); 1154 1155 err = l2cap_set_mode(chan, mode); 1156 if (err) 1157 break; 1158 1159 BT_DBG("mode 0x%2.2x", chan->mode); 1160 1161 break; 1162 1163 default: 1164 err = -ENOPROTOOPT; 1165 break; 1166 } 1167 1168 release_sock(sk); 1169 l2cap_chan_unlock(chan); 1170 return err; 1171 } 1172 1173 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1174 size_t len) 1175 { 1176 struct sock *sk = sock->sk; 1177 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1178 struct sockcm_cookie sockc; 1179 int err; 1180 1181 BT_DBG("sock %p, sk %p", sock, sk); 1182 1183 err = sock_error(sk); 1184 if (err) 1185 return err; 1186 1187 if (msg->msg_flags & MSG_OOB) 1188 return -EOPNOTSUPP; 1189 1190 if (sk->sk_state != BT_CONNECTED) 1191 return -ENOTCONN; 1192 1193 hci_sockcm_init(&sockc, sk); 1194 1195 if (msg->msg_controllen) { 1196 err = sock_cmsg_send(sk, msg, &sockc); 1197 if (err) 1198 return err; 1199 } 1200 1201 lock_sock(sk); 1202 err = bt_sock_wait_ready(sk, msg->msg_flags); 1203 release_sock(sk); 1204 if (err) 1205 return err; 1206 1207 l2cap_chan_lock(chan); 1208 err = l2cap_chan_send(chan, msg, len, &sockc); 1209 l2cap_chan_unlock(chan); 1210 1211 return err; 1212 } 1213 1214 static void l2cap_publish_rx_avail(struct l2cap_chan *chan) 1215 { 1216 struct sock *sk = chan->data; 1217 ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc); 1218 int expected_skbs, skb_overhead; 1219 1220 if (avail <= 0) { 1221 l2cap_chan_rx_avail(chan, 0); 1222 return; 1223 } 1224 1225 if (!chan->mps) { 1226 l2cap_chan_rx_avail(chan, -1); 1227 return; 1228 } 1229 1230 /* Correct available memory by estimated sk_buff overhead. 1231 * This is significant due to small transfer sizes. However, accept 1232 * at least one full packet if receive space is non-zero. 1233 */ 1234 expected_skbs = DIV_ROUND_UP(avail, chan->mps); 1235 skb_overhead = expected_skbs * sizeof(struct sk_buff); 1236 if (skb_overhead < avail) 1237 l2cap_chan_rx_avail(chan, avail - skb_overhead); 1238 else 1239 l2cap_chan_rx_avail(chan, -1); 1240 } 1241 1242 static int l2cap_sock_defer(struct sock *sk) 1243 { 1244 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1245 bool have_conn; 1246 int err = 0; 1247 1248 /* Fast path check */ 1249 lock_sock(sk); 1250 if (sk->sk_state != BT_CONNECT2) { 1251 release_sock(sk); 1252 return 0; 1253 } 1254 release_sock(sk); 1255 1256 have_conn = l2cap_chan_lock_conn(chan); 1257 lock_sock(sk); 1258 1259 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP, 1260 &bt_sk(sk)->flags)) { 1261 err = 1; 1262 1263 if (!have_conn) { 1264 release_sock(sk); 1265 err = -ENOTCONN; 1266 } else if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 1267 sk->sk_state = BT_CONNECTED; 1268 chan->state = BT_CONNECTED; 1269 release_sock(sk); 1270 __l2cap_ecred_conn_rsp_defer(chan); 1271 } else if (bdaddr_type_is_le(chan->src_type)) { 1272 sk->sk_state = BT_CONNECTED; 1273 chan->state = BT_CONNECTED; 1274 release_sock(sk); 1275 __l2cap_le_connect_rsp_defer(chan); 1276 } else { 1277 sk->sk_state = BT_CONFIG; 1278 chan->state = BT_CONFIG; 1279 release_sock(sk); 1280 __l2cap_connect_rsp_defer(chan); 1281 } 1282 } else { 1283 release_sock(sk); 1284 } 1285 1286 l2cap_chan_unlock_conn(chan, have_conn); 1287 return err; 1288 } 1289 1290 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1291 size_t len, int flags) 1292 { 1293 struct sock *sk = sock->sk; 1294 struct l2cap_pinfo *pi = l2cap_pi(sk); 1295 int err; 1296 1297 if (unlikely(flags & MSG_ERRQUEUE)) 1298 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 1299 BT_SCM_ERROR); 1300 1301 err = l2cap_sock_defer(sk); 1302 if (err) 1303 return err < 0 ? err : 0; 1304 1305 if (sock->type == SOCK_STREAM) 1306 err = bt_sock_stream_recvmsg(sock, msg, len, flags); 1307 else 1308 err = bt_sock_recvmsg(sock, msg, len, flags); 1309 1310 if (pi->chan->mode != L2CAP_MODE_ERTM && 1311 pi->chan->mode != L2CAP_MODE_LE_FLOWCTL && 1312 pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL) 1313 return err; 1314 1315 lock_sock(sk); 1316 1317 l2cap_publish_rx_avail(pi->chan); 1318 1319 /* Attempt to put pending rx data in the socket buffer */ 1320 while (!list_empty(&pi->rx_busy)) { 1321 struct l2cap_rx_busy *rx_busy = 1322 list_first_entry(&pi->rx_busy, 1323 struct l2cap_rx_busy, 1324 list); 1325 if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0) 1326 goto done; 1327 list_del(&rx_busy->list); 1328 kfree(rx_busy); 1329 } 1330 1331 /* Restore data flow when half of the receive buffer is 1332 * available. This avoids resending large numbers of 1333 * frames. 1334 */ 1335 if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) && 1336 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1) 1337 l2cap_chan_busy(pi->chan, 0); 1338 1339 done: 1340 release_sock(sk); 1341 return err; 1342 } 1343 1344 /* Release the sock's ref on chan and clear the pointer so that the ref is 1345 * dropped exactly once even if both l2cap_sock_kill() and 1346 * l2cap_sock_destruct() run. Setting chan->data to NULL first stops any other 1347 * task from dereferencing the now-dead sock pointer. 1348 */ 1349 static void l2cap_sock_put_chan(struct sock *sk) 1350 { 1351 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1352 1353 if (!chan) 1354 return; 1355 1356 chan->data = NULL; 1357 l2cap_pi(sk)->chan = NULL; 1358 l2cap_chan_put(chan); 1359 } 1360 1361 /* Kill socket (only if zapped and orphan) 1362 * Must be called on unlocked socket, with l2cap channel lock. 1363 */ 1364 static void l2cap_sock_kill(struct sock *sk) 1365 { 1366 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 1367 return; 1368 1369 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); 1370 1371 /* Take lock to synchronize against access without owning sk->sk_socket, 1372 * eg. in l2cap_sock_cleanup_listen(). proto_ops etc. don't need lock. 1373 */ 1374 lock_sock(sk); 1375 l2cap_sock_put_chan(sk); 1376 release_sock(sk); 1377 1378 /* Kill poor orphan */ 1379 sock_set_flag(sk, SOCK_DEAD); 1380 sock_put(sk); 1381 } 1382 1383 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan) 1384 { 1385 DECLARE_WAITQUEUE(wait, current); 1386 int err = 0; 1387 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1388 /* Timeout to prevent infinite loop */ 1389 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT; 1390 1391 add_wait_queue(sk_sleep(sk), &wait); 1392 set_current_state(TASK_INTERRUPTIBLE); 1393 do { 1394 BT_DBG("Waiting for %d ACKs, timeout %04d ms", 1395 chan->unacked_frames, time_after(jiffies, timeout) ? 0 : 1396 jiffies_to_msecs(timeout - jiffies)); 1397 1398 if (!timeo) 1399 timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1400 1401 if (signal_pending(current)) { 1402 err = sock_intr_errno(timeo); 1403 break; 1404 } 1405 1406 release_sock(sk); 1407 timeo = schedule_timeout(timeo); 1408 lock_sock(sk); 1409 set_current_state(TASK_INTERRUPTIBLE); 1410 1411 err = sock_error(sk); 1412 if (err) 1413 break; 1414 1415 if (time_after(jiffies, timeout)) { 1416 err = -ENOLINK; 1417 break; 1418 } 1419 1420 } while (chan->unacked_frames > 0 && 1421 chan->state == BT_CONNECTED); 1422 1423 set_current_state(TASK_RUNNING); 1424 remove_wait_queue(sk_sleep(sk), &wait); 1425 return err; 1426 } 1427 1428 static int l2cap_sock_shutdown(struct socket *sock, int how) 1429 __context_unsafe(/* complex chan->conn locking */) 1430 { 1431 struct sock *sk = sock->sk; 1432 struct l2cap_chan *chan; 1433 int err = 0; 1434 1435 BT_DBG("sock %p, sk %p, how %d", sock, sk, how); 1436 1437 /* 'how' parameter is mapped to sk_shutdown as follows: 1438 * SHUT_RD (0) --> RCV_SHUTDOWN (1) 1439 * SHUT_WR (1) --> SEND_SHUTDOWN (2) 1440 * SHUT_RDWR (2) --> SHUTDOWN_MASK (3) 1441 */ 1442 how++; 1443 1444 if (!sk) 1445 return 0; 1446 1447 lock_sock(sk); 1448 1449 if ((sk->sk_shutdown & how) == how) 1450 goto shutdown_already; 1451 1452 BT_DBG("Handling sock shutdown"); 1453 1454 /* prevent sk structure from being freed whilst unlocked */ 1455 sock_hold(sk); 1456 1457 /* prevent chan structure from being freed whilst unlocked */ 1458 chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); 1459 if (!chan) 1460 goto shutdown_already; 1461 1462 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1463 1464 if (chan->mode == L2CAP_MODE_ERTM && 1465 chan->unacked_frames > 0 && 1466 chan->state == BT_CONNECTED) { 1467 err = __l2cap_wait_ack(sk, chan); 1468 1469 /* After waiting for ACKs, check whether shutdown 1470 * has already been actioned to close the L2CAP 1471 * link such as by l2cap_disconnection_req(). 1472 */ 1473 if ((sk->sk_shutdown & how) == how) 1474 goto shutdown_matched; 1475 } 1476 1477 /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN 1478 * is already set 1479 */ 1480 if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) { 1481 sk->sk_shutdown |= RCV_SHUTDOWN; 1482 if ((sk->sk_shutdown & how) == how) 1483 goto shutdown_matched; 1484 } 1485 1486 sk->sk_shutdown |= SEND_SHUTDOWN; 1487 release_sock(sk); 1488 1489 l2cap_chan_close_unlocked(chan, 0); 1490 1491 lock_sock(sk); 1492 1493 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1494 !(current->flags & PF_EXITING)) 1495 err = bt_sock_wait_state(sk, BT_CLOSED, 1496 sk->sk_lingertime); 1497 1498 shutdown_matched: 1499 l2cap_chan_put(chan); 1500 sock_put(sk); 1501 1502 shutdown_already: 1503 if (!err && sk->sk_err) 1504 err = -sk->sk_err; 1505 1506 release_sock(sk); 1507 1508 BT_DBG("Sock shutdown complete err: %d", err); 1509 1510 return err; 1511 } 1512 1513 static int l2cap_sock_release(struct socket *sock) 1514 { 1515 struct sock *sk = sock->sk; 1516 int err; 1517 struct l2cap_chan *chan; 1518 1519 BT_DBG("sock %p, sk %p", sock, sk); 1520 1521 if (!sk) 1522 return 0; 1523 1524 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 1525 l2cap_sock_cleanup_listen(sk); 1526 release_sock(sk); 1527 1528 bt_sock_unlink(&l2cap_sk_list, sk); 1529 1530 err = l2cap_sock_shutdown(sock, SHUT_RDWR); 1531 chan = l2cap_pi(sk)->chan; 1532 1533 l2cap_chan_hold(chan); 1534 l2cap_chan_lock(chan); 1535 1536 sock_orphan(sk); 1537 l2cap_sock_kill(sk); 1538 1539 l2cap_chan_unlock(chan); 1540 l2cap_chan_put(chan); 1541 1542 return err; 1543 } 1544 1545 static void l2cap_sock_cleanup_listen(struct sock *parent) 1546 { 1547 struct sock *sk; 1548 1549 BT_DBG("parent %p state %s", parent, 1550 state_to_string(parent->sk_state)); 1551 1552 /* Close not yet accepted channels. 1553 * 1554 * bt_accept_dequeue() returns sk with its temporary queue-walk 1555 * reference held, so a concurrent l2cap_conn_del() 1556 * -> l2cap_sock_kill() cannot free sk under us. 1557 * 1558 * cleanup_listen() runs under the parent sk lock, so unlike 1559 * l2cap_sock_shutdown() we must NOT take conn->lock here: that would 1560 * establish sk_lock -> conn->lock and invert the established 1561 * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock). 1562 * 1563 * Instead, briefly take the child sk lock to synchronize vs. 1564 * l2cap_sock_kill that puts l2cap_pi(sk)->chan. We then drop the sk 1565 * lock before taking chan->lock, so sk and chan locks are never held 1566 * together. 1567 * 1568 * Since we cannot call l2cap_chan_close() without conn->lock, 1569 * schedule l2cap_chan_timeout to close the channel; it already 1570 * acquires conn->lock -> chan->lock in the correct order. 1571 */ 1572 while ((sk = bt_accept_dequeue(parent, NULL))) { 1573 struct l2cap_chan *chan; 1574 1575 lock_sock_nested(sk, L2CAP_NESTING_NORMAL); 1576 chan = l2cap_pi(sk)->chan; 1577 if (chan) 1578 l2cap_chan_hold(chan); 1579 release_sock(sk); 1580 if (!chan) { 1581 /* Already torn down */ 1582 sock_put(sk); 1583 continue; 1584 } 1585 1586 BT_DBG("child chan %p state %s", chan, 1587 state_to_string(chan->state)); 1588 1589 l2cap_chan_lock(chan); 1590 /* Since we cannot call l2cap_chan_close() without 1591 * conn->lock, schedule its timer to trigger the close 1592 * and cleanup of this channel. 1593 */ 1594 if (chan->conn) 1595 __set_chan_timer(chan, 0); 1596 l2cap_chan_unlock(chan); 1597 1598 l2cap_chan_put(chan); 1599 sock_put(sk); 1600 } 1601 } 1602 1603 static int l2cap_sock_new_connection_cb(struct l2cap_chan *chan, 1604 struct l2cap_chan *new_chan) 1605 { 1606 struct sock *sk, *parent = chan->data; 1607 1608 if (!parent) 1609 return -EINVAL; 1610 1611 lock_sock(parent); 1612 1613 if (parent->sk_state != BT_LISTEN) { 1614 release_sock(parent); 1615 return -EINVAL; 1616 } 1617 1618 /* Check for backlog size */ 1619 if (sk_acceptq_is_full(parent)) { 1620 BT_DBG("backlog full %d", parent->sk_ack_backlog); 1621 release_sock(parent); 1622 return -ENOBUFS; 1623 } 1624 1625 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, 1626 GFP_ATOMIC, 0, new_chan); 1627 if (!sk) { 1628 release_sock(parent); 1629 return -ENOMEM; 1630 } 1631 1632 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP); 1633 1634 l2cap_sock_init(sk, parent); 1635 1636 /* The conn list reference taken by l2cap_new_connection() keeps new_chan 1637 * alive once release_sock() lets another task free this socket. 1638 */ 1639 bt_accept_enqueue(parent, sk, false); 1640 1641 release_sock(parent); 1642 1643 return 0; 1644 } 1645 1646 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 1647 { 1648 struct sock *sk; 1649 struct l2cap_pinfo *pi; 1650 int err; 1651 1652 sk = chan->data; 1653 if (!sk) 1654 return -ENXIO; 1655 1656 pi = l2cap_pi(sk); 1657 lock_sock(sk); 1658 if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) { 1659 err = -ENOMEM; 1660 goto done; 1661 } 1662 1663 if (chan->mode != L2CAP_MODE_ERTM && 1664 chan->mode != L2CAP_MODE_STREAMING && 1665 chan->mode != L2CAP_MODE_LE_FLOWCTL && 1666 chan->mode != L2CAP_MODE_EXT_FLOWCTL) { 1667 /* Even if no filter is attached, we could potentially 1668 * get errors from security modules, etc. 1669 */ 1670 err = sk_filter(sk, skb); 1671 if (err) 1672 goto done; 1673 } 1674 1675 err = __sock_queue_rcv_skb(sk, skb); 1676 1677 l2cap_publish_rx_avail(chan); 1678 1679 /* For ERTM and LE, handle a skb that doesn't fit into the recv 1680 * buffer. This is important to do because the data frames 1681 * have already been acked, so the skb cannot be discarded. 1682 * 1683 * Notify the l2cap core that the buffer is full, so the 1684 * LOCAL_BUSY state is entered and no more frames are 1685 * acked and reassembled until there is buffer space 1686 * available. 1687 */ 1688 if (err < 0 && 1689 (chan->mode == L2CAP_MODE_ERTM || 1690 chan->mode == L2CAP_MODE_LE_FLOWCTL || 1691 chan->mode == L2CAP_MODE_EXT_FLOWCTL)) { 1692 struct l2cap_rx_busy *rx_busy = kmalloc_obj(*rx_busy); 1693 if (!rx_busy) { 1694 err = -ENOMEM; 1695 goto done; 1696 } 1697 rx_busy->skb = skb; 1698 list_add_tail(&rx_busy->list, &pi->rx_busy); 1699 l2cap_chan_busy(chan, 1); 1700 err = 0; 1701 } 1702 1703 done: 1704 release_sock(sk); 1705 1706 return err; 1707 } 1708 1709 static void l2cap_sock_close_cb(struct l2cap_chan *chan) 1710 { 1711 struct sock *sk = chan->data; 1712 1713 if (!sk) 1714 return; 1715 1716 l2cap_sock_kill(sk); 1717 } 1718 1719 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) 1720 { 1721 struct sock *sk = chan->data; 1722 struct sock *parent; 1723 1724 if (!sk) 1725 return; 1726 1727 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1728 1729 /* This callback can be called both for server (BT_LISTEN) 1730 * sockets as well as "normal" ones. To avoid lockdep warnings 1731 * with child socket locking (through l2cap_sock_cleanup_listen) 1732 * we need separation into separate nesting levels. The simplest 1733 * way to accomplish this is to inherit the nesting level used 1734 * for the channel. 1735 */ 1736 lock_sock_nested(sk, atomic_read(&chan->nesting)); 1737 1738 parent = bt_sk(sk)->parent; 1739 1740 switch (chan->state) { 1741 case BT_OPEN: 1742 case BT_BOUND: 1743 case BT_CLOSED: 1744 break; 1745 case BT_LISTEN: 1746 l2cap_sock_cleanup_listen(sk); 1747 sk->sk_state = BT_CLOSED; 1748 chan->state = BT_CLOSED; 1749 1750 break; 1751 default: 1752 sk->sk_state = BT_CLOSED; 1753 chan->state = BT_CLOSED; 1754 1755 sk->sk_err = err; 1756 1757 if (parent) { 1758 /* 1759 * Keep the listener alive after unlinking the 1760 * child. 1761 */ 1762 sock_hold(parent); 1763 bt_accept_unlink(sk); 1764 parent->sk_data_ready(parent); 1765 sock_put(parent); 1766 } else { 1767 sk->sk_state_change(sk); 1768 } 1769 1770 break; 1771 } 1772 release_sock(sk); 1773 1774 /* Only zap after cleanup to avoid use after free race */ 1775 sock_set_flag(sk, SOCK_ZAPPED); 1776 1777 } 1778 1779 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, 1780 int err) 1781 { 1782 struct sock *sk = chan->data; 1783 1784 if (!sk) 1785 return; 1786 1787 lock_sock(sk); 1788 1789 sk->sk_state = state; 1790 1791 if (err) 1792 sk->sk_err = err; 1793 1794 release_sock(sk); 1795 } 1796 1797 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, 1798 unsigned long hdr_len, 1799 unsigned long len, int nb) 1800 __must_hold(&chan->lock) 1801 { 1802 struct sock *sk = chan->data; 1803 struct sk_buff *skb; 1804 int err; 1805 1806 l2cap_chan_unlock(chan); 1807 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err); 1808 l2cap_chan_lock(chan); 1809 1810 if (!skb) 1811 return ERR_PTR(err); 1812 1813 /* Channel lock is released before requesting new skb and then 1814 * reacquired thus we need to recheck channel state. 1815 */ 1816 if (chan->state != BT_CONNECTED) { 1817 kfree_skb(skb); 1818 return ERR_PTR(-ENOTCONN); 1819 } 1820 1821 skb->priority = READ_ONCE(sk->sk_priority); 1822 1823 bt_cb(skb)->l2cap.chan = chan; 1824 1825 return skb; 1826 } 1827 1828 static void l2cap_sock_ready_cb(struct l2cap_chan *chan) 1829 { 1830 struct sock *sk = chan->data; 1831 struct sock *parent; 1832 1833 if (!sk) 1834 return; 1835 1836 lock_sock(sk); 1837 1838 parent = bt_sk(sk)->parent; 1839 1840 BT_DBG("sk %p, parent %p", sk, parent); 1841 1842 sk->sk_state = BT_CONNECTED; 1843 sk->sk_state_change(sk); 1844 1845 if (parent) 1846 parent->sk_data_ready(parent); 1847 1848 release_sock(sk); 1849 } 1850 1851 static void l2cap_sock_defer_cb(struct l2cap_chan *chan) 1852 { 1853 struct sock *parent, *sk = chan->data; 1854 1855 lock_sock(sk); 1856 1857 parent = bt_sk(sk)->parent; 1858 if (parent) 1859 parent->sk_data_ready(parent); 1860 1861 release_sock(sk); 1862 } 1863 1864 static void l2cap_sock_resume_cb(struct l2cap_chan *chan) 1865 { 1866 struct sock *sk = chan->data; 1867 1868 if (!sk) 1869 return; 1870 1871 lock_sock(sk); 1872 1873 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) { 1874 sk->sk_state = BT_CONNECTED; 1875 chan->state = BT_CONNECTED; 1876 } 1877 1878 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1879 sk->sk_state_change(sk); 1880 1881 release_sock(sk); 1882 } 1883 1884 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan) 1885 { 1886 struct sock *sk = chan->data; 1887 1888 lock_sock(sk); 1889 sk->sk_shutdown = SHUTDOWN_MASK; 1890 release_sock(sk); 1891 } 1892 1893 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan) 1894 { 1895 struct sock *sk = chan->data; 1896 1897 if (!sk) 1898 return 0; 1899 1900 return READ_ONCE(sk->sk_sndtimeo); 1901 } 1902 1903 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan) 1904 { 1905 struct sock *sk = chan->data; 1906 1907 return sk->sk_peer_pid; 1908 } 1909 1910 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) 1911 { 1912 struct sock *sk = chan->data; 1913 1914 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1915 sk->sk_state_change(sk); 1916 } 1917 1918 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) 1919 { 1920 struct sock *sk = chan->data; 1921 1922 switch (chan->mode) { 1923 case L2CAP_MODE_ERTM: 1924 case L2CAP_MODE_STREAMING: 1925 return sk_filter(sk, skb); 1926 } 1927 1928 return 0; 1929 } 1930 1931 static const struct l2cap_ops l2cap_chan_ops = { 1932 .name = "L2CAP Socket Interface", 1933 .new_connection = l2cap_sock_new_connection_cb, 1934 .recv = l2cap_sock_recv_cb, 1935 .close = l2cap_sock_close_cb, 1936 .teardown = l2cap_sock_teardown_cb, 1937 .state_change = l2cap_sock_state_change_cb, 1938 .ready = l2cap_sock_ready_cb, 1939 .defer = l2cap_sock_defer_cb, 1940 .resume = l2cap_sock_resume_cb, 1941 .suspend = l2cap_sock_suspend_cb, 1942 .set_shutdown = l2cap_sock_set_shutdown_cb, 1943 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, 1944 .get_peer_pid = l2cap_sock_get_peer_pid_cb, 1945 .alloc_skb = l2cap_sock_alloc_skb_cb, 1946 .filter = l2cap_sock_filter, 1947 }; 1948 1949 static void l2cap_sock_destruct(struct sock *sk) 1950 { 1951 struct l2cap_rx_busy *rx_busy, *next; 1952 1953 BT_DBG("sk %p", sk); 1954 1955 l2cap_sock_put_chan(sk); 1956 1957 list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) { 1958 kfree_skb(rx_busy->skb); 1959 list_del(&rx_busy->list); 1960 kfree(rx_busy); 1961 } 1962 1963 skb_queue_purge(&sk->sk_receive_queue); 1964 skb_queue_purge(&sk->sk_write_queue); 1965 skb_queue_purge(&sk->sk_error_queue); 1966 } 1967 1968 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name, 1969 int *msg_namelen) 1970 { 1971 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name); 1972 1973 memset(la, 0, sizeof(struct sockaddr_l2)); 1974 la->l2_family = AF_BLUETOOTH; 1975 la->l2_psm = bt_cb(skb)->l2cap.psm; 1976 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr); 1977 1978 *msg_namelen = sizeof(struct sockaddr_l2); 1979 } 1980 1981 static void l2cap_sock_init(struct sock *sk, struct sock *parent) 1982 { 1983 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1984 1985 BT_DBG("sk %p", sk); 1986 1987 if (parent) { 1988 sk->sk_type = parent->sk_type; 1989 bt_sk(sk)->flags = bt_sk(parent)->flags; 1990 1991 /* Channel configuration is inherited from the parent by 1992 * l2cap_new_connection(). 1993 */ 1994 security_sk_clone(parent, sk); 1995 } else { 1996 switch (sk->sk_type) { 1997 case SOCK_RAW: 1998 chan->chan_type = L2CAP_CHAN_RAW; 1999 break; 2000 case SOCK_DGRAM: 2001 chan->chan_type = L2CAP_CHAN_CONN_LESS; 2002 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name; 2003 break; 2004 case SOCK_SEQPACKET: 2005 case SOCK_STREAM: 2006 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED; 2007 break; 2008 } 2009 2010 chan->imtu = L2CAP_DEFAULT_MTU; 2011 chan->omtu = 0; 2012 if (!disable_ertm && sk->sk_type == SOCK_STREAM) { 2013 chan->mode = L2CAP_MODE_ERTM; 2014 set_bit(CONF_STATE2_DEVICE, &chan->conf_state); 2015 } else { 2016 chan->mode = L2CAP_MODE_BASIC; 2017 } 2018 2019 l2cap_chan_set_defaults(chan, NULL); 2020 } 2021 2022 /* Default config options */ 2023 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 2024 2025 chan->data = sk; 2026 chan->ops = &l2cap_chan_ops; 2027 2028 l2cap_publish_rx_avail(chan); 2029 } 2030 2031 static struct proto l2cap_proto = { 2032 .name = "L2CAP", 2033 .owner = THIS_MODULE, 2034 .obj_size = sizeof(struct l2cap_pinfo) 2035 }; 2036 2037 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 2038 int proto, gfp_t prio, int kern, 2039 struct l2cap_chan *chan) 2040 { 2041 struct sock *sk; 2042 2043 sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern); 2044 if (!sk) 2045 return NULL; 2046 2047 sk->sk_destruct = l2cap_sock_destruct; 2048 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT; 2049 2050 INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy); 2051 2052 /* The sock takes ownership of the caller's reference on chan. */ 2053 l2cap_pi(sk)->chan = chan; 2054 2055 return sk; 2056 } 2057 2058 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol, 2059 int kern) 2060 { 2061 struct sock *sk; 2062 struct l2cap_chan *chan; 2063 2064 BT_DBG("sock %p", sock); 2065 2066 sock->state = SS_UNCONNECTED; 2067 2068 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM && 2069 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW) 2070 return -ESOCKTNOSUPPORT; 2071 2072 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) 2073 return -EPERM; 2074 2075 sock->ops = &l2cap_sock_ops; 2076 2077 chan = l2cap_chan_create(); 2078 if (!chan) 2079 return -ENOMEM; 2080 2081 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern, chan); 2082 if (!sk) { 2083 l2cap_chan_put(chan); 2084 return -ENOMEM; 2085 } 2086 2087 l2cap_sock_init(sk, NULL); 2088 bt_sock_link(&l2cap_sk_list, sk); 2089 return 0; 2090 } 2091 2092 static const struct proto_ops l2cap_sock_ops = { 2093 .family = PF_BLUETOOTH, 2094 .owner = THIS_MODULE, 2095 .release = l2cap_sock_release, 2096 .bind = l2cap_sock_bind, 2097 .connect = l2cap_sock_connect, 2098 .listen = l2cap_sock_listen, 2099 .accept = l2cap_sock_accept, 2100 .getname = l2cap_sock_getname, 2101 .sendmsg = l2cap_sock_sendmsg, 2102 .recvmsg = l2cap_sock_recvmsg, 2103 .poll = bt_sock_poll, 2104 .ioctl = bt_sock_ioctl, 2105 .gettstamp = sock_gettstamp, 2106 .mmap = sock_no_mmap, 2107 .socketpair = sock_no_socketpair, 2108 .shutdown = l2cap_sock_shutdown, 2109 .setsockopt = l2cap_sock_setsockopt, 2110 .getsockopt_iter = l2cap_sock_getsockopt 2111 }; 2112 2113 static const struct net_proto_family l2cap_sock_family_ops = { 2114 .family = PF_BLUETOOTH, 2115 .owner = THIS_MODULE, 2116 .create = l2cap_sock_create, 2117 }; 2118 2119 int __init l2cap_init_sockets(void) 2120 { 2121 int err; 2122 2123 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr)); 2124 2125 err = proto_register(&l2cap_proto, 0); 2126 if (err < 0) 2127 return err; 2128 2129 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops); 2130 if (err < 0) { 2131 BT_ERR("L2CAP socket registration failed"); 2132 goto error; 2133 } 2134 2135 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list, 2136 NULL); 2137 if (err < 0) { 2138 BT_ERR("Failed to create L2CAP proc file"); 2139 bt_sock_unregister(BTPROTO_L2CAP); 2140 goto error; 2141 } 2142 2143 BT_INFO("L2CAP socket layer initialized"); 2144 2145 return 0; 2146 2147 error: 2148 proto_unregister(&l2cap_proto); 2149 return err; 2150 } 2151 2152 void l2cap_cleanup_sockets(void) 2153 { 2154 bt_procfs_cleanup(&init_net, "l2cap"); 2155 bt_sock_unregister(BTPROTO_L2CAP); 2156 proto_unregister(&l2cap_proto); 2157 } 2158