1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 6 Copyright (C) 2010 Google Inc. 7 Copyright (C) 2011 ProFUSION Embedded Systems 8 9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth L2CAP sockets. */ 26 27 #include <linux/module.h> 28 #include <linux/export.h> 29 #include <linux/filter.h> 30 #include <linux/sched/signal.h> 31 #include <linux/uio.h> 32 33 #include <net/bluetooth/bluetooth.h> 34 #include <net/bluetooth/hci_core.h> 35 #include <net/bluetooth/l2cap.h> 36 37 #include "smp.h" 38 39 static struct bt_sock_list l2cap_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock) 41 }; 42 43 static const struct proto_ops l2cap_sock_ops; 44 static void l2cap_sock_init(struct sock *sk, struct sock *parent); 45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 46 int proto, gfp_t prio, int kern, 47 struct l2cap_chan *chan); 48 static void l2cap_sock_cleanup_listen(struct sock *parent); 49 50 bool l2cap_is_socket(struct socket *sock) 51 { 52 return sock && sock->ops == &l2cap_sock_ops; 53 } 54 EXPORT_SYMBOL(l2cap_is_socket); 55 56 static int l2cap_validate_bredr_psm(u16 psm) 57 { 58 /* PSM must be odd and lsb of upper byte must be 0 */ 59 if ((psm & 0x0101) != 0x0001) 60 return -EINVAL; 61 62 /* Restrict usage of well-known PSMs */ 63 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 64 return -EACCES; 65 66 return 0; 67 } 68 69 static int l2cap_validate_le_psm(u16 psm) 70 { 71 /* Valid LE_PSM ranges are defined only until 0x00ff */ 72 if (psm > L2CAP_PSM_LE_DYN_END) 73 return -EINVAL; 74 75 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */ 76 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 77 return -EACCES; 78 79 return 0; 80 } 81 82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen) 83 { 84 struct sock *sk = sock->sk; 85 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 86 struct sockaddr_l2 la; 87 int len, err = 0; 88 89 BT_DBG("sk %p", sk); 90 91 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 92 addr->sa_family != AF_BLUETOOTH) 93 return -EINVAL; 94 95 memset(&la, 0, sizeof(la)); 96 len = min_t(unsigned int, sizeof(la), alen); 97 memcpy(&la, addr, len); 98 99 if (la.l2_cid && la.l2_psm) 100 return -EINVAL; 101 102 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 103 return -EINVAL; 104 105 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 106 /* We only allow ATT user space socket */ 107 if (la.l2_cid && 108 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 109 return -EINVAL; 110 } 111 112 lock_sock(sk); 113 114 if (sk->sk_state != BT_OPEN) { 115 err = -EBADFD; 116 goto done; 117 } 118 119 if (la.l2_psm) { 120 __u16 psm = __le16_to_cpu(la.l2_psm); 121 122 if (la.l2_bdaddr_type == BDADDR_BREDR) 123 err = l2cap_validate_bredr_psm(psm); 124 else 125 err = l2cap_validate_le_psm(psm); 126 127 if (err) 128 goto done; 129 } 130 131 bacpy(&chan->src, &la.l2_bdaddr); 132 chan->src_type = la.l2_bdaddr_type; 133 134 if (la.l2_cid) 135 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid)); 136 else 137 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm); 138 139 if (err < 0) 140 goto done; 141 142 switch (chan->chan_type) { 143 case L2CAP_CHAN_CONN_LESS: 144 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP) 145 chan->sec_level = BT_SECURITY_SDP; 146 break; 147 case L2CAP_CHAN_CONN_ORIENTED: 148 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP || 149 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM) 150 chan->sec_level = BT_SECURITY_SDP; 151 break; 152 case L2CAP_CHAN_RAW: 153 chan->sec_level = BT_SECURITY_SDP; 154 break; 155 case L2CAP_CHAN_FIXED: 156 /* Fixed channels default to the L2CAP core not holding a 157 * hci_conn reference for them. For fixed channels mapping to 158 * L2CAP sockets we do want to hold a reference so set the 159 * appropriate flag to request it. 160 */ 161 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags); 162 break; 163 } 164 165 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 166 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 167 */ 168 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 169 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 170 chan->mode = L2CAP_MODE_LE_FLOWCTL; 171 172 chan->state = BT_BOUND; 173 sk->sk_state = BT_BOUND; 174 175 done: 176 release_sock(sk); 177 return err; 178 } 179 180 static int l2cap_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 181 int alen, int flags) 182 { 183 struct sock *sk = sock->sk; 184 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 185 struct sockaddr_l2 la; 186 int len, err = 0; 187 bool zapped; 188 189 BT_DBG("sk %p", sk); 190 191 lock_sock(sk); 192 zapped = sock_flag(sk, SOCK_ZAPPED); 193 release_sock(sk); 194 195 if (zapped) 196 return -EINVAL; 197 198 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 199 addr->sa_family != AF_BLUETOOTH) 200 return -EINVAL; 201 202 memset(&la, 0, sizeof(la)); 203 len = min_t(unsigned int, sizeof(la), alen); 204 memcpy(&la, addr, len); 205 206 if (la.l2_cid && la.l2_psm) 207 return -EINVAL; 208 209 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 210 return -EINVAL; 211 212 /* Check that the socket wasn't bound to something that 213 * conflicts with the address given to connect(). If chan->src 214 * is BDADDR_ANY it means bind() was never used, in which case 215 * chan->src_type and la.l2_bdaddr_type do not need to match. 216 */ 217 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) && 218 bdaddr_type_is_le(la.l2_bdaddr_type)) { 219 /* Old user space versions will try to incorrectly bind 220 * the ATT socket using BDADDR_BREDR. We need to accept 221 * this and fix up the source address type only when 222 * both the source CID and destination CID indicate 223 * ATT. Anything else is an invalid combination. 224 */ 225 if (chan->scid != L2CAP_CID_ATT || 226 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 227 return -EINVAL; 228 229 /* We don't have the hdev available here to make a 230 * better decision on random vs public, but since all 231 * user space versions that exhibit this issue anyway do 232 * not support random local addresses assuming public 233 * here is good enough. 234 */ 235 chan->src_type = BDADDR_LE_PUBLIC; 236 } 237 238 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR) 239 return -EINVAL; 240 241 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 242 /* We only allow ATT user space socket */ 243 if (la.l2_cid && 244 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 245 return -EINVAL; 246 } 247 248 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 249 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 250 */ 251 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 252 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 253 chan->mode = L2CAP_MODE_LE_FLOWCTL; 254 255 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid), 256 &la.l2_bdaddr, la.l2_bdaddr_type, 257 READ_ONCE(sk->sk_sndtimeo)); 258 if (err) 259 return err; 260 261 lock_sock(sk); 262 263 err = bt_sock_wait_state(sk, BT_CONNECTED, 264 sock_sndtimeo(sk, flags & O_NONBLOCK)); 265 266 release_sock(sk); 267 268 return err; 269 } 270 271 static int l2cap_sock_listen(struct socket *sock, int backlog) 272 { 273 struct sock *sk = sock->sk; 274 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 275 int err = 0; 276 277 BT_DBG("sk %p backlog %d", sk, backlog); 278 279 lock_sock(sk); 280 281 if (sk->sk_state != BT_BOUND) { 282 err = -EBADFD; 283 goto done; 284 } 285 286 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) { 287 err = -EINVAL; 288 goto done; 289 } 290 291 switch (chan->mode) { 292 case L2CAP_MODE_BASIC: 293 case L2CAP_MODE_LE_FLOWCTL: 294 break; 295 case L2CAP_MODE_EXT_FLOWCTL: 296 if (!enable_ecred) { 297 err = -EOPNOTSUPP; 298 goto done; 299 } 300 break; 301 case L2CAP_MODE_ERTM: 302 case L2CAP_MODE_STREAMING: 303 if (!disable_ertm) 304 break; 305 fallthrough; 306 default: 307 err = -EOPNOTSUPP; 308 goto done; 309 } 310 311 sk->sk_max_ack_backlog = backlog; 312 sk->sk_ack_backlog = 0; 313 314 /* Listening channels need to use nested locking in order not to 315 * cause lockdep warnings when the created child channels end up 316 * being locked in the same thread as the parent channel. 317 */ 318 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); 319 320 chan->state = BT_LISTEN; 321 sk->sk_state = BT_LISTEN; 322 323 done: 324 release_sock(sk); 325 return err; 326 } 327 328 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, 329 struct proto_accept_arg *arg) 330 { 331 DEFINE_WAIT_FUNC(wait, woken_wake_function); 332 struct sock *sk = sock->sk, *nsk; 333 long timeo; 334 int err = 0; 335 336 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 337 338 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 339 340 BT_DBG("sk %p timeo %ld", sk, timeo); 341 342 /* Wait for an incoming connection. (wake-one). */ 343 add_wait_queue_exclusive(sk_sleep(sk), &wait); 344 while (1) { 345 if (sk->sk_state != BT_LISTEN) { 346 err = -EBADFD; 347 break; 348 } 349 350 nsk = bt_accept_dequeue(sk, newsock); 351 if (nsk) { 352 /* Drop the bridging ref from bt_accept_dequeue(); 353 * the grafted socket keeps nsk alive from here. 354 */ 355 sock_put(nsk); 356 break; 357 } 358 359 if (!timeo) { 360 err = -EAGAIN; 361 break; 362 } 363 364 if (signal_pending(current)) { 365 err = sock_intr_errno(timeo); 366 break; 367 } 368 369 release_sock(sk); 370 371 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 372 373 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 374 } 375 remove_wait_queue(sk_sleep(sk), &wait); 376 377 if (err) 378 goto done; 379 380 newsock->state = SS_CONNECTED; 381 382 BT_DBG("new socket %p", nsk); 383 384 done: 385 release_sock(sk); 386 return err; 387 } 388 389 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, 390 int peer) 391 { 392 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr; 393 struct sock *sk = sock->sk; 394 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 395 396 BT_DBG("sock %p, sk %p", sock, sk); 397 398 if (peer && sk->sk_state != BT_CONNECTED && 399 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 && 400 sk->sk_state != BT_CONFIG) 401 return -ENOTCONN; 402 403 memset(la, 0, sizeof(struct sockaddr_l2)); 404 addr->sa_family = AF_BLUETOOTH; 405 406 la->l2_psm = chan->psm; 407 408 if (peer) { 409 bacpy(&la->l2_bdaddr, &chan->dst); 410 la->l2_cid = cpu_to_le16(chan->dcid); 411 la->l2_bdaddr_type = chan->dst_type; 412 } else { 413 bacpy(&la->l2_bdaddr, &chan->src); 414 la->l2_cid = cpu_to_le16(chan->scid); 415 la->l2_bdaddr_type = chan->src_type; 416 } 417 418 return sizeof(struct sockaddr_l2); 419 } 420 421 static int l2cap_get_mode(struct l2cap_chan *chan) 422 { 423 switch (chan->mode) { 424 case L2CAP_MODE_BASIC: 425 return BT_MODE_BASIC; 426 case L2CAP_MODE_ERTM: 427 return BT_MODE_ERTM; 428 case L2CAP_MODE_STREAMING: 429 return BT_MODE_STREAMING; 430 case L2CAP_MODE_LE_FLOWCTL: 431 return BT_MODE_LE_FLOWCTL; 432 case L2CAP_MODE_EXT_FLOWCTL: 433 return BT_MODE_EXT_FLOWCTL; 434 } 435 436 return -EINVAL; 437 } 438 439 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, 440 sockopt_t *sopt) 441 { 442 struct sock *sk = sock->sk; 443 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 444 struct l2cap_options opts; 445 struct l2cap_conninfo cinfo; 446 int err = 0; 447 size_t len; 448 u32 opt; 449 450 BT_DBG("sk %p", sk); 451 452 len = sopt->optlen; 453 454 lock_sock(sk); 455 456 switch (optname) { 457 case L2CAP_OPTIONS: 458 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since 459 * legacy ATT code depends on getsockopt for 460 * L2CAP_OPTIONS we need to let this pass. 461 */ 462 if (bdaddr_type_is_le(chan->src_type) && 463 chan->scid != L2CAP_CID_ATT) { 464 err = -EINVAL; 465 break; 466 } 467 468 /* Only BR/EDR modes are supported here */ 469 switch (chan->mode) { 470 case L2CAP_MODE_BASIC: 471 case L2CAP_MODE_ERTM: 472 case L2CAP_MODE_STREAMING: 473 break; 474 default: 475 err = -EINVAL; 476 break; 477 } 478 479 if (err < 0) 480 break; 481 482 memset(&opts, 0, sizeof(opts)); 483 opts.imtu = chan->imtu; 484 opts.omtu = chan->omtu; 485 opts.flush_to = chan->flush_to; 486 opts.mode = chan->mode; 487 opts.fcs = chan->fcs; 488 opts.max_tx = chan->max_tx; 489 opts.txwin_size = chan->tx_win; 490 491 BT_DBG("mode 0x%2.2x", chan->mode); 492 493 len = min(len, sizeof(opts)); 494 if (copy_to_iter(&opts, len, &sopt->iter_out) != len) 495 err = -EFAULT; 496 497 break; 498 499 case L2CAP_LM: 500 switch (chan->sec_level) { 501 case BT_SECURITY_LOW: 502 opt = L2CAP_LM_AUTH; 503 break; 504 case BT_SECURITY_MEDIUM: 505 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT; 506 break; 507 case BT_SECURITY_HIGH: 508 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 509 L2CAP_LM_SECURE; 510 break; 511 case BT_SECURITY_FIPS: 512 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 513 L2CAP_LM_SECURE | L2CAP_LM_FIPS; 514 break; 515 default: 516 opt = 0; 517 break; 518 } 519 520 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags)) 521 opt |= L2CAP_LM_MASTER; 522 523 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 524 opt |= L2CAP_LM_RELIABLE; 525 526 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 527 sizeof(opt)) 528 err = -EFAULT; 529 530 break; 531 532 case L2CAP_CONNINFO: 533 if (sk->sk_state != BT_CONNECTED && 534 !(sk->sk_state == BT_CONNECT2 && 535 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 536 err = -ENOTCONN; 537 break; 538 } 539 540 memset(&cinfo, 0, sizeof(cinfo)); 541 cinfo.hci_handle = chan->conn->hcon->handle; 542 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3); 543 544 len = min(len, sizeof(cinfo)); 545 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 546 err = -EFAULT; 547 548 break; 549 550 default: 551 err = -ENOPROTOOPT; 552 break; 553 } 554 555 release_sock(sk); 556 return err; 557 } 558 559 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, 560 sockopt_t *sopt) 561 { 562 struct sock *sk = sock->sk; 563 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 564 struct bt_security sec; 565 struct bt_power pwr; 566 int len, mode, err = 0; 567 u32 opt; 568 u16 mtu; 569 u8 mval; 570 571 BT_DBG("sk %p", sk); 572 573 if (level == SOL_L2CAP) 574 return l2cap_sock_getsockopt_old(sock, optname, sopt); 575 576 if (level != SOL_BLUETOOTH) 577 return -ENOPROTOOPT; 578 579 len = sopt->optlen; 580 581 lock_sock(sk); 582 583 switch (optname) { 584 case BT_SECURITY: 585 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 586 chan->chan_type != L2CAP_CHAN_FIXED && 587 chan->chan_type != L2CAP_CHAN_RAW) { 588 err = -EINVAL; 589 break; 590 } 591 592 memset(&sec, 0, sizeof(sec)); 593 if (chan->conn) { 594 sec.level = chan->conn->hcon->sec_level; 595 596 if (sk->sk_state == BT_CONNECTED) 597 sec.key_size = chan->conn->hcon->enc_key_size; 598 } else { 599 sec.level = chan->sec_level; 600 } 601 602 len = min_t(unsigned int, len, sizeof(sec)); 603 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 604 err = -EFAULT; 605 606 break; 607 608 case BT_DEFER_SETUP: 609 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 610 err = -EINVAL; 611 break; 612 } 613 614 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 615 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 616 sizeof(opt)) 617 err = -EFAULT; 618 619 break; 620 621 case BT_FLUSHABLE: 622 opt = test_bit(FLAG_FLUSHABLE, &chan->flags); 623 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 624 sizeof(opt)) 625 err = -EFAULT; 626 627 break; 628 629 case BT_POWER: 630 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM 631 && sk->sk_type != SOCK_RAW) { 632 err = -EINVAL; 633 break; 634 } 635 636 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 637 638 len = min_t(unsigned int, len, sizeof(pwr)); 639 if (copy_to_iter(&pwr, len, &sopt->iter_out) != len) 640 err = -EFAULT; 641 642 break; 643 644 case BT_CHANNEL_POLICY: 645 opt = chan->chan_policy; 646 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 647 sizeof(opt)) 648 err = -EFAULT; 649 break; 650 651 case BT_SNDMTU: 652 if (!bdaddr_type_is_le(chan->src_type)) { 653 err = -EINVAL; 654 break; 655 } 656 657 if (sk->sk_state != BT_CONNECTED) { 658 err = -ENOTCONN; 659 break; 660 } 661 662 mtu = chan->omtu; 663 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 664 sizeof(mtu)) 665 err = -EFAULT; 666 break; 667 668 case BT_RCVMTU: 669 if (!bdaddr_type_is_le(chan->src_type)) { 670 err = -EINVAL; 671 break; 672 } 673 674 mtu = chan->imtu; 675 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 676 sizeof(mtu)) 677 err = -EFAULT; 678 break; 679 680 case BT_PHY: 681 if (sk->sk_state != BT_CONNECTED) { 682 err = -ENOTCONN; 683 break; 684 } 685 686 opt = hci_conn_get_phy(chan->conn->hcon); 687 688 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 689 sizeof(opt)) 690 err = -EFAULT; 691 break; 692 693 case BT_MODE: 694 if (!enable_ecred) { 695 err = -ENOPROTOOPT; 696 break; 697 } 698 699 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 700 err = -EINVAL; 701 break; 702 } 703 704 mode = l2cap_get_mode(chan); 705 if (mode < 0) { 706 err = mode; 707 break; 708 } 709 710 mval = mode; 711 if (copy_to_iter(&mval, sizeof(mval), &sopt->iter_out) != 712 sizeof(mval)) 713 err = -EFAULT; 714 break; 715 716 default: 717 err = -ENOPROTOOPT; 718 break; 719 } 720 721 release_sock(sk); 722 return err; 723 } 724 725 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu) 726 { 727 switch (chan->scid) { 728 case L2CAP_CID_ATT: 729 if (mtu && mtu < L2CAP_LE_MIN_MTU) 730 return false; 731 break; 732 733 default: 734 if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU) 735 return false; 736 } 737 738 return true; 739 } 740 741 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 742 sockptr_t optval, unsigned int optlen) 743 { 744 struct sock *sk = sock->sk; 745 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 746 struct l2cap_options opts; 747 int err = 0; 748 u32 opt; 749 750 BT_DBG("sk %p", sk); 751 752 lock_sock(sk); 753 754 switch (optname) { 755 case L2CAP_OPTIONS: 756 if (bdaddr_type_is_le(chan->src_type)) { 757 err = -EINVAL; 758 break; 759 } 760 761 if (sk->sk_state == BT_CONNECTED) { 762 err = -EINVAL; 763 break; 764 } 765 766 opts.imtu = chan->imtu; 767 opts.omtu = chan->omtu; 768 opts.flush_to = chan->flush_to; 769 opts.mode = chan->mode; 770 opts.fcs = chan->fcs; 771 opts.max_tx = chan->max_tx; 772 opts.txwin_size = chan->tx_win; 773 774 err = copy_safe_from_sockptr(&opts, sizeof(opts), optval, 775 optlen); 776 if (err) 777 break; 778 779 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { 780 err = -EINVAL; 781 break; 782 } 783 784 if (!l2cap_valid_mtu(chan, opts.imtu)) { 785 err = -EINVAL; 786 break; 787 } 788 789 /* Only BR/EDR modes are supported here */ 790 switch (opts.mode) { 791 case L2CAP_MODE_BASIC: 792 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 793 break; 794 case L2CAP_MODE_ERTM: 795 case L2CAP_MODE_STREAMING: 796 if (!disable_ertm) 797 break; 798 fallthrough; 799 default: 800 err = -EINVAL; 801 break; 802 } 803 804 if (err < 0) 805 break; 806 807 chan->mode = opts.mode; 808 809 BT_DBG("mode 0x%2.2x", chan->mode); 810 811 chan->imtu = opts.imtu; 812 chan->omtu = opts.omtu; 813 chan->fcs = opts.fcs; 814 chan->max_tx = opts.max_tx; 815 chan->tx_win = opts.txwin_size; 816 chan->flush_to = opts.flush_to; 817 break; 818 819 case L2CAP_LM: 820 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 821 if (err) 822 break; 823 824 if (opt & L2CAP_LM_FIPS) { 825 err = -EINVAL; 826 break; 827 } 828 829 if (opt & L2CAP_LM_AUTH) 830 chan->sec_level = BT_SECURITY_LOW; 831 if (opt & L2CAP_LM_ENCRYPT) 832 chan->sec_level = BT_SECURITY_MEDIUM; 833 if (opt & L2CAP_LM_SECURE) 834 chan->sec_level = BT_SECURITY_HIGH; 835 836 if (opt & L2CAP_LM_MASTER) 837 set_bit(FLAG_ROLE_SWITCH, &chan->flags); 838 else 839 clear_bit(FLAG_ROLE_SWITCH, &chan->flags); 840 841 if (opt & L2CAP_LM_RELIABLE) 842 set_bit(FLAG_FORCE_RELIABLE, &chan->flags); 843 else 844 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags); 845 break; 846 847 default: 848 err = -ENOPROTOOPT; 849 break; 850 } 851 852 release_sock(sk); 853 return err; 854 } 855 856 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode) 857 { 858 switch (mode) { 859 case BT_MODE_BASIC: 860 if (bdaddr_type_is_le(chan->src_type)) 861 return -EINVAL; 862 mode = L2CAP_MODE_BASIC; 863 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 864 break; 865 case BT_MODE_ERTM: 866 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 867 return -EINVAL; 868 mode = L2CAP_MODE_ERTM; 869 break; 870 case BT_MODE_STREAMING: 871 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 872 return -EINVAL; 873 mode = L2CAP_MODE_STREAMING; 874 break; 875 case BT_MODE_LE_FLOWCTL: 876 if (!bdaddr_type_is_le(chan->src_type)) 877 return -EINVAL; 878 mode = L2CAP_MODE_LE_FLOWCTL; 879 break; 880 case BT_MODE_EXT_FLOWCTL: 881 /* TODO: Add support for ECRED PDUs to BR/EDR */ 882 if (!bdaddr_type_is_le(chan->src_type)) 883 return -EINVAL; 884 mode = L2CAP_MODE_EXT_FLOWCTL; 885 break; 886 default: 887 return -EINVAL; 888 } 889 890 chan->mode = mode; 891 892 return 0; 893 } 894 895 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 896 sockptr_t optval, unsigned int optlen) 897 { 898 struct sock *sk = sock->sk; 899 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 900 struct bt_security sec; 901 struct bt_power pwr; 902 struct l2cap_conn *conn; 903 int err = 0; 904 u32 opt, phys; 905 u16 mtu; 906 u8 mode; 907 908 BT_DBG("sk %p", sk); 909 910 if (level == SOL_L2CAP) 911 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen); 912 913 if (level != SOL_BLUETOOTH) 914 return -ENOPROTOOPT; 915 916 lock_sock(sk); 917 918 switch (optname) { 919 case BT_SECURITY: 920 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 921 chan->chan_type != L2CAP_CHAN_FIXED && 922 chan->chan_type != L2CAP_CHAN_RAW) { 923 err = -EINVAL; 924 break; 925 } 926 927 sec.level = BT_SECURITY_LOW; 928 929 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 930 if (err) 931 break; 932 933 if (sec.level < BT_SECURITY_LOW || 934 sec.level > BT_SECURITY_FIPS) { 935 err = -EINVAL; 936 break; 937 } 938 939 chan->sec_level = sec.level; 940 941 if (!chan->conn) 942 break; 943 944 conn = chan->conn; 945 946 /* change security for LE channels */ 947 if (chan->scid == L2CAP_CID_ATT) { 948 if (smp_conn_security(conn->hcon, sec.level)) { 949 err = -EINVAL; 950 break; 951 } 952 953 set_bit(FLAG_PENDING_SECURITY, &chan->flags); 954 sk->sk_state = BT_CONFIG; 955 chan->state = BT_CONFIG; 956 957 /* or for ACL link */ 958 } else if ((sk->sk_state == BT_CONNECT2 && 959 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) || 960 sk->sk_state == BT_CONNECTED) { 961 if (!l2cap_chan_check_security(chan, true)) 962 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 963 else 964 sk->sk_state_change(sk); 965 } else { 966 err = -EINVAL; 967 } 968 break; 969 970 case BT_DEFER_SETUP: 971 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 972 err = -EINVAL; 973 break; 974 } 975 976 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 977 if (err) 978 break; 979 980 if (opt) { 981 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 982 set_bit(FLAG_DEFER_SETUP, &chan->flags); 983 } else { 984 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 985 clear_bit(FLAG_DEFER_SETUP, &chan->flags); 986 } 987 break; 988 989 case BT_FLUSHABLE: 990 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 991 if (err) 992 break; 993 994 if (opt > BT_FLUSHABLE_ON) { 995 err = -EINVAL; 996 break; 997 } 998 999 if (opt == BT_FLUSHABLE_OFF) { 1000 conn = chan->conn; 1001 /* proceed further only when we have l2cap_conn and 1002 No Flush support in the LM */ 1003 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) { 1004 err = -EINVAL; 1005 break; 1006 } 1007 } 1008 1009 if (opt) 1010 set_bit(FLAG_FLUSHABLE, &chan->flags); 1011 else 1012 clear_bit(FLAG_FLUSHABLE, &chan->flags); 1013 break; 1014 1015 case BT_POWER: 1016 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 1017 chan->chan_type != L2CAP_CHAN_RAW) { 1018 err = -EINVAL; 1019 break; 1020 } 1021 1022 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; 1023 1024 err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen); 1025 if (err) 1026 break; 1027 1028 if (pwr.force_active) 1029 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1030 else 1031 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1032 break; 1033 1034 case BT_CHANNEL_POLICY: 1035 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1036 if (err) 1037 break; 1038 1039 err = -EOPNOTSUPP; 1040 break; 1041 1042 case BT_SNDMTU: 1043 if (!bdaddr_type_is_le(chan->src_type)) { 1044 err = -EINVAL; 1045 break; 1046 } 1047 1048 /* Only allow setting output MTU when not connected */ 1049 if (sk->sk_state == BT_CONNECTED) { 1050 err = -EISCONN; 1051 break; 1052 } 1053 1054 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1055 if (err) 1056 break; 1057 1058 chan->omtu = mtu; 1059 break; 1060 1061 case BT_RCVMTU: 1062 if (!bdaddr_type_is_le(chan->src_type)) { 1063 err = -EINVAL; 1064 break; 1065 } 1066 1067 if (chan->mode == L2CAP_MODE_LE_FLOWCTL && 1068 sk->sk_state == BT_CONNECTED) { 1069 err = -EISCONN; 1070 break; 1071 } 1072 1073 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1074 if (err) 1075 break; 1076 1077 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && 1078 sk->sk_state == BT_CONNECTED) 1079 err = l2cap_chan_reconfigure(chan, mtu); 1080 else 1081 chan->imtu = mtu; 1082 1083 break; 1084 1085 case BT_PHY: 1086 if (sk->sk_state != BT_CONNECTED) { 1087 err = -ENOTCONN; 1088 break; 1089 } 1090 1091 err = copy_safe_from_sockptr(&phys, sizeof(phys), optval, 1092 optlen); 1093 if (err) 1094 break; 1095 1096 if (!chan->conn) 1097 break; 1098 1099 conn = chan->conn; 1100 err = hci_conn_set_phy(conn->hcon, phys); 1101 break; 1102 1103 case BT_MODE: 1104 if (!enable_ecred) { 1105 err = -ENOPROTOOPT; 1106 break; 1107 } 1108 1109 BT_DBG("sk->sk_state %u", sk->sk_state); 1110 1111 if (sk->sk_state != BT_BOUND) { 1112 err = -EINVAL; 1113 break; 1114 } 1115 1116 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1117 err = -EINVAL; 1118 break; 1119 } 1120 1121 err = copy_safe_from_sockptr(&mode, sizeof(mode), optval, 1122 optlen); 1123 if (err) 1124 break; 1125 1126 BT_DBG("mode %u", mode); 1127 1128 err = l2cap_set_mode(chan, mode); 1129 if (err) 1130 break; 1131 1132 BT_DBG("mode 0x%2.2x", chan->mode); 1133 1134 break; 1135 1136 default: 1137 err = -ENOPROTOOPT; 1138 break; 1139 } 1140 1141 release_sock(sk); 1142 return err; 1143 } 1144 1145 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1146 size_t len) 1147 { 1148 struct sock *sk = sock->sk; 1149 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1150 struct sockcm_cookie sockc; 1151 int err; 1152 1153 BT_DBG("sock %p, sk %p", sock, sk); 1154 1155 err = sock_error(sk); 1156 if (err) 1157 return err; 1158 1159 if (msg->msg_flags & MSG_OOB) 1160 return -EOPNOTSUPP; 1161 1162 if (sk->sk_state != BT_CONNECTED) 1163 return -ENOTCONN; 1164 1165 hci_sockcm_init(&sockc, sk); 1166 1167 if (msg->msg_controllen) { 1168 err = sock_cmsg_send(sk, msg, &sockc); 1169 if (err) 1170 return err; 1171 } 1172 1173 lock_sock(sk); 1174 err = bt_sock_wait_ready(sk, msg->msg_flags); 1175 release_sock(sk); 1176 if (err) 1177 return err; 1178 1179 l2cap_chan_lock(chan); 1180 err = l2cap_chan_send(chan, msg, len, &sockc); 1181 l2cap_chan_unlock(chan); 1182 1183 return err; 1184 } 1185 1186 static void l2cap_publish_rx_avail(struct l2cap_chan *chan) 1187 { 1188 struct sock *sk = chan->data; 1189 ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc); 1190 int expected_skbs, skb_overhead; 1191 1192 if (avail <= 0) { 1193 l2cap_chan_rx_avail(chan, 0); 1194 return; 1195 } 1196 1197 if (!chan->mps) { 1198 l2cap_chan_rx_avail(chan, -1); 1199 return; 1200 } 1201 1202 /* Correct available memory by estimated sk_buff overhead. 1203 * This is significant due to small transfer sizes. However, accept 1204 * at least one full packet if receive space is non-zero. 1205 */ 1206 expected_skbs = DIV_ROUND_UP(avail, chan->mps); 1207 skb_overhead = expected_skbs * sizeof(struct sk_buff); 1208 if (skb_overhead < avail) 1209 l2cap_chan_rx_avail(chan, avail - skb_overhead); 1210 else 1211 l2cap_chan_rx_avail(chan, -1); 1212 } 1213 1214 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1215 size_t len, int flags) 1216 { 1217 struct sock *sk = sock->sk; 1218 struct l2cap_pinfo *pi = l2cap_pi(sk); 1219 int err; 1220 1221 if (unlikely(flags & MSG_ERRQUEUE)) 1222 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 1223 BT_SCM_ERROR); 1224 1225 lock_sock(sk); 1226 1227 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP, 1228 &bt_sk(sk)->flags)) { 1229 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 1230 sk->sk_state = BT_CONNECTED; 1231 pi->chan->state = BT_CONNECTED; 1232 __l2cap_ecred_conn_rsp_defer(pi->chan); 1233 } else if (bdaddr_type_is_le(pi->chan->src_type)) { 1234 sk->sk_state = BT_CONNECTED; 1235 pi->chan->state = BT_CONNECTED; 1236 __l2cap_le_connect_rsp_defer(pi->chan); 1237 } else { 1238 sk->sk_state = BT_CONFIG; 1239 pi->chan->state = BT_CONFIG; 1240 __l2cap_connect_rsp_defer(pi->chan); 1241 } 1242 1243 err = 0; 1244 goto done; 1245 } 1246 1247 release_sock(sk); 1248 1249 if (sock->type == SOCK_STREAM) 1250 err = bt_sock_stream_recvmsg(sock, msg, len, flags); 1251 else 1252 err = bt_sock_recvmsg(sock, msg, len, flags); 1253 1254 if (pi->chan->mode != L2CAP_MODE_ERTM && 1255 pi->chan->mode != L2CAP_MODE_LE_FLOWCTL && 1256 pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL) 1257 return err; 1258 1259 lock_sock(sk); 1260 1261 l2cap_publish_rx_avail(pi->chan); 1262 1263 /* Attempt to put pending rx data in the socket buffer */ 1264 while (!list_empty(&pi->rx_busy)) { 1265 struct l2cap_rx_busy *rx_busy = 1266 list_first_entry(&pi->rx_busy, 1267 struct l2cap_rx_busy, 1268 list); 1269 if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0) 1270 goto done; 1271 list_del(&rx_busy->list); 1272 kfree(rx_busy); 1273 } 1274 1275 /* Restore data flow when half of the receive buffer is 1276 * available. This avoids resending large numbers of 1277 * frames. 1278 */ 1279 if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) && 1280 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1) 1281 l2cap_chan_busy(pi->chan, 0); 1282 1283 done: 1284 release_sock(sk); 1285 return err; 1286 } 1287 1288 /* Release the sock's ref on chan and clear the pointer so that the ref is 1289 * dropped exactly once even if both l2cap_sock_kill() and 1290 * l2cap_sock_destruct() run. Setting chan->data to NULL first stops any other 1291 * task from dereferencing the now-dead sock pointer. 1292 */ 1293 static void l2cap_sock_put_chan(struct sock *sk) 1294 { 1295 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1296 1297 if (!chan) 1298 return; 1299 1300 chan->data = NULL; 1301 l2cap_pi(sk)->chan = NULL; 1302 l2cap_chan_put(chan); 1303 } 1304 1305 /* Kill socket (only if zapped and orphan) 1306 * Must be called on unlocked socket, with l2cap channel lock. 1307 */ 1308 static void l2cap_sock_kill(struct sock *sk) 1309 { 1310 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 1311 return; 1312 1313 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); 1314 1315 l2cap_sock_put_chan(sk); 1316 1317 /* Kill poor orphan */ 1318 sock_set_flag(sk, SOCK_DEAD); 1319 sock_put(sk); 1320 } 1321 1322 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan) 1323 { 1324 DECLARE_WAITQUEUE(wait, current); 1325 int err = 0; 1326 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1327 /* Timeout to prevent infinite loop */ 1328 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT; 1329 1330 add_wait_queue(sk_sleep(sk), &wait); 1331 set_current_state(TASK_INTERRUPTIBLE); 1332 do { 1333 BT_DBG("Waiting for %d ACKs, timeout %04d ms", 1334 chan->unacked_frames, time_after(jiffies, timeout) ? 0 : 1335 jiffies_to_msecs(timeout - jiffies)); 1336 1337 if (!timeo) 1338 timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1339 1340 if (signal_pending(current)) { 1341 err = sock_intr_errno(timeo); 1342 break; 1343 } 1344 1345 release_sock(sk); 1346 timeo = schedule_timeout(timeo); 1347 lock_sock(sk); 1348 set_current_state(TASK_INTERRUPTIBLE); 1349 1350 err = sock_error(sk); 1351 if (err) 1352 break; 1353 1354 if (time_after(jiffies, timeout)) { 1355 err = -ENOLINK; 1356 break; 1357 } 1358 1359 } while (chan->unacked_frames > 0 && 1360 chan->state == BT_CONNECTED); 1361 1362 set_current_state(TASK_RUNNING); 1363 remove_wait_queue(sk_sleep(sk), &wait); 1364 return err; 1365 } 1366 1367 static int l2cap_sock_shutdown(struct socket *sock, int how) 1368 __context_unsafe(/* complex chan->conn locking */) 1369 { 1370 struct sock *sk = sock->sk; 1371 struct l2cap_chan *chan; 1372 struct l2cap_conn *conn; 1373 int err = 0; 1374 1375 BT_DBG("sock %p, sk %p, how %d", sock, sk, how); 1376 1377 /* 'how' parameter is mapped to sk_shutdown as follows: 1378 * SHUT_RD (0) --> RCV_SHUTDOWN (1) 1379 * SHUT_WR (1) --> SEND_SHUTDOWN (2) 1380 * SHUT_RDWR (2) --> SHUTDOWN_MASK (3) 1381 */ 1382 how++; 1383 1384 if (!sk) 1385 return 0; 1386 1387 lock_sock(sk); 1388 1389 if ((sk->sk_shutdown & how) == how) 1390 goto shutdown_already; 1391 1392 BT_DBG("Handling sock shutdown"); 1393 1394 /* prevent sk structure from being freed whilst unlocked */ 1395 sock_hold(sk); 1396 1397 /* prevent chan structure from being freed whilst unlocked */ 1398 chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); 1399 if (!chan) 1400 goto shutdown_already; 1401 1402 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1403 1404 if (chan->mode == L2CAP_MODE_ERTM && 1405 chan->unacked_frames > 0 && 1406 chan->state == BT_CONNECTED) { 1407 err = __l2cap_wait_ack(sk, chan); 1408 1409 /* After waiting for ACKs, check whether shutdown 1410 * has already been actioned to close the L2CAP 1411 * link such as by l2cap_disconnection_req(). 1412 */ 1413 if ((sk->sk_shutdown & how) == how) 1414 goto shutdown_matched; 1415 } 1416 1417 /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN 1418 * is already set 1419 */ 1420 if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) { 1421 sk->sk_shutdown |= RCV_SHUTDOWN; 1422 if ((sk->sk_shutdown & how) == how) 1423 goto shutdown_matched; 1424 } 1425 1426 sk->sk_shutdown |= SEND_SHUTDOWN; 1427 release_sock(sk); 1428 1429 l2cap_chan_lock(chan); 1430 /* prevent conn structure from being freed */ 1431 conn = l2cap_conn_hold_unless_zero(chan->conn); 1432 l2cap_chan_unlock(chan); 1433 1434 if (conn) 1435 /* mutex lock must be taken before l2cap_chan_lock() */ 1436 mutex_lock(&conn->lock); 1437 1438 l2cap_chan_lock(chan); 1439 l2cap_chan_close(chan, 0); 1440 l2cap_chan_unlock(chan); 1441 1442 if (conn) { 1443 mutex_unlock(&conn->lock); 1444 l2cap_conn_put(conn); 1445 } 1446 1447 lock_sock(sk); 1448 1449 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1450 !(current->flags & PF_EXITING)) 1451 err = bt_sock_wait_state(sk, BT_CLOSED, 1452 sk->sk_lingertime); 1453 1454 shutdown_matched: 1455 l2cap_chan_put(chan); 1456 sock_put(sk); 1457 1458 shutdown_already: 1459 if (!err && sk->sk_err) 1460 err = -sk->sk_err; 1461 1462 release_sock(sk); 1463 1464 BT_DBG("Sock shutdown complete err: %d", err); 1465 1466 return err; 1467 } 1468 1469 static int l2cap_sock_release(struct socket *sock) 1470 { 1471 struct sock *sk = sock->sk; 1472 int err; 1473 struct l2cap_chan *chan; 1474 1475 BT_DBG("sock %p, sk %p", sock, sk); 1476 1477 if (!sk) 1478 return 0; 1479 1480 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 1481 l2cap_sock_cleanup_listen(sk); 1482 release_sock(sk); 1483 1484 bt_sock_unlink(&l2cap_sk_list, sk); 1485 1486 err = l2cap_sock_shutdown(sock, SHUT_RDWR); 1487 chan = l2cap_pi(sk)->chan; 1488 1489 l2cap_chan_hold(chan); 1490 l2cap_chan_lock(chan); 1491 1492 sock_orphan(sk); 1493 l2cap_sock_kill(sk); 1494 1495 l2cap_chan_unlock(chan); 1496 l2cap_chan_put(chan); 1497 1498 return err; 1499 } 1500 1501 static void l2cap_sock_cleanup_listen(struct sock *parent) 1502 { 1503 struct sock *sk; 1504 1505 BT_DBG("parent %p state %s", parent, 1506 state_to_string(parent->sk_state)); 1507 1508 /* Close not yet accepted channels. 1509 * 1510 * bt_accept_dequeue() returns sk with its temporary queue-walk 1511 * reference held, so a concurrent l2cap_conn_del() 1512 * -> l2cap_sock_kill() cannot free sk under us. 1513 * 1514 * cleanup_listen() runs under the parent sk lock, so unlike 1515 * l2cap_sock_shutdown() we must NOT take conn->lock here: that would 1516 * establish sk_lock -> conn->lock and invert the established 1517 * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock). 1518 * 1519 * Instead, briefly take the child sk lock to fetch and pin its chan. 1520 * l2cap_conn_del() reaches the chan free only via 1521 * l2cap_chan_del() -> l2cap_sock_teardown_cb(), which itself takes 1522 * the child sk lock; holding it across l2cap_chan_hold_unless_zero() 1523 * therefore guarantees the chan cannot be freed while we read and 1524 * pin it (hold_unless_zero() additionally skips a chan already past 1525 * its last reference). We then drop the sk lock before taking 1526 * chan->lock, so sk and chan locks are never held together. 1527 * 1528 * Since we cannot call l2cap_chan_close() without conn->lock, 1529 * schedule l2cap_chan_timeout to close the channel; it already 1530 * acquires conn->lock -> chan->lock in the correct order. 1531 */ 1532 while ((sk = bt_accept_dequeue(parent, NULL))) { 1533 struct l2cap_chan *chan; 1534 1535 lock_sock_nested(sk, L2CAP_NESTING_NORMAL); 1536 chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); 1537 release_sock(sk); 1538 if (!chan) { 1539 /* l2cap_conn_del() already tearing this child down */ 1540 sock_put(sk); 1541 continue; 1542 } 1543 1544 BT_DBG("child chan %p state %s", chan, 1545 state_to_string(chan->state)); 1546 1547 l2cap_chan_lock(chan); 1548 /* Since we cannot call l2cap_chan_close() without 1549 * conn->lock, schedule its timer to trigger the close 1550 * and cleanup of this channel. 1551 */ 1552 if (chan->conn) 1553 __set_chan_timer(chan, 0); 1554 l2cap_chan_unlock(chan); 1555 1556 l2cap_chan_put(chan); 1557 sock_put(sk); 1558 } 1559 } 1560 1561 static int l2cap_sock_new_connection_cb(struct l2cap_chan *chan, 1562 struct l2cap_chan *new_chan) 1563 { 1564 struct sock *sk, *parent = chan->data; 1565 1566 if (!parent) 1567 return -EINVAL; 1568 1569 lock_sock(parent); 1570 1571 /* Check for backlog size */ 1572 if (sk_acceptq_is_full(parent)) { 1573 BT_DBG("backlog full %d", parent->sk_ack_backlog); 1574 release_sock(parent); 1575 return -ENOBUFS; 1576 } 1577 1578 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, 1579 GFP_ATOMIC, 0, new_chan); 1580 if (!sk) { 1581 release_sock(parent); 1582 return -ENOMEM; 1583 } 1584 1585 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP); 1586 1587 l2cap_sock_init(sk, parent); 1588 1589 /* The conn list reference taken by l2cap_new_connection() keeps new_chan 1590 * alive once release_sock() lets another task free this socket. 1591 */ 1592 bt_accept_enqueue(parent, sk, false); 1593 1594 release_sock(parent); 1595 1596 return 0; 1597 } 1598 1599 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 1600 { 1601 struct sock *sk; 1602 struct l2cap_pinfo *pi; 1603 int err; 1604 1605 sk = chan->data; 1606 if (!sk) 1607 return -ENXIO; 1608 1609 pi = l2cap_pi(sk); 1610 lock_sock(sk); 1611 if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) { 1612 err = -ENOMEM; 1613 goto done; 1614 } 1615 1616 if (chan->mode != L2CAP_MODE_ERTM && 1617 chan->mode != L2CAP_MODE_STREAMING && 1618 chan->mode != L2CAP_MODE_LE_FLOWCTL && 1619 chan->mode != L2CAP_MODE_EXT_FLOWCTL) { 1620 /* Even if no filter is attached, we could potentially 1621 * get errors from security modules, etc. 1622 */ 1623 err = sk_filter(sk, skb); 1624 if (err) 1625 goto done; 1626 } 1627 1628 err = __sock_queue_rcv_skb(sk, skb); 1629 1630 l2cap_publish_rx_avail(chan); 1631 1632 /* For ERTM and LE, handle a skb that doesn't fit into the recv 1633 * buffer. This is important to do because the data frames 1634 * have already been acked, so the skb cannot be discarded. 1635 * 1636 * Notify the l2cap core that the buffer is full, so the 1637 * LOCAL_BUSY state is entered and no more frames are 1638 * acked and reassembled until there is buffer space 1639 * available. 1640 */ 1641 if (err < 0 && 1642 (chan->mode == L2CAP_MODE_ERTM || 1643 chan->mode == L2CAP_MODE_LE_FLOWCTL || 1644 chan->mode == L2CAP_MODE_EXT_FLOWCTL)) { 1645 struct l2cap_rx_busy *rx_busy = kmalloc_obj(*rx_busy); 1646 if (!rx_busy) { 1647 err = -ENOMEM; 1648 goto done; 1649 } 1650 rx_busy->skb = skb; 1651 list_add_tail(&rx_busy->list, &pi->rx_busy); 1652 l2cap_chan_busy(chan, 1); 1653 err = 0; 1654 } 1655 1656 done: 1657 release_sock(sk); 1658 1659 return err; 1660 } 1661 1662 static void l2cap_sock_close_cb(struct l2cap_chan *chan) 1663 { 1664 struct sock *sk = chan->data; 1665 1666 if (!sk) 1667 return; 1668 1669 l2cap_sock_kill(sk); 1670 } 1671 1672 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) 1673 { 1674 struct sock *sk = chan->data; 1675 struct sock *parent; 1676 1677 if (!sk) 1678 return; 1679 1680 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1681 1682 /* This callback can be called both for server (BT_LISTEN) 1683 * sockets as well as "normal" ones. To avoid lockdep warnings 1684 * with child socket locking (through l2cap_sock_cleanup_listen) 1685 * we need separation into separate nesting levels. The simplest 1686 * way to accomplish this is to inherit the nesting level used 1687 * for the channel. 1688 */ 1689 lock_sock_nested(sk, atomic_read(&chan->nesting)); 1690 1691 parent = bt_sk(sk)->parent; 1692 1693 switch (chan->state) { 1694 case BT_OPEN: 1695 case BT_BOUND: 1696 case BT_CLOSED: 1697 break; 1698 case BT_LISTEN: 1699 l2cap_sock_cleanup_listen(sk); 1700 sk->sk_state = BT_CLOSED; 1701 chan->state = BT_CLOSED; 1702 1703 break; 1704 default: 1705 sk->sk_state = BT_CLOSED; 1706 chan->state = BT_CLOSED; 1707 1708 sk->sk_err = err; 1709 1710 if (parent) { 1711 bt_accept_unlink(sk); 1712 parent->sk_data_ready(parent); 1713 } else { 1714 sk->sk_state_change(sk); 1715 } 1716 1717 break; 1718 } 1719 release_sock(sk); 1720 1721 /* Only zap after cleanup to avoid use after free race */ 1722 sock_set_flag(sk, SOCK_ZAPPED); 1723 1724 } 1725 1726 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, 1727 int err) 1728 { 1729 struct sock *sk = chan->data; 1730 1731 if (!sk) 1732 return; 1733 1734 sk->sk_state = state; 1735 1736 if (err) 1737 sk->sk_err = err; 1738 } 1739 1740 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, 1741 unsigned long hdr_len, 1742 unsigned long len, int nb) 1743 { 1744 struct sock *sk = chan->data; 1745 struct sk_buff *skb; 1746 int err; 1747 1748 l2cap_chan_unlock(chan); 1749 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err); 1750 l2cap_chan_lock(chan); 1751 1752 if (!skb) 1753 return ERR_PTR(err); 1754 1755 /* Channel lock is released before requesting new skb and then 1756 * reacquired thus we need to recheck channel state. 1757 */ 1758 if (chan->state != BT_CONNECTED) { 1759 kfree_skb(skb); 1760 return ERR_PTR(-ENOTCONN); 1761 } 1762 1763 skb->priority = READ_ONCE(sk->sk_priority); 1764 1765 bt_cb(skb)->l2cap.chan = chan; 1766 1767 return skb; 1768 } 1769 1770 static void l2cap_sock_ready_cb(struct l2cap_chan *chan) 1771 { 1772 struct sock *sk = chan->data; 1773 struct sock *parent; 1774 1775 if (!sk) 1776 return; 1777 1778 lock_sock(sk); 1779 1780 parent = bt_sk(sk)->parent; 1781 1782 BT_DBG("sk %p, parent %p", sk, parent); 1783 1784 sk->sk_state = BT_CONNECTED; 1785 sk->sk_state_change(sk); 1786 1787 if (parent) 1788 parent->sk_data_ready(parent); 1789 1790 release_sock(sk); 1791 } 1792 1793 static void l2cap_sock_defer_cb(struct l2cap_chan *chan) 1794 { 1795 struct sock *parent, *sk = chan->data; 1796 1797 lock_sock(sk); 1798 1799 parent = bt_sk(sk)->parent; 1800 if (parent) 1801 parent->sk_data_ready(parent); 1802 1803 release_sock(sk); 1804 } 1805 1806 static void l2cap_sock_resume_cb(struct l2cap_chan *chan) 1807 { 1808 struct sock *sk = chan->data; 1809 1810 if (!sk) 1811 return; 1812 1813 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) { 1814 sk->sk_state = BT_CONNECTED; 1815 chan->state = BT_CONNECTED; 1816 } 1817 1818 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1819 sk->sk_state_change(sk); 1820 } 1821 1822 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan) 1823 { 1824 struct sock *sk = chan->data; 1825 1826 lock_sock(sk); 1827 sk->sk_shutdown = SHUTDOWN_MASK; 1828 release_sock(sk); 1829 } 1830 1831 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan) 1832 { 1833 struct sock *sk = chan->data; 1834 1835 if (!sk) 1836 return 0; 1837 1838 return READ_ONCE(sk->sk_sndtimeo); 1839 } 1840 1841 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan) 1842 { 1843 struct sock *sk = chan->data; 1844 1845 return sk->sk_peer_pid; 1846 } 1847 1848 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) 1849 { 1850 struct sock *sk = chan->data; 1851 1852 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1853 sk->sk_state_change(sk); 1854 } 1855 1856 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) 1857 { 1858 struct sock *sk = chan->data; 1859 1860 switch (chan->mode) { 1861 case L2CAP_MODE_ERTM: 1862 case L2CAP_MODE_STREAMING: 1863 return sk_filter(sk, skb); 1864 } 1865 1866 return 0; 1867 } 1868 1869 static const struct l2cap_ops l2cap_chan_ops = { 1870 .name = "L2CAP Socket Interface", 1871 .new_connection = l2cap_sock_new_connection_cb, 1872 .recv = l2cap_sock_recv_cb, 1873 .close = l2cap_sock_close_cb, 1874 .teardown = l2cap_sock_teardown_cb, 1875 .state_change = l2cap_sock_state_change_cb, 1876 .ready = l2cap_sock_ready_cb, 1877 .defer = l2cap_sock_defer_cb, 1878 .resume = l2cap_sock_resume_cb, 1879 .suspend = l2cap_sock_suspend_cb, 1880 .set_shutdown = l2cap_sock_set_shutdown_cb, 1881 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, 1882 .get_peer_pid = l2cap_sock_get_peer_pid_cb, 1883 .alloc_skb = l2cap_sock_alloc_skb_cb, 1884 .filter = l2cap_sock_filter, 1885 }; 1886 1887 static void l2cap_sock_destruct(struct sock *sk) 1888 { 1889 struct l2cap_rx_busy *rx_busy, *next; 1890 1891 BT_DBG("sk %p", sk); 1892 1893 l2cap_sock_put_chan(sk); 1894 1895 list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) { 1896 kfree_skb(rx_busy->skb); 1897 list_del(&rx_busy->list); 1898 kfree(rx_busy); 1899 } 1900 1901 skb_queue_purge(&sk->sk_receive_queue); 1902 skb_queue_purge(&sk->sk_write_queue); 1903 skb_queue_purge(&sk->sk_error_queue); 1904 } 1905 1906 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name, 1907 int *msg_namelen) 1908 { 1909 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name); 1910 1911 memset(la, 0, sizeof(struct sockaddr_l2)); 1912 la->l2_family = AF_BLUETOOTH; 1913 la->l2_psm = bt_cb(skb)->l2cap.psm; 1914 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr); 1915 1916 *msg_namelen = sizeof(struct sockaddr_l2); 1917 } 1918 1919 static void l2cap_sock_init(struct sock *sk, struct sock *parent) 1920 { 1921 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1922 1923 BT_DBG("sk %p", sk); 1924 1925 if (parent) { 1926 sk->sk_type = parent->sk_type; 1927 bt_sk(sk)->flags = bt_sk(parent)->flags; 1928 1929 /* Channel configuration is inherited from the parent by 1930 * l2cap_new_connection(). 1931 */ 1932 security_sk_clone(parent, sk); 1933 } else { 1934 switch (sk->sk_type) { 1935 case SOCK_RAW: 1936 chan->chan_type = L2CAP_CHAN_RAW; 1937 break; 1938 case SOCK_DGRAM: 1939 chan->chan_type = L2CAP_CHAN_CONN_LESS; 1940 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name; 1941 break; 1942 case SOCK_SEQPACKET: 1943 case SOCK_STREAM: 1944 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED; 1945 break; 1946 } 1947 1948 chan->imtu = L2CAP_DEFAULT_MTU; 1949 chan->omtu = 0; 1950 if (!disable_ertm && sk->sk_type == SOCK_STREAM) { 1951 chan->mode = L2CAP_MODE_ERTM; 1952 set_bit(CONF_STATE2_DEVICE, &chan->conf_state); 1953 } else { 1954 chan->mode = L2CAP_MODE_BASIC; 1955 } 1956 1957 l2cap_chan_set_defaults(chan, NULL); 1958 } 1959 1960 /* Default config options */ 1961 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 1962 1963 chan->data = sk; 1964 chan->ops = &l2cap_chan_ops; 1965 1966 l2cap_publish_rx_avail(chan); 1967 } 1968 1969 static struct proto l2cap_proto = { 1970 .name = "L2CAP", 1971 .owner = THIS_MODULE, 1972 .obj_size = sizeof(struct l2cap_pinfo) 1973 }; 1974 1975 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 1976 int proto, gfp_t prio, int kern, 1977 struct l2cap_chan *chan) 1978 { 1979 struct sock *sk; 1980 1981 sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern); 1982 if (!sk) 1983 return NULL; 1984 1985 sk->sk_destruct = l2cap_sock_destruct; 1986 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT; 1987 1988 INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy); 1989 1990 /* The sock takes ownership of the caller's reference on chan. */ 1991 l2cap_pi(sk)->chan = chan; 1992 1993 return sk; 1994 } 1995 1996 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol, 1997 int kern) 1998 { 1999 struct sock *sk; 2000 struct l2cap_chan *chan; 2001 2002 BT_DBG("sock %p", sock); 2003 2004 sock->state = SS_UNCONNECTED; 2005 2006 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM && 2007 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW) 2008 return -ESOCKTNOSUPPORT; 2009 2010 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) 2011 return -EPERM; 2012 2013 sock->ops = &l2cap_sock_ops; 2014 2015 chan = l2cap_chan_create(); 2016 if (!chan) 2017 return -ENOMEM; 2018 2019 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern, chan); 2020 if (!sk) { 2021 l2cap_chan_put(chan); 2022 return -ENOMEM; 2023 } 2024 2025 l2cap_sock_init(sk, NULL); 2026 bt_sock_link(&l2cap_sk_list, sk); 2027 return 0; 2028 } 2029 2030 static const struct proto_ops l2cap_sock_ops = { 2031 .family = PF_BLUETOOTH, 2032 .owner = THIS_MODULE, 2033 .release = l2cap_sock_release, 2034 .bind = l2cap_sock_bind, 2035 .connect = l2cap_sock_connect, 2036 .listen = l2cap_sock_listen, 2037 .accept = l2cap_sock_accept, 2038 .getname = l2cap_sock_getname, 2039 .sendmsg = l2cap_sock_sendmsg, 2040 .recvmsg = l2cap_sock_recvmsg, 2041 .poll = bt_sock_poll, 2042 .ioctl = bt_sock_ioctl, 2043 .gettstamp = sock_gettstamp, 2044 .mmap = sock_no_mmap, 2045 .socketpair = sock_no_socketpair, 2046 .shutdown = l2cap_sock_shutdown, 2047 .setsockopt = l2cap_sock_setsockopt, 2048 .getsockopt_iter = l2cap_sock_getsockopt 2049 }; 2050 2051 static const struct net_proto_family l2cap_sock_family_ops = { 2052 .family = PF_BLUETOOTH, 2053 .owner = THIS_MODULE, 2054 .create = l2cap_sock_create, 2055 }; 2056 2057 int __init l2cap_init_sockets(void) 2058 { 2059 int err; 2060 2061 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr)); 2062 2063 err = proto_register(&l2cap_proto, 0); 2064 if (err < 0) 2065 return err; 2066 2067 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops); 2068 if (err < 0) { 2069 BT_ERR("L2CAP socket registration failed"); 2070 goto error; 2071 } 2072 2073 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list, 2074 NULL); 2075 if (err < 0) { 2076 BT_ERR("Failed to create L2CAP proc file"); 2077 bt_sock_unregister(BTPROTO_L2CAP); 2078 goto error; 2079 } 2080 2081 BT_INFO("L2CAP socket layer initialized"); 2082 2083 return 0; 2084 2085 error: 2086 proto_unregister(&l2cap_proto); 2087 return err; 2088 } 2089 2090 void l2cap_cleanup_sockets(void) 2091 { 2092 bt_procfs_cleanup(&init_net, "l2cap"); 2093 bt_sock_unregister(BTPROTO_L2CAP); 2094 proto_unregister(&l2cap_proto); 2095 } 2096