1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 6 Copyright (C) 2010 Google Inc. 7 Copyright (C) 2011 ProFUSION Embedded Systems 8 9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth L2CAP sockets. */ 26 27 #include <linux/module.h> 28 #include <linux/export.h> 29 #include <linux/filter.h> 30 #include <linux/sched/signal.h> 31 #include <linux/uio.h> 32 33 #include <net/bluetooth/bluetooth.h> 34 #include <net/bluetooth/hci_core.h> 35 #include <net/bluetooth/l2cap.h> 36 37 #include "smp.h" 38 39 static struct bt_sock_list l2cap_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock) 41 }; 42 43 static const struct proto_ops l2cap_sock_ops; 44 static void l2cap_sock_init(struct sock *sk, struct sock *parent); 45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 46 int proto, gfp_t prio, int kern, 47 struct l2cap_chan *chan); 48 static void l2cap_sock_cleanup_listen(struct sock *parent); 49 50 bool l2cap_is_socket(struct socket *sock) 51 { 52 return sock && sock->ops == &l2cap_sock_ops; 53 } 54 EXPORT_SYMBOL(l2cap_is_socket); 55 56 static int l2cap_validate_bredr_psm(u16 psm) 57 { 58 /* PSM must be odd and lsb of upper byte must be 0 */ 59 if ((psm & 0x0101) != 0x0001) 60 return -EINVAL; 61 62 /* Restrict usage of well-known PSMs */ 63 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 64 return -EACCES; 65 66 return 0; 67 } 68 69 static int l2cap_validate_le_psm(u16 psm) 70 { 71 /* Valid LE_PSM ranges are defined only until 0x00ff */ 72 if (psm > L2CAP_PSM_LE_DYN_END) 73 return -EINVAL; 74 75 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */ 76 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE)) 77 return -EACCES; 78 79 return 0; 80 } 81 82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen) 83 { 84 struct sock *sk = sock->sk; 85 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 86 struct sockaddr_l2 la; 87 int len, err = 0; 88 89 BT_DBG("sk %p", sk); 90 91 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 92 addr->sa_family != AF_BLUETOOTH) 93 return -EINVAL; 94 95 memset(&la, 0, sizeof(la)); 96 len = min_t(unsigned int, sizeof(la), alen); 97 memcpy(&la, addr, len); 98 99 if (la.l2_cid && la.l2_psm) 100 return -EINVAL; 101 102 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 103 return -EINVAL; 104 105 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 106 /* We only allow ATT user space socket */ 107 if (la.l2_cid && 108 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 109 return -EINVAL; 110 } 111 112 lock_sock(sk); 113 114 if (sk->sk_state != BT_OPEN) { 115 err = -EBADFD; 116 goto done; 117 } 118 119 if (la.l2_psm) { 120 __u16 psm = __le16_to_cpu(la.l2_psm); 121 122 if (la.l2_bdaddr_type == BDADDR_BREDR) 123 err = l2cap_validate_bredr_psm(psm); 124 else 125 err = l2cap_validate_le_psm(psm); 126 127 if (err) 128 goto done; 129 } 130 131 bacpy(&chan->src, &la.l2_bdaddr); 132 chan->src_type = la.l2_bdaddr_type; 133 134 if (la.l2_cid) 135 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid)); 136 else 137 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm); 138 139 if (err < 0) 140 goto done; 141 142 switch (chan->chan_type) { 143 case L2CAP_CHAN_CONN_LESS: 144 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP) 145 chan->sec_level = BT_SECURITY_SDP; 146 break; 147 case L2CAP_CHAN_CONN_ORIENTED: 148 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP || 149 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM) 150 chan->sec_level = BT_SECURITY_SDP; 151 break; 152 case L2CAP_CHAN_RAW: 153 chan->sec_level = BT_SECURITY_SDP; 154 break; 155 case L2CAP_CHAN_FIXED: 156 /* Fixed channels default to the L2CAP core not holding a 157 * hci_conn reference for them. For fixed channels mapping to 158 * L2CAP sockets we do want to hold a reference so set the 159 * appropriate flag to request it. 160 */ 161 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags); 162 break; 163 } 164 165 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 166 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 167 */ 168 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 169 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 170 chan->mode = L2CAP_MODE_LE_FLOWCTL; 171 172 chan->state = BT_BOUND; 173 sk->sk_state = BT_BOUND; 174 175 done: 176 release_sock(sk); 177 return err; 178 } 179 180 static int l2cap_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, 181 int alen, int flags) 182 { 183 struct sock *sk = sock->sk; 184 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 185 struct sockaddr_l2 la; 186 int len, err = 0; 187 bool zapped; 188 189 BT_DBG("sk %p", sk); 190 191 lock_sock(sk); 192 zapped = sock_flag(sk, SOCK_ZAPPED); 193 release_sock(sk); 194 195 if (zapped) 196 return -EINVAL; 197 198 if (!addr || alen < offsetofend(struct sockaddr, sa_family) || 199 addr->sa_family != AF_BLUETOOTH) 200 return -EINVAL; 201 202 memset(&la, 0, sizeof(la)); 203 len = min_t(unsigned int, sizeof(la), alen); 204 memcpy(&la, addr, len); 205 206 if (la.l2_cid && la.l2_psm) 207 return -EINVAL; 208 209 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 210 return -EINVAL; 211 212 /* Check that the socket wasn't bound to something that 213 * conflicts with the address given to connect(). If chan->src 214 * is BDADDR_ANY it means bind() was never used, in which case 215 * chan->src_type and la.l2_bdaddr_type do not need to match. 216 */ 217 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) && 218 bdaddr_type_is_le(la.l2_bdaddr_type)) { 219 /* Old user space versions will try to incorrectly bind 220 * the ATT socket using BDADDR_BREDR. We need to accept 221 * this and fix up the source address type only when 222 * both the source CID and destination CID indicate 223 * ATT. Anything else is an invalid combination. 224 */ 225 if (chan->scid != L2CAP_CID_ATT || 226 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 227 return -EINVAL; 228 229 /* We don't have the hdev available here to make a 230 * better decision on random vs public, but since all 231 * user space versions that exhibit this issue anyway do 232 * not support random local addresses assuming public 233 * here is good enough. 234 */ 235 chan->src_type = BDADDR_LE_PUBLIC; 236 } 237 238 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR) 239 return -EINVAL; 240 241 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 242 /* We only allow ATT user space socket */ 243 if (la.l2_cid && 244 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 245 return -EINVAL; 246 } 247 248 /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and 249 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set. 250 */ 251 if (chan->psm && bdaddr_type_is_le(chan->src_type) && 252 chan->mode != L2CAP_MODE_EXT_FLOWCTL) 253 chan->mode = L2CAP_MODE_LE_FLOWCTL; 254 255 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid), 256 &la.l2_bdaddr, la.l2_bdaddr_type, 257 READ_ONCE(sk->sk_sndtimeo)); 258 if (err) 259 return err; 260 261 lock_sock(sk); 262 263 err = bt_sock_wait_state(sk, BT_CONNECTED, 264 sock_sndtimeo(sk, flags & O_NONBLOCK)); 265 266 release_sock(sk); 267 268 return err; 269 } 270 271 static int l2cap_sock_listen(struct socket *sock, int backlog) 272 { 273 struct sock *sk = sock->sk; 274 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 275 int err = 0; 276 277 BT_DBG("sk %p backlog %d", sk, backlog); 278 279 lock_sock(sk); 280 281 if (sk->sk_state != BT_BOUND) { 282 err = -EBADFD; 283 goto done; 284 } 285 286 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) { 287 err = -EINVAL; 288 goto done; 289 } 290 291 switch (chan->mode) { 292 case L2CAP_MODE_BASIC: 293 case L2CAP_MODE_LE_FLOWCTL: 294 break; 295 case L2CAP_MODE_EXT_FLOWCTL: 296 if (!enable_ecred) { 297 err = -EOPNOTSUPP; 298 goto done; 299 } 300 break; 301 case L2CAP_MODE_ERTM: 302 case L2CAP_MODE_STREAMING: 303 if (!disable_ertm) 304 break; 305 fallthrough; 306 default: 307 err = -EOPNOTSUPP; 308 goto done; 309 } 310 311 sk->sk_max_ack_backlog = backlog; 312 sk->sk_ack_backlog = 0; 313 314 /* Listening channels need to use nested locking in order not to 315 * cause lockdep warnings when the created child channels end up 316 * being locked in the same thread as the parent channel. 317 */ 318 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); 319 320 chan->state = BT_LISTEN; 321 sk->sk_state = BT_LISTEN; 322 323 done: 324 release_sock(sk); 325 return err; 326 } 327 328 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, 329 struct proto_accept_arg *arg) 330 { 331 DEFINE_WAIT_FUNC(wait, woken_wake_function); 332 struct sock *sk = sock->sk, *nsk; 333 long timeo; 334 int err = 0; 335 336 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 337 338 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 339 340 BT_DBG("sk %p timeo %ld", sk, timeo); 341 342 /* Wait for an incoming connection. (wake-one). */ 343 add_wait_queue_exclusive(sk_sleep(sk), &wait); 344 while (1) { 345 if (sk->sk_state != BT_LISTEN) { 346 err = -EBADFD; 347 break; 348 } 349 350 nsk = bt_accept_dequeue(sk, newsock); 351 if (nsk) { 352 /* Drop the bridging ref from bt_accept_dequeue(); 353 * the grafted socket keeps nsk alive from here. 354 */ 355 sock_put(nsk); 356 break; 357 } 358 359 if (!timeo) { 360 err = -EAGAIN; 361 break; 362 } 363 364 if (signal_pending(current)) { 365 err = sock_intr_errno(timeo); 366 break; 367 } 368 369 release_sock(sk); 370 371 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 372 373 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 374 } 375 remove_wait_queue(sk_sleep(sk), &wait); 376 377 if (err) 378 goto done; 379 380 newsock->state = SS_CONNECTED; 381 382 BT_DBG("new socket %p", nsk); 383 384 done: 385 release_sock(sk); 386 return err; 387 } 388 389 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, 390 int peer) 391 { 392 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr; 393 struct sock *sk = sock->sk; 394 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 395 396 BT_DBG("sock %p, sk %p", sock, sk); 397 398 if (peer && sk->sk_state != BT_CONNECTED && 399 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 && 400 sk->sk_state != BT_CONFIG) 401 return -ENOTCONN; 402 403 memset(la, 0, sizeof(struct sockaddr_l2)); 404 addr->sa_family = AF_BLUETOOTH; 405 406 la->l2_psm = chan->psm; 407 408 if (peer) { 409 bacpy(&la->l2_bdaddr, &chan->dst); 410 la->l2_cid = cpu_to_le16(chan->dcid); 411 la->l2_bdaddr_type = chan->dst_type; 412 } else { 413 bacpy(&la->l2_bdaddr, &chan->src); 414 la->l2_cid = cpu_to_le16(chan->scid); 415 la->l2_bdaddr_type = chan->src_type; 416 } 417 418 return sizeof(struct sockaddr_l2); 419 } 420 421 static int l2cap_get_mode(struct l2cap_chan *chan) 422 { 423 switch (chan->mode) { 424 case L2CAP_MODE_BASIC: 425 return BT_MODE_BASIC; 426 case L2CAP_MODE_ERTM: 427 return BT_MODE_ERTM; 428 case L2CAP_MODE_STREAMING: 429 return BT_MODE_STREAMING; 430 case L2CAP_MODE_LE_FLOWCTL: 431 return BT_MODE_LE_FLOWCTL; 432 case L2CAP_MODE_EXT_FLOWCTL: 433 return BT_MODE_EXT_FLOWCTL; 434 } 435 436 return -EINVAL; 437 } 438 439 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, 440 sockopt_t *sopt) 441 { 442 struct sock *sk = sock->sk; 443 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 444 struct l2cap_options opts; 445 struct l2cap_conninfo cinfo; 446 int err = 0; 447 size_t len; 448 u32 opt; 449 450 BT_DBG("sk %p", sk); 451 452 len = sopt->optlen; 453 454 lock_sock(sk); 455 456 switch (optname) { 457 case L2CAP_OPTIONS: 458 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since 459 * legacy ATT code depends on getsockopt for 460 * L2CAP_OPTIONS we need to let this pass. 461 */ 462 if (bdaddr_type_is_le(chan->src_type) && 463 chan->scid != L2CAP_CID_ATT) { 464 err = -EINVAL; 465 break; 466 } 467 468 /* Only BR/EDR modes are supported here */ 469 switch (chan->mode) { 470 case L2CAP_MODE_BASIC: 471 case L2CAP_MODE_ERTM: 472 case L2CAP_MODE_STREAMING: 473 break; 474 default: 475 err = -EINVAL; 476 break; 477 } 478 479 if (err < 0) 480 break; 481 482 memset(&opts, 0, sizeof(opts)); 483 opts.imtu = chan->imtu; 484 opts.omtu = chan->omtu; 485 opts.flush_to = chan->flush_to; 486 opts.mode = chan->mode; 487 opts.fcs = chan->fcs; 488 opts.max_tx = chan->max_tx; 489 opts.txwin_size = chan->tx_win; 490 491 BT_DBG("mode 0x%2.2x", chan->mode); 492 493 len = min(len, sizeof(opts)); 494 if (copy_to_iter(&opts, len, &sopt->iter_out) != len) 495 err = -EFAULT; 496 497 break; 498 499 case L2CAP_LM: 500 switch (chan->sec_level) { 501 case BT_SECURITY_LOW: 502 opt = L2CAP_LM_AUTH; 503 break; 504 case BT_SECURITY_MEDIUM: 505 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT; 506 break; 507 case BT_SECURITY_HIGH: 508 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 509 L2CAP_LM_SECURE; 510 break; 511 case BT_SECURITY_FIPS: 512 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 513 L2CAP_LM_SECURE | L2CAP_LM_FIPS; 514 break; 515 default: 516 opt = 0; 517 break; 518 } 519 520 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags)) 521 opt |= L2CAP_LM_MASTER; 522 523 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 524 opt |= L2CAP_LM_RELIABLE; 525 526 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 527 sizeof(opt)) 528 err = -EFAULT; 529 530 break; 531 532 case L2CAP_CONNINFO: 533 if (sk->sk_state != BT_CONNECTED && 534 !(sk->sk_state == BT_CONNECT2 && 535 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 536 err = -ENOTCONN; 537 break; 538 } 539 540 memset(&cinfo, 0, sizeof(cinfo)); 541 cinfo.hci_handle = chan->conn->hcon->handle; 542 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3); 543 544 len = min(len, sizeof(cinfo)); 545 if (copy_to_iter(&cinfo, len, &sopt->iter_out) != len) 546 err = -EFAULT; 547 548 break; 549 550 default: 551 err = -ENOPROTOOPT; 552 break; 553 } 554 555 release_sock(sk); 556 return err; 557 } 558 559 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, 560 sockopt_t *sopt) 561 { 562 struct sock *sk = sock->sk; 563 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 564 struct bt_security sec; 565 struct bt_power pwr; 566 int len, mode, err = 0; 567 u32 opt; 568 u16 mtu; 569 u8 mval; 570 571 BT_DBG("sk %p", sk); 572 573 if (level == SOL_L2CAP) 574 return l2cap_sock_getsockopt_old(sock, optname, sopt); 575 576 if (level != SOL_BLUETOOTH) 577 return -ENOPROTOOPT; 578 579 len = sopt->optlen; 580 581 lock_sock(sk); 582 583 switch (optname) { 584 case BT_SECURITY: 585 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 586 chan->chan_type != L2CAP_CHAN_FIXED && 587 chan->chan_type != L2CAP_CHAN_RAW) { 588 err = -EINVAL; 589 break; 590 } 591 592 memset(&sec, 0, sizeof(sec)); 593 if (chan->conn) { 594 sec.level = chan->conn->hcon->sec_level; 595 596 if (sk->sk_state == BT_CONNECTED) 597 sec.key_size = chan->conn->hcon->enc_key_size; 598 } else { 599 sec.level = chan->sec_level; 600 } 601 602 len = min_t(unsigned int, len, sizeof(sec)); 603 if (copy_to_iter(&sec, len, &sopt->iter_out) != len) 604 err = -EFAULT; 605 606 break; 607 608 case BT_DEFER_SETUP: 609 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 610 err = -EINVAL; 611 break; 612 } 613 614 opt = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 615 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 616 sizeof(opt)) 617 err = -EFAULT; 618 619 break; 620 621 case BT_FLUSHABLE: 622 opt = test_bit(FLAG_FLUSHABLE, &chan->flags); 623 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 624 sizeof(opt)) 625 err = -EFAULT; 626 627 break; 628 629 case BT_POWER: 630 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM 631 && sk->sk_type != SOCK_RAW) { 632 err = -EINVAL; 633 break; 634 } 635 636 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 637 638 len = min_t(unsigned int, len, sizeof(pwr)); 639 if (copy_to_iter(&pwr, len, &sopt->iter_out) != len) 640 err = -EFAULT; 641 642 break; 643 644 case BT_CHANNEL_POLICY: 645 opt = chan->chan_policy; 646 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 647 sizeof(opt)) 648 err = -EFAULT; 649 break; 650 651 case BT_SNDMTU: 652 if (!bdaddr_type_is_le(chan->src_type)) { 653 err = -EINVAL; 654 break; 655 } 656 657 if (sk->sk_state != BT_CONNECTED) { 658 err = -ENOTCONN; 659 break; 660 } 661 662 mtu = chan->omtu; 663 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 664 sizeof(mtu)) 665 err = -EFAULT; 666 break; 667 668 case BT_RCVMTU: 669 if (!bdaddr_type_is_le(chan->src_type)) { 670 err = -EINVAL; 671 break; 672 } 673 674 mtu = chan->imtu; 675 if (copy_to_iter(&mtu, sizeof(mtu), &sopt->iter_out) != 676 sizeof(mtu)) 677 err = -EFAULT; 678 break; 679 680 case BT_PHY: 681 if (sk->sk_state != BT_CONNECTED) { 682 err = -ENOTCONN; 683 break; 684 } 685 686 opt = hci_conn_get_phy(chan->conn->hcon); 687 688 if (copy_to_iter(&opt, sizeof(opt), &sopt->iter_out) != 689 sizeof(opt)) 690 err = -EFAULT; 691 break; 692 693 case BT_MODE: 694 if (!enable_ecred) { 695 err = -ENOPROTOOPT; 696 break; 697 } 698 699 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 700 err = -EINVAL; 701 break; 702 } 703 704 mode = l2cap_get_mode(chan); 705 if (mode < 0) { 706 err = mode; 707 break; 708 } 709 710 mval = mode; 711 if (copy_to_iter(&mval, sizeof(mval), &sopt->iter_out) != 712 sizeof(mval)) 713 err = -EFAULT; 714 break; 715 716 default: 717 err = -ENOPROTOOPT; 718 break; 719 } 720 721 release_sock(sk); 722 return err; 723 } 724 725 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu) 726 { 727 switch (chan->scid) { 728 case L2CAP_CID_ATT: 729 if (mtu && mtu < L2CAP_LE_MIN_MTU) 730 return false; 731 break; 732 733 default: 734 if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU) 735 return false; 736 } 737 738 return true; 739 } 740 741 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 742 sockptr_t optval, unsigned int optlen) 743 { 744 struct sock *sk = sock->sk; 745 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 746 struct l2cap_options opts; 747 int err = 0; 748 u32 opt; 749 750 BT_DBG("sk %p", sk); 751 752 lock_sock(sk); 753 754 switch (optname) { 755 case L2CAP_OPTIONS: 756 if (bdaddr_type_is_le(chan->src_type)) { 757 err = -EINVAL; 758 break; 759 } 760 761 if (sk->sk_state == BT_CONNECTED) { 762 err = -EINVAL; 763 break; 764 } 765 766 opts.imtu = chan->imtu; 767 opts.omtu = chan->omtu; 768 opts.flush_to = chan->flush_to; 769 opts.mode = chan->mode; 770 opts.fcs = chan->fcs; 771 opts.max_tx = chan->max_tx; 772 opts.txwin_size = chan->tx_win; 773 774 err = copy_safe_from_sockptr(&opts, sizeof(opts), optval, 775 optlen); 776 if (err) 777 break; 778 779 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { 780 err = -EINVAL; 781 break; 782 } 783 784 if (!l2cap_valid_mtu(chan, opts.imtu)) { 785 err = -EINVAL; 786 break; 787 } 788 789 /* Only BR/EDR modes are supported here */ 790 switch (opts.mode) { 791 case L2CAP_MODE_BASIC: 792 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 793 break; 794 case L2CAP_MODE_ERTM: 795 case L2CAP_MODE_STREAMING: 796 if (!disable_ertm) 797 break; 798 fallthrough; 799 default: 800 err = -EINVAL; 801 break; 802 } 803 804 if (err < 0) 805 break; 806 807 chan->mode = opts.mode; 808 809 BT_DBG("mode 0x%2.2x", chan->mode); 810 811 chan->imtu = opts.imtu; 812 chan->omtu = opts.omtu; 813 chan->fcs = opts.fcs; 814 chan->max_tx = opts.max_tx; 815 chan->tx_win = opts.txwin_size; 816 chan->flush_to = opts.flush_to; 817 break; 818 819 case L2CAP_LM: 820 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 821 if (err) 822 break; 823 824 if (opt & L2CAP_LM_FIPS) { 825 err = -EINVAL; 826 break; 827 } 828 829 if (opt & L2CAP_LM_AUTH) 830 chan->sec_level = BT_SECURITY_LOW; 831 if (opt & L2CAP_LM_ENCRYPT) 832 chan->sec_level = BT_SECURITY_MEDIUM; 833 if (opt & L2CAP_LM_SECURE) 834 chan->sec_level = BT_SECURITY_HIGH; 835 836 if (opt & L2CAP_LM_MASTER) 837 set_bit(FLAG_ROLE_SWITCH, &chan->flags); 838 else 839 clear_bit(FLAG_ROLE_SWITCH, &chan->flags); 840 841 if (opt & L2CAP_LM_RELIABLE) 842 set_bit(FLAG_FORCE_RELIABLE, &chan->flags); 843 else 844 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags); 845 break; 846 847 default: 848 err = -ENOPROTOOPT; 849 break; 850 } 851 852 release_sock(sk); 853 return err; 854 } 855 856 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode) 857 { 858 switch (mode) { 859 case BT_MODE_BASIC: 860 if (bdaddr_type_is_le(chan->src_type)) 861 return -EINVAL; 862 mode = L2CAP_MODE_BASIC; 863 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 864 break; 865 case BT_MODE_ERTM: 866 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 867 return -EINVAL; 868 mode = L2CAP_MODE_ERTM; 869 break; 870 case BT_MODE_STREAMING: 871 if (!disable_ertm || bdaddr_type_is_le(chan->src_type)) 872 return -EINVAL; 873 mode = L2CAP_MODE_STREAMING; 874 break; 875 case BT_MODE_LE_FLOWCTL: 876 if (!bdaddr_type_is_le(chan->src_type)) 877 return -EINVAL; 878 mode = L2CAP_MODE_LE_FLOWCTL; 879 break; 880 case BT_MODE_EXT_FLOWCTL: 881 /* TODO: Add support for ECRED PDUs to BR/EDR */ 882 if (!bdaddr_type_is_le(chan->src_type)) 883 return -EINVAL; 884 mode = L2CAP_MODE_EXT_FLOWCTL; 885 break; 886 default: 887 return -EINVAL; 888 } 889 890 chan->mode = mode; 891 892 return 0; 893 } 894 895 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 896 sockptr_t optval, unsigned int optlen) 897 { 898 struct sock *sk = sock->sk; 899 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 900 struct bt_security sec; 901 struct bt_power pwr; 902 struct l2cap_conn *conn; 903 int err = 0; 904 u32 opt, phys; 905 u16 mtu; 906 u8 mode; 907 908 BT_DBG("sk %p", sk); 909 910 if (level == SOL_L2CAP) 911 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen); 912 913 if (level != SOL_BLUETOOTH) 914 return -ENOPROTOOPT; 915 916 lock_sock(sk); 917 918 switch (optname) { 919 case BT_SECURITY: 920 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 921 chan->chan_type != L2CAP_CHAN_FIXED && 922 chan->chan_type != L2CAP_CHAN_RAW) { 923 err = -EINVAL; 924 break; 925 } 926 927 sec.level = BT_SECURITY_LOW; 928 929 err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen); 930 if (err) 931 break; 932 933 if (sec.level < BT_SECURITY_LOW || 934 sec.level > BT_SECURITY_FIPS) { 935 err = -EINVAL; 936 break; 937 } 938 939 chan->sec_level = sec.level; 940 941 if (!chan->conn) 942 break; 943 944 conn = chan->conn; 945 946 /* change security for LE channels */ 947 if (chan->scid == L2CAP_CID_ATT) { 948 if (smp_conn_security(conn->hcon, sec.level)) { 949 err = -EINVAL; 950 break; 951 } 952 953 set_bit(FLAG_PENDING_SECURITY, &chan->flags); 954 sk->sk_state = BT_CONFIG; 955 chan->state = BT_CONFIG; 956 957 /* or for ACL link */ 958 } else if ((sk->sk_state == BT_CONNECT2 && 959 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) || 960 sk->sk_state == BT_CONNECTED) { 961 if (!l2cap_chan_check_security(chan, true)) 962 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 963 else 964 sk->sk_state_change(sk); 965 } else { 966 err = -EINVAL; 967 } 968 break; 969 970 case BT_DEFER_SETUP: 971 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 972 err = -EINVAL; 973 break; 974 } 975 976 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 977 if (err) 978 break; 979 980 if (opt) { 981 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 982 set_bit(FLAG_DEFER_SETUP, &chan->flags); 983 } else { 984 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 985 clear_bit(FLAG_DEFER_SETUP, &chan->flags); 986 } 987 break; 988 989 case BT_FLUSHABLE: 990 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 991 if (err) 992 break; 993 994 if (opt > BT_FLUSHABLE_ON) { 995 err = -EINVAL; 996 break; 997 } 998 999 if (opt == BT_FLUSHABLE_OFF) { 1000 conn = chan->conn; 1001 /* proceed further only when we have l2cap_conn and 1002 No Flush support in the LM */ 1003 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) { 1004 err = -EINVAL; 1005 break; 1006 } 1007 } 1008 1009 if (opt) 1010 set_bit(FLAG_FLUSHABLE, &chan->flags); 1011 else 1012 clear_bit(FLAG_FLUSHABLE, &chan->flags); 1013 break; 1014 1015 case BT_POWER: 1016 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 1017 chan->chan_type != L2CAP_CHAN_RAW) { 1018 err = -EINVAL; 1019 break; 1020 } 1021 1022 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; 1023 1024 err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen); 1025 if (err) 1026 break; 1027 1028 if (pwr.force_active) 1029 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1030 else 1031 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1032 break; 1033 1034 case BT_CHANNEL_POLICY: 1035 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1036 if (err) 1037 break; 1038 1039 err = -EOPNOTSUPP; 1040 break; 1041 1042 case BT_SNDMTU: 1043 if (!bdaddr_type_is_le(chan->src_type)) { 1044 err = -EINVAL; 1045 break; 1046 } 1047 1048 /* Only allow setting output MTU when not connected */ 1049 if (sk->sk_state == BT_CONNECTED) { 1050 err = -EISCONN; 1051 break; 1052 } 1053 1054 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1055 if (err) 1056 break; 1057 1058 chan->omtu = mtu; 1059 break; 1060 1061 case BT_RCVMTU: 1062 if (!bdaddr_type_is_le(chan->src_type)) { 1063 err = -EINVAL; 1064 break; 1065 } 1066 1067 if (chan->mode == L2CAP_MODE_LE_FLOWCTL && 1068 sk->sk_state == BT_CONNECTED) { 1069 err = -EISCONN; 1070 break; 1071 } 1072 1073 err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen); 1074 if (err) 1075 break; 1076 1077 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && 1078 sk->sk_state == BT_CONNECTED) 1079 err = l2cap_chan_reconfigure(chan, mtu); 1080 else 1081 chan->imtu = mtu; 1082 1083 break; 1084 1085 case BT_PHY: 1086 if (sk->sk_state != BT_CONNECTED) { 1087 err = -ENOTCONN; 1088 break; 1089 } 1090 1091 err = copy_safe_from_sockptr(&phys, sizeof(phys), optval, 1092 optlen); 1093 if (err) 1094 break; 1095 1096 if (!chan->conn) 1097 break; 1098 1099 conn = chan->conn; 1100 err = hci_conn_set_phy(conn->hcon, phys); 1101 break; 1102 1103 case BT_MODE: 1104 if (!enable_ecred) { 1105 err = -ENOPROTOOPT; 1106 break; 1107 } 1108 1109 BT_DBG("sk->sk_state %u", sk->sk_state); 1110 1111 if (sk->sk_state != BT_BOUND) { 1112 err = -EINVAL; 1113 break; 1114 } 1115 1116 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1117 err = -EINVAL; 1118 break; 1119 } 1120 1121 err = copy_safe_from_sockptr(&mode, sizeof(mode), optval, 1122 optlen); 1123 if (err) 1124 break; 1125 1126 BT_DBG("mode %u", mode); 1127 1128 err = l2cap_set_mode(chan, mode); 1129 if (err) 1130 break; 1131 1132 BT_DBG("mode 0x%2.2x", chan->mode); 1133 1134 break; 1135 1136 default: 1137 err = -ENOPROTOOPT; 1138 break; 1139 } 1140 1141 release_sock(sk); 1142 return err; 1143 } 1144 1145 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1146 size_t len) 1147 { 1148 struct sock *sk = sock->sk; 1149 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1150 struct sockcm_cookie sockc; 1151 int err; 1152 1153 BT_DBG("sock %p, sk %p", sock, sk); 1154 1155 err = sock_error(sk); 1156 if (err) 1157 return err; 1158 1159 if (msg->msg_flags & MSG_OOB) 1160 return -EOPNOTSUPP; 1161 1162 if (sk->sk_state != BT_CONNECTED) 1163 return -ENOTCONN; 1164 1165 hci_sockcm_init(&sockc, sk); 1166 1167 if (msg->msg_controllen) { 1168 err = sock_cmsg_send(sk, msg, &sockc); 1169 if (err) 1170 return err; 1171 } 1172 1173 lock_sock(sk); 1174 err = bt_sock_wait_ready(sk, msg->msg_flags); 1175 release_sock(sk); 1176 if (err) 1177 return err; 1178 1179 l2cap_chan_lock(chan); 1180 err = l2cap_chan_send(chan, msg, len, &sockc); 1181 l2cap_chan_unlock(chan); 1182 1183 return err; 1184 } 1185 1186 static void l2cap_publish_rx_avail(struct l2cap_chan *chan) 1187 { 1188 struct sock *sk = chan->data; 1189 ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc); 1190 int expected_skbs, skb_overhead; 1191 1192 if (avail <= 0) { 1193 l2cap_chan_rx_avail(chan, 0); 1194 return; 1195 } 1196 1197 if (!chan->mps) { 1198 l2cap_chan_rx_avail(chan, -1); 1199 return; 1200 } 1201 1202 /* Correct available memory by estimated sk_buff overhead. 1203 * This is significant due to small transfer sizes. However, accept 1204 * at least one full packet if receive space is non-zero. 1205 */ 1206 expected_skbs = DIV_ROUND_UP(avail, chan->mps); 1207 skb_overhead = expected_skbs * sizeof(struct sk_buff); 1208 if (skb_overhead < avail) 1209 l2cap_chan_rx_avail(chan, avail - skb_overhead); 1210 else 1211 l2cap_chan_rx_avail(chan, -1); 1212 } 1213 1214 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1215 size_t len, int flags) 1216 { 1217 struct sock *sk = sock->sk; 1218 struct l2cap_pinfo *pi = l2cap_pi(sk); 1219 int err; 1220 1221 if (unlikely(flags & MSG_ERRQUEUE)) 1222 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 1223 BT_SCM_ERROR); 1224 1225 lock_sock(sk); 1226 1227 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP, 1228 &bt_sk(sk)->flags)) { 1229 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 1230 sk->sk_state = BT_CONNECTED; 1231 pi->chan->state = BT_CONNECTED; 1232 __l2cap_ecred_conn_rsp_defer(pi->chan); 1233 } else if (bdaddr_type_is_le(pi->chan->src_type)) { 1234 sk->sk_state = BT_CONNECTED; 1235 pi->chan->state = BT_CONNECTED; 1236 __l2cap_le_connect_rsp_defer(pi->chan); 1237 } else { 1238 sk->sk_state = BT_CONFIG; 1239 pi->chan->state = BT_CONFIG; 1240 __l2cap_connect_rsp_defer(pi->chan); 1241 } 1242 1243 err = 0; 1244 goto done; 1245 } 1246 1247 release_sock(sk); 1248 1249 if (sock->type == SOCK_STREAM) 1250 err = bt_sock_stream_recvmsg(sock, msg, len, flags); 1251 else 1252 err = bt_sock_recvmsg(sock, msg, len, flags); 1253 1254 if (pi->chan->mode != L2CAP_MODE_ERTM && 1255 pi->chan->mode != L2CAP_MODE_LE_FLOWCTL && 1256 pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL) 1257 return err; 1258 1259 lock_sock(sk); 1260 1261 l2cap_publish_rx_avail(pi->chan); 1262 1263 /* Attempt to put pending rx data in the socket buffer */ 1264 while (!list_empty(&pi->rx_busy)) { 1265 struct l2cap_rx_busy *rx_busy = 1266 list_first_entry(&pi->rx_busy, 1267 struct l2cap_rx_busy, 1268 list); 1269 if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0) 1270 goto done; 1271 list_del(&rx_busy->list); 1272 kfree(rx_busy); 1273 } 1274 1275 /* Restore data flow when half of the receive buffer is 1276 * available. This avoids resending large numbers of 1277 * frames. 1278 */ 1279 if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) && 1280 atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1) 1281 l2cap_chan_busy(pi->chan, 0); 1282 1283 done: 1284 release_sock(sk); 1285 return err; 1286 } 1287 1288 /* Release the sock's ref on chan and clear the pointer so that the ref is 1289 * dropped exactly once even if both l2cap_sock_kill() and 1290 * l2cap_sock_destruct() run. Setting chan->data to NULL first stops any other 1291 * task from dereferencing the now-dead sock pointer. 1292 */ 1293 static void l2cap_sock_put_chan(struct sock *sk) 1294 { 1295 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1296 1297 if (!chan) 1298 return; 1299 1300 chan->data = NULL; 1301 l2cap_pi(sk)->chan = NULL; 1302 l2cap_chan_put(chan); 1303 } 1304 1305 /* Kill socket (only if zapped and orphan) 1306 * Must be called on unlocked socket, with l2cap channel lock. 1307 */ 1308 static void l2cap_sock_kill(struct sock *sk) 1309 { 1310 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 1311 return; 1312 1313 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); 1314 1315 l2cap_sock_put_chan(sk); 1316 1317 /* Kill poor orphan */ 1318 sock_set_flag(sk, SOCK_DEAD); 1319 sock_put(sk); 1320 } 1321 1322 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan) 1323 { 1324 DECLARE_WAITQUEUE(wait, current); 1325 int err = 0; 1326 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1327 /* Timeout to prevent infinite loop */ 1328 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT; 1329 1330 add_wait_queue(sk_sleep(sk), &wait); 1331 set_current_state(TASK_INTERRUPTIBLE); 1332 do { 1333 BT_DBG("Waiting for %d ACKs, timeout %04d ms", 1334 chan->unacked_frames, time_after(jiffies, timeout) ? 0 : 1335 jiffies_to_msecs(timeout - jiffies)); 1336 1337 if (!timeo) 1338 timeo = L2CAP_WAIT_ACK_POLL_PERIOD; 1339 1340 if (signal_pending(current)) { 1341 err = sock_intr_errno(timeo); 1342 break; 1343 } 1344 1345 release_sock(sk); 1346 timeo = schedule_timeout(timeo); 1347 lock_sock(sk); 1348 set_current_state(TASK_INTERRUPTIBLE); 1349 1350 err = sock_error(sk); 1351 if (err) 1352 break; 1353 1354 if (time_after(jiffies, timeout)) { 1355 err = -ENOLINK; 1356 break; 1357 } 1358 1359 } while (chan->unacked_frames > 0 && 1360 chan->state == BT_CONNECTED); 1361 1362 set_current_state(TASK_RUNNING); 1363 remove_wait_queue(sk_sleep(sk), &wait); 1364 return err; 1365 } 1366 1367 static int l2cap_sock_shutdown(struct socket *sock, int how) 1368 { 1369 struct sock *sk = sock->sk; 1370 struct l2cap_chan *chan; 1371 struct l2cap_conn *conn; 1372 int err = 0; 1373 1374 BT_DBG("sock %p, sk %p, how %d", sock, sk, how); 1375 1376 /* 'how' parameter is mapped to sk_shutdown as follows: 1377 * SHUT_RD (0) --> RCV_SHUTDOWN (1) 1378 * SHUT_WR (1) --> SEND_SHUTDOWN (2) 1379 * SHUT_RDWR (2) --> SHUTDOWN_MASK (3) 1380 */ 1381 how++; 1382 1383 if (!sk) 1384 return 0; 1385 1386 lock_sock(sk); 1387 1388 if ((sk->sk_shutdown & how) == how) 1389 goto shutdown_already; 1390 1391 BT_DBG("Handling sock shutdown"); 1392 1393 /* prevent sk structure from being freed whilst unlocked */ 1394 sock_hold(sk); 1395 1396 /* prevent chan structure from being freed whilst unlocked */ 1397 chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); 1398 if (!chan) 1399 goto shutdown_already; 1400 1401 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1402 1403 if (chan->mode == L2CAP_MODE_ERTM && 1404 chan->unacked_frames > 0 && 1405 chan->state == BT_CONNECTED) { 1406 err = __l2cap_wait_ack(sk, chan); 1407 1408 /* After waiting for ACKs, check whether shutdown 1409 * has already been actioned to close the L2CAP 1410 * link such as by l2cap_disconnection_req(). 1411 */ 1412 if ((sk->sk_shutdown & how) == how) 1413 goto shutdown_matched; 1414 } 1415 1416 /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN 1417 * is already set 1418 */ 1419 if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) { 1420 sk->sk_shutdown |= RCV_SHUTDOWN; 1421 if ((sk->sk_shutdown & how) == how) 1422 goto shutdown_matched; 1423 } 1424 1425 sk->sk_shutdown |= SEND_SHUTDOWN; 1426 release_sock(sk); 1427 1428 l2cap_chan_lock(chan); 1429 /* prevent conn structure from being freed */ 1430 conn = l2cap_conn_hold_unless_zero(chan->conn); 1431 l2cap_chan_unlock(chan); 1432 1433 if (conn) 1434 /* mutex lock must be taken before l2cap_chan_lock() */ 1435 mutex_lock(&conn->lock); 1436 1437 l2cap_chan_lock(chan); 1438 l2cap_chan_close(chan, 0); 1439 l2cap_chan_unlock(chan); 1440 1441 if (conn) { 1442 mutex_unlock(&conn->lock); 1443 l2cap_conn_put(conn); 1444 } 1445 1446 lock_sock(sk); 1447 1448 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1449 !(current->flags & PF_EXITING)) 1450 err = bt_sock_wait_state(sk, BT_CLOSED, 1451 sk->sk_lingertime); 1452 1453 shutdown_matched: 1454 l2cap_chan_put(chan); 1455 sock_put(sk); 1456 1457 shutdown_already: 1458 if (!err && sk->sk_err) 1459 err = -sk->sk_err; 1460 1461 release_sock(sk); 1462 1463 BT_DBG("Sock shutdown complete err: %d", err); 1464 1465 return err; 1466 } 1467 1468 static int l2cap_sock_release(struct socket *sock) 1469 { 1470 struct sock *sk = sock->sk; 1471 int err; 1472 struct l2cap_chan *chan; 1473 1474 BT_DBG("sock %p, sk %p", sock, sk); 1475 1476 if (!sk) 1477 return 0; 1478 1479 lock_sock_nested(sk, L2CAP_NESTING_PARENT); 1480 l2cap_sock_cleanup_listen(sk); 1481 release_sock(sk); 1482 1483 bt_sock_unlink(&l2cap_sk_list, sk); 1484 1485 err = l2cap_sock_shutdown(sock, SHUT_RDWR); 1486 chan = l2cap_pi(sk)->chan; 1487 1488 l2cap_chan_hold(chan); 1489 l2cap_chan_lock(chan); 1490 1491 sock_orphan(sk); 1492 l2cap_sock_kill(sk); 1493 1494 l2cap_chan_unlock(chan); 1495 l2cap_chan_put(chan); 1496 1497 return err; 1498 } 1499 1500 static void l2cap_sock_cleanup_listen(struct sock *parent) 1501 { 1502 struct sock *sk; 1503 1504 BT_DBG("parent %p state %s", parent, 1505 state_to_string(parent->sk_state)); 1506 1507 /* Close not yet accepted channels. 1508 * 1509 * bt_accept_dequeue() returns sk with its temporary queue-walk 1510 * reference held, so a concurrent l2cap_conn_del() 1511 * -> l2cap_sock_kill() cannot free sk under us. 1512 * 1513 * cleanup_listen() runs under the parent sk lock, so unlike 1514 * l2cap_sock_shutdown() we must NOT take conn->lock here: that would 1515 * establish sk_lock -> conn->lock and invert the established 1516 * conn->lock -> chan->lock -> sk_lock order (lockdep deadlock). 1517 * 1518 * Instead, briefly take the child sk lock to fetch and pin its chan. 1519 * l2cap_conn_del() reaches the chan free only via 1520 * l2cap_chan_del() -> l2cap_sock_teardown_cb(), which itself takes 1521 * the child sk lock; holding it across l2cap_chan_hold_unless_zero() 1522 * therefore guarantees the chan cannot be freed while we read and 1523 * pin it (hold_unless_zero() additionally skips a chan already past 1524 * its last reference). We then drop the sk lock before taking 1525 * chan->lock, so sk and chan locks are never held together. 1526 * 1527 * Since we cannot call l2cap_chan_close() without conn->lock, 1528 * schedule l2cap_chan_timeout to close the channel; it already 1529 * acquires conn->lock -> chan->lock in the correct order. 1530 */ 1531 while ((sk = bt_accept_dequeue(parent, NULL))) { 1532 struct l2cap_chan *chan; 1533 1534 lock_sock_nested(sk, L2CAP_NESTING_NORMAL); 1535 chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); 1536 release_sock(sk); 1537 if (!chan) { 1538 /* l2cap_conn_del() already tearing this child down */ 1539 sock_put(sk); 1540 continue; 1541 } 1542 1543 BT_DBG("child chan %p state %s", chan, 1544 state_to_string(chan->state)); 1545 1546 l2cap_chan_lock(chan); 1547 /* Since we cannot call l2cap_chan_close() without 1548 * conn->lock, schedule its timer to trigger the close 1549 * and cleanup of this channel. 1550 */ 1551 if (chan->conn) 1552 __set_chan_timer(chan, 0); 1553 l2cap_chan_unlock(chan); 1554 1555 l2cap_chan_put(chan); 1556 sock_put(sk); 1557 } 1558 } 1559 1560 static int l2cap_sock_new_connection_cb(struct l2cap_chan *chan, 1561 struct l2cap_chan *new_chan) 1562 { 1563 struct sock *sk, *parent = chan->data; 1564 1565 if (!parent) 1566 return -EINVAL; 1567 1568 lock_sock(parent); 1569 1570 /* Check for backlog size */ 1571 if (sk_acceptq_is_full(parent)) { 1572 BT_DBG("backlog full %d", parent->sk_ack_backlog); 1573 release_sock(parent); 1574 return -ENOBUFS; 1575 } 1576 1577 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, 1578 GFP_ATOMIC, 0, new_chan); 1579 if (!sk) { 1580 release_sock(parent); 1581 return -ENOMEM; 1582 } 1583 1584 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP); 1585 1586 l2cap_sock_init(sk, parent); 1587 1588 /* The conn list reference taken by l2cap_new_connection() keeps new_chan 1589 * alive once release_sock() lets another task free this socket. 1590 */ 1591 bt_accept_enqueue(parent, sk, false); 1592 1593 release_sock(parent); 1594 1595 return 0; 1596 } 1597 1598 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 1599 { 1600 struct sock *sk; 1601 struct l2cap_pinfo *pi; 1602 int err; 1603 1604 sk = chan->data; 1605 if (!sk) 1606 return -ENXIO; 1607 1608 pi = l2cap_pi(sk); 1609 lock_sock(sk); 1610 if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) { 1611 err = -ENOMEM; 1612 goto done; 1613 } 1614 1615 if (chan->mode != L2CAP_MODE_ERTM && 1616 chan->mode != L2CAP_MODE_STREAMING && 1617 chan->mode != L2CAP_MODE_LE_FLOWCTL && 1618 chan->mode != L2CAP_MODE_EXT_FLOWCTL) { 1619 /* Even if no filter is attached, we could potentially 1620 * get errors from security modules, etc. 1621 */ 1622 err = sk_filter(sk, skb); 1623 if (err) 1624 goto done; 1625 } 1626 1627 err = __sock_queue_rcv_skb(sk, skb); 1628 1629 l2cap_publish_rx_avail(chan); 1630 1631 /* For ERTM and LE, handle a skb that doesn't fit into the recv 1632 * buffer. This is important to do because the data frames 1633 * have already been acked, so the skb cannot be discarded. 1634 * 1635 * Notify the l2cap core that the buffer is full, so the 1636 * LOCAL_BUSY state is entered and no more frames are 1637 * acked and reassembled until there is buffer space 1638 * available. 1639 */ 1640 if (err < 0 && 1641 (chan->mode == L2CAP_MODE_ERTM || 1642 chan->mode == L2CAP_MODE_LE_FLOWCTL || 1643 chan->mode == L2CAP_MODE_EXT_FLOWCTL)) { 1644 struct l2cap_rx_busy *rx_busy = kmalloc_obj(*rx_busy); 1645 if (!rx_busy) { 1646 err = -ENOMEM; 1647 goto done; 1648 } 1649 rx_busy->skb = skb; 1650 list_add_tail(&rx_busy->list, &pi->rx_busy); 1651 l2cap_chan_busy(chan, 1); 1652 err = 0; 1653 } 1654 1655 done: 1656 release_sock(sk); 1657 1658 return err; 1659 } 1660 1661 static void l2cap_sock_close_cb(struct l2cap_chan *chan) 1662 { 1663 struct sock *sk = chan->data; 1664 1665 if (!sk) 1666 return; 1667 1668 l2cap_sock_kill(sk); 1669 } 1670 1671 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) 1672 { 1673 struct sock *sk = chan->data; 1674 struct sock *parent; 1675 1676 if (!sk) 1677 return; 1678 1679 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 1680 1681 /* This callback can be called both for server (BT_LISTEN) 1682 * sockets as well as "normal" ones. To avoid lockdep warnings 1683 * with child socket locking (through l2cap_sock_cleanup_listen) 1684 * we need separation into separate nesting levels. The simplest 1685 * way to accomplish this is to inherit the nesting level used 1686 * for the channel. 1687 */ 1688 lock_sock_nested(sk, atomic_read(&chan->nesting)); 1689 1690 parent = bt_sk(sk)->parent; 1691 1692 switch (chan->state) { 1693 case BT_OPEN: 1694 case BT_BOUND: 1695 case BT_CLOSED: 1696 break; 1697 case BT_LISTEN: 1698 l2cap_sock_cleanup_listen(sk); 1699 sk->sk_state = BT_CLOSED; 1700 chan->state = BT_CLOSED; 1701 1702 break; 1703 default: 1704 sk->sk_state = BT_CLOSED; 1705 chan->state = BT_CLOSED; 1706 1707 sk->sk_err = err; 1708 1709 if (parent) { 1710 bt_accept_unlink(sk); 1711 parent->sk_data_ready(parent); 1712 } else { 1713 sk->sk_state_change(sk); 1714 } 1715 1716 break; 1717 } 1718 release_sock(sk); 1719 1720 /* Only zap after cleanup to avoid use after free race */ 1721 sock_set_flag(sk, SOCK_ZAPPED); 1722 1723 } 1724 1725 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, 1726 int err) 1727 { 1728 struct sock *sk = chan->data; 1729 1730 if (!sk) 1731 return; 1732 1733 sk->sk_state = state; 1734 1735 if (err) 1736 sk->sk_err = err; 1737 } 1738 1739 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, 1740 unsigned long hdr_len, 1741 unsigned long len, int nb) 1742 { 1743 struct sock *sk = chan->data; 1744 struct sk_buff *skb; 1745 int err; 1746 1747 l2cap_chan_unlock(chan); 1748 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err); 1749 l2cap_chan_lock(chan); 1750 1751 if (!skb) 1752 return ERR_PTR(err); 1753 1754 /* Channel lock is released before requesting new skb and then 1755 * reacquired thus we need to recheck channel state. 1756 */ 1757 if (chan->state != BT_CONNECTED) { 1758 kfree_skb(skb); 1759 return ERR_PTR(-ENOTCONN); 1760 } 1761 1762 skb->priority = READ_ONCE(sk->sk_priority); 1763 1764 bt_cb(skb)->l2cap.chan = chan; 1765 1766 return skb; 1767 } 1768 1769 static void l2cap_sock_ready_cb(struct l2cap_chan *chan) 1770 { 1771 struct sock *sk = chan->data; 1772 struct sock *parent; 1773 1774 if (!sk) 1775 return; 1776 1777 lock_sock(sk); 1778 1779 parent = bt_sk(sk)->parent; 1780 1781 BT_DBG("sk %p, parent %p", sk, parent); 1782 1783 sk->sk_state = BT_CONNECTED; 1784 sk->sk_state_change(sk); 1785 1786 if (parent) 1787 parent->sk_data_ready(parent); 1788 1789 release_sock(sk); 1790 } 1791 1792 static void l2cap_sock_defer_cb(struct l2cap_chan *chan) 1793 { 1794 struct sock *parent, *sk = chan->data; 1795 1796 lock_sock(sk); 1797 1798 parent = bt_sk(sk)->parent; 1799 if (parent) 1800 parent->sk_data_ready(parent); 1801 1802 release_sock(sk); 1803 } 1804 1805 static void l2cap_sock_resume_cb(struct l2cap_chan *chan) 1806 { 1807 struct sock *sk = chan->data; 1808 1809 if (!sk) 1810 return; 1811 1812 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) { 1813 sk->sk_state = BT_CONNECTED; 1814 chan->state = BT_CONNECTED; 1815 } 1816 1817 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1818 sk->sk_state_change(sk); 1819 } 1820 1821 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan) 1822 { 1823 struct sock *sk = chan->data; 1824 1825 lock_sock(sk); 1826 sk->sk_shutdown = SHUTDOWN_MASK; 1827 release_sock(sk); 1828 } 1829 1830 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan) 1831 { 1832 struct sock *sk = chan->data; 1833 1834 if (!sk) 1835 return 0; 1836 1837 return READ_ONCE(sk->sk_sndtimeo); 1838 } 1839 1840 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan) 1841 { 1842 struct sock *sk = chan->data; 1843 1844 return sk->sk_peer_pid; 1845 } 1846 1847 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) 1848 { 1849 struct sock *sk = chan->data; 1850 1851 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1852 sk->sk_state_change(sk); 1853 } 1854 1855 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) 1856 { 1857 struct sock *sk = chan->data; 1858 1859 switch (chan->mode) { 1860 case L2CAP_MODE_ERTM: 1861 case L2CAP_MODE_STREAMING: 1862 return sk_filter(sk, skb); 1863 } 1864 1865 return 0; 1866 } 1867 1868 static const struct l2cap_ops l2cap_chan_ops = { 1869 .name = "L2CAP Socket Interface", 1870 .new_connection = l2cap_sock_new_connection_cb, 1871 .recv = l2cap_sock_recv_cb, 1872 .close = l2cap_sock_close_cb, 1873 .teardown = l2cap_sock_teardown_cb, 1874 .state_change = l2cap_sock_state_change_cb, 1875 .ready = l2cap_sock_ready_cb, 1876 .defer = l2cap_sock_defer_cb, 1877 .resume = l2cap_sock_resume_cb, 1878 .suspend = l2cap_sock_suspend_cb, 1879 .set_shutdown = l2cap_sock_set_shutdown_cb, 1880 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, 1881 .get_peer_pid = l2cap_sock_get_peer_pid_cb, 1882 .alloc_skb = l2cap_sock_alloc_skb_cb, 1883 .filter = l2cap_sock_filter, 1884 }; 1885 1886 static void l2cap_sock_destruct(struct sock *sk) 1887 { 1888 struct l2cap_rx_busy *rx_busy, *next; 1889 1890 BT_DBG("sk %p", sk); 1891 1892 l2cap_sock_put_chan(sk); 1893 1894 list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) { 1895 kfree_skb(rx_busy->skb); 1896 list_del(&rx_busy->list); 1897 kfree(rx_busy); 1898 } 1899 1900 skb_queue_purge(&sk->sk_receive_queue); 1901 skb_queue_purge(&sk->sk_write_queue); 1902 skb_queue_purge(&sk->sk_error_queue); 1903 } 1904 1905 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name, 1906 int *msg_namelen) 1907 { 1908 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name); 1909 1910 memset(la, 0, sizeof(struct sockaddr_l2)); 1911 la->l2_family = AF_BLUETOOTH; 1912 la->l2_psm = bt_cb(skb)->l2cap.psm; 1913 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr); 1914 1915 *msg_namelen = sizeof(struct sockaddr_l2); 1916 } 1917 1918 static void l2cap_sock_init(struct sock *sk, struct sock *parent) 1919 { 1920 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1921 1922 BT_DBG("sk %p", sk); 1923 1924 if (parent) { 1925 sk->sk_type = parent->sk_type; 1926 bt_sk(sk)->flags = bt_sk(parent)->flags; 1927 1928 /* Channel configuration is inherited from the parent by 1929 * l2cap_new_connection(). 1930 */ 1931 security_sk_clone(parent, sk); 1932 } else { 1933 switch (sk->sk_type) { 1934 case SOCK_RAW: 1935 chan->chan_type = L2CAP_CHAN_RAW; 1936 break; 1937 case SOCK_DGRAM: 1938 chan->chan_type = L2CAP_CHAN_CONN_LESS; 1939 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name; 1940 break; 1941 case SOCK_SEQPACKET: 1942 case SOCK_STREAM: 1943 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED; 1944 break; 1945 } 1946 1947 chan->imtu = L2CAP_DEFAULT_MTU; 1948 chan->omtu = 0; 1949 if (!disable_ertm && sk->sk_type == SOCK_STREAM) { 1950 chan->mode = L2CAP_MODE_ERTM; 1951 set_bit(CONF_STATE2_DEVICE, &chan->conf_state); 1952 } else { 1953 chan->mode = L2CAP_MODE_BASIC; 1954 } 1955 1956 l2cap_chan_set_defaults(chan, NULL); 1957 } 1958 1959 /* Default config options */ 1960 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 1961 1962 chan->data = sk; 1963 chan->ops = &l2cap_chan_ops; 1964 1965 l2cap_publish_rx_avail(chan); 1966 } 1967 1968 static struct proto l2cap_proto = { 1969 .name = "L2CAP", 1970 .owner = THIS_MODULE, 1971 .obj_size = sizeof(struct l2cap_pinfo) 1972 }; 1973 1974 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 1975 int proto, gfp_t prio, int kern, 1976 struct l2cap_chan *chan) 1977 { 1978 struct sock *sk; 1979 1980 sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern); 1981 if (!sk) 1982 return NULL; 1983 1984 sk->sk_destruct = l2cap_sock_destruct; 1985 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT; 1986 1987 INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy); 1988 1989 /* The sock takes ownership of the caller's reference on chan. */ 1990 l2cap_pi(sk)->chan = chan; 1991 1992 return sk; 1993 } 1994 1995 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol, 1996 int kern) 1997 { 1998 struct sock *sk; 1999 struct l2cap_chan *chan; 2000 2001 BT_DBG("sock %p", sock); 2002 2003 sock->state = SS_UNCONNECTED; 2004 2005 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM && 2006 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW) 2007 return -ESOCKTNOSUPPORT; 2008 2009 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) 2010 return -EPERM; 2011 2012 sock->ops = &l2cap_sock_ops; 2013 2014 chan = l2cap_chan_create(); 2015 if (!chan) 2016 return -ENOMEM; 2017 2018 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern, chan); 2019 if (!sk) { 2020 l2cap_chan_put(chan); 2021 return -ENOMEM; 2022 } 2023 2024 l2cap_sock_init(sk, NULL); 2025 bt_sock_link(&l2cap_sk_list, sk); 2026 return 0; 2027 } 2028 2029 static const struct proto_ops l2cap_sock_ops = { 2030 .family = PF_BLUETOOTH, 2031 .owner = THIS_MODULE, 2032 .release = l2cap_sock_release, 2033 .bind = l2cap_sock_bind, 2034 .connect = l2cap_sock_connect, 2035 .listen = l2cap_sock_listen, 2036 .accept = l2cap_sock_accept, 2037 .getname = l2cap_sock_getname, 2038 .sendmsg = l2cap_sock_sendmsg, 2039 .recvmsg = l2cap_sock_recvmsg, 2040 .poll = bt_sock_poll, 2041 .ioctl = bt_sock_ioctl, 2042 .gettstamp = sock_gettstamp, 2043 .mmap = sock_no_mmap, 2044 .socketpair = sock_no_socketpair, 2045 .shutdown = l2cap_sock_shutdown, 2046 .setsockopt = l2cap_sock_setsockopt, 2047 .getsockopt_iter = l2cap_sock_getsockopt 2048 }; 2049 2050 static const struct net_proto_family l2cap_sock_family_ops = { 2051 .family = PF_BLUETOOTH, 2052 .owner = THIS_MODULE, 2053 .create = l2cap_sock_create, 2054 }; 2055 2056 int __init l2cap_init_sockets(void) 2057 { 2058 int err; 2059 2060 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr)); 2061 2062 err = proto_register(&l2cap_proto, 0); 2063 if (err < 0) 2064 return err; 2065 2066 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops); 2067 if (err < 0) { 2068 BT_ERR("L2CAP socket registration failed"); 2069 goto error; 2070 } 2071 2072 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list, 2073 NULL); 2074 if (err < 0) { 2075 BT_ERR("Failed to create L2CAP proc file"); 2076 bt_sock_unregister(BTPROTO_L2CAP); 2077 goto error; 2078 } 2079 2080 BT_INFO("L2CAP socket layer initialized"); 2081 2082 return 0; 2083 2084 error: 2085 proto_unregister(&l2cap_proto); 2086 return err; 2087 } 2088 2089 void l2cap_cleanup_sockets(void) 2090 { 2091 bt_procfs_cleanup(&init_net, "l2cap"); 2092 bt_sock_unregister(BTPROTO_L2CAP); 2093 proto_unregister(&l2cap_proto); 2094 } 2095