l2cap_sock.c

   1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5   Copyright (C) 2010 Google Inc.
   6   Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10   This program is free software; you can redistribute it and/or modify
  11   it under the terms of the GNU General Public License version 2 as
  12   published by the Free Software Foundation;
  13
  14   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25   SOFTWARE IS DISCLAIMED.
  26*/
  27
  28/* Bluetooth L2CAP sockets. */
  29
  30#include <linux/module.h>
  31#include <linux/export.h>
  32#include <linux/filter.h>
  33#include <linux/sched/signal.h>
  34
  35#include <net/bluetooth/bluetooth.h>
  36#include <net/bluetooth/hci_core.h>
  37#include <net/bluetooth/l2cap.h>
  38
  39#include "smp.h"
  40
  41static struct bt_sock_list l2cap_sk_list = {
  42	.lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  43};
  44
  45static const struct proto_ops l2cap_sock_ops;
  46static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  47static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  48				     int proto, gfp_t prio, int kern);
  49static void l2cap_sock_cleanup_listen(struct sock *parent);
  50
  51bool l2cap_is_socket(struct socket *sock)
  52{
  53	return sock && sock->ops == &l2cap_sock_ops;
  54}
  55EXPORT_SYMBOL(l2cap_is_socket);
  56
  57static int l2cap_validate_bredr_psm(u16 psm)
  58{
  59	/* PSM must be odd and lsb of upper byte must be 0 */
  60	if ((psm & 0x0101) != 0x0001)
  61		return -EINVAL;
  62
  63	/* Restrict usage of well-known PSMs */
  64	if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  65		return -EACCES;
  66
  67	return 0;
  68}
  69
  70static int l2cap_validate_le_psm(u16 psm)
  71{
  72	/* Valid LE_PSM ranges are defined only until 0x00ff */
  73	if (psm > L2CAP_PSM_LE_DYN_END)
  74		return -EINVAL;
  75
  76	/* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  77	if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  78		return -EACCES;
  79
  80	return 0;
  81}
  82
  83static int l2cap_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, int alen)
  84{
  85	struct sock *sk = sock->sk;
  86	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  87	struct sockaddr_l2 la;
  88	int len, err = 0;
  89
  90	BT_DBG("sk %p", sk);
  91
  92	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  93	    addr->sa_family != AF_BLUETOOTH)
  94		return -EINVAL;
  95
  96	memset(&la, 0, sizeof(la));
  97	len = min_t(unsigned int, sizeof(la), alen);
  98	memcpy(&la, addr, len);
  99
 100	if (la.l2_cid && la.l2_psm)
 101		return -EINVAL;
 102
 103	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 104		return -EINVAL;
 105
 106	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 107		/* We only allow ATT user space socket */
 108		if (la.l2_cid &&
 109		    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 110			return -EINVAL;
 111	}
 112
 113	lock_sock(sk);
 114
 115	if (sk->sk_state != BT_OPEN) {
 116		err = -EBADFD;
 117		goto done;
 118	}
 119
 120	if (la.l2_psm) {
 121		__u16 psm = __le16_to_cpu(la.l2_psm);
 122
 123		if (la.l2_bdaddr_type == BDADDR_BREDR)
 124			err = l2cap_validate_bredr_psm(psm);
 125		else
 126			err = l2cap_validate_le_psm(psm);
 127
 128		if (err)
 129			goto done;
 130	}
 131
 132	bacpy(&chan->src, &la.l2_bdaddr);
 133	chan->src_type = la.l2_bdaddr_type;
 134
 135	if (la.l2_cid)
 136		err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 137	else
 138		err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 139
 140	if (err < 0)
 141		goto done;
 142
 143	switch (chan->chan_type) {
 144	case L2CAP_CHAN_CONN_LESS:
 145		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 146			chan->sec_level = BT_SECURITY_SDP;
 147		break;
 148	case L2CAP_CHAN_CONN_ORIENTED:
 149		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 150		    __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 151			chan->sec_level = BT_SECURITY_SDP;
 152		break;
 153	case L2CAP_CHAN_RAW:
 154		chan->sec_level = BT_SECURITY_SDP;
 155		break;
 156	case L2CAP_CHAN_FIXED:
 157		/* Fixed channels default to the L2CAP core not holding a
 158		 * hci_conn reference for them. For fixed channels mapping to
 159		 * L2CAP sockets we do want to hold a reference so set the
 160		 * appropriate flag to request it.
 161		 */
 162		set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 163		break;
 164	}
 165
 166	/* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 167	 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 168	 */
 169	if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 170	    chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 171		chan->mode = L2CAP_MODE_LE_FLOWCTL;
 172
 173	chan->state = BT_BOUND;
 174	sk->sk_state = BT_BOUND;
 175
 176done:
 177	release_sock(sk);
 178	return err;
 179}
 180
 181static int l2cap_sock_connect(struct socket *sock, struct sockaddr_unsized *addr,
 182			      int alen, int flags)
 183{
 184	struct sock *sk = sock->sk;
 185	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 186	struct sockaddr_l2 la;
 187	int len, err = 0;
 188	bool zapped;
 189
 190	BT_DBG("sk %p", sk);
 191
 192	lock_sock(sk);
 193	zapped = sock_flag(sk, SOCK_ZAPPED);
 194	release_sock(sk);
 195
 196	if (zapped)
 197		return -EINVAL;
 198
 199	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 200	    addr->sa_family != AF_BLUETOOTH)
 201		return -EINVAL;
 202
 203	memset(&la, 0, sizeof(la));
 204	len = min_t(unsigned int, sizeof(la), alen);
 205	memcpy(&la, addr, len);
 206
 207	if (la.l2_cid && la.l2_psm)
 208		return -EINVAL;
 209
 210	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 211		return -EINVAL;
 212
 213	/* Check that the socket wasn't bound to something that
 214	 * conflicts with the address given to connect(). If chan->src
 215	 * is BDADDR_ANY it means bind() was never used, in which case
 216	 * chan->src_type and la.l2_bdaddr_type do not need to match.
 217	 */
 218	if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 219	    bdaddr_type_is_le(la.l2_bdaddr_type)) {
 220		/* Old user space versions will try to incorrectly bind
 221		 * the ATT socket using BDADDR_BREDR. We need to accept
 222		 * this and fix up the source address type only when
 223		 * both the source CID and destination CID indicate
 224		 * ATT. Anything else is an invalid combination.
 225		 */
 226		if (chan->scid != L2CAP_CID_ATT ||
 227		    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 228			return -EINVAL;
 229
 230		/* We don't have the hdev available here to make a
 231		 * better decision on random vs public, but since all
 232		 * user space versions that exhibit this issue anyway do
 233		 * not support random local addresses assuming public
 234		 * here is good enough.
 235		 */
 236		chan->src_type = BDADDR_LE_PUBLIC;
 237	}
 238
 239	if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 240		return -EINVAL;
 241
 242	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 243		/* We only allow ATT user space socket */
 244		if (la.l2_cid &&
 245		    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 246			return -EINVAL;
 247	}
 248
 249	/* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 250	 * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 251	 */
 252	if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 253	    chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 254		chan->mode = L2CAP_MODE_LE_FLOWCTL;
 255
 256	err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 257				 &la.l2_bdaddr, la.l2_bdaddr_type,
 258				 READ_ONCE(sk->sk_sndtimeo));
 259	if (err)
 260		return err;
 261
 262	lock_sock(sk);
 263
 264	err = bt_sock_wait_state(sk, BT_CONNECTED,
 265				 sock_sndtimeo(sk, flags & O_NONBLOCK));
 266
 267	release_sock(sk);
 268
 269	return err;
 270}
 271
 272static int l2cap_sock_listen(struct socket *sock, int backlog)
 273{
 274	struct sock *sk = sock->sk;
 275	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 276	int err = 0;
 277
 278	BT_DBG("sk %p backlog %d", sk, backlog);
 279
 280	lock_sock(sk);
 281
 282	if (sk->sk_state != BT_BOUND) {
 283		err = -EBADFD;
 284		goto done;
 285	}
 286
 287	if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 288		err = -EINVAL;
 289		goto done;
 290	}
 291
 292	switch (chan->mode) {
 293	case L2CAP_MODE_BASIC:
 294	case L2CAP_MODE_LE_FLOWCTL:
 295		break;
 296	case L2CAP_MODE_EXT_FLOWCTL:
 297		if (!enable_ecred) {
 298			err = -EOPNOTSUPP;
 299			goto done;
 300		}
 301		break;
 302	case L2CAP_MODE_ERTM:
 303	case L2CAP_MODE_STREAMING:
 304		if (!disable_ertm)
 305			break;
 306		fallthrough;
 307	default:
 308		err = -EOPNOTSUPP;
 309		goto done;
 310	}
 311
 312	sk->sk_max_ack_backlog = backlog;
 313	sk->sk_ack_backlog = 0;
 314
 315	/* Listening channels need to use nested locking in order not to
 316	 * cause lockdep warnings when the created child channels end up
 317	 * being locked in the same thread as the parent channel.
 318	 */
 319	atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 320
 321	chan->state = BT_LISTEN;
 322	sk->sk_state = BT_LISTEN;
 323
 324done:
 325	release_sock(sk);
 326	return err;
 327}
 328
 329static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 330			     struct proto_accept_arg *arg)
 331{
 332	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 333	struct sock *sk = sock->sk, *nsk;
 334	long timeo;
 335	int err = 0;
 336
 337	lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 338
 339	timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
 340
 341	BT_DBG("sk %p timeo %ld", sk, timeo);
 342
 343	/* Wait for an incoming connection. (wake-one). */
 344	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 345	while (1) {
 346		if (sk->sk_state != BT_LISTEN) {
 347			err = -EBADFD;
 348			break;
 349		}
 350
 351		nsk = bt_accept_dequeue(sk, newsock);
 352		if (nsk)
 353			break;
 354
 355		if (!timeo) {
 356			err = -EAGAIN;
 357			break;
 358		}
 359
 360		if (signal_pending(current)) {
 361			err = sock_intr_errno(timeo);
 362			break;
 363		}
 364
 365		release_sock(sk);
 366
 367		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 368
 369		lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 370	}
 371	remove_wait_queue(sk_sleep(sk), &wait);
 372
 373	if (err)
 374		goto done;
 375
 376	newsock->state = SS_CONNECTED;
 377
 378	BT_DBG("new socket %p", nsk);
 379
 380done:
 381	release_sock(sk);
 382	return err;
 383}
 384
 385static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 386			      int peer)
 387{
 388	struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 389	struct sock *sk = sock->sk;
 390	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 391
 392	BT_DBG("sock %p, sk %p", sock, sk);
 393
 394	if (peer && sk->sk_state != BT_CONNECTED &&
 395	    sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 396	    sk->sk_state != BT_CONFIG)
 397		return -ENOTCONN;
 398
 399	memset(la, 0, sizeof(struct sockaddr_l2));
 400	addr->sa_family = AF_BLUETOOTH;
 401
 402	la->l2_psm = chan->psm;
 403
 404	if (peer) {
 405		bacpy(&la->l2_bdaddr, &chan->dst);
 406		la->l2_cid = cpu_to_le16(chan->dcid);
 407		la->l2_bdaddr_type = chan->dst_type;
 408	} else {
 409		bacpy(&la->l2_bdaddr, &chan->src);
 410		la->l2_cid = cpu_to_le16(chan->scid);
 411		la->l2_bdaddr_type = chan->src_type;
 412	}
 413
 414	return sizeof(struct sockaddr_l2);
 415}
 416
 417static int l2cap_get_mode(struct l2cap_chan *chan)
 418{
 419	switch (chan->mode) {
 420	case L2CAP_MODE_BASIC:
 421		return BT_MODE_BASIC;
 422	case L2CAP_MODE_ERTM:
 423		return BT_MODE_ERTM;
 424	case L2CAP_MODE_STREAMING:
 425		return BT_MODE_STREAMING;
 426	case L2CAP_MODE_LE_FLOWCTL:
 427		return BT_MODE_LE_FLOWCTL;
 428	case L2CAP_MODE_EXT_FLOWCTL:
 429		return BT_MODE_EXT_FLOWCTL;
 430	}
 431
 432	return -EINVAL;
 433}
 434
 435static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 436				     char __user *optval, int __user *optlen)
 437{
 438	struct sock *sk = sock->sk;
 439	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 440	struct l2cap_options opts;
 441	struct l2cap_conninfo cinfo;
 442	int err = 0;
 443	size_t len;
 444	u32 opt;
 445
 446	BT_DBG("sk %p", sk);
 447
 448	if (get_user(len, optlen))
 449		return -EFAULT;
 450
 451	lock_sock(sk);
 452
 453	switch (optname) {
 454	case L2CAP_OPTIONS:
 455		/* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 456		 * legacy ATT code depends on getsockopt for
 457		 * L2CAP_OPTIONS we need to let this pass.
 458		 */
 459		if (bdaddr_type_is_le(chan->src_type) &&
 460		    chan->scid != L2CAP_CID_ATT) {
 461			err = -EINVAL;
 462			break;
 463		}
 464
 465		/* Only BR/EDR modes are supported here */
 466		switch (chan->mode) {
 467		case L2CAP_MODE_BASIC:
 468		case L2CAP_MODE_ERTM:
 469		case L2CAP_MODE_STREAMING:
 470			break;
 471		default:
 472			err = -EINVAL;
 473			break;
 474		}
 475
 476		if (err < 0)
 477			break;
 478
 479		memset(&opts, 0, sizeof(opts));
 480		opts.imtu     = chan->imtu;
 481		opts.omtu     = chan->omtu;
 482		opts.flush_to = chan->flush_to;
 483		opts.mode     = chan->mode;
 484		opts.fcs      = chan->fcs;
 485		opts.max_tx   = chan->max_tx;
 486		opts.txwin_size = chan->tx_win;
 487
 488		BT_DBG("mode 0x%2.2x", chan->mode);
 489
 490		len = min(len, sizeof(opts));
 491		if (copy_to_user(optval, (char *) &opts, len))
 492			err = -EFAULT;
 493
 494		break;
 495
 496	case L2CAP_LM:
 497		switch (chan->sec_level) {
 498		case BT_SECURITY_LOW:
 499			opt = L2CAP_LM_AUTH;
 500			break;
 501		case BT_SECURITY_MEDIUM:
 502			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 503			break;
 504		case BT_SECURITY_HIGH:
 505			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 506			      L2CAP_LM_SECURE;
 507			break;
 508		case BT_SECURITY_FIPS:
 509			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 510			      L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 511			break;
 512		default:
 513			opt = 0;
 514			break;
 515		}
 516
 517		if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 518			opt |= L2CAP_LM_MASTER;
 519
 520		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 521			opt |= L2CAP_LM_RELIABLE;
 522
 523		if (put_user(opt, (u32 __user *) optval))
 524			err = -EFAULT;
 525
 526		break;
 527
 528	case L2CAP_CONNINFO:
 529		if (sk->sk_state != BT_CONNECTED &&
 530		    !(sk->sk_state == BT_CONNECT2 &&
 531		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 532			err = -ENOTCONN;
 533			break;
 534		}
 535
 536		memset(&cinfo, 0, sizeof(cinfo));
 537		cinfo.hci_handle = chan->conn->hcon->handle;
 538		memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 539
 540		len = min(len, sizeof(cinfo));
 541		if (copy_to_user(optval, (char *) &cinfo, len))
 542			err = -EFAULT;
 543
 544		break;
 545
 546	default:
 547		err = -ENOPROTOOPT;
 548		break;
 549	}
 550
 551	release_sock(sk);
 552	return err;
 553}
 554
 555static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 556				 char __user *optval, int __user *optlen)
 557{
 558	struct sock *sk = sock->sk;
 559	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 560	struct bt_security sec;
 561	struct bt_power pwr;
 562	u32 phys;
 563	int len, mode, err = 0;
 564
 565	BT_DBG("sk %p", sk);
 566
 567	if (level == SOL_L2CAP)
 568		return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 569
 570	if (level != SOL_BLUETOOTH)
 571		return -ENOPROTOOPT;
 572
 573	if (get_user(len, optlen))
 574		return -EFAULT;
 575
 576	lock_sock(sk);
 577
 578	switch (optname) {
 579	case BT_SECURITY:
 580		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 581		    chan->chan_type != L2CAP_CHAN_FIXED &&
 582		    chan->chan_type != L2CAP_CHAN_RAW) {
 583			err = -EINVAL;
 584			break;
 585		}
 586
 587		memset(&sec, 0, sizeof(sec));
 588		if (chan->conn) {
 589			sec.level = chan->conn->hcon->sec_level;
 590
 591			if (sk->sk_state == BT_CONNECTED)
 592				sec.key_size = chan->conn->hcon->enc_key_size;
 593		} else {
 594			sec.level = chan->sec_level;
 595		}
 596
 597		len = min_t(unsigned int, len, sizeof(sec));
 598		if (copy_to_user(optval, (char *) &sec, len))
 599			err = -EFAULT;
 600
 601		break;
 602
 603	case BT_DEFER_SETUP:
 604		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 605			err = -EINVAL;
 606			break;
 607		}
 608
 609		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 610			     (u32 __user *) optval))
 611			err = -EFAULT;
 612
 613		break;
 614
 615	case BT_FLUSHABLE:
 616		if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 617			     (u32 __user *) optval))
 618			err = -EFAULT;
 619
 620		break;
 621
 622	case BT_POWER:
 623		if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 624		    && sk->sk_type != SOCK_RAW) {
 625			err = -EINVAL;
 626			break;
 627		}
 628
 629		pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 630
 631		len = min_t(unsigned int, len, sizeof(pwr));
 632		if (copy_to_user(optval, (char *) &pwr, len))
 633			err = -EFAULT;
 634
 635		break;
 636
 637	case BT_CHANNEL_POLICY:
 638		if (put_user(chan->chan_policy, (u32 __user *) optval))
 639			err = -EFAULT;
 640		break;
 641
 642	case BT_SNDMTU:
 643		if (!bdaddr_type_is_le(chan->src_type)) {
 644			err = -EINVAL;
 645			break;
 646		}
 647
 648		if (sk->sk_state != BT_CONNECTED) {
 649			err = -ENOTCONN;
 650			break;
 651		}
 652
 653		if (put_user(chan->omtu, (u16 __user *) optval))
 654			err = -EFAULT;
 655		break;
 656
 657	case BT_RCVMTU:
 658		if (!bdaddr_type_is_le(chan->src_type)) {
 659			err = -EINVAL;
 660			break;
 661		}
 662
 663		if (put_user(chan->imtu, (u16 __user *) optval))
 664			err = -EFAULT;
 665		break;
 666
 667	case BT_PHY:
 668		if (sk->sk_state != BT_CONNECTED) {
 669			err = -ENOTCONN;
 670			break;
 671		}
 672
 673		phys = hci_conn_get_phy(chan->conn->hcon);
 674
 675		if (put_user(phys, (u32 __user *) optval))
 676			err = -EFAULT;
 677		break;
 678
 679	case BT_MODE:
 680		if (!enable_ecred) {
 681			err = -ENOPROTOOPT;
 682			break;
 683		}
 684
 685		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 686			err = -EINVAL;
 687			break;
 688		}
 689
 690		mode = l2cap_get_mode(chan);
 691		if (mode < 0) {
 692			err = mode;
 693			break;
 694		}
 695
 696		if (put_user(mode, (u8 __user *) optval))
 697			err = -EFAULT;
 698		break;
 699
 700	default:
 701		err = -ENOPROTOOPT;
 702		break;
 703	}
 704
 705	release_sock(sk);
 706	return err;
 707}
 708
 709static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 710{
 711	switch (chan->scid) {
 712	case L2CAP_CID_ATT:
 713		if (mtu && mtu < L2CAP_LE_MIN_MTU)
 714			return false;
 715		break;
 716
 717	default:
 718		if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU)
 719			return false;
 720	}
 721
 722	return true;
 723}
 724
 725static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 726				     sockptr_t optval, unsigned int optlen)
 727{
 728	struct sock *sk = sock->sk;
 729	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 730	struct l2cap_options opts;
 731	int err = 0;
 732	u32 opt;
 733
 734	BT_DBG("sk %p", sk);
 735
 736	lock_sock(sk);
 737
 738	switch (optname) {
 739	case L2CAP_OPTIONS:
 740		if (bdaddr_type_is_le(chan->src_type)) {
 741			err = -EINVAL;
 742			break;
 743		}
 744
 745		if (sk->sk_state == BT_CONNECTED) {
 746			err = -EINVAL;
 747			break;
 748		}
 749
 750		opts.imtu     = chan->imtu;
 751		opts.omtu     = chan->omtu;
 752		opts.flush_to = chan->flush_to;
 753		opts.mode     = chan->mode;
 754		opts.fcs      = chan->fcs;
 755		opts.max_tx   = chan->max_tx;
 756		opts.txwin_size = chan->tx_win;
 757
 758		err = copy_safe_from_sockptr(&opts, sizeof(opts), optval,
 759					     optlen);
 760		if (err)
 761			break;
 762
 763		if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 764			err = -EINVAL;
 765			break;
 766		}
 767
 768		if (!l2cap_valid_mtu(chan, opts.imtu)) {
 769			err = -EINVAL;
 770			break;
 771		}
 772
 773		/* Only BR/EDR modes are supported here */
 774		switch (opts.mode) {
 775		case L2CAP_MODE_BASIC:
 776			clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 777			break;
 778		case L2CAP_MODE_ERTM:
 779		case L2CAP_MODE_STREAMING:
 780			if (!disable_ertm)
 781				break;
 782			fallthrough;
 783		default:
 784			err = -EINVAL;
 785			break;
 786		}
 787
 788		if (err < 0)
 789			break;
 790
 791		chan->mode = opts.mode;
 792
 793		BT_DBG("mode 0x%2.2x", chan->mode);
 794
 795		chan->imtu = opts.imtu;
 796		chan->omtu = opts.omtu;
 797		chan->fcs  = opts.fcs;
 798		chan->max_tx = opts.max_tx;
 799		chan->tx_win = opts.txwin_size;
 800		chan->flush_to = opts.flush_to;
 801		break;
 802
 803	case L2CAP_LM:
 804		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 805		if (err)
 806			break;
 807
 808		if (opt & L2CAP_LM_FIPS) {
 809			err = -EINVAL;
 810			break;
 811		}
 812
 813		if (opt & L2CAP_LM_AUTH)
 814			chan->sec_level = BT_SECURITY_LOW;
 815		if (opt & L2CAP_LM_ENCRYPT)
 816			chan->sec_level = BT_SECURITY_MEDIUM;
 817		if (opt & L2CAP_LM_SECURE)
 818			chan->sec_level = BT_SECURITY_HIGH;
 819
 820		if (opt & L2CAP_LM_MASTER)
 821			set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 822		else
 823			clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 824
 825		if (opt & L2CAP_LM_RELIABLE)
 826			set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 827		else
 828			clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 829		break;
 830
 831	default:
 832		err = -ENOPROTOOPT;
 833		break;
 834	}
 835
 836	release_sock(sk);
 837	return err;
 838}
 839
 840static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
 841{
 842	switch (mode) {
 843	case BT_MODE_BASIC:
 844		if (bdaddr_type_is_le(chan->src_type))
 845			return -EINVAL;
 846		mode = L2CAP_MODE_BASIC;
 847		clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 848		break;
 849	case BT_MODE_ERTM:
 850		if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 851			return -EINVAL;
 852		mode = L2CAP_MODE_ERTM;
 853		break;
 854	case BT_MODE_STREAMING:
 855		if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 856			return -EINVAL;
 857		mode = L2CAP_MODE_STREAMING;
 858		break;
 859	case BT_MODE_LE_FLOWCTL:
 860		if (!bdaddr_type_is_le(chan->src_type))
 861			return -EINVAL;
 862		mode = L2CAP_MODE_LE_FLOWCTL;
 863		break;
 864	case BT_MODE_EXT_FLOWCTL:
 865		/* TODO: Add support for ECRED PDUs to BR/EDR */
 866		if (!bdaddr_type_is_le(chan->src_type))
 867			return -EINVAL;
 868		mode = L2CAP_MODE_EXT_FLOWCTL;
 869		break;
 870	default:
 871		return -EINVAL;
 872	}
 873
 874	chan->mode = mode;
 875
 876	return 0;
 877}
 878
 879static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 880				 sockptr_t optval, unsigned int optlen)
 881{
 882	struct sock *sk = sock->sk;
 883	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 884	struct bt_security sec;
 885	struct bt_power pwr;
 886	struct l2cap_conn *conn;
 887	int err = 0;
 888	u32 opt, phys;
 889	u16 mtu;
 890	u8 mode;
 891
 892	BT_DBG("sk %p", sk);
 893
 894	if (level == SOL_L2CAP)
 895		return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 896
 897	if (level != SOL_BLUETOOTH)
 898		return -ENOPROTOOPT;
 899
 900	lock_sock(sk);
 901
 902	switch (optname) {
 903	case BT_SECURITY:
 904		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 905		    chan->chan_type != L2CAP_CHAN_FIXED &&
 906		    chan->chan_type != L2CAP_CHAN_RAW) {
 907			err = -EINVAL;
 908			break;
 909		}
 910
 911		sec.level = BT_SECURITY_LOW;
 912
 913		err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
 914		if (err)
 915			break;
 916
 917		if (sec.level < BT_SECURITY_LOW ||
 918		    sec.level > BT_SECURITY_FIPS) {
 919			err = -EINVAL;
 920			break;
 921		}
 922
 923		chan->sec_level = sec.level;
 924
 925		if (!chan->conn)
 926			break;
 927
 928		conn = chan->conn;
 929
 930		/* change security for LE channels */
 931		if (chan->scid == L2CAP_CID_ATT) {
 932			if (smp_conn_security(conn->hcon, sec.level)) {
 933				err = -EINVAL;
 934				break;
 935			}
 936
 937			set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 938			sk->sk_state = BT_CONFIG;
 939			chan->state = BT_CONFIG;
 940
 941		/* or for ACL link */
 942		} else if ((sk->sk_state == BT_CONNECT2 &&
 943			    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 944			   sk->sk_state == BT_CONNECTED) {
 945			if (!l2cap_chan_check_security(chan, true))
 946				set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 947			else
 948				sk->sk_state_change(sk);
 949		} else {
 950			err = -EINVAL;
 951		}
 952		break;
 953
 954	case BT_DEFER_SETUP:
 955		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 956			err = -EINVAL;
 957			break;
 958		}
 959
 960		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 961		if (err)
 962			break;
 963
 964		if (opt) {
 965			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 966			set_bit(FLAG_DEFER_SETUP, &chan->flags);
 967		} else {
 968			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 969			clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 970		}
 971		break;
 972
 973	case BT_FLUSHABLE:
 974		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 975		if (err)
 976			break;
 977
 978		if (opt > BT_FLUSHABLE_ON) {
 979			err = -EINVAL;
 980			break;
 981		}
 982
 983		if (opt == BT_FLUSHABLE_OFF) {
 984			conn = chan->conn;
 985			/* proceed further only when we have l2cap_conn and
 986			   No Flush support in the LM */
 987			if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 988				err = -EINVAL;
 989				break;
 990			}
 991		}
 992
 993		if (opt)
 994			set_bit(FLAG_FLUSHABLE, &chan->flags);
 995		else
 996			clear_bit(FLAG_FLUSHABLE, &chan->flags);
 997		break;
 998
 999	case BT_POWER:
1000		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
1001		    chan->chan_type != L2CAP_CHAN_RAW) {
1002			err = -EINVAL;
1003			break;
1004		}
1005
1006		pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1007
1008		err = copy_safe_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
1009		if (err)
1010			break;
1011
1012		if (pwr.force_active)
1013			set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1014		else
1015			clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1016		break;
1017
1018	case BT_CHANNEL_POLICY:
1019		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1020		if (err)
1021			break;
1022
1023		err = -EOPNOTSUPP;
1024		break;
1025
1026	case BT_SNDMTU:
1027		if (!bdaddr_type_is_le(chan->src_type)) {
1028			err = -EINVAL;
1029			break;
1030		}
1031
1032		/* Only allow setting output MTU when not connected */
1033		if (sk->sk_state == BT_CONNECTED) {
1034			err = -EISCONN;
1035			break;
1036		}
1037
1038		err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1039		if (err)
1040			break;
1041
1042		chan->omtu = mtu;
1043		break;
1044
1045	case BT_RCVMTU:
1046		if (!bdaddr_type_is_le(chan->src_type)) {
1047			err = -EINVAL;
1048			break;
1049		}
1050
1051		if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1052		    sk->sk_state == BT_CONNECTED) {
1053			err = -EISCONN;
1054			break;
1055		}
1056
1057		err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
1058		if (err)
1059			break;
1060
1061		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1062		    sk->sk_state == BT_CONNECTED)
1063			err = l2cap_chan_reconfigure(chan, mtu);
1064		else
1065			chan->imtu = mtu;
1066
1067		break;
1068
1069	case BT_PHY:
1070		if (sk->sk_state != BT_CONNECTED) {
1071			err = -ENOTCONN;
1072			break;
1073		}
1074
1075		err = copy_safe_from_sockptr(&phys, sizeof(phys), optval,
1076					     optlen);
1077		if (err)
1078			break;
1079
1080		if (!chan->conn)
1081			break;
1082
1083		conn = chan->conn;
1084		err = hci_conn_set_phy(conn->hcon, phys);
1085		break;
1086
1087	case BT_MODE:
1088		if (!enable_ecred) {
1089			err = -ENOPROTOOPT;
1090			break;
1091		}
1092
1093		BT_DBG("sk->sk_state %u", sk->sk_state);
1094
1095		if (sk->sk_state != BT_BOUND) {
1096			err = -EINVAL;
1097			break;
1098		}
1099
1100		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1101			err = -EINVAL;
1102			break;
1103		}
1104
1105		err = copy_safe_from_sockptr(&mode, sizeof(mode), optval,
1106					     optlen);
1107		if (err)
1108			break;
1109
1110		BT_DBG("mode %u", mode);
1111
1112		err = l2cap_set_mode(chan, mode);
1113		if (err)
1114			break;
1115
1116		BT_DBG("mode 0x%2.2x", chan->mode);
1117
1118		break;
1119
1120	default:
1121		err = -ENOPROTOOPT;
1122		break;
1123	}
1124
1125	release_sock(sk);
1126	return err;
1127}
1128
1129static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1130			      size_t len)
1131{
1132	struct sock *sk = sock->sk;
1133	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1134	struct sockcm_cookie sockc;
1135	int err;
1136
1137	BT_DBG("sock %p, sk %p", sock, sk);
1138
1139	err = sock_error(sk);
1140	if (err)
1141		return err;
1142
1143	if (msg->msg_flags & MSG_OOB)
1144		return -EOPNOTSUPP;
1145
1146	if (sk->sk_state != BT_CONNECTED)
1147		return -ENOTCONN;
1148
1149	hci_sockcm_init(&sockc, sk);
1150
1151	if (msg->msg_controllen) {
1152		err = sock_cmsg_send(sk, msg, &sockc);
1153		if (err)
1154			return err;
1155	}
1156
1157	lock_sock(sk);
1158	err = bt_sock_wait_ready(sk, msg->msg_flags);
1159	release_sock(sk);
1160	if (err)
1161		return err;
1162
1163	l2cap_chan_lock(chan);
1164	err = l2cap_chan_send(chan, msg, len, &sockc);
1165	l2cap_chan_unlock(chan);
1166
1167	return err;
1168}
1169
1170static void l2cap_publish_rx_avail(struct l2cap_chan *chan)
1171{
1172	struct sock *sk = chan->data;
1173	ssize_t avail = sk->sk_rcvbuf - atomic_read(&sk->sk_rmem_alloc);
1174	int expected_skbs, skb_overhead;
1175
1176	if (avail <= 0) {
1177		l2cap_chan_rx_avail(chan, 0);
1178		return;
1179	}
1180
1181	if (!chan->mps) {
1182		l2cap_chan_rx_avail(chan, -1);
1183		return;
1184	}
1185
1186	/* Correct available memory by estimated sk_buff overhead.
1187	 * This is significant due to small transfer sizes. However, accept
1188	 * at least one full packet if receive space is non-zero.
1189	 */
1190	expected_skbs = DIV_ROUND_UP(avail, chan->mps);
1191	skb_overhead = expected_skbs * sizeof(struct sk_buff);
1192	if (skb_overhead < avail)
1193		l2cap_chan_rx_avail(chan, avail - skb_overhead);
1194	else
1195		l2cap_chan_rx_avail(chan, -1);
1196}
1197
1198static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1199			      size_t len, int flags)
1200{
1201	struct sock *sk = sock->sk;
1202	struct l2cap_pinfo *pi = l2cap_pi(sk);
1203	int err;
1204
1205	if (unlikely(flags & MSG_ERRQUEUE))
1206		return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH,
1207					  BT_SCM_ERROR);
1208
1209	lock_sock(sk);
1210
1211	if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1212						    &bt_sk(sk)->flags)) {
1213		if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1214			sk->sk_state = BT_CONNECTED;
1215			pi->chan->state = BT_CONNECTED;
1216			__l2cap_ecred_conn_rsp_defer(pi->chan);
1217		} else if (bdaddr_type_is_le(pi->chan->src_type)) {
1218			sk->sk_state = BT_CONNECTED;
1219			pi->chan->state = BT_CONNECTED;
1220			__l2cap_le_connect_rsp_defer(pi->chan);
1221		} else {
1222			sk->sk_state = BT_CONFIG;
1223			pi->chan->state = BT_CONFIG;
1224			__l2cap_connect_rsp_defer(pi->chan);
1225		}
1226
1227		err = 0;
1228		goto done;
1229	}
1230
1231	release_sock(sk);
1232
1233	if (sock->type == SOCK_STREAM)
1234		err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1235	else
1236		err = bt_sock_recvmsg(sock, msg, len, flags);
1237
1238	if (pi->chan->mode != L2CAP_MODE_ERTM &&
1239	    pi->chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1240	    pi->chan->mode != L2CAP_MODE_EXT_FLOWCTL)
1241		return err;
1242
1243	lock_sock(sk);
1244
1245	l2cap_publish_rx_avail(pi->chan);
1246
1247	/* Attempt to put pending rx data in the socket buffer */
1248	while (!list_empty(&pi->rx_busy)) {
1249		struct l2cap_rx_busy *rx_busy =
1250			list_first_entry(&pi->rx_busy,
1251					 struct l2cap_rx_busy,
1252					 list);
1253		if (__sock_queue_rcv_skb(sk, rx_busy->skb) < 0)
1254			goto done;
1255		list_del(&rx_busy->list);
1256		kfree(rx_busy);
1257	}
1258
1259	/* Restore data flow when half of the receive buffer is
1260	 * available.  This avoids resending large numbers of
1261	 * frames.
1262	 */
1263	if (test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state) &&
1264	    atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1265		l2cap_chan_busy(pi->chan, 0);
1266
1267done:
1268	release_sock(sk);
1269	return err;
1270}
1271
1272/* Kill socket (only if zapped and orphan)
1273 * Must be called on unlocked socket, with l2cap channel lock.
1274 */
1275static void l2cap_sock_kill(struct sock *sk)
1276{
1277	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1278		return;
1279
1280	BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1281
1282	/* Sock is dead, so set chan data to NULL, avoid other task use invalid
1283	 * sock pointer.
1284	 */
1285	l2cap_pi(sk)->chan->data = NULL;
1286	/* Kill poor orphan */
1287
1288	l2cap_chan_put(l2cap_pi(sk)->chan);
1289	sock_set_flag(sk, SOCK_DEAD);
1290	sock_put(sk);
1291}
1292
1293static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1294{
1295	DECLARE_WAITQUEUE(wait, current);
1296	int err = 0;
1297	int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1298	/* Timeout to prevent infinite loop */
1299	unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1300
1301	add_wait_queue(sk_sleep(sk), &wait);
1302	set_current_state(TASK_INTERRUPTIBLE);
1303	do {
1304		BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1305		       chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1306		       jiffies_to_msecs(timeout - jiffies));
1307
1308		if (!timeo)
1309			timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1310
1311		if (signal_pending(current)) {
1312			err = sock_intr_errno(timeo);
1313			break;
1314		}
1315
1316		release_sock(sk);
1317		timeo = schedule_timeout(timeo);
1318		lock_sock(sk);
1319		set_current_state(TASK_INTERRUPTIBLE);
1320
1321		err = sock_error(sk);
1322		if (err)
1323			break;
1324
1325		if (time_after(jiffies, timeout)) {
1326			err = -ENOLINK;
1327			break;
1328		}
1329
1330	} while (chan->unacked_frames > 0 &&
1331		 chan->state == BT_CONNECTED);
1332
1333	set_current_state(TASK_RUNNING);
1334	remove_wait_queue(sk_sleep(sk), &wait);
1335	return err;
1336}
1337
1338static int l2cap_sock_shutdown(struct socket *sock, int how)
1339{
1340	struct sock *sk = sock->sk;
1341	struct l2cap_chan *chan;
1342	struct l2cap_conn *conn;
1343	int err = 0;
1344
1345	BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1346
1347	/* 'how' parameter is mapped to sk_shutdown as follows:
1348	 * SHUT_RD   (0) --> RCV_SHUTDOWN  (1)
1349	 * SHUT_WR   (1) --> SEND_SHUTDOWN (2)
1350	 * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1351	 */
1352	how++;
1353
1354	if (!sk)
1355		return 0;
1356
1357	lock_sock(sk);
1358
1359	if ((sk->sk_shutdown & how) == how)
1360		goto shutdown_already;
1361
1362	BT_DBG("Handling sock shutdown");
1363
1364	/* prevent sk structure from being freed whilst unlocked */
1365	sock_hold(sk);
1366
1367	/* prevent chan structure from being freed whilst unlocked */
1368	chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
1369	if (!chan)
1370		goto shutdown_already;
1371
1372	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1373
1374	if (chan->mode == L2CAP_MODE_ERTM &&
1375	    chan->unacked_frames > 0 &&
1376	    chan->state == BT_CONNECTED) {
1377		err = __l2cap_wait_ack(sk, chan);
1378
1379		/* After waiting for ACKs, check whether shutdown
1380		 * has already been actioned to close the L2CAP
1381		 * link such as by l2cap_disconnection_req().
1382		 */
1383		if ((sk->sk_shutdown & how) == how)
1384			goto shutdown_matched;
1385	}
1386
1387	/* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1388	 * is already set
1389	 */
1390	if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1391		sk->sk_shutdown |= RCV_SHUTDOWN;
1392		if ((sk->sk_shutdown & how) == how)
1393			goto shutdown_matched;
1394	}
1395
1396	sk->sk_shutdown |= SEND_SHUTDOWN;
1397	release_sock(sk);
1398
1399	l2cap_chan_lock(chan);
1400	/* prevent conn structure from being freed */
1401	conn = l2cap_conn_hold_unless_zero(chan->conn);
1402	l2cap_chan_unlock(chan);
1403
1404	if (conn)
1405		/* mutex lock must be taken before l2cap_chan_lock() */
1406		mutex_lock(&conn->lock);
1407
1408	l2cap_chan_lock(chan);
1409	l2cap_chan_close(chan, 0);
1410	l2cap_chan_unlock(chan);
1411
1412	if (conn) {
1413		mutex_unlock(&conn->lock);
1414		l2cap_conn_put(conn);
1415	}
1416
1417	lock_sock(sk);
1418
1419	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1420	    !(current->flags & PF_EXITING))
1421		err = bt_sock_wait_state(sk, BT_CLOSED,
1422					 sk->sk_lingertime);
1423
1424shutdown_matched:
1425	l2cap_chan_put(chan);
1426	sock_put(sk);
1427
1428shutdown_already:
1429	if (!err && sk->sk_err)
1430		err = -sk->sk_err;
1431
1432	release_sock(sk);
1433
1434	BT_DBG("Sock shutdown complete err: %d", err);
1435
1436	return err;
1437}
1438
1439static int l2cap_sock_release(struct socket *sock)
1440{
1441	struct sock *sk = sock->sk;
1442	int err;
1443	struct l2cap_chan *chan;
1444
1445	BT_DBG("sock %p, sk %p", sock, sk);
1446
1447	if (!sk)
1448		return 0;
1449
1450	lock_sock_nested(sk, L2CAP_NESTING_PARENT);
1451	l2cap_sock_cleanup_listen(sk);
1452	release_sock(sk);
1453
1454	bt_sock_unlink(&l2cap_sk_list, sk);
1455
1456	err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1457	chan = l2cap_pi(sk)->chan;
1458
1459	l2cap_chan_hold(chan);
1460	l2cap_chan_lock(chan);
1461
1462	sock_orphan(sk);
1463	l2cap_sock_kill(sk);
1464
1465	l2cap_chan_unlock(chan);
1466	l2cap_chan_put(chan);
1467
1468	return err;
1469}
1470
1471static void l2cap_sock_cleanup_listen(struct sock *parent)
1472{
1473	struct sock *sk;
1474
1475	BT_DBG("parent %p state %s", parent,
1476	       state_to_string(parent->sk_state));
1477
1478	/* Close not yet accepted channels */
1479	while ((sk = bt_accept_dequeue(parent, NULL))) {
1480		struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1481
1482		BT_DBG("child chan %p state %s", chan,
1483		       state_to_string(chan->state));
1484
1485		l2cap_chan_hold(chan);
1486		l2cap_chan_lock(chan);
1487
1488		__clear_chan_timer(chan);
1489		l2cap_chan_close(chan, ECONNRESET);
1490		l2cap_sock_kill(sk);
1491
1492		l2cap_chan_unlock(chan);
1493		l2cap_chan_put(chan);
1494	}
1495}
1496
1497static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1498{
1499	struct sock *sk, *parent = chan->data;
1500
1501	lock_sock(parent);
1502
1503	/* Check for backlog size */
1504	if (sk_acceptq_is_full(parent)) {
1505		BT_DBG("backlog full %d", parent->sk_ack_backlog);
1506		release_sock(parent);
1507		return NULL;
1508	}
1509
1510	sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1511			      GFP_ATOMIC, 0);
1512	if (!sk) {
1513		release_sock(parent);
1514		return NULL;
1515        }
1516
1517	bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1518
1519	l2cap_sock_init(sk, parent);
1520
1521	bt_accept_enqueue(parent, sk, false);
1522
1523	release_sock(parent);
1524
1525	return l2cap_pi(sk)->chan;
1526}
1527
1528static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1529{
1530	struct sock *sk;
1531	struct l2cap_pinfo *pi;
1532	int err;
1533
1534	sk = chan->data;
1535	if (!sk)
1536		return -ENXIO;
1537
1538	pi = l2cap_pi(sk);
1539	lock_sock(sk);
1540	if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) {
1541		err = -ENOMEM;
1542		goto done;
1543	}
1544
1545	if (chan->mode != L2CAP_MODE_ERTM &&
1546	    chan->mode != L2CAP_MODE_STREAMING &&
1547	    chan->mode != L2CAP_MODE_LE_FLOWCTL &&
1548	    chan->mode != L2CAP_MODE_EXT_FLOWCTL) {
1549		/* Even if no filter is attached, we could potentially
1550		 * get errors from security modules, etc.
1551		 */
1552		err = sk_filter(sk, skb);
1553		if (err)
1554			goto done;
1555	}
1556
1557	err = __sock_queue_rcv_skb(sk, skb);
1558
1559	l2cap_publish_rx_avail(chan);
1560
1561	/* For ERTM and LE, handle a skb that doesn't fit into the recv
1562	 * buffer.  This is important to do because the data frames
1563	 * have already been acked, so the skb cannot be discarded.
1564	 *
1565	 * Notify the l2cap core that the buffer is full, so the
1566	 * LOCAL_BUSY state is entered and no more frames are
1567	 * acked and reassembled until there is buffer space
1568	 * available.
1569	 */
1570	if (err < 0 &&
1571	    (chan->mode == L2CAP_MODE_ERTM ||
1572	     chan->mode == L2CAP_MODE_LE_FLOWCTL ||
1573	     chan->mode == L2CAP_MODE_EXT_FLOWCTL)) {
1574		struct l2cap_rx_busy *rx_busy =
1575			kmalloc(sizeof(*rx_busy), GFP_KERNEL);
1576		if (!rx_busy) {
1577			err = -ENOMEM;
1578			goto done;
1579		}
1580		rx_busy->skb = skb;
1581		list_add_tail(&rx_busy->list, &pi->rx_busy);
1582		l2cap_chan_busy(chan, 1);
1583		err = 0;
1584	}
1585
1586done:
1587	release_sock(sk);
1588
1589	return err;
1590}
1591
1592static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1593{
1594	struct sock *sk = chan->data;
1595
1596	if (!sk)
1597		return;
1598
1599	l2cap_sock_kill(sk);
1600}
1601
1602static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1603{
1604	struct sock *sk = chan->data;
1605	struct sock *parent;
1606
1607	if (!sk)
1608		return;
1609
1610	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1611
1612	/* This callback can be called both for server (BT_LISTEN)
1613	 * sockets as well as "normal" ones. To avoid lockdep warnings
1614	 * with child socket locking (through l2cap_sock_cleanup_listen)
1615	 * we need separation into separate nesting levels. The simplest
1616	 * way to accomplish this is to inherit the nesting level used
1617	 * for the channel.
1618	 */
1619	lock_sock_nested(sk, atomic_read(&chan->nesting));
1620
1621	parent = bt_sk(sk)->parent;
1622
1623	switch (chan->state) {
1624	case BT_OPEN:
1625	case BT_BOUND:
1626	case BT_CLOSED:
1627		break;
1628	case BT_LISTEN:
1629		l2cap_sock_cleanup_listen(sk);
1630		sk->sk_state = BT_CLOSED;
1631		chan->state = BT_CLOSED;
1632
1633		break;
1634	default:
1635		sk->sk_state = BT_CLOSED;
1636		chan->state = BT_CLOSED;
1637
1638		sk->sk_err = err;
1639
1640		if (parent) {
1641			bt_accept_unlink(sk);
1642			parent->sk_data_ready(parent);
1643		} else {
1644			sk->sk_state_change(sk);
1645		}
1646
1647		break;
1648	}
1649	release_sock(sk);
1650
1651	/* Only zap after cleanup to avoid use after free race */
1652	sock_set_flag(sk, SOCK_ZAPPED);
1653
1654}
1655
1656static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1657				       int err)
1658{
1659	struct sock *sk = chan->data;
1660
1661	sk->sk_state = state;
1662
1663	if (err)
1664		sk->sk_err = err;
1665}
1666
1667static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1668					       unsigned long hdr_len,
1669					       unsigned long len, int nb)
1670{
1671	struct sock *sk = chan->data;
1672	struct sk_buff *skb;
1673	int err;
1674
1675	l2cap_chan_unlock(chan);
1676	skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1677	l2cap_chan_lock(chan);
1678
1679	if (!skb)
1680		return ERR_PTR(err);
1681
1682	/* Channel lock is released before requesting new skb and then
1683	 * reacquired thus we need to recheck channel state.
1684	 */
1685	if (chan->state != BT_CONNECTED) {
1686		kfree_skb(skb);
1687		return ERR_PTR(-ENOTCONN);
1688	}
1689
1690	skb->priority = READ_ONCE(sk->sk_priority);
1691
1692	bt_cb(skb)->l2cap.chan = chan;
1693
1694	return skb;
1695}
1696
1697static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1698{
1699	struct sock *sk = chan->data;
1700	struct sock *parent;
1701
1702	if (!sk)
1703		return;
1704
1705	lock_sock(sk);
1706
1707	parent = bt_sk(sk)->parent;
1708
1709	BT_DBG("sk %p, parent %p", sk, parent);
1710
1711	sk->sk_state = BT_CONNECTED;
1712	sk->sk_state_change(sk);
1713
1714	if (parent)
1715		parent->sk_data_ready(parent);
1716
1717	release_sock(sk);
1718}
1719
1720static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1721{
1722	struct sock *parent, *sk = chan->data;
1723
1724	lock_sock(sk);
1725
1726	parent = bt_sk(sk)->parent;
1727	if (parent)
1728		parent->sk_data_ready(parent);
1729
1730	release_sock(sk);
1731}
1732
1733static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1734{
1735	struct sock *sk = chan->data;
1736
1737	if (!sk)
1738		return;
1739
1740	if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1741		sk->sk_state = BT_CONNECTED;
1742		chan->state = BT_CONNECTED;
1743	}
1744
1745	clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1746	sk->sk_state_change(sk);
1747}
1748
1749static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1750{
1751	struct sock *sk = chan->data;
1752
1753	lock_sock(sk);
1754	sk->sk_shutdown = SHUTDOWN_MASK;
1755	release_sock(sk);
1756}
1757
1758static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1759{
1760	struct sock *sk = chan->data;
1761
1762	return READ_ONCE(sk->sk_sndtimeo);
1763}
1764
1765static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1766{
1767	struct sock *sk = chan->data;
1768
1769	return sk->sk_peer_pid;
1770}
1771
1772static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1773{
1774	struct sock *sk = chan->data;
1775
1776	set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1777	sk->sk_state_change(sk);
1778}
1779
1780static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1781{
1782	struct sock *sk = chan->data;
1783
1784	switch (chan->mode) {
1785	case L2CAP_MODE_ERTM:
1786	case L2CAP_MODE_STREAMING:
1787		return sk_filter(sk, skb);
1788	}
1789
1790	return 0;
1791}
1792
1793static const struct l2cap_ops l2cap_chan_ops = {
1794	.name			= "L2CAP Socket Interface",
1795	.new_connection		= l2cap_sock_new_connection_cb,
1796	.recv			= l2cap_sock_recv_cb,
1797	.close			= l2cap_sock_close_cb,
1798	.teardown		= l2cap_sock_teardown_cb,
1799	.state_change		= l2cap_sock_state_change_cb,
1800	.ready			= l2cap_sock_ready_cb,
1801	.defer			= l2cap_sock_defer_cb,
1802	.resume			= l2cap_sock_resume_cb,
1803	.suspend		= l2cap_sock_suspend_cb,
1804	.set_shutdown		= l2cap_sock_set_shutdown_cb,
1805	.get_sndtimeo		= l2cap_sock_get_sndtimeo_cb,
1806	.get_peer_pid		= l2cap_sock_get_peer_pid_cb,
1807	.alloc_skb		= l2cap_sock_alloc_skb_cb,
1808	.filter			= l2cap_sock_filter,
1809};
1810
1811static void l2cap_sock_destruct(struct sock *sk)
1812{
1813	struct l2cap_rx_busy *rx_busy, *next;
1814
1815	BT_DBG("sk %p", sk);
1816
1817	if (l2cap_pi(sk)->chan) {
1818		l2cap_pi(sk)->chan->data = NULL;
1819		l2cap_chan_put(l2cap_pi(sk)->chan);
1820	}
1821
1822	list_for_each_entry_safe(rx_busy, next, &l2cap_pi(sk)->rx_busy, list) {
1823		kfree_skb(rx_busy->skb);
1824		list_del(&rx_busy->list);
1825		kfree(rx_busy);
1826	}
1827
1828	skb_queue_purge(&sk->sk_receive_queue);
1829	skb_queue_purge(&sk->sk_write_queue);
1830	skb_queue_purge(&sk->sk_error_queue);
1831}
1832
1833static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1834			       int *msg_namelen)
1835{
1836	DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1837
1838	memset(la, 0, sizeof(struct sockaddr_l2));
1839	la->l2_family = AF_BLUETOOTH;
1840	la->l2_psm = bt_cb(skb)->l2cap.psm;
1841	bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1842
1843	*msg_namelen = sizeof(struct sockaddr_l2);
1844}
1845
1846static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1847{
1848	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1849
1850	BT_DBG("sk %p", sk);
1851
1852	if (parent) {
1853		struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1854
1855		sk->sk_type = parent->sk_type;
1856		bt_sk(sk)->flags = bt_sk(parent)->flags;
1857
1858		chan->chan_type = pchan->chan_type;
1859		chan->imtu = pchan->imtu;
1860		chan->omtu = pchan->omtu;
1861		chan->conf_state = pchan->conf_state;
1862		chan->mode = pchan->mode;
1863		chan->fcs  = pchan->fcs;
1864		chan->max_tx = pchan->max_tx;
1865		chan->tx_win = pchan->tx_win;
1866		chan->tx_win_max = pchan->tx_win_max;
1867		chan->sec_level = pchan->sec_level;
1868		chan->flags = pchan->flags;
1869		chan->tx_credits = pchan->tx_credits;
1870		chan->rx_credits = pchan->rx_credits;
1871
1872		if (chan->chan_type == L2CAP_CHAN_FIXED) {
1873			chan->scid = pchan->scid;
1874			chan->dcid = pchan->scid;
1875		}
1876
1877		security_sk_clone(parent, sk);
1878	} else {
1879		switch (sk->sk_type) {
1880		case SOCK_RAW:
1881			chan->chan_type = L2CAP_CHAN_RAW;
1882			break;
1883		case SOCK_DGRAM:
1884			chan->chan_type = L2CAP_CHAN_CONN_LESS;
1885			bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1886			break;
1887		case SOCK_SEQPACKET:
1888		case SOCK_STREAM:
1889			chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1890			break;
1891		}
1892
1893		chan->imtu = L2CAP_DEFAULT_MTU;
1894		chan->omtu = 0;
1895		if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1896			chan->mode = L2CAP_MODE_ERTM;
1897			set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1898		} else {
1899			chan->mode = L2CAP_MODE_BASIC;
1900		}
1901
1902		l2cap_chan_set_defaults(chan);
1903	}
1904
1905	/* Default config options */
1906	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1907
1908	chan->data = sk;
1909	chan->ops = &l2cap_chan_ops;
1910
1911	l2cap_publish_rx_avail(chan);
1912}
1913
1914static struct proto l2cap_proto = {
1915	.name		= "L2CAP",
1916	.owner		= THIS_MODULE,
1917	.obj_size	= sizeof(struct l2cap_pinfo)
1918};
1919
1920static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1921				     int proto, gfp_t prio, int kern)
1922{
1923	struct sock *sk;
1924	struct l2cap_chan *chan;
1925
1926	sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern);
1927	if (!sk)
1928		return NULL;
1929
1930	sk->sk_destruct = l2cap_sock_destruct;
1931	sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1932
1933	INIT_LIST_HEAD(&l2cap_pi(sk)->rx_busy);
1934
1935	chan = l2cap_chan_create();
1936	if (!chan) {
1937		sk_free(sk);
1938		if (sock)
1939			sock->sk = NULL;
1940		return NULL;
1941	}
1942
1943	l2cap_chan_hold(chan);
1944
1945	l2cap_pi(sk)->chan = chan;
1946
1947	return sk;
1948}
1949
1950static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1951			     int kern)
1952{
1953	struct sock *sk;
1954
1955	BT_DBG("sock %p", sock);
1956
1957	sock->state = SS_UNCONNECTED;
1958
1959	if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1960	    sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1961		return -ESOCKTNOSUPPORT;
1962
1963	if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1964		return -EPERM;
1965
1966	sock->ops = &l2cap_sock_ops;
1967
1968	sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1969	if (!sk)
1970		return -ENOMEM;
1971
1972	l2cap_sock_init(sk, NULL);
1973	bt_sock_link(&l2cap_sk_list, sk);
1974	return 0;
1975}
1976
1977static const struct proto_ops l2cap_sock_ops = {
1978	.family		= PF_BLUETOOTH,
1979	.owner		= THIS_MODULE,
1980	.release	= l2cap_sock_release,
1981	.bind		= l2cap_sock_bind,
1982	.connect	= l2cap_sock_connect,
1983	.listen		= l2cap_sock_listen,
1984	.accept		= l2cap_sock_accept,
1985	.getname	= l2cap_sock_getname,
1986	.sendmsg	= l2cap_sock_sendmsg,
1987	.recvmsg	= l2cap_sock_recvmsg,
1988	.poll		= bt_sock_poll,
1989	.ioctl		= bt_sock_ioctl,
1990	.gettstamp	= sock_gettstamp,
1991	.mmap		= sock_no_mmap,
1992	.socketpair	= sock_no_socketpair,
1993	.shutdown	= l2cap_sock_shutdown,
1994	.setsockopt	= l2cap_sock_setsockopt,
1995	.getsockopt	= l2cap_sock_getsockopt
1996};
1997
1998static const struct net_proto_family l2cap_sock_family_ops = {
1999	.family	= PF_BLUETOOTH,
2000	.owner	= THIS_MODULE,
2001	.create	= l2cap_sock_create,
2002};
2003
2004int __init l2cap_init_sockets(void)
2005{
2006	int err;
2007
2008	BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
2009
2010	err = proto_register(&l2cap_proto, 0);
2011	if (err < 0)
2012		return err;
2013
2014	err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
2015	if (err < 0) {
2016		BT_ERR("L2CAP socket registration failed");
2017		goto error;
2018	}
2019
2020	err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
2021			     NULL);
2022	if (err < 0) {
2023		BT_ERR("Failed to create L2CAP proc file");
2024		bt_sock_unregister(BTPROTO_L2CAP);
2025		goto error;
2026	}
2027
2028	BT_INFO("L2CAP socket layer initialized");
2029
2030	return 0;
2031
2032error:
2033	proto_unregister(&l2cap_proto);
2034	return err;
2035}
2036
2037void l2cap_cleanup_sockets(void)
2038{
2039	bt_procfs_cleanup(&init_net, "l2cap");
2040	bt_sock_unregister(BTPROTO_L2CAP);
2041	proto_unregister(&l2cap_proto);
2042}