net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/filter.h>
  33 #include <linux/sched/signal.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37 #include <net/bluetooth/l2cap.h>
  38
  39 #include "smp.h"
  40
  41 static struct bt_sock_list l2cap_sk_list = {
  42         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  43 };
  44
  45 static const struct proto_ops l2cap_sock_ops;
  46 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  47 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  48                                      int proto, gfp_t prio, int kern);
  49 static void l2cap_sock_cleanup_listen(struct sock *parent);
  50
  51 bool l2cap_is_socket(struct socket *sock)
  52 {
  53         return sock && sock->ops == &l2cap_sock_ops;
  54 }
  55 EXPORT_SYMBOL(l2cap_is_socket);
  56
  57 static int l2cap_validate_bredr_psm(u16 psm)
  58 {
  59         /* PSM must be odd and lsb of upper byte must be 0 */
  60         if ((psm & 0x0101) != 0x0001)
  61                 return -EINVAL;
  62
  63         /* Restrict usage of well-known PSMs */
  64         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  65                 return -EACCES;
  66
  67         return 0;
  68 }
  69
  70 static int l2cap_validate_le_psm(u16 psm)
  71 {
  72         /* Valid LE_PSM ranges are defined only until 0x00ff */
  73         if (psm > L2CAP_PSM_LE_DYN_END)
  74                 return -EINVAL;
  75
  76         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  77         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  78                 return -EACCES;
  79
  80         return 0;
  81 }
  82
  83 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  84 {
  85         struct sock *sk = sock->sk;
  86         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  87         struct sockaddr_l2 la;
  88         int len, err = 0;
  89
  90         BT_DBG("sk %p", sk);
  91
  92         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  93             addr->sa_family != AF_BLUETOOTH)
  94                 return -EINVAL;
  95
  96         memset(&la, 0, sizeof(la));
  97         len = min_t(unsigned int, sizeof(la), alen);
  98         memcpy(&la, addr, len);
  99
 100         if (la.l2_cid && la.l2_psm)
 101                 return -EINVAL;
 102
 103         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 104                 return -EINVAL;
 105
 106         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 107                 /* We only allow ATT user space socket */
 108                 if (la.l2_cid &&
 109                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 110                         return -EINVAL;
 111         }
 112
 113         lock_sock(sk);
 114
 115         if (sk->sk_state != BT_OPEN) {
 116                 err = -EBADFD;
 117                 goto done;
 118         }
 119
 120         if (la.l2_psm) {
 121                 __u16 psm = __le16_to_cpu(la.l2_psm);
 122
 123                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 124                         err = l2cap_validate_bredr_psm(psm);
 125                 else
 126                         err = l2cap_validate_le_psm(psm);
 127
 128                 if (err)
 129                         goto done;
 130         }
 131
 132         bacpy(&chan->src, &la.l2_bdaddr);
 133         chan->src_type = la.l2_bdaddr_type;
 134
 135         if (la.l2_cid)
 136                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 137         else
 138                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 139
 140         if (err < 0)
 141                 goto done;
 142
 143         switch (chan->chan_type) {
 144         case L2CAP_CHAN_CONN_LESS:
 145                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 146                         chan->sec_level = BT_SECURITY_SDP;
 147                 break;
 148         case L2CAP_CHAN_CONN_ORIENTED:
 149                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 150                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 151                         chan->sec_level = BT_SECURITY_SDP;
 152                 break;
 153         case L2CAP_CHAN_RAW:
 154                 chan->sec_level = BT_SECURITY_SDP;
 155                 break;
 156         case L2CAP_CHAN_FIXED:
 157                 /* Fixed channels default to the L2CAP core not holding a
 158                  * hci_conn reference for them. For fixed channels mapping to
 159                  * L2CAP sockets we do want to hold a reference so set the
 160                  * appropriate flag to request it.
 161                  */
 162                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 163                 break;
 164         }
 165
 166         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 167          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 168          */
 169         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 170             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 171                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 172
 173         chan->state = BT_BOUND;
 174         sk->sk_state = BT_BOUND;
 175
 176 done:
 177         release_sock(sk);
 178         return err;
 179 }
 180
 181 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 182                               int alen, int flags)
 183 {
 184         struct sock *sk = sock->sk;
 185         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 186         struct sockaddr_l2 la;
 187         int len, err = 0;
 188         bool zapped;
 189
 190         BT_DBG("sk %p", sk);
 191
 192         lock_sock(sk);
 193         zapped = sock_flag(sk, SOCK_ZAPPED);
 194         release_sock(sk);
 195
 196         if (zapped)
 197                 return -EINVAL;
 198
 199         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 200             addr->sa_family != AF_BLUETOOTH)
 201                 return -EINVAL;
 202
 203         memset(&la, 0, sizeof(la));
 204         len = min_t(unsigned int, sizeof(la), alen);
 205         memcpy(&la, addr, len);
 206
 207         if (la.l2_cid && la.l2_psm)
 208                 return -EINVAL;
 209
 210         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 211                 return -EINVAL;
 212
 213         /* Check that the socket wasn't bound to something that
 214          * conflicts with the address given to connect(). If chan->src
 215          * is BDADDR_ANY it means bind() was never used, in which case
 216          * chan->src_type and la.l2_bdaddr_type do not need to match.
 217          */
 218         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 219             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 220                 /* Old user space versions will try to incorrectly bind
 221                  * the ATT socket using BDADDR_BREDR. We need to accept
 222                  * this and fix up the source address type only when
 223                  * both the source CID and destination CID indicate
 224                  * ATT. Anything else is an invalid combination.
 225                  */
 226                 if (chan->scid != L2CAP_CID_ATT ||
 227                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 228                         return -EINVAL;
 229
 230                 /* We don't have the hdev available here to make a
 231                  * better decision on random vs public, but since all
 232                  * user space versions that exhibit this issue anyway do
 233                  * not support random local addresses assuming public
 234                  * here is good enough.
 235                  */
 236                 chan->src_type = BDADDR_LE_PUBLIC;
 237         }
 238
 239         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 240                 return -EINVAL;
 241
 242         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 243                 /* We only allow ATT user space socket */
 244                 if (la.l2_cid &&
 245                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 246                         return -EINVAL;
 247         }
 248
 249         /* Use L2CAP_MODE_LE_FLOWCTL (CoC) in case of LE address and
 250          * L2CAP_MODE_EXT_FLOWCTL (ECRED) has not been set.
 251          */
 252         if (chan->psm && bdaddr_type_is_le(chan->src_type) &&
 253             chan->mode != L2CAP_MODE_EXT_FLOWCTL)
 254                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 255
 256         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 257                                  &la.l2_bdaddr, la.l2_bdaddr_type,
 258                                  sk->sk_sndtimeo);
 259         if (err)
 260                 return err;
 261
 262         lock_sock(sk);
 263
 264         err = bt_sock_wait_state(sk, BT_CONNECTED,
 265                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 266
 267         release_sock(sk);
 268
 269         return err;
 270 }
 271
 272 static int l2cap_sock_listen(struct socket *sock, int backlog)
 273 {
 274         struct sock *sk = sock->sk;
 275         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 276         int err = 0;
 277
 278         BT_DBG("sk %p backlog %d", sk, backlog);
 279
 280         lock_sock(sk);
 281
 282         if (sk->sk_state != BT_BOUND) {
 283                 err = -EBADFD;
 284                 goto done;
 285         }
 286
 287         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 288                 err = -EINVAL;
 289                 goto done;
 290         }
 291
 292         switch (chan->mode) {
 293         case L2CAP_MODE_BASIC:
 294         case L2CAP_MODE_LE_FLOWCTL:
 295                 break;
 296         case L2CAP_MODE_EXT_FLOWCTL:
 297                 if (!enable_ecred) {
 298                         err = -EOPNOTSUPP;
 299                         goto done;
 300                 }
 301                 break;
 302         case L2CAP_MODE_ERTM:
 303         case L2CAP_MODE_STREAMING:
 304                 if (!disable_ertm)
 305                         break;
 306                 fallthrough;
 307         default:
 308                 err = -EOPNOTSUPP;
 309                 goto done;
 310         }
 311
 312         sk->sk_max_ack_backlog = backlog;
 313         sk->sk_ack_backlog = 0;
 314
 315         /* Listening channels need to use nested locking in order not to
 316          * cause lockdep warnings when the created child channels end up
 317          * being locked in the same thread as the parent channel.
 318          */
 319         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 320
 321         chan->state = BT_LISTEN;
 322         sk->sk_state = BT_LISTEN;
 323
 324 done:
 325         release_sock(sk);
 326         return err;
 327 }
 328
 329 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 330                              int flags, bool kern)
 331 {
 332         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 333         struct sock *sk = sock->sk, *nsk;
 334         long timeo;
 335         int err = 0;
 336
 337         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 338
 339         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 340
 341         BT_DBG("sk %p timeo %ld", sk, timeo);
 342
 343         /* Wait for an incoming connection. (wake-one). */
 344         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 345         while (1) {
 346                 if (sk->sk_state != BT_LISTEN) {
 347                         err = -EBADFD;
 348                         break;
 349                 }
 350
 351                 nsk = bt_accept_dequeue(sk, newsock);
 352                 if (nsk)
 353                         break;
 354
 355                 if (!timeo) {
 356                         err = -EAGAIN;
 357                         break;
 358                 }
 359
 360                 if (signal_pending(current)) {
 361                         err = sock_intr_errno(timeo);
 362                         break;
 363                 }
 364
 365                 release_sock(sk);
 366
 367                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 368
 369                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 370         }
 371         remove_wait_queue(sk_sleep(sk), &wait);
 372
 373         if (err)
 374                 goto done;
 375
 376         newsock->state = SS_CONNECTED;
 377
 378         BT_DBG("new socket %p", nsk);
 379
 380 done:
 381         release_sock(sk);
 382         return err;
 383 }
 384
 385 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 386                               int peer)
 387 {
 388         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 389         struct sock *sk = sock->sk;
 390         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 391
 392         BT_DBG("sock %p, sk %p", sock, sk);
 393
 394         if (peer && sk->sk_state != BT_CONNECTED &&
 395             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 396             sk->sk_state != BT_CONFIG)
 397                 return -ENOTCONN;
 398
 399         memset(la, 0, sizeof(struct sockaddr_l2));
 400         addr->sa_family = AF_BLUETOOTH;
 401
 402         la->l2_psm = chan->psm;
 403
 404         if (peer) {
 405                 bacpy(&la->l2_bdaddr, &chan->dst);
 406                 la->l2_cid = cpu_to_le16(chan->dcid);
 407                 la->l2_bdaddr_type = chan->dst_type;
 408         } else {
 409                 bacpy(&la->l2_bdaddr, &chan->src);
 410                 la->l2_cid = cpu_to_le16(chan->scid);
 411                 la->l2_bdaddr_type = chan->src_type;
 412         }
 413
 414         return sizeof(struct sockaddr_l2);
 415 }
 416
 417 static int l2cap_get_mode(struct l2cap_chan *chan)
 418 {
 419         switch (chan->mode) {
 420         case L2CAP_MODE_BASIC:
 421                 return BT_MODE_BASIC;
 422         case L2CAP_MODE_ERTM:
 423                 return BT_MODE_ERTM;
 424         case L2CAP_MODE_STREAMING:
 425                 return BT_MODE_STREAMING;
 426         case L2CAP_MODE_LE_FLOWCTL:
 427                 return BT_MODE_LE_FLOWCTL;
 428         case L2CAP_MODE_EXT_FLOWCTL:
 429                 return BT_MODE_EXT_FLOWCTL;
 430         }
 431
 432         return -EINVAL;
 433 }
 434
 435 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 436                                      char __user *optval, int __user *optlen)
 437 {
 438         struct sock *sk = sock->sk;
 439         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 440         struct l2cap_options opts;
 441         struct l2cap_conninfo cinfo;
 442         int len, err = 0;
 443         u32 opt;
 444
 445         BT_DBG("sk %p", sk);
 446
 447         if (get_user(len, optlen))
 448                 return -EFAULT;
 449
 450         lock_sock(sk);
 451
 452         switch (optname) {
 453         case L2CAP_OPTIONS:
 454                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 455                  * legacy ATT code depends on getsockopt for
 456                  * L2CAP_OPTIONS we need to let this pass.
 457                  */
 458                 if (bdaddr_type_is_le(chan->src_type) &&
 459                     chan->scid != L2CAP_CID_ATT) {
 460                         err = -EINVAL;
 461                         break;
 462                 }
 463
 464                 /* Only BR/EDR modes are supported here */
 465                 switch (chan->mode) {
 466                 case L2CAP_MODE_BASIC:
 467                 case L2CAP_MODE_ERTM:
 468                 case L2CAP_MODE_STREAMING:
 469                         break;
 470                 default:
 471                         err = -EINVAL;
 472                         break;
 473                 }
 474
 475                 if (err < 0)
 476                         break;
 477
 478                 memset(&opts, 0, sizeof(opts));
 479                 opts.imtu     = chan->imtu;
 480                 opts.omtu     = chan->omtu;
 481                 opts.flush_to = chan->flush_to;
 482                 opts.mode     = chan->mode;
 483                 opts.fcs      = chan->fcs;
 484                 opts.max_tx   = chan->max_tx;
 485                 opts.txwin_size = chan->tx_win;
 486
 487                 BT_DBG("mode 0x%2.2x", chan->mode);
 488
 489                 len = min_t(unsigned int, len, sizeof(opts));
 490                 if (copy_to_user(optval, (char *) &opts, len))
 491                         err = -EFAULT;
 492
 493                 break;
 494
 495         case L2CAP_LM:
 496                 switch (chan->sec_level) {
 497                 case BT_SECURITY_LOW:
 498                         opt = L2CAP_LM_AUTH;
 499                         break;
 500                 case BT_SECURITY_MEDIUM:
 501                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 502                         break;
 503                 case BT_SECURITY_HIGH:
 504                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 505                               L2CAP_LM_SECURE;
 506                         break;
 507                 case BT_SECURITY_FIPS:
 508                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 509                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 510                         break;
 511                 default:
 512                         opt = 0;
 513                         break;
 514                 }
 515
 516                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 517                         opt |= L2CAP_LM_MASTER;
 518
 519                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 520                         opt |= L2CAP_LM_RELIABLE;
 521
 522                 if (put_user(opt, (u32 __user *) optval))
 523                         err = -EFAULT;
 524
 525                 break;
 526
 527         case L2CAP_CONNINFO:
 528                 if (sk->sk_state != BT_CONNECTED &&
 529                     !(sk->sk_state == BT_CONNECT2 &&
 530                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 531                         err = -ENOTCONN;
 532                         break;
 533                 }
 534
 535                 memset(&cinfo, 0, sizeof(cinfo));
 536                 cinfo.hci_handle = chan->conn->hcon->handle;
 537                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 538
 539                 len = min_t(unsigned int, len, sizeof(cinfo));
 540                 if (copy_to_user(optval, (char *) &cinfo, len))
 541                         err = -EFAULT;
 542
 543                 break;
 544
 545         default:
 546                 err = -ENOPROTOOPT;
 547                 break;
 548         }
 549
 550         release_sock(sk);
 551         return err;
 552 }
 553
 554 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 555                                  char __user *optval, int __user *optlen)
 556 {
 557         struct sock *sk = sock->sk;
 558         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 559         struct bt_security sec;
 560         struct bt_power pwr;
 561         u32 phys;
 562         int len, mode, err = 0;
 563
 564         BT_DBG("sk %p", sk);
 565
 566         if (level == SOL_L2CAP)
 567                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 568
 569         if (level != SOL_BLUETOOTH)
 570                 return -ENOPROTOOPT;
 571
 572         if (get_user(len, optlen))
 573                 return -EFAULT;
 574
 575         lock_sock(sk);
 576
 577         switch (optname) {
 578         case BT_SECURITY:
 579                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 580                     chan->chan_type != L2CAP_CHAN_FIXED &&
 581                     chan->chan_type != L2CAP_CHAN_RAW) {
 582                         err = -EINVAL;
 583                         break;
 584                 }
 585
 586                 memset(&sec, 0, sizeof(sec));
 587                 if (chan->conn) {
 588                         sec.level = chan->conn->hcon->sec_level;
 589
 590                         if (sk->sk_state == BT_CONNECTED)
 591                                 sec.key_size = chan->conn->hcon->enc_key_size;
 592                 } else {
 593                         sec.level = chan->sec_level;
 594                 }
 595
 596                 len = min_t(unsigned int, len, sizeof(sec));
 597                 if (copy_to_user(optval, (char *) &sec, len))
 598                         err = -EFAULT;
 599
 600                 break;
 601
 602         case BT_DEFER_SETUP:
 603                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 604                         err = -EINVAL;
 605                         break;
 606                 }
 607
 608                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 609                              (u32 __user *) optval))
 610                         err = -EFAULT;
 611
 612                 break;
 613
 614         case BT_FLUSHABLE:
 615                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 616                              (u32 __user *) optval))
 617                         err = -EFAULT;
 618
 619                 break;
 620
 621         case BT_POWER:
 622                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 623                     && sk->sk_type != SOCK_RAW) {
 624                         err = -EINVAL;
 625                         break;
 626                 }
 627
 628                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 629
 630                 len = min_t(unsigned int, len, sizeof(pwr));
 631                 if (copy_to_user(optval, (char *) &pwr, len))
 632                         err = -EFAULT;
 633
 634                 break;
 635
 636         case BT_CHANNEL_POLICY:
 637                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 638                         err = -EFAULT;
 639                 break;
 640
 641         case BT_SNDMTU:
 642                 if (!bdaddr_type_is_le(chan->src_type)) {
 643                         err = -EINVAL;
 644                         break;
 645                 }
 646
 647                 if (sk->sk_state != BT_CONNECTED) {
 648                         err = -ENOTCONN;
 649                         break;
 650                 }
 651
 652                 if (put_user(chan->omtu, (u16 __user *) optval))
 653                         err = -EFAULT;
 654                 break;
 655
 656         case BT_RCVMTU:
 657                 if (!bdaddr_type_is_le(chan->src_type)) {
 658                         err = -EINVAL;
 659                         break;
 660                 }
 661
 662                 if (put_user(chan->imtu, (u16 __user *) optval))
 663                         err = -EFAULT;
 664                 break;
 665
 666         case BT_PHY:
 667                 if (sk->sk_state != BT_CONNECTED) {
 668                         err = -ENOTCONN;
 669                         break;
 670                 }
 671
 672                 phys = hci_conn_get_phy(chan->conn->hcon);
 673
 674                 if (put_user(phys, (u32 __user *) optval))
 675                         err = -EFAULT;
 676                 break;
 677
 678         case BT_MODE:
 679                 if (!enable_ecred) {
 680                         err = -ENOPROTOOPT;
 681                         break;
 682                 }
 683
 684                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
 685                         err = -EINVAL;
 686                         break;
 687                 }
 688
 689                 mode = l2cap_get_mode(chan);
 690                 if (mode < 0) {
 691                         err = mode;
 692                         break;
 693                 }
 694
 695                 if (put_user(mode, (u8 __user *) optval))
 696                         err = -EFAULT;
 697                 break;
 698
 699         default:
 700                 err = -ENOPROTOOPT;
 701                 break;
 702         }
 703
 704         release_sock(sk);
 705         return err;
 706 }
 707
 708 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 709 {
 710         switch (chan->scid) {
 711         case L2CAP_CID_ATT:
 712                 if (mtu < L2CAP_LE_MIN_MTU)
 713                         return false;
 714                 break;
 715
 716         default:
 717                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 718                         return false;
 719         }
 720
 721         return true;
 722 }
 723
 724 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 725                                      sockptr_t optval, unsigned int optlen)
 726 {
 727         struct sock *sk = sock->sk;
 728         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 729         struct l2cap_options opts;
 730         int len, err = 0;
 731         u32 opt;
 732
 733         BT_DBG("sk %p", sk);
 734
 735         lock_sock(sk);
 736
 737         switch (optname) {
 738         case L2CAP_OPTIONS:
 739                 if (bdaddr_type_is_le(chan->src_type)) {
 740                         err = -EINVAL;
 741                         break;
 742                 }
 743
 744                 if (sk->sk_state == BT_CONNECTED) {
 745                         err = -EINVAL;
 746                         break;
 747                 }
 748
 749                 opts.imtu     = chan->imtu;
 750                 opts.omtu     = chan->omtu;
 751                 opts.flush_to = chan->flush_to;
 752                 opts.mode     = chan->mode;
 753                 opts.fcs      = chan->fcs;
 754                 opts.max_tx   = chan->max_tx;
 755                 opts.txwin_size = chan->tx_win;
 756
 757                 len = min_t(unsigned int, sizeof(opts), optlen);
 758                 if (copy_from_sockptr(&opts, optval, len)) {
 759                         err = -EFAULT;
 760                         break;
 761                 }
 762
 763                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 764                         err = -EINVAL;
 765                         break;
 766                 }
 767
 768                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 769                         err = -EINVAL;
 770                         break;
 771                 }
 772
 773                 /* Only BR/EDR modes are supported here */
 774                 switch (opts.mode) {
 775                 case L2CAP_MODE_BASIC:
 776                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 777                         break;
 778                 case L2CAP_MODE_ERTM:
 779                 case L2CAP_MODE_STREAMING:
 780                         if (!disable_ertm)
 781                                 break;
 782                         fallthrough;
 783                 default:
 784                         err = -EINVAL;
 785                         break;
 786                 }
 787
 788                 if (err < 0)
 789                         break;
 790
 791                 chan->mode = opts.mode;
 792
 793                 BT_DBG("mode 0x%2.2x", chan->mode);
 794
 795                 chan->imtu = opts.imtu;
 796                 chan->omtu = opts.omtu;
 797                 chan->fcs  = opts.fcs;
 798                 chan->max_tx = opts.max_tx;
 799                 chan->tx_win = opts.txwin_size;
 800                 chan->flush_to = opts.flush_to;
 801                 break;
 802
 803         case L2CAP_LM:
 804                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 805                         err = -EFAULT;
 806                         break;
 807                 }
 808
 809                 if (opt & L2CAP_LM_FIPS) {
 810                         err = -EINVAL;
 811                         break;
 812                 }
 813
 814                 if (opt & L2CAP_LM_AUTH)
 815                         chan->sec_level = BT_SECURITY_LOW;
 816                 if (opt & L2CAP_LM_ENCRYPT)
 817                         chan->sec_level = BT_SECURITY_MEDIUM;
 818                 if (opt & L2CAP_LM_SECURE)
 819                         chan->sec_level = BT_SECURITY_HIGH;
 820
 821                 if (opt & L2CAP_LM_MASTER)
 822                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 823                 else
 824                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 825
 826                 if (opt & L2CAP_LM_RELIABLE)
 827                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 828                 else
 829                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 830                 break;
 831
 832         default:
 833                 err = -ENOPROTOOPT;
 834                 break;
 835         }
 836
 837         release_sock(sk);
 838         return err;
 839 }
 840
 841 static int l2cap_set_mode(struct l2cap_chan *chan, u8 mode)
 842 {
 843         switch (mode) {
 844         case BT_MODE_BASIC:
 845                 if (bdaddr_type_is_le(chan->src_type))
 846                         return -EINVAL;
 847                 mode = L2CAP_MODE_BASIC;
 848                 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 849                 break;
 850         case BT_MODE_ERTM:
 851                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 852                         return -EINVAL;
 853                 mode = L2CAP_MODE_ERTM;
 854                 break;
 855         case BT_MODE_STREAMING:
 856                 if (!disable_ertm || bdaddr_type_is_le(chan->src_type))
 857                         return -EINVAL;
 858                 mode = L2CAP_MODE_STREAMING;
 859                 break;
 860         case BT_MODE_LE_FLOWCTL:
 861                 if (!bdaddr_type_is_le(chan->src_type))
 862                         return -EINVAL;
 863                 mode = L2CAP_MODE_LE_FLOWCTL;
 864                 break;
 865         case BT_MODE_EXT_FLOWCTL:
 866                 /* TODO: Add support for ECRED PDUs to BR/EDR */
 867                 if (!bdaddr_type_is_le(chan->src_type))
 868                         return -EINVAL;
 869                 mode = L2CAP_MODE_EXT_FLOWCTL;
 870                 break;
 871         default:
 872                 return -EINVAL;
 873         }
 874
 875         chan->mode = mode;
 876
 877         return 0;
 878 }
 879
 880 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 881                                  sockptr_t optval, unsigned int optlen)
 882 {
 883         struct sock *sk = sock->sk;
 884         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 885         struct bt_security sec;
 886         struct bt_power pwr;
 887         struct l2cap_conn *conn;
 888         int len, err = 0;
 889         u32 opt;
 890         u16 mtu;
 891         u8 mode;
 892
 893         BT_DBG("sk %p", sk);
 894
 895         if (level == SOL_L2CAP)
 896                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 897
 898         if (level != SOL_BLUETOOTH)
 899                 return -ENOPROTOOPT;
 900
 901         lock_sock(sk);
 902
 903         switch (optname) {
 904         case BT_SECURITY:
 905                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 906                     chan->chan_type != L2CAP_CHAN_FIXED &&
 907                     chan->chan_type != L2CAP_CHAN_RAW) {
 908                         err = -EINVAL;
 909                         break;
 910                 }
 911
 912                 sec.level = BT_SECURITY_LOW;
 913
 914                 len = min_t(unsigned int, sizeof(sec), optlen);
 915                 if (copy_from_sockptr(&sec, optval, len)) {
 916                         err = -EFAULT;
 917                         break;
 918                 }
 919
 920                 if (sec.level < BT_SECURITY_LOW ||
 921                     sec.level > BT_SECURITY_FIPS) {
 922                         err = -EINVAL;
 923                         break;
 924                 }
 925
 926                 chan->sec_level = sec.level;
 927
 928                 if (!chan->conn)
 929                         break;
 930
 931                 conn = chan->conn;
 932
 933                 /* change security for LE channels */
 934                 if (chan->scid == L2CAP_CID_ATT) {
 935                         if (smp_conn_security(conn->hcon, sec.level)) {
 936                                 err = -EINVAL;
 937                                 break;
 938                         }
 939
 940                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 941                         sk->sk_state = BT_CONFIG;
 942                         chan->state = BT_CONFIG;
 943
 944                 /* or for ACL link */
 945                 } else if ((sk->sk_state == BT_CONNECT2 &&
 946                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 947                            sk->sk_state == BT_CONNECTED) {
 948                         if (!l2cap_chan_check_security(chan, true))
 949                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 950                         else
 951                                 sk->sk_state_change(sk);
 952                 } else {
 953                         err = -EINVAL;
 954                 }
 955                 break;
 956
 957         case BT_DEFER_SETUP:
 958                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 959                         err = -EINVAL;
 960                         break;
 961                 }
 962
 963                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 964                         err = -EFAULT;
 965                         break;
 966                 }
 967
 968                 if (opt) {
 969                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 970                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 971                 } else {
 972                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 973                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 974                 }
 975                 break;
 976
 977         case BT_FLUSHABLE:
 978                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 979                         err = -EFAULT;
 980                         break;
 981                 }
 982
 983                 if (opt > BT_FLUSHABLE_ON) {
 984                         err = -EINVAL;
 985                         break;
 986                 }
 987
 988                 if (opt == BT_FLUSHABLE_OFF) {
 989                         conn = chan->conn;
 990                         /* proceed further only when we have l2cap_conn and
 991                            No Flush support in the LM */
 992                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 993                                 err = -EINVAL;
 994                                 break;
 995                         }
 996                 }
 997
 998                 if (opt)
 999                         set_bit(FLAG_FLUSHABLE, &chan->flags);
1000                 else
1001                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
1002                 break;
1003
1004         case BT_POWER:
1005                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
1006                     chan->chan_type != L2CAP_CHAN_RAW) {
1007                         err = -EINVAL;
1008                         break;
1009                 }
1010
1011                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
1012
1013                 len = min_t(unsigned int, sizeof(pwr), optlen);
1014                 if (copy_from_sockptr(&pwr, optval, len)) {
1015                         err = -EFAULT;
1016                         break;
1017                 }
1018
1019                 if (pwr.force_active)
1020                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1021                 else
1022                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
1023                 break;
1024
1025         case BT_CHANNEL_POLICY:
1026                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
1027                         err = -EFAULT;
1028                         break;
1029                 }
1030
1031                 err = -EOPNOTSUPP;
1032                 break;
1033
1034         case BT_SNDMTU:
1035                 if (!bdaddr_type_is_le(chan->src_type)) {
1036                         err = -EINVAL;
1037                         break;
1038                 }
1039
1040                 /* Setting is not supported as it's the remote side that
1041                  * decides this.
1042                  */
1043                 err = -EPERM;
1044                 break;
1045
1046         case BT_RCVMTU:
1047                 if (!bdaddr_type_is_le(chan->src_type)) {
1048                         err = -EINVAL;
1049                         break;
1050                 }
1051
1052                 if (chan->mode == L2CAP_MODE_LE_FLOWCTL &&
1053                     sk->sk_state == BT_CONNECTED) {
1054                         err = -EISCONN;
1055                         break;
1056                 }
1057
1058                 if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
1059                         err = -EFAULT;
1060                         break;
1061                 }
1062
1063                 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
1064                     sk->sk_state == BT_CONNECTED)
1065                         err = l2cap_chan_reconfigure(chan, mtu);
1066                 else
1067                         chan->imtu = mtu;
1068
1069                 break;
1070
1071         case BT_MODE:
1072                 if (!enable_ecred) {
1073                         err = -ENOPROTOOPT;
1074                         break;
1075                 }
1076
1077                 BT_DBG("sk->sk_state %u", sk->sk_state);
1078
1079                 if (sk->sk_state != BT_BOUND) {
1080                         err = -EINVAL;
1081                         break;
1082                 }
1083
1084                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1085                         err = -EINVAL;
1086                         break;
1087                 }
1088
1089                 if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
1090                         err = -EFAULT;
1091                         break;
1092                 }
1093
1094                 BT_DBG("mode %u", mode);
1095
1096                 err = l2cap_set_mode(chan, mode);
1097                 if (err)
1098                         break;
1099
1100                 BT_DBG("mode 0x%2.2x", chan->mode);
1101
1102                 break;
1103
1104         default:
1105                 err = -ENOPROTOOPT;
1106                 break;
1107         }
1108
1109         release_sock(sk);
1110         return err;
1111 }
1112
1113 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1114                               size_t len)
1115 {
1116         struct sock *sk = sock->sk;
1117         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1118         int err;
1119
1120         BT_DBG("sock %p, sk %p", sock, sk);
1121
1122         err = sock_error(sk);
1123         if (err)
1124                 return err;
1125
1126         if (msg->msg_flags & MSG_OOB)
1127                 return -EOPNOTSUPP;
1128
1129         if (sk->sk_state != BT_CONNECTED)
1130                 return -ENOTCONN;
1131
1132         lock_sock(sk);
1133         err = bt_sock_wait_ready(sk, msg->msg_flags);
1134         release_sock(sk);
1135         if (err)
1136                 return err;
1137
1138         l2cap_chan_lock(chan);
1139         err = l2cap_chan_send(chan, msg, len);
1140         l2cap_chan_unlock(chan);
1141
1142         return err;
1143 }
1144
1145 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1146                               size_t len, int flags)
1147 {
1148         struct sock *sk = sock->sk;
1149         struct l2cap_pinfo *pi = l2cap_pi(sk);
1150         int err;
1151
1152         lock_sock(sk);
1153
1154         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1155                                                     &bt_sk(sk)->flags)) {
1156                 if (pi->chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
1157                         sk->sk_state = BT_CONNECTED;
1158                         pi->chan->state = BT_CONNECTED;
1159                         __l2cap_ecred_conn_rsp_defer(pi->chan);
1160                 } else if (bdaddr_type_is_le(pi->chan->src_type)) {
1161                         sk->sk_state = BT_CONNECTED;
1162                         pi->chan->state = BT_CONNECTED;
1163                         __l2cap_le_connect_rsp_defer(pi->chan);
1164                 } else {
1165                         sk->sk_state = BT_CONFIG;
1166                         pi->chan->state = BT_CONFIG;
1167                         __l2cap_connect_rsp_defer(pi->chan);
1168                 }
1169
1170                 err = 0;
1171                 goto done;
1172         }
1173
1174         release_sock(sk);
1175
1176         if (sock->type == SOCK_STREAM)
1177                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1178         else
1179                 err = bt_sock_recvmsg(sock, msg, len, flags);
1180
1181         if (pi->chan->mode != L2CAP_MODE_ERTM)
1182                 return err;
1183
1184         /* Attempt to put pending rx data in the socket buffer */
1185
1186         lock_sock(sk);
1187
1188         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1189                 goto done;
1190
1191         if (pi->rx_busy_skb) {
1192                 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1193                         pi->rx_busy_skb = NULL;
1194                 else
1195                         goto done;
1196         }
1197
1198         /* Restore data flow when half of the receive buffer is
1199          * available.  This avoids resending large numbers of
1200          * frames.
1201          */
1202         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1203                 l2cap_chan_busy(pi->chan, 0);
1204
1205 done:
1206         release_sock(sk);
1207         return err;
1208 }
1209
1210 /* Kill socket (only if zapped and orphan)
1211  * Must be called on unlocked socket, with l2cap channel lock.
1212  */
1213 static void l2cap_sock_kill(struct sock *sk)
1214 {
1215         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1216                 return;
1217
1218         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1219
1220         /* Kill poor orphan */
1221
1222         l2cap_chan_put(l2cap_pi(sk)->chan);
1223         sock_set_flag(sk, SOCK_DEAD);
1224         sock_put(sk);
1225 }
1226
1227 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1228 {
1229         DECLARE_WAITQUEUE(wait, current);
1230         int err = 0;
1231         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1232         /* Timeout to prevent infinite loop */
1233         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1234
1235         add_wait_queue(sk_sleep(sk), &wait);
1236         set_current_state(TASK_INTERRUPTIBLE);
1237         do {
1238                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1239                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1240                        jiffies_to_msecs(timeout - jiffies));
1241
1242                 if (!timeo)
1243                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1244
1245                 if (signal_pending(current)) {
1246                         err = sock_intr_errno(timeo);
1247                         break;
1248                 }
1249
1250                 release_sock(sk);
1251                 timeo = schedule_timeout(timeo);
1252                 lock_sock(sk);
1253                 set_current_state(TASK_INTERRUPTIBLE);
1254
1255                 err = sock_error(sk);
1256                 if (err)
1257                         break;
1258
1259                 if (time_after(jiffies, timeout)) {
1260                         err = -ENOLINK;
1261                         break;
1262                 }
1263
1264         } while (chan->unacked_frames > 0 &&
1265                  chan->state == BT_CONNECTED);
1266
1267         set_current_state(TASK_RUNNING);
1268         remove_wait_queue(sk_sleep(sk), &wait);
1269         return err;
1270 }
1271
1272 static int l2cap_sock_shutdown(struct socket *sock, int how)
1273 {
1274         struct sock *sk = sock->sk;
1275         struct l2cap_chan *chan;
1276         struct l2cap_conn *conn;
1277         int err = 0;
1278
1279         BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1280
1281         /* 'how' parameter is mapped to sk_shutdown as follows:
1282          * SHUT_RD   (0) --> RCV_SHUTDOWN  (1)
1283          * SHUT_WR   (1) --> SEND_SHUTDOWN (2)
1284          * SHUT_RDWR (2) --> SHUTDOWN_MASK (3)
1285          */
1286         how++;
1287
1288         if (!sk)
1289                 return 0;
1290
1291         lock_sock(sk);
1292
1293         if ((sk->sk_shutdown & how) == how)
1294                 goto shutdown_already;
1295
1296         BT_DBG("Handling sock shutdown");
1297
1298         /* prevent sk structure from being freed whilst unlocked */
1299         sock_hold(sk);
1300
1301         chan = l2cap_pi(sk)->chan;
1302         /* prevent chan structure from being freed whilst unlocked */
1303         l2cap_chan_hold(chan);
1304
1305         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1306
1307         if (chan->mode == L2CAP_MODE_ERTM &&
1308             chan->unacked_frames > 0 &&
1309             chan->state == BT_CONNECTED) {
1310                 err = __l2cap_wait_ack(sk, chan);
1311
1312                 /* After waiting for ACKs, check whether shutdown
1313                  * has already been actioned to close the L2CAP
1314                  * link such as by l2cap_disconnection_req().
1315                  */
1316                 if ((sk->sk_shutdown & how) == how)
1317                         goto shutdown_matched;
1318         }
1319
1320         /* Try setting the RCV_SHUTDOWN bit, return early if SEND_SHUTDOWN
1321          * is already set
1322          */
1323         if ((how & RCV_SHUTDOWN) && !(sk->sk_shutdown & RCV_SHUTDOWN)) {
1324                 sk->sk_shutdown |= RCV_SHUTDOWN;
1325                 if ((sk->sk_shutdown & how) == how)
1326                         goto shutdown_matched;
1327         }
1328
1329         sk->sk_shutdown |= SEND_SHUTDOWN;
1330         release_sock(sk);
1331
1332         l2cap_chan_lock(chan);
1333         conn = chan->conn;
1334         if (conn)
1335                 /* prevent conn structure from being freed */
1336                 l2cap_conn_get(conn);
1337         l2cap_chan_unlock(chan);
1338
1339         if (conn)
1340                 /* mutex lock must be taken before l2cap_chan_lock() */
1341                 mutex_lock(&conn->chan_lock);
1342
1343         l2cap_chan_lock(chan);
1344         l2cap_chan_close(chan, 0);
1345         l2cap_chan_unlock(chan);
1346
1347         if (conn) {
1348                 mutex_unlock(&conn->chan_lock);
1349                 l2cap_conn_put(conn);
1350         }
1351
1352         lock_sock(sk);
1353
1354         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1355             !(current->flags & PF_EXITING))
1356                 err = bt_sock_wait_state(sk, BT_CLOSED,
1357                                          sk->sk_lingertime);
1358
1359 shutdown_matched:
1360         l2cap_chan_put(chan);
1361         sock_put(sk);
1362
1363 shutdown_already:
1364         if (!err && sk->sk_err)
1365                 err = -sk->sk_err;
1366
1367         release_sock(sk);
1368
1369         BT_DBG("Sock shutdown complete err: %d", err);
1370
1371         return err;
1372 }
1373
1374 static int l2cap_sock_release(struct socket *sock)
1375 {
1376         struct sock *sk = sock->sk;
1377         int err;
1378         struct l2cap_chan *chan;
1379
1380         BT_DBG("sock %p, sk %p", sock, sk);
1381
1382         if (!sk)
1383                 return 0;
1384
1385         l2cap_sock_cleanup_listen(sk);
1386         bt_sock_unlink(&l2cap_sk_list, sk);
1387
1388         err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1389         chan = l2cap_pi(sk)->chan;
1390
1391         l2cap_chan_hold(chan);
1392         l2cap_chan_lock(chan);
1393
1394         sock_orphan(sk);
1395         l2cap_sock_kill(sk);
1396
1397         l2cap_chan_unlock(chan);
1398         l2cap_chan_put(chan);
1399
1400         return err;
1401 }
1402
1403 static void l2cap_sock_cleanup_listen(struct sock *parent)
1404 {
1405         struct sock *sk;
1406
1407         BT_DBG("parent %p state %s", parent,
1408                state_to_string(parent->sk_state));
1409
1410         /* Close not yet accepted channels */
1411         while ((sk = bt_accept_dequeue(parent, NULL))) {
1412                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1413
1414                 BT_DBG("child chan %p state %s", chan,
1415                        state_to_string(chan->state));
1416
1417                 l2cap_chan_hold(chan);
1418                 l2cap_chan_lock(chan);
1419
1420                 __clear_chan_timer(chan);
1421                 l2cap_chan_close(chan, ECONNRESET);
1422                 l2cap_sock_kill(sk);
1423
1424                 l2cap_chan_unlock(chan);
1425                 l2cap_chan_put(chan);
1426         }
1427 }
1428
1429 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1430 {
1431         struct sock *sk, *parent = chan->data;
1432
1433         lock_sock(parent);
1434
1435         /* Check for backlog size */
1436         if (sk_acceptq_is_full(parent)) {
1437                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1438                 release_sock(parent);
1439                 return NULL;
1440         }
1441
1442         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1443                               GFP_ATOMIC, 0);
1444         if (!sk) {
1445                 release_sock(parent);
1446                 return NULL;
1447         }
1448
1449         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1450
1451         l2cap_sock_init(sk, parent);
1452
1453         bt_accept_enqueue(parent, sk, false);
1454
1455         release_sock(parent);
1456
1457         return l2cap_pi(sk)->chan;
1458 }
1459
1460 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1461 {
1462         struct sock *sk = chan->data;
1463         int err;
1464
1465         lock_sock(sk);
1466
1467         if (l2cap_pi(sk)->rx_busy_skb) {
1468                 err = -ENOMEM;
1469                 goto done;
1470         }
1471
1472         if (chan->mode != L2CAP_MODE_ERTM &&
1473             chan->mode != L2CAP_MODE_STREAMING) {
1474                 /* Even if no filter is attached, we could potentially
1475                  * get errors from security modules, etc.
1476                  */
1477                 err = sk_filter(sk, skb);
1478                 if (err)
1479                         goto done;
1480         }
1481
1482         err = __sock_queue_rcv_skb(sk, skb);
1483
1484         /* For ERTM, handle one skb that doesn't fit into the recv
1485          * buffer.  This is important to do because the data frames
1486          * have already been acked, so the skb cannot be discarded.
1487          *
1488          * Notify the l2cap core that the buffer is full, so the
1489          * LOCAL_BUSY state is entered and no more frames are
1490          * acked and reassembled until there is buffer space
1491          * available.
1492          */
1493         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1494                 l2cap_pi(sk)->rx_busy_skb = skb;
1495                 l2cap_chan_busy(chan, 1);
1496                 err = 0;
1497         }
1498
1499 done:
1500         release_sock(sk);
1501
1502         return err;
1503 }
1504
1505 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1506 {
1507         struct sock *sk = chan->data;
1508
1509         if (!sk)
1510                 return;
1511
1512         l2cap_sock_kill(sk);
1513 }
1514
1515 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1516 {
1517         struct sock *sk = chan->data;
1518         struct sock *parent;
1519
1520         if (!sk)
1521                 return;
1522
1523         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1524
1525         /* This callback can be called both for server (BT_LISTEN)
1526          * sockets as well as "normal" ones. To avoid lockdep warnings
1527          * with child socket locking (through l2cap_sock_cleanup_listen)
1528          * we need separation into separate nesting levels. The simplest
1529          * way to accomplish this is to inherit the nesting level used
1530          * for the channel.
1531          */
1532         lock_sock_nested(sk, atomic_read(&chan->nesting));
1533
1534         parent = bt_sk(sk)->parent;
1535
1536         switch (chan->state) {
1537         case BT_OPEN:
1538         case BT_BOUND:
1539         case BT_CLOSED:
1540                 break;
1541         case BT_LISTEN:
1542                 l2cap_sock_cleanup_listen(sk);
1543                 sk->sk_state = BT_CLOSED;
1544                 chan->state = BT_CLOSED;
1545
1546                 break;
1547         default:
1548                 sk->sk_state = BT_CLOSED;
1549                 chan->state = BT_CLOSED;
1550
1551                 sk->sk_err = err;
1552
1553                 if (parent) {
1554                         bt_accept_unlink(sk);
1555                         parent->sk_data_ready(parent);
1556                 } else {
1557                         sk->sk_state_change(sk);
1558                 }
1559
1560                 break;
1561         }
1562         release_sock(sk);
1563
1564         /* Only zap after cleanup to avoid use after free race */
1565         sock_set_flag(sk, SOCK_ZAPPED);
1566
1567 }
1568
1569 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1570                                        int err)
1571 {
1572         struct sock *sk = chan->data;
1573
1574         sk->sk_state = state;
1575
1576         if (err)
1577                 sk->sk_err = err;
1578 }
1579
1580 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1581                                                unsigned long hdr_len,
1582                                                unsigned long len, int nb)
1583 {
1584         struct sock *sk = chan->data;
1585         struct sk_buff *skb;
1586         int err;
1587
1588         l2cap_chan_unlock(chan);
1589         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1590         l2cap_chan_lock(chan);
1591
1592         if (!skb)
1593                 return ERR_PTR(err);
1594
1595         /* Channel lock is released before requesting new skb and then
1596          * reacquired thus we need to recheck channel state.
1597          */
1598         if (chan->state != BT_CONNECTED) {
1599                 kfree_skb(skb);
1600                 return ERR_PTR(-ENOTCONN);
1601         }
1602
1603         skb->priority = READ_ONCE(sk->sk_priority);
1604
1605         bt_cb(skb)->l2cap.chan = chan;
1606
1607         return skb;
1608 }
1609
1610 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1611 {
1612         struct sock *sk = chan->data;
1613         struct sock *parent;
1614
1615         lock_sock(sk);
1616
1617         parent = bt_sk(sk)->parent;
1618
1619         BT_DBG("sk %p, parent %p", sk, parent);
1620
1621         sk->sk_state = BT_CONNECTED;
1622         sk->sk_state_change(sk);
1623
1624         if (parent)
1625                 parent->sk_data_ready(parent);
1626
1627         release_sock(sk);
1628 }
1629
1630 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1631 {
1632         struct sock *parent, *sk = chan->data;
1633
1634         lock_sock(sk);
1635
1636         parent = bt_sk(sk)->parent;
1637         if (parent)
1638                 parent->sk_data_ready(parent);
1639
1640         release_sock(sk);
1641 }
1642
1643 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1644 {
1645         struct sock *sk = chan->data;
1646
1647         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1648                 sk->sk_state = BT_CONNECTED;
1649                 chan->state = BT_CONNECTED;
1650         }
1651
1652         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1653         sk->sk_state_change(sk);
1654 }
1655
1656 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1657 {
1658         struct sock *sk = chan->data;
1659
1660         lock_sock(sk);
1661         sk->sk_shutdown = SHUTDOWN_MASK;
1662         release_sock(sk);
1663 }
1664
1665 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1666 {
1667         struct sock *sk = chan->data;
1668
1669         return sk->sk_sndtimeo;
1670 }
1671
1672 static struct pid *l2cap_sock_get_peer_pid_cb(struct l2cap_chan *chan)
1673 {
1674         struct sock *sk = chan->data;
1675
1676         return sk->sk_peer_pid;
1677 }
1678
1679 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1680 {
1681         struct sock *sk = chan->data;
1682
1683         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1684         sk->sk_state_change(sk);
1685 }
1686
1687 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1688 {
1689         struct sock *sk = chan->data;
1690
1691         switch (chan->mode) {
1692         case L2CAP_MODE_ERTM:
1693         case L2CAP_MODE_STREAMING:
1694                 return sk_filter(sk, skb);
1695         }
1696
1697         return 0;
1698 }
1699
1700 static const struct l2cap_ops l2cap_chan_ops = {
1701         .name                   = "L2CAP Socket Interface",
1702         .new_connection         = l2cap_sock_new_connection_cb,
1703         .recv                   = l2cap_sock_recv_cb,
1704         .close                  = l2cap_sock_close_cb,
1705         .teardown               = l2cap_sock_teardown_cb,
1706         .state_change           = l2cap_sock_state_change_cb,
1707         .ready                  = l2cap_sock_ready_cb,
1708         .defer                  = l2cap_sock_defer_cb,
1709         .resume                 = l2cap_sock_resume_cb,
1710         .suspend                = l2cap_sock_suspend_cb,
1711         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1712         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1713         .get_peer_pid           = l2cap_sock_get_peer_pid_cb,
1714         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1715         .filter                 = l2cap_sock_filter,
1716 };
1717
1718 static void l2cap_sock_destruct(struct sock *sk)
1719 {
1720         BT_DBG("sk %p", sk);
1721
1722         if (l2cap_pi(sk)->chan) {
1723                 l2cap_pi(sk)->chan->data = NULL;
1724                 l2cap_chan_put(l2cap_pi(sk)->chan);
1725         }
1726
1727         if (l2cap_pi(sk)->rx_busy_skb) {
1728                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1729                 l2cap_pi(sk)->rx_busy_skb = NULL;
1730         }
1731
1732         skb_queue_purge(&sk->sk_receive_queue);
1733         skb_queue_purge(&sk->sk_write_queue);
1734 }
1735
1736 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1737                                int *msg_namelen)
1738 {
1739         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1740
1741         memset(la, 0, sizeof(struct sockaddr_l2));
1742         la->l2_family = AF_BLUETOOTH;
1743         la->l2_psm = bt_cb(skb)->l2cap.psm;
1744         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1745
1746         *msg_namelen = sizeof(struct sockaddr_l2);
1747 }
1748
1749 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1750 {
1751         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1752
1753         BT_DBG("sk %p", sk);
1754
1755         if (parent) {
1756                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1757
1758                 sk->sk_type = parent->sk_type;
1759                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1760
1761                 chan->chan_type = pchan->chan_type;
1762                 chan->imtu = pchan->imtu;
1763                 chan->omtu = pchan->omtu;
1764                 chan->conf_state = pchan->conf_state;
1765                 chan->mode = pchan->mode;
1766                 chan->fcs  = pchan->fcs;
1767                 chan->max_tx = pchan->max_tx;
1768                 chan->tx_win = pchan->tx_win;
1769                 chan->tx_win_max = pchan->tx_win_max;
1770                 chan->sec_level = pchan->sec_level;
1771                 chan->flags = pchan->flags;
1772                 chan->tx_credits = pchan->tx_credits;
1773                 chan->rx_credits = pchan->rx_credits;
1774
1775                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1776                         chan->scid = pchan->scid;
1777                         chan->dcid = pchan->scid;
1778                 }
1779
1780                 security_sk_clone(parent, sk);
1781         } else {
1782                 switch (sk->sk_type) {
1783                 case SOCK_RAW:
1784                         chan->chan_type = L2CAP_CHAN_RAW;
1785                         break;
1786                 case SOCK_DGRAM:
1787                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1788                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1789                         break;
1790                 case SOCK_SEQPACKET:
1791                 case SOCK_STREAM:
1792                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1793                         break;
1794                 }
1795
1796                 chan->imtu = L2CAP_DEFAULT_MTU;
1797                 chan->omtu = 0;
1798                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1799                         chan->mode = L2CAP_MODE_ERTM;
1800                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1801                 } else {
1802                         chan->mode = L2CAP_MODE_BASIC;
1803                 }
1804
1805                 l2cap_chan_set_defaults(chan);
1806         }
1807
1808         /* Default config options */
1809         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1810
1811         chan->data = sk;
1812         chan->ops = &l2cap_chan_ops;
1813 }
1814
1815 static struct proto l2cap_proto = {
1816         .name           = "L2CAP",
1817         .owner          = THIS_MODULE,
1818         .obj_size       = sizeof(struct l2cap_pinfo)
1819 };
1820
1821 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1822                                      int proto, gfp_t prio, int kern)
1823 {
1824         struct sock *sk;
1825         struct l2cap_chan *chan;
1826
1827         sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern);
1828         if (!sk)
1829                 return NULL;
1830
1831         sk->sk_destruct = l2cap_sock_destruct;
1832         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1833
1834         chan = l2cap_chan_create();
1835         if (!chan) {
1836                 sk_free(sk);
1837                 return NULL;
1838         }
1839
1840         l2cap_chan_hold(chan);
1841
1842         l2cap_pi(sk)->chan = chan;
1843
1844         return sk;
1845 }
1846
1847 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1848                              int kern)
1849 {
1850         struct sock *sk;
1851
1852         BT_DBG("sock %p", sock);
1853
1854         sock->state = SS_UNCONNECTED;
1855
1856         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1857             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1858                 return -ESOCKTNOSUPPORT;
1859
1860         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1861                 return -EPERM;
1862
1863         sock->ops = &l2cap_sock_ops;
1864
1865         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1866         if (!sk)
1867                 return -ENOMEM;
1868
1869         l2cap_sock_init(sk, NULL);
1870         bt_sock_link(&l2cap_sk_list, sk);
1871         return 0;
1872 }
1873
1874 static const struct proto_ops l2cap_sock_ops = {
1875         .family         = PF_BLUETOOTH,
1876         .owner          = THIS_MODULE,
1877         .release        = l2cap_sock_release,
1878         .bind           = l2cap_sock_bind,
1879         .connect        = l2cap_sock_connect,
1880         .listen         = l2cap_sock_listen,
1881         .accept         = l2cap_sock_accept,
1882         .getname        = l2cap_sock_getname,
1883         .sendmsg        = l2cap_sock_sendmsg,
1884         .recvmsg        = l2cap_sock_recvmsg,
1885         .poll           = bt_sock_poll,
1886         .ioctl          = bt_sock_ioctl,
1887         .gettstamp      = sock_gettstamp,
1888         .mmap           = sock_no_mmap,
1889         .socketpair     = sock_no_socketpair,
1890         .shutdown       = l2cap_sock_shutdown,
1891         .setsockopt     = l2cap_sock_setsockopt,
1892         .getsockopt     = l2cap_sock_getsockopt
1893 };
1894
1895 static const struct net_proto_family l2cap_sock_family_ops = {
1896         .family = PF_BLUETOOTH,
1897         .owner  = THIS_MODULE,
1898         .create = l2cap_sock_create,
1899 };
1900
1901 int __init l2cap_init_sockets(void)
1902 {
1903         int err;
1904
1905         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1906
1907         err = proto_register(&l2cap_proto, 0);
1908         if (err < 0)
1909                 return err;
1910
1911         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1912         if (err < 0) {
1913                 BT_ERR("L2CAP socket registration failed");
1914                 goto error;
1915         }
1916
1917         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1918                              NULL);
1919         if (err < 0) {
1920                 BT_ERR("Failed to create L2CAP proc file");
1921                 bt_sock_unregister(BTPROTO_L2CAP);
1922                 goto error;
1923         }
1924
1925         BT_INFO("L2CAP socket layer initialized");
1926
1927         return 0;
1928
1929 error:
1930         proto_unregister(&l2cap_proto);
1931         return err;
1932 }
1933
1934 void l2cap_cleanup_sockets(void)
1935 {
1936         bt_procfs_cleanup(&init_net, "l2cap");
1937         bt_sock_unregister(BTPROTO_L2CAP);
1938         proto_unregister(&l2cap_proto);
1939 }