net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32 #include <linux/sched/signal.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/l2cap.h>
  37
  38 #include "smp.h"
  39
  40 static struct bt_sock_list l2cap_sk_list = {
  41         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  42 };
  43
  44 static const struct proto_ops l2cap_sock_ops;
  45 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  46 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  47                                      int proto, gfp_t prio, int kern);
  48
  49 bool l2cap_is_socket(struct socket *sock)
  50 {
  51         return sock && sock->ops == &l2cap_sock_ops;
  52 }
  53 EXPORT_SYMBOL(l2cap_is_socket);
  54
  55 static int l2cap_validate_bredr_psm(u16 psm)
  56 {
  57         /* PSM must be odd and lsb of upper byte must be 0 */
  58         if ((psm & 0x0101) != 0x0001)
  59                 return -EINVAL;
  60
  61         /* Restrict usage of well-known PSMs */
  62         if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  63                 return -EACCES;
  64
  65         return 0;
  66 }
  67
  68 static int l2cap_validate_le_psm(u16 psm)
  69 {
  70         /* Valid LE_PSM ranges are defined only until 0x00ff */
  71         if (psm > L2CAP_PSM_LE_DYN_END)
  72                 return -EINVAL;
  73
  74         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  75         if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
  76                 return -EACCES;
  77
  78         return 0;
  79 }
  80
  81 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  82 {
  83         struct sock *sk = sock->sk;
  84         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  85         struct sockaddr_l2 la;
  86         int len, err = 0;
  87
  88         BT_DBG("sk %p", sk);
  89
  90         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
  91             addr->sa_family != AF_BLUETOOTH)
  92                 return -EINVAL;
  93
  94         memset(&la, 0, sizeof(la));
  95         len = min_t(unsigned int, sizeof(la), alen);
  96         memcpy(&la, addr, len);
  97
  98         if (la.l2_cid && la.l2_psm)
  99                 return -EINVAL;
 100
 101         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 102                 return -EINVAL;
 103
 104         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 105                 /* We only allow ATT user space socket */
 106                 if (la.l2_cid &&
 107                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 108                         return -EINVAL;
 109         }
 110
 111         lock_sock(sk);
 112
 113         if (sk->sk_state != BT_OPEN) {
 114                 err = -EBADFD;
 115                 goto done;
 116         }
 117
 118         if (la.l2_psm) {
 119                 __u16 psm = __le16_to_cpu(la.l2_psm);
 120
 121                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 122                         err = l2cap_validate_bredr_psm(psm);
 123                 else
 124                         err = l2cap_validate_le_psm(psm);
 125
 126                 if (err)
 127                         goto done;
 128         }
 129
 130         bacpy(&chan->src, &la.l2_bdaddr);
 131         chan->src_type = la.l2_bdaddr_type;
 132
 133         if (la.l2_cid)
 134                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 135         else
 136                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 137
 138         if (err < 0)
 139                 goto done;
 140
 141         switch (chan->chan_type) {
 142         case L2CAP_CHAN_CONN_LESS:
 143                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 144                         chan->sec_level = BT_SECURITY_SDP;
 145                 break;
 146         case L2CAP_CHAN_CONN_ORIENTED:
 147                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 148                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 149                         chan->sec_level = BT_SECURITY_SDP;
 150                 break;
 151         case L2CAP_CHAN_RAW:
 152                 chan->sec_level = BT_SECURITY_SDP;
 153                 break;
 154         case L2CAP_CHAN_FIXED:
 155                 /* Fixed channels default to the L2CAP core not holding a
 156                  * hci_conn reference for them. For fixed channels mapping to
 157                  * L2CAP sockets we do want to hold a reference so set the
 158                  * appropriate flag to request it.
 159                  */
 160                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 161                 break;
 162         }
 163
 164         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 165                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 166
 167         chan->state = BT_BOUND;
 168         sk->sk_state = BT_BOUND;
 169
 170 done:
 171         release_sock(sk);
 172         return err;
 173 }
 174
 175 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 176                               int alen, int flags)
 177 {
 178         struct sock *sk = sock->sk;
 179         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 180         struct sockaddr_l2 la;
 181         int len, err = 0;
 182
 183         BT_DBG("sk %p", sk);
 184
 185         if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
 186             addr->sa_family != AF_BLUETOOTH)
 187                 return -EINVAL;
 188
 189         memset(&la, 0, sizeof(la));
 190         len = min_t(unsigned int, sizeof(la), alen);
 191         memcpy(&la, addr, len);
 192
 193         if (la.l2_cid && la.l2_psm)
 194                 return -EINVAL;
 195
 196         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 197                 return -EINVAL;
 198
 199         /* Check that the socket wasn't bound to something that
 200          * conflicts with the address given to connect(). If chan->src
 201          * is BDADDR_ANY it means bind() was never used, in which case
 202          * chan->src_type and la.l2_bdaddr_type do not need to match.
 203          */
 204         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 205             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 206                 /* Old user space versions will try to incorrectly bind
 207                  * the ATT socket using BDADDR_BREDR. We need to accept
 208                  * this and fix up the source address type only when
 209                  * both the source CID and destination CID indicate
 210                  * ATT. Anything else is an invalid combination.
 211                  */
 212                 if (chan->scid != L2CAP_CID_ATT ||
 213                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 214                         return -EINVAL;
 215
 216                 /* We don't have the hdev available here to make a
 217                  * better decision on random vs public, but since all
 218                  * user space versions that exhibit this issue anyway do
 219                  * not support random local addresses assuming public
 220                  * here is good enough.
 221                  */
 222                 chan->src_type = BDADDR_LE_PUBLIC;
 223         }
 224
 225         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 226                 return -EINVAL;
 227
 228         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 229                 /* We only allow ATT user space socket */
 230                 if (la.l2_cid &&
 231                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 232                         return -EINVAL;
 233         }
 234
 235         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 236                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 237
 238         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 239                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 240         if (err)
 241                 return err;
 242
 243         lock_sock(sk);
 244
 245         err = bt_sock_wait_state(sk, BT_CONNECTED,
 246                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 247
 248         release_sock(sk);
 249
 250         return err;
 251 }
 252
 253 static int l2cap_sock_listen(struct socket *sock, int backlog)
 254 {
 255         struct sock *sk = sock->sk;
 256         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 257         int err = 0;
 258
 259         BT_DBG("sk %p backlog %d", sk, backlog);
 260
 261         lock_sock(sk);
 262
 263         if (sk->sk_state != BT_BOUND) {
 264                 err = -EBADFD;
 265                 goto done;
 266         }
 267
 268         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 269                 err = -EINVAL;
 270                 goto done;
 271         }
 272
 273         switch (chan->mode) {
 274         case L2CAP_MODE_BASIC:
 275         case L2CAP_MODE_LE_FLOWCTL:
 276                 break;
 277         case L2CAP_MODE_ERTM:
 278         case L2CAP_MODE_STREAMING:
 279                 if (!disable_ertm)
 280                         break;
 281                 /* fall through */
 282         default:
 283                 err = -EOPNOTSUPP;
 284                 goto done;
 285         }
 286
 287         sk->sk_max_ack_backlog = backlog;
 288         sk->sk_ack_backlog = 0;
 289
 290         /* Listening channels need to use nested locking in order not to
 291          * cause lockdep warnings when the created child channels end up
 292          * being locked in the same thread as the parent channel.
 293          */
 294         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 295
 296         chan->state = BT_LISTEN;
 297         sk->sk_state = BT_LISTEN;
 298
 299 done:
 300         release_sock(sk);
 301         return err;
 302 }
 303
 304 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 305                              int flags, bool kern)
 306 {
 307         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 308         struct sock *sk = sock->sk, *nsk;
 309         long timeo;
 310         int err = 0;
 311
 312         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 313
 314         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 315
 316         BT_DBG("sk %p timeo %ld", sk, timeo);
 317
 318         /* Wait for an incoming connection. (wake-one). */
 319         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 320         while (1) {
 321                 if (sk->sk_state != BT_LISTEN) {
 322                         err = -EBADFD;
 323                         break;
 324                 }
 325
 326                 nsk = bt_accept_dequeue(sk, newsock);
 327                 if (nsk)
 328                         break;
 329
 330                 if (!timeo) {
 331                         err = -EAGAIN;
 332                         break;
 333                 }
 334
 335                 if (signal_pending(current)) {
 336                         err = sock_intr_errno(timeo);
 337                         break;
 338                 }
 339
 340                 release_sock(sk);
 341
 342                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 343
 344                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 345         }
 346         remove_wait_queue(sk_sleep(sk), &wait);
 347
 348         if (err)
 349                 goto done;
 350
 351         newsock->state = SS_CONNECTED;
 352
 353         BT_DBG("new socket %p", nsk);
 354
 355 done:
 356         release_sock(sk);
 357         return err;
 358 }
 359
 360 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 361                               int *len, int peer)
 362 {
 363         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 364         struct sock *sk = sock->sk;
 365         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 366
 367         BT_DBG("sock %p, sk %p", sock, sk);
 368
 369         if (peer && sk->sk_state != BT_CONNECTED &&
 370             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 371             sk->sk_state != BT_CONFIG)
 372                 return -ENOTCONN;
 373
 374         memset(la, 0, sizeof(struct sockaddr_l2));
 375         addr->sa_family = AF_BLUETOOTH;
 376         *len = sizeof(struct sockaddr_l2);
 377
 378         la->l2_psm = chan->psm;
 379
 380         if (peer) {
 381                 bacpy(&la->l2_bdaddr, &chan->dst);
 382                 la->l2_cid = cpu_to_le16(chan->dcid);
 383                 la->l2_bdaddr_type = chan->dst_type;
 384         } else {
 385                 bacpy(&la->l2_bdaddr, &chan->src);
 386                 la->l2_cid = cpu_to_le16(chan->scid);
 387                 la->l2_bdaddr_type = chan->src_type;
 388         }
 389
 390         return 0;
 391 }
 392
 393 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 394                                      char __user *optval, int __user *optlen)
 395 {
 396         struct sock *sk = sock->sk;
 397         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 398         struct l2cap_options opts;
 399         struct l2cap_conninfo cinfo;
 400         int len, err = 0;
 401         u32 opt;
 402
 403         BT_DBG("sk %p", sk);
 404
 405         if (get_user(len, optlen))
 406                 return -EFAULT;
 407
 408         lock_sock(sk);
 409
 410         switch (optname) {
 411         case L2CAP_OPTIONS:
 412                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 413                  * legacy ATT code depends on getsockopt for
 414                  * L2CAP_OPTIONS we need to let this pass.
 415                  */
 416                 if (bdaddr_type_is_le(chan->src_type) &&
 417                     chan->scid != L2CAP_CID_ATT) {
 418                         err = -EINVAL;
 419                         break;
 420                 }
 421
 422                 memset(&opts, 0, sizeof(opts));
 423                 opts.imtu     = chan->imtu;
 424                 opts.omtu     = chan->omtu;
 425                 opts.flush_to = chan->flush_to;
 426                 opts.mode     = chan->mode;
 427                 opts.fcs      = chan->fcs;
 428                 opts.max_tx   = chan->max_tx;
 429                 opts.txwin_size = chan->tx_win;
 430
 431                 len = min_t(unsigned int, len, sizeof(opts));
 432                 if (copy_to_user(optval, (char *) &opts, len))
 433                         err = -EFAULT;
 434
 435                 break;
 436
 437         case L2CAP_LM:
 438                 switch (chan->sec_level) {
 439                 case BT_SECURITY_LOW:
 440                         opt = L2CAP_LM_AUTH;
 441                         break;
 442                 case BT_SECURITY_MEDIUM:
 443                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 444                         break;
 445                 case BT_SECURITY_HIGH:
 446                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 447                               L2CAP_LM_SECURE;
 448                         break;
 449                 case BT_SECURITY_FIPS:
 450                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 451                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 452                         break;
 453                 default:
 454                         opt = 0;
 455                         break;
 456                 }
 457
 458                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 459                         opt |= L2CAP_LM_MASTER;
 460
 461                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 462                         opt |= L2CAP_LM_RELIABLE;
 463
 464                 if (put_user(opt, (u32 __user *) optval))
 465                         err = -EFAULT;
 466
 467                 break;
 468
 469         case L2CAP_CONNINFO:
 470                 if (sk->sk_state != BT_CONNECTED &&
 471                     !(sk->sk_state == BT_CONNECT2 &&
 472                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 473                         err = -ENOTCONN;
 474                         break;
 475                 }
 476
 477                 memset(&cinfo, 0, sizeof(cinfo));
 478                 cinfo.hci_handle = chan->conn->hcon->handle;
 479                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 480
 481                 len = min_t(unsigned int, len, sizeof(cinfo));
 482                 if (copy_to_user(optval, (char *) &cinfo, len))
 483                         err = -EFAULT;
 484
 485                 break;
 486
 487         default:
 488                 err = -ENOPROTOOPT;
 489                 break;
 490         }
 491
 492         release_sock(sk);
 493         return err;
 494 }
 495
 496 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 497                                  char __user *optval, int __user *optlen)
 498 {
 499         struct sock *sk = sock->sk;
 500         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 501         struct bt_security sec;
 502         struct bt_power pwr;
 503         int len, err = 0;
 504
 505         BT_DBG("sk %p", sk);
 506
 507         if (level == SOL_L2CAP)
 508                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 509
 510         if (level != SOL_BLUETOOTH)
 511                 return -ENOPROTOOPT;
 512
 513         if (get_user(len, optlen))
 514                 return -EFAULT;
 515
 516         lock_sock(sk);
 517
 518         switch (optname) {
 519         case BT_SECURITY:
 520                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 521                     chan->chan_type != L2CAP_CHAN_FIXED &&
 522                     chan->chan_type != L2CAP_CHAN_RAW) {
 523                         err = -EINVAL;
 524                         break;
 525                 }
 526
 527                 memset(&sec, 0, sizeof(sec));
 528                 if (chan->conn) {
 529                         sec.level = chan->conn->hcon->sec_level;
 530
 531                         if (sk->sk_state == BT_CONNECTED)
 532                                 sec.key_size = chan->conn->hcon->enc_key_size;
 533                 } else {
 534                         sec.level = chan->sec_level;
 535                 }
 536
 537                 len = min_t(unsigned int, len, sizeof(sec));
 538                 if (copy_to_user(optval, (char *) &sec, len))
 539                         err = -EFAULT;
 540
 541                 break;
 542
 543         case BT_DEFER_SETUP:
 544                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 545                         err = -EINVAL;
 546                         break;
 547                 }
 548
 549                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 550                              (u32 __user *) optval))
 551                         err = -EFAULT;
 552
 553                 break;
 554
 555         case BT_FLUSHABLE:
 556                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 557                              (u32 __user *) optval))
 558                         err = -EFAULT;
 559
 560                 break;
 561
 562         case BT_POWER:
 563                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 564                     && sk->sk_type != SOCK_RAW) {
 565                         err = -EINVAL;
 566                         break;
 567                 }
 568
 569                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 570
 571                 len = min_t(unsigned int, len, sizeof(pwr));
 572                 if (copy_to_user(optval, (char *) &pwr, len))
 573                         err = -EFAULT;
 574
 575                 break;
 576
 577         case BT_CHANNEL_POLICY:
 578                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 579                         err = -EFAULT;
 580                 break;
 581
 582         case BT_SNDMTU:
 583                 if (!bdaddr_type_is_le(chan->src_type)) {
 584                         err = -EINVAL;
 585                         break;
 586                 }
 587
 588                 if (sk->sk_state != BT_CONNECTED) {
 589                         err = -ENOTCONN;
 590                         break;
 591                 }
 592
 593                 if (put_user(chan->omtu, (u16 __user *) optval))
 594                         err = -EFAULT;
 595                 break;
 596
 597         case BT_RCVMTU:
 598                 if (!bdaddr_type_is_le(chan->src_type)) {
 599                         err = -EINVAL;
 600                         break;
 601                 }
 602
 603                 if (put_user(chan->imtu, (u16 __user *) optval))
 604                         err = -EFAULT;
 605                 break;
 606
 607         default:
 608                 err = -ENOPROTOOPT;
 609                 break;
 610         }
 611
 612         release_sock(sk);
 613         return err;
 614 }
 615
 616 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 617 {
 618         switch (chan->scid) {
 619         case L2CAP_CID_ATT:
 620                 if (mtu < L2CAP_LE_MIN_MTU)
 621                         return false;
 622                 break;
 623
 624         default:
 625                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 626                         return false;
 627         }
 628
 629         return true;
 630 }
 631
 632 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 633                                      char __user *optval, unsigned int optlen)
 634 {
 635         struct sock *sk = sock->sk;
 636         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 637         struct l2cap_options opts;
 638         int len, err = 0;
 639         u32 opt;
 640
 641         BT_DBG("sk %p", sk);
 642
 643         lock_sock(sk);
 644
 645         switch (optname) {
 646         case L2CAP_OPTIONS:
 647                 if (bdaddr_type_is_le(chan->src_type)) {
 648                         err = -EINVAL;
 649                         break;
 650                 }
 651
 652                 if (sk->sk_state == BT_CONNECTED) {
 653                         err = -EINVAL;
 654                         break;
 655                 }
 656
 657                 opts.imtu     = chan->imtu;
 658                 opts.omtu     = chan->omtu;
 659                 opts.flush_to = chan->flush_to;
 660                 opts.mode     = chan->mode;
 661                 opts.fcs      = chan->fcs;
 662                 opts.max_tx   = chan->max_tx;
 663                 opts.txwin_size = chan->tx_win;
 664
 665                 len = min_t(unsigned int, sizeof(opts), optlen);
 666                 if (copy_from_user((char *) &opts, optval, len)) {
 667                         err = -EFAULT;
 668                         break;
 669                 }
 670
 671                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 672                         err = -EINVAL;
 673                         break;
 674                 }
 675
 676                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 677                         err = -EINVAL;
 678                         break;
 679                 }
 680
 681                 chan->mode = opts.mode;
 682                 switch (chan->mode) {
 683                 case L2CAP_MODE_LE_FLOWCTL:
 684                         break;
 685                 case L2CAP_MODE_BASIC:
 686                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 687                         break;
 688                 case L2CAP_MODE_ERTM:
 689                 case L2CAP_MODE_STREAMING:
 690                         if (!disable_ertm)
 691                                 break;
 692                         /* fall through */
 693                 default:
 694                         err = -EINVAL;
 695                         break;
 696                 }
 697
 698                 chan->imtu = opts.imtu;
 699                 chan->omtu = opts.omtu;
 700                 chan->fcs  = opts.fcs;
 701                 chan->max_tx = opts.max_tx;
 702                 chan->tx_win = opts.txwin_size;
 703                 chan->flush_to = opts.flush_to;
 704                 break;
 705
 706         case L2CAP_LM:
 707                 if (get_user(opt, (u32 __user *) optval)) {
 708                         err = -EFAULT;
 709                         break;
 710                 }
 711
 712                 if (opt & L2CAP_LM_FIPS) {
 713                         err = -EINVAL;
 714                         break;
 715                 }
 716
 717                 if (opt & L2CAP_LM_AUTH)
 718                         chan->sec_level = BT_SECURITY_LOW;
 719                 if (opt & L2CAP_LM_ENCRYPT)
 720                         chan->sec_level = BT_SECURITY_MEDIUM;
 721                 if (opt & L2CAP_LM_SECURE)
 722                         chan->sec_level = BT_SECURITY_HIGH;
 723
 724                 if (opt & L2CAP_LM_MASTER)
 725                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 726                 else
 727                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 728
 729                 if (opt & L2CAP_LM_RELIABLE)
 730                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 731                 else
 732                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 733                 break;
 734
 735         default:
 736                 err = -ENOPROTOOPT;
 737                 break;
 738         }
 739
 740         release_sock(sk);
 741         return err;
 742 }
 743
 744 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 745                                  char __user *optval, unsigned int optlen)
 746 {
 747         struct sock *sk = sock->sk;
 748         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 749         struct bt_security sec;
 750         struct bt_power pwr;
 751         struct l2cap_conn *conn;
 752         int len, err = 0;
 753         u32 opt;
 754
 755         BT_DBG("sk %p", sk);
 756
 757         if (level == SOL_L2CAP)
 758                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 759
 760         if (level != SOL_BLUETOOTH)
 761                 return -ENOPROTOOPT;
 762
 763         lock_sock(sk);
 764
 765         switch (optname) {
 766         case BT_SECURITY:
 767                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 768                     chan->chan_type != L2CAP_CHAN_FIXED &&
 769                     chan->chan_type != L2CAP_CHAN_RAW) {
 770                         err = -EINVAL;
 771                         break;
 772                 }
 773
 774                 sec.level = BT_SECURITY_LOW;
 775
 776                 len = min_t(unsigned int, sizeof(sec), optlen);
 777                 if (copy_from_user((char *) &sec, optval, len)) {
 778                         err = -EFAULT;
 779                         break;
 780                 }
 781
 782                 if (sec.level < BT_SECURITY_LOW ||
 783                     sec.level > BT_SECURITY_FIPS) {
 784                         err = -EINVAL;
 785                         break;
 786                 }
 787
 788                 chan->sec_level = sec.level;
 789
 790                 if (!chan->conn)
 791                         break;
 792
 793                 conn = chan->conn;
 794
 795                 /*change security for LE channels */
 796                 if (chan->scid == L2CAP_CID_ATT) {
 797                         if (smp_conn_security(conn->hcon, sec.level))
 798                                 break;
 799                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 800                         sk->sk_state = BT_CONFIG;
 801                         chan->state = BT_CONFIG;
 802
 803                 /* or for ACL link */
 804                 } else if ((sk->sk_state == BT_CONNECT2 &&
 805                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 806                            sk->sk_state == BT_CONNECTED) {
 807                         if (!l2cap_chan_check_security(chan, true))
 808                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 809                         else
 810                                 sk->sk_state_change(sk);
 811                 } else {
 812                         err = -EINVAL;
 813                 }
 814                 break;
 815
 816         case BT_DEFER_SETUP:
 817                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 818                         err = -EINVAL;
 819                         break;
 820                 }
 821
 822                 if (get_user(opt, (u32 __user *) optval)) {
 823                         err = -EFAULT;
 824                         break;
 825                 }
 826
 827                 if (opt) {
 828                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 829                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 830                 } else {
 831                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 832                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 833                 }
 834                 break;
 835
 836         case BT_FLUSHABLE:
 837                 if (get_user(opt, (u32 __user *) optval)) {
 838                         err = -EFAULT;
 839                         break;
 840                 }
 841
 842                 if (opt > BT_FLUSHABLE_ON) {
 843                         err = -EINVAL;
 844                         break;
 845                 }
 846
 847                 if (opt == BT_FLUSHABLE_OFF) {
 848                         conn = chan->conn;
 849                         /* proceed further only when we have l2cap_conn and
 850                            No Flush support in the LM */
 851                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 852                                 err = -EINVAL;
 853                                 break;
 854                         }
 855                 }
 856
 857                 if (opt)
 858                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 859                 else
 860                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 861                 break;
 862
 863         case BT_POWER:
 864                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 865                     chan->chan_type != L2CAP_CHAN_RAW) {
 866                         err = -EINVAL;
 867                         break;
 868                 }
 869
 870                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 871
 872                 len = min_t(unsigned int, sizeof(pwr), optlen);
 873                 if (copy_from_user((char *) &pwr, optval, len)) {
 874                         err = -EFAULT;
 875                         break;
 876                 }
 877
 878                 if (pwr.force_active)
 879                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 880                 else
 881                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 882                 break;
 883
 884         case BT_CHANNEL_POLICY:
 885                 if (get_user(opt, (u32 __user *) optval)) {
 886                         err = -EFAULT;
 887                         break;
 888                 }
 889
 890                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 891                         err = -EINVAL;
 892                         break;
 893                 }
 894
 895                 if (chan->mode != L2CAP_MODE_ERTM &&
 896                     chan->mode != L2CAP_MODE_STREAMING) {
 897                         err = -EOPNOTSUPP;
 898                         break;
 899                 }
 900
 901                 chan->chan_policy = (u8) opt;
 902
 903                 if (sk->sk_state == BT_CONNECTED &&
 904                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 905                         l2cap_move_start(chan);
 906
 907                 break;
 908
 909         case BT_SNDMTU:
 910                 if (!bdaddr_type_is_le(chan->src_type)) {
 911                         err = -EINVAL;
 912                         break;
 913                 }
 914
 915                 /* Setting is not supported as it's the remote side that
 916                  * decides this.
 917                  */
 918                 err = -EPERM;
 919                 break;
 920
 921         case BT_RCVMTU:
 922                 if (!bdaddr_type_is_le(chan->src_type)) {
 923                         err = -EINVAL;
 924                         break;
 925                 }
 926
 927                 if (sk->sk_state == BT_CONNECTED) {
 928                         err = -EISCONN;
 929                         break;
 930                 }
 931
 932                 if (get_user(opt, (u16 __user *) optval)) {
 933                         err = -EFAULT;
 934                         break;
 935                 }
 936
 937                 chan->imtu = opt;
 938                 break;
 939
 940         default:
 941                 err = -ENOPROTOOPT;
 942                 break;
 943         }
 944
 945         release_sock(sk);
 946         return err;
 947 }
 948
 949 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 950                               size_t len)
 951 {
 952         struct sock *sk = sock->sk;
 953         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 954         int err;
 955
 956         BT_DBG("sock %p, sk %p", sock, sk);
 957
 958         err = sock_error(sk);
 959         if (err)
 960                 return err;
 961
 962         if (msg->msg_flags & MSG_OOB)
 963                 return -EOPNOTSUPP;
 964
 965         if (sk->sk_state != BT_CONNECTED)
 966                 return -ENOTCONN;
 967
 968         lock_sock(sk);
 969         err = bt_sock_wait_ready(sk, msg->msg_flags);
 970         release_sock(sk);
 971         if (err)
 972                 return err;
 973
 974         l2cap_chan_lock(chan);
 975         err = l2cap_chan_send(chan, msg, len);
 976         l2cap_chan_unlock(chan);
 977
 978         return err;
 979 }
 980
 981 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 982                               size_t len, int flags)
 983 {
 984         struct sock *sk = sock->sk;
 985         struct l2cap_pinfo *pi = l2cap_pi(sk);
 986         int err;
 987
 988         lock_sock(sk);
 989
 990         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
 991                                                     &bt_sk(sk)->flags)) {
 992                 if (bdaddr_type_is_le(pi->chan->src_type)) {
 993                         sk->sk_state = BT_CONNECTED;
 994                         pi->chan->state = BT_CONNECTED;
 995                         __l2cap_le_connect_rsp_defer(pi->chan);
 996                 } else {
 997                         sk->sk_state = BT_CONFIG;
 998                         pi->chan->state = BT_CONFIG;
 999                         __l2cap_connect_rsp_defer(pi->chan);
1000                 }
1001
1002                 err = 0;
1003                 goto done;
1004         }
1005
1006         release_sock(sk);
1007
1008         if (sock->type == SOCK_STREAM)
1009                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1010         else
1011                 err = bt_sock_recvmsg(sock, msg, len, flags);
1012
1013         if (pi->chan->mode != L2CAP_MODE_ERTM)
1014                 return err;
1015
1016         /* Attempt to put pending rx data in the socket buffer */
1017
1018         lock_sock(sk);
1019
1020         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1021                 goto done;
1022
1023         if (pi->rx_busy_skb) {
1024                 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1025                         pi->rx_busy_skb = NULL;
1026                 else
1027                         goto done;
1028         }
1029
1030         /* Restore data flow when half of the receive buffer is
1031          * available.  This avoids resending large numbers of
1032          * frames.
1033          */
1034         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1035                 l2cap_chan_busy(pi->chan, 0);
1036
1037 done:
1038         release_sock(sk);
1039         return err;
1040 }
1041
1042 /* Kill socket (only if zapped and orphan)
1043  * Must be called on unlocked socket.
1044  */
1045 static void l2cap_sock_kill(struct sock *sk)
1046 {
1047         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1048                 return;
1049
1050         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1051
1052         /* Kill poor orphan */
1053
1054         l2cap_chan_put(l2cap_pi(sk)->chan);
1055         sock_set_flag(sk, SOCK_DEAD);
1056         sock_put(sk);
1057 }
1058
1059 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1060 {
1061         DECLARE_WAITQUEUE(wait, current);
1062         int err = 0;
1063         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1064         /* Timeout to prevent infinite loop */
1065         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1066
1067         add_wait_queue(sk_sleep(sk), &wait);
1068         set_current_state(TASK_INTERRUPTIBLE);
1069         do {
1070                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1071                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1072                        jiffies_to_msecs(timeout - jiffies));
1073
1074                 if (!timeo)
1075                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1076
1077                 if (signal_pending(current)) {
1078                         err = sock_intr_errno(timeo);
1079                         break;
1080                 }
1081
1082                 release_sock(sk);
1083                 timeo = schedule_timeout(timeo);
1084                 lock_sock(sk);
1085                 set_current_state(TASK_INTERRUPTIBLE);
1086
1087                 err = sock_error(sk);
1088                 if (err)
1089                         break;
1090
1091                 if (time_after(jiffies, timeout)) {
1092                         err = -ENOLINK;
1093                         break;
1094                 }
1095
1096         } while (chan->unacked_frames > 0 &&
1097                  chan->state == BT_CONNECTED);
1098
1099         set_current_state(TASK_RUNNING);
1100         remove_wait_queue(sk_sleep(sk), &wait);
1101         return err;
1102 }
1103
1104 static int l2cap_sock_shutdown(struct socket *sock, int how)
1105 {
1106         struct sock *sk = sock->sk;
1107         struct l2cap_chan *chan;
1108         struct l2cap_conn *conn;
1109         int err = 0;
1110
1111         BT_DBG("sock %p, sk %p", sock, sk);
1112
1113         if (!sk)
1114                 return 0;
1115
1116         lock_sock(sk);
1117
1118         if (sk->sk_shutdown)
1119                 goto shutdown_already;
1120
1121         BT_DBG("Handling sock shutdown");
1122
1123         /* prevent sk structure from being freed whilst unlocked */
1124         sock_hold(sk);
1125
1126         chan = l2cap_pi(sk)->chan;
1127         /* prevent chan structure from being freed whilst unlocked */
1128         l2cap_chan_hold(chan);
1129
1130         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1131
1132         if (chan->mode == L2CAP_MODE_ERTM &&
1133             chan->unacked_frames > 0 &&
1134             chan->state == BT_CONNECTED) {
1135                 err = __l2cap_wait_ack(sk, chan);
1136
1137                 /* After waiting for ACKs, check whether shutdown
1138                  * has already been actioned to close the L2CAP
1139                  * link such as by l2cap_disconnection_req().
1140                  */
1141                 if (sk->sk_shutdown)
1142                         goto has_shutdown;
1143         }
1144
1145         sk->sk_shutdown = SHUTDOWN_MASK;
1146         release_sock(sk);
1147
1148         l2cap_chan_lock(chan);
1149         conn = chan->conn;
1150         if (conn)
1151                 /* prevent conn structure from being freed */
1152                 l2cap_conn_get(conn);
1153         l2cap_chan_unlock(chan);
1154
1155         if (conn)
1156                 /* mutex lock must be taken before l2cap_chan_lock() */
1157                 mutex_lock(&conn->chan_lock);
1158
1159         l2cap_chan_lock(chan);
1160         l2cap_chan_close(chan, 0);
1161         l2cap_chan_unlock(chan);
1162
1163         if (conn) {
1164                 mutex_unlock(&conn->chan_lock);
1165                 l2cap_conn_put(conn);
1166         }
1167
1168         lock_sock(sk);
1169
1170         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1171             !(current->flags & PF_EXITING))
1172                 err = bt_sock_wait_state(sk, BT_CLOSED,
1173                                          sk->sk_lingertime);
1174
1175 has_shutdown:
1176         l2cap_chan_put(chan);
1177         sock_put(sk);
1178
1179 shutdown_already:
1180         if (!err && sk->sk_err)
1181                 err = -sk->sk_err;
1182
1183         release_sock(sk);
1184
1185         BT_DBG("Sock shutdown complete err: %d", err);
1186
1187         return err;
1188 }
1189
1190 static int l2cap_sock_release(struct socket *sock)
1191 {
1192         struct sock *sk = sock->sk;
1193         int err;
1194
1195         BT_DBG("sock %p, sk %p", sock, sk);
1196
1197         if (!sk)
1198                 return 0;
1199
1200         bt_sock_unlink(&l2cap_sk_list, sk);
1201
1202         err = l2cap_sock_shutdown(sock, 2);
1203
1204         sock_orphan(sk);
1205         l2cap_sock_kill(sk);
1206         return err;
1207 }
1208
1209 static void l2cap_sock_cleanup_listen(struct sock *parent)
1210 {
1211         struct sock *sk;
1212
1213         BT_DBG("parent %p state %s", parent,
1214                state_to_string(parent->sk_state));
1215
1216         /* Close not yet accepted channels */
1217         while ((sk = bt_accept_dequeue(parent, NULL))) {
1218                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1219
1220                 BT_DBG("child chan %p state %s", chan,
1221                        state_to_string(chan->state));
1222
1223                 l2cap_chan_lock(chan);
1224                 __clear_chan_timer(chan);
1225                 l2cap_chan_close(chan, ECONNRESET);
1226                 l2cap_chan_unlock(chan);
1227
1228                 l2cap_sock_kill(sk);
1229         }
1230 }
1231
1232 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1233 {
1234         struct sock *sk, *parent = chan->data;
1235
1236         lock_sock(parent);
1237
1238         /* Check for backlog size */
1239         if (sk_acceptq_is_full(parent)) {
1240                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1241                 release_sock(parent);
1242                 return NULL;
1243         }
1244
1245         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1246                               GFP_ATOMIC, 0);
1247         if (!sk) {
1248                 release_sock(parent);
1249                 return NULL;
1250         }
1251
1252         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1253
1254         l2cap_sock_init(sk, parent);
1255
1256         bt_accept_enqueue(parent, sk);
1257
1258         release_sock(parent);
1259
1260         return l2cap_pi(sk)->chan;
1261 }
1262
1263 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1264 {
1265         struct sock *sk = chan->data;
1266         int err;
1267
1268         lock_sock(sk);
1269
1270         if (l2cap_pi(sk)->rx_busy_skb) {
1271                 err = -ENOMEM;
1272                 goto done;
1273         }
1274
1275         if (chan->mode != L2CAP_MODE_ERTM &&
1276             chan->mode != L2CAP_MODE_STREAMING) {
1277                 /* Even if no filter is attached, we could potentially
1278                  * get errors from security modules, etc.
1279                  */
1280                 err = sk_filter(sk, skb);
1281                 if (err)
1282                         goto done;
1283         }
1284
1285         err = __sock_queue_rcv_skb(sk, skb);
1286
1287         /* For ERTM, handle one skb that doesn't fit into the recv
1288          * buffer.  This is important to do because the data frames
1289          * have already been acked, so the skb cannot be discarded.
1290          *
1291          * Notify the l2cap core that the buffer is full, so the
1292          * LOCAL_BUSY state is entered and no more frames are
1293          * acked and reassembled until there is buffer space
1294          * available.
1295          */
1296         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1297                 l2cap_pi(sk)->rx_busy_skb = skb;
1298                 l2cap_chan_busy(chan, 1);
1299                 err = 0;
1300         }
1301
1302 done:
1303         release_sock(sk);
1304
1305         return err;
1306 }
1307
1308 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1309 {
1310         struct sock *sk = chan->data;
1311
1312         l2cap_sock_kill(sk);
1313 }
1314
1315 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1316 {
1317         struct sock *sk = chan->data;
1318         struct sock *parent;
1319
1320         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1321
1322         /* This callback can be called both for server (BT_LISTEN)
1323          * sockets as well as "normal" ones. To avoid lockdep warnings
1324          * with child socket locking (through l2cap_sock_cleanup_listen)
1325          * we need separation into separate nesting levels. The simplest
1326          * way to accomplish this is to inherit the nesting level used
1327          * for the channel.
1328          */
1329         lock_sock_nested(sk, atomic_read(&chan->nesting));
1330
1331         parent = bt_sk(sk)->parent;
1332
1333         sock_set_flag(sk, SOCK_ZAPPED);
1334
1335         switch (chan->state) {
1336         case BT_OPEN:
1337         case BT_BOUND:
1338         case BT_CLOSED:
1339                 break;
1340         case BT_LISTEN:
1341                 l2cap_sock_cleanup_listen(sk);
1342                 sk->sk_state = BT_CLOSED;
1343                 chan->state = BT_CLOSED;
1344
1345                 break;
1346         default:
1347                 sk->sk_state = BT_CLOSED;
1348                 chan->state = BT_CLOSED;
1349
1350                 sk->sk_err = err;
1351
1352                 if (parent) {
1353                         bt_accept_unlink(sk);
1354                         parent->sk_data_ready(parent);
1355                 } else {
1356                         sk->sk_state_change(sk);
1357                 }
1358
1359                 break;
1360         }
1361
1362         release_sock(sk);
1363 }
1364
1365 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1366                                        int err)
1367 {
1368         struct sock *sk = chan->data;
1369
1370         sk->sk_state = state;
1371
1372         if (err)
1373                 sk->sk_err = err;
1374 }
1375
1376 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1377                                                unsigned long hdr_len,
1378                                                unsigned long len, int nb)
1379 {
1380         struct sock *sk = chan->data;
1381         struct sk_buff *skb;
1382         int err;
1383
1384         l2cap_chan_unlock(chan);
1385         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1386         l2cap_chan_lock(chan);
1387
1388         if (!skb)
1389                 return ERR_PTR(err);
1390
1391         skb->priority = sk->sk_priority;
1392
1393         bt_cb(skb)->l2cap.chan = chan;
1394
1395         return skb;
1396 }
1397
1398 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1399 {
1400         struct sock *sk = chan->data;
1401         struct sock *parent;
1402
1403         lock_sock(sk);
1404
1405         parent = bt_sk(sk)->parent;
1406
1407         BT_DBG("sk %p, parent %p", sk, parent);
1408
1409         sk->sk_state = BT_CONNECTED;
1410         sk->sk_state_change(sk);
1411
1412         if (parent)
1413                 parent->sk_data_ready(parent);
1414
1415         release_sock(sk);
1416 }
1417
1418 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1419 {
1420         struct sock *parent, *sk = chan->data;
1421
1422         lock_sock(sk);
1423
1424         parent = bt_sk(sk)->parent;
1425         if (parent)
1426                 parent->sk_data_ready(parent);
1427
1428         release_sock(sk);
1429 }
1430
1431 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1432 {
1433         struct sock *sk = chan->data;
1434
1435         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1436                 sk->sk_state = BT_CONNECTED;
1437                 chan->state = BT_CONNECTED;
1438         }
1439
1440         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1441         sk->sk_state_change(sk);
1442 }
1443
1444 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1445 {
1446         struct sock *sk = chan->data;
1447
1448         lock_sock(sk);
1449         sk->sk_shutdown = SHUTDOWN_MASK;
1450         release_sock(sk);
1451 }
1452
1453 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1454 {
1455         struct sock *sk = chan->data;
1456
1457         return sk->sk_sndtimeo;
1458 }
1459
1460 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1461 {
1462         struct sock *sk = chan->data;
1463
1464         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1465         sk->sk_state_change(sk);
1466 }
1467
1468 static const struct l2cap_ops l2cap_chan_ops = {
1469         .name                   = "L2CAP Socket Interface",
1470         .new_connection         = l2cap_sock_new_connection_cb,
1471         .recv                   = l2cap_sock_recv_cb,
1472         .close                  = l2cap_sock_close_cb,
1473         .teardown               = l2cap_sock_teardown_cb,
1474         .state_change           = l2cap_sock_state_change_cb,
1475         .ready                  = l2cap_sock_ready_cb,
1476         .defer                  = l2cap_sock_defer_cb,
1477         .resume                 = l2cap_sock_resume_cb,
1478         .suspend                = l2cap_sock_suspend_cb,
1479         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1480         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1481         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1482 };
1483
1484 static void l2cap_sock_destruct(struct sock *sk)
1485 {
1486         BT_DBG("sk %p", sk);
1487
1488         if (l2cap_pi(sk)->chan)
1489                 l2cap_chan_put(l2cap_pi(sk)->chan);
1490
1491         if (l2cap_pi(sk)->rx_busy_skb) {
1492                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1493                 l2cap_pi(sk)->rx_busy_skb = NULL;
1494         }
1495
1496         skb_queue_purge(&sk->sk_receive_queue);
1497         skb_queue_purge(&sk->sk_write_queue);
1498 }
1499
1500 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1501                                int *msg_namelen)
1502 {
1503         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1504
1505         memset(la, 0, sizeof(struct sockaddr_l2));
1506         la->l2_family = AF_BLUETOOTH;
1507         la->l2_psm = bt_cb(skb)->l2cap.psm;
1508         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1509
1510         *msg_namelen = sizeof(struct sockaddr_l2);
1511 }
1512
1513 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1514 {
1515         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1516
1517         BT_DBG("sk %p", sk);
1518
1519         if (parent) {
1520                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1521
1522                 sk->sk_type = parent->sk_type;
1523                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1524
1525                 chan->chan_type = pchan->chan_type;
1526                 chan->imtu = pchan->imtu;
1527                 chan->omtu = pchan->omtu;
1528                 chan->conf_state = pchan->conf_state;
1529                 chan->mode = pchan->mode;
1530                 chan->fcs  = pchan->fcs;
1531                 chan->max_tx = pchan->max_tx;
1532                 chan->tx_win = pchan->tx_win;
1533                 chan->tx_win_max = pchan->tx_win_max;
1534                 chan->sec_level = pchan->sec_level;
1535                 chan->flags = pchan->flags;
1536                 chan->tx_credits = pchan->tx_credits;
1537                 chan->rx_credits = pchan->rx_credits;
1538
1539                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1540                         chan->scid = pchan->scid;
1541                         chan->dcid = pchan->scid;
1542                 }
1543
1544                 security_sk_clone(parent, sk);
1545         } else {
1546                 switch (sk->sk_type) {
1547                 case SOCK_RAW:
1548                         chan->chan_type = L2CAP_CHAN_RAW;
1549                         break;
1550                 case SOCK_DGRAM:
1551                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1552                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1553                         break;
1554                 case SOCK_SEQPACKET:
1555                 case SOCK_STREAM:
1556                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1557                         break;
1558                 }
1559
1560                 chan->imtu = L2CAP_DEFAULT_MTU;
1561                 chan->omtu = 0;
1562                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1563                         chan->mode = L2CAP_MODE_ERTM;
1564                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1565                 } else {
1566                         chan->mode = L2CAP_MODE_BASIC;
1567                 }
1568
1569                 l2cap_chan_set_defaults(chan);
1570         }
1571
1572         /* Default config options */
1573         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1574
1575         chan->data = sk;
1576         chan->ops = &l2cap_chan_ops;
1577 }
1578
1579 static struct proto l2cap_proto = {
1580         .name           = "L2CAP",
1581         .owner          = THIS_MODULE,
1582         .obj_size       = sizeof(struct l2cap_pinfo)
1583 };
1584
1585 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1586                                      int proto, gfp_t prio, int kern)
1587 {
1588         struct sock *sk;
1589         struct l2cap_chan *chan;
1590
1591         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1592         if (!sk)
1593                 return NULL;
1594
1595         sock_init_data(sock, sk);
1596         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1597
1598         sk->sk_destruct = l2cap_sock_destruct;
1599         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1600
1601         sock_reset_flag(sk, SOCK_ZAPPED);
1602
1603         sk->sk_protocol = proto;
1604         sk->sk_state = BT_OPEN;
1605
1606         chan = l2cap_chan_create();
1607         if (!chan) {
1608                 sk_free(sk);
1609                 return NULL;
1610         }
1611
1612         l2cap_chan_hold(chan);
1613
1614         l2cap_pi(sk)->chan = chan;
1615
1616         return sk;
1617 }
1618
1619 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1620                              int kern)
1621 {
1622         struct sock *sk;
1623
1624         BT_DBG("sock %p", sock);
1625
1626         sock->state = SS_UNCONNECTED;
1627
1628         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1629             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1630                 return -ESOCKTNOSUPPORT;
1631
1632         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1633                 return -EPERM;
1634
1635         sock->ops = &l2cap_sock_ops;
1636
1637         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1638         if (!sk)
1639                 return -ENOMEM;
1640
1641         l2cap_sock_init(sk, NULL);
1642         bt_sock_link(&l2cap_sk_list, sk);
1643         return 0;
1644 }
1645
1646 static const struct proto_ops l2cap_sock_ops = {
1647         .family         = PF_BLUETOOTH,
1648         .owner          = THIS_MODULE,
1649         .release        = l2cap_sock_release,
1650         .bind           = l2cap_sock_bind,
1651         .connect        = l2cap_sock_connect,
1652         .listen         = l2cap_sock_listen,
1653         .accept         = l2cap_sock_accept,
1654         .getname        = l2cap_sock_getname,
1655         .sendmsg        = l2cap_sock_sendmsg,
1656         .recvmsg        = l2cap_sock_recvmsg,
1657         .poll           = bt_sock_poll,
1658         .ioctl          = bt_sock_ioctl,
1659         .mmap           = sock_no_mmap,
1660         .socketpair     = sock_no_socketpair,
1661         .shutdown       = l2cap_sock_shutdown,
1662         .setsockopt     = l2cap_sock_setsockopt,
1663         .getsockopt     = l2cap_sock_getsockopt
1664 };
1665
1666 static const struct net_proto_family l2cap_sock_family_ops = {
1667         .family = PF_BLUETOOTH,
1668         .owner  = THIS_MODULE,
1669         .create = l2cap_sock_create,
1670 };
1671
1672 int __init l2cap_init_sockets(void)
1673 {
1674         int err;
1675
1676         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1677
1678         err = proto_register(&l2cap_proto, 0);
1679         if (err < 0)
1680                 return err;
1681
1682         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1683         if (err < 0) {
1684                 BT_ERR("L2CAP socket registration failed");
1685                 goto error;
1686         }
1687
1688         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1689                              NULL);
1690         if (err < 0) {
1691                 BT_ERR("Failed to create L2CAP proc file");
1692                 bt_sock_unregister(BTPROTO_L2CAP);
1693                 goto error;
1694         }
1695
1696         BT_INFO("L2CAP socket layer initialized");
1697
1698         return 0;
1699
1700 error:
1701         proto_unregister(&l2cap_proto);
1702         return err;
1703 }
1704
1705 void l2cap_cleanup_sockets(void)
1706 {
1707         bt_procfs_cleanup(&init_net, "l2cap");
1708         bt_sock_unregister(BTPROTO_L2CAP);
1709         proto_unregister(&l2cap_proto);
1710 }