]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/l2cap_sock.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux...
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / l2cap_sock.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
13
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
26 */
27
28 /* Bluetooth L2CAP sockets. */
29
30 #include <linux/module.h>
31 #include <linux/export.h>
32
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
36
37 #include "smp.h"
38
39 static struct bt_sock_list l2cap_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
41 };
42
43 static const struct proto_ops l2cap_sock_ops;
44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
46 int proto, gfp_t prio);
47
48 bool l2cap_is_socket(struct socket *sock)
49 {
50 return sock && sock->ops == &l2cap_sock_ops;
51 }
52 EXPORT_SYMBOL(l2cap_is_socket);
53
54 static int l2cap_validate_bredr_psm(u16 psm)
55 {
56 /* PSM must be odd and lsb of upper byte must be 0 */
57 if ((psm & 0x0101) != 0x0001)
58 return -EINVAL;
59
60 /* Restrict usage of well-known PSMs */
61 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
62 return -EACCES;
63
64 return 0;
65 }
66
67 static int l2cap_validate_le_psm(u16 psm)
68 {
69 /* Valid LE_PSM ranges are defined only until 0x00ff */
70 if (psm > 0x00ff)
71 return -EINVAL;
72
73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74 if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
75 return -EACCES;
76
77 return 0;
78 }
79
80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
81 {
82 struct sock *sk = sock->sk;
83 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
84 struct sockaddr_l2 la;
85 int len, err = 0;
86
87 BT_DBG("sk %p", sk);
88
89 if (!addr || addr->sa_family != AF_BLUETOOTH)
90 return -EINVAL;
91
92 memset(&la, 0, sizeof(la));
93 len = min_t(unsigned int, sizeof(la), alen);
94 memcpy(&la, addr, len);
95
96 if (la.l2_cid && la.l2_psm)
97 return -EINVAL;
98
99 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
100 return -EINVAL;
101
102 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
103 /* We only allow ATT user space socket */
104 if (la.l2_cid &&
105 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
106 return -EINVAL;
107 }
108
109 lock_sock(sk);
110
111 if (sk->sk_state != BT_OPEN) {
112 err = -EBADFD;
113 goto done;
114 }
115
116 if (la.l2_psm) {
117 __u16 psm = __le16_to_cpu(la.l2_psm);
118
119 if (la.l2_bdaddr_type == BDADDR_BREDR)
120 err = l2cap_validate_bredr_psm(psm);
121 else
122 err = l2cap_validate_le_psm(psm);
123
124 if (err)
125 goto done;
126 }
127
128 if (la.l2_cid)
129 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
130 else
131 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
132
133 if (err < 0)
134 goto done;
135
136 switch (chan->chan_type) {
137 case L2CAP_CHAN_CONN_LESS:
138 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
139 chan->sec_level = BT_SECURITY_SDP;
140 break;
141 case L2CAP_CHAN_CONN_ORIENTED:
142 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
143 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
144 chan->sec_level = BT_SECURITY_SDP;
145 break;
146 case L2CAP_CHAN_RAW:
147 chan->sec_level = BT_SECURITY_SDP;
148 break;
149 case L2CAP_CHAN_FIXED:
150 /* Fixed channels default to the L2CAP core not holding a
151 * hci_conn reference for them. For fixed channels mapping to
152 * L2CAP sockets we do want to hold a reference so set the
153 * appropriate flag to request it.
154 */
155 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
156 break;
157 }
158
159 bacpy(&chan->src, &la.l2_bdaddr);
160 chan->src_type = la.l2_bdaddr_type;
161
162 if (chan->psm && bdaddr_type_is_le(chan->src_type))
163 chan->mode = L2CAP_MODE_LE_FLOWCTL;
164
165 chan->state = BT_BOUND;
166 sk->sk_state = BT_BOUND;
167
168 done:
169 release_sock(sk);
170 return err;
171 }
172
173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
174 int alen, int flags)
175 {
176 struct sock *sk = sock->sk;
177 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
178 struct sockaddr_l2 la;
179 int len, err = 0;
180
181 BT_DBG("sk %p", sk);
182
183 if (!addr || alen < sizeof(addr->sa_family) ||
184 addr->sa_family != AF_BLUETOOTH)
185 return -EINVAL;
186
187 memset(&la, 0, sizeof(la));
188 len = min_t(unsigned int, sizeof(la), alen);
189 memcpy(&la, addr, len);
190
191 if (la.l2_cid && la.l2_psm)
192 return -EINVAL;
193
194 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
195 return -EINVAL;
196
197 /* Check that the socket wasn't bound to something that
198 * conflicts with the address given to connect(). If chan->src
199 * is BDADDR_ANY it means bind() was never used, in which case
200 * chan->src_type and la.l2_bdaddr_type do not need to match.
201 */
202 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
203 bdaddr_type_is_le(la.l2_bdaddr_type)) {
204 /* Old user space versions will try to incorrectly bind
205 * the ATT socket using BDADDR_BREDR. We need to accept
206 * this and fix up the source address type only when
207 * both the source CID and destination CID indicate
208 * ATT. Anything else is an invalid combination.
209 */
210 if (chan->scid != L2CAP_CID_ATT ||
211 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
212 return -EINVAL;
213
214 /* We don't have the hdev available here to make a
215 * better decision on random vs public, but since all
216 * user space versions that exhibit this issue anyway do
217 * not support random local addresses assuming public
218 * here is good enough.
219 */
220 chan->src_type = BDADDR_LE_PUBLIC;
221 }
222
223 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
224 return -EINVAL;
225
226 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
227 /* We only allow ATT user space socket */
228 if (la.l2_cid &&
229 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
230 return -EINVAL;
231 }
232
233 if (chan->psm && bdaddr_type_is_le(chan->src_type))
234 chan->mode = L2CAP_MODE_LE_FLOWCTL;
235
236 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
237 &la.l2_bdaddr, la.l2_bdaddr_type);
238 if (err)
239 return err;
240
241 lock_sock(sk);
242
243 err = bt_sock_wait_state(sk, BT_CONNECTED,
244 sock_sndtimeo(sk, flags & O_NONBLOCK));
245
246 release_sock(sk);
247
248 return err;
249 }
250
251 static int l2cap_sock_listen(struct socket *sock, int backlog)
252 {
253 struct sock *sk = sock->sk;
254 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
255 int err = 0;
256
257 BT_DBG("sk %p backlog %d", sk, backlog);
258
259 lock_sock(sk);
260
261 if (sk->sk_state != BT_BOUND) {
262 err = -EBADFD;
263 goto done;
264 }
265
266 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
267 err = -EINVAL;
268 goto done;
269 }
270
271 switch (chan->mode) {
272 case L2CAP_MODE_BASIC:
273 case L2CAP_MODE_LE_FLOWCTL:
274 break;
275 case L2CAP_MODE_ERTM:
276 case L2CAP_MODE_STREAMING:
277 if (!disable_ertm)
278 break;
279 /* fall through */
280 default:
281 err = -EOPNOTSUPP;
282 goto done;
283 }
284
285 sk->sk_max_ack_backlog = backlog;
286 sk->sk_ack_backlog = 0;
287
288 chan->state = BT_LISTEN;
289 sk->sk_state = BT_LISTEN;
290
291 done:
292 release_sock(sk);
293 return err;
294 }
295
296 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
297 int flags)
298 {
299 DECLARE_WAITQUEUE(wait, current);
300 struct sock *sk = sock->sk, *nsk;
301 long timeo;
302 int err = 0;
303
304 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
305
306 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
307
308 BT_DBG("sk %p timeo %ld", sk, timeo);
309
310 /* Wait for an incoming connection. (wake-one). */
311 add_wait_queue_exclusive(sk_sleep(sk), &wait);
312 while (1) {
313 set_current_state(TASK_INTERRUPTIBLE);
314
315 if (sk->sk_state != BT_LISTEN) {
316 err = -EBADFD;
317 break;
318 }
319
320 nsk = bt_accept_dequeue(sk, newsock);
321 if (nsk)
322 break;
323
324 if (!timeo) {
325 err = -EAGAIN;
326 break;
327 }
328
329 if (signal_pending(current)) {
330 err = sock_intr_errno(timeo);
331 break;
332 }
333
334 release_sock(sk);
335 timeo = schedule_timeout(timeo);
336 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
337 }
338 __set_current_state(TASK_RUNNING);
339 remove_wait_queue(sk_sleep(sk), &wait);
340
341 if (err)
342 goto done;
343
344 newsock->state = SS_CONNECTED;
345
346 BT_DBG("new socket %p", nsk);
347
348 done:
349 release_sock(sk);
350 return err;
351 }
352
353 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
354 int *len, int peer)
355 {
356 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
357 struct sock *sk = sock->sk;
358 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
359
360 BT_DBG("sock %p, sk %p", sock, sk);
361
362 if (peer && sk->sk_state != BT_CONNECTED &&
363 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
364 sk->sk_state != BT_CONFIG)
365 return -ENOTCONN;
366
367 memset(la, 0, sizeof(struct sockaddr_l2));
368 addr->sa_family = AF_BLUETOOTH;
369 *len = sizeof(struct sockaddr_l2);
370
371 la->l2_psm = chan->psm;
372
373 if (peer) {
374 bacpy(&la->l2_bdaddr, &chan->dst);
375 la->l2_cid = cpu_to_le16(chan->dcid);
376 la->l2_bdaddr_type = chan->dst_type;
377 } else {
378 bacpy(&la->l2_bdaddr, &chan->src);
379 la->l2_cid = cpu_to_le16(chan->scid);
380 la->l2_bdaddr_type = chan->src_type;
381 }
382
383 return 0;
384 }
385
386 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
387 char __user *optval, int __user *optlen)
388 {
389 struct sock *sk = sock->sk;
390 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
391 struct l2cap_options opts;
392 struct l2cap_conninfo cinfo;
393 int len, err = 0;
394 u32 opt;
395
396 BT_DBG("sk %p", sk);
397
398 if (get_user(len, optlen))
399 return -EFAULT;
400
401 lock_sock(sk);
402
403 switch (optname) {
404 case L2CAP_OPTIONS:
405 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
406 * legacy ATT code depends on getsockopt for
407 * L2CAP_OPTIONS we need to let this pass.
408 */
409 if (bdaddr_type_is_le(chan->src_type) &&
410 chan->scid != L2CAP_CID_ATT) {
411 err = -EINVAL;
412 break;
413 }
414
415 memset(&opts, 0, sizeof(opts));
416 opts.imtu = chan->imtu;
417 opts.omtu = chan->omtu;
418 opts.flush_to = chan->flush_to;
419 opts.mode = chan->mode;
420 opts.fcs = chan->fcs;
421 opts.max_tx = chan->max_tx;
422 opts.txwin_size = chan->tx_win;
423
424 len = min_t(unsigned int, len, sizeof(opts));
425 if (copy_to_user(optval, (char *) &opts, len))
426 err = -EFAULT;
427
428 break;
429
430 case L2CAP_LM:
431 switch (chan->sec_level) {
432 case BT_SECURITY_LOW:
433 opt = L2CAP_LM_AUTH;
434 break;
435 case BT_SECURITY_MEDIUM:
436 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
437 break;
438 case BT_SECURITY_HIGH:
439 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
440 L2CAP_LM_SECURE;
441 break;
442 case BT_SECURITY_FIPS:
443 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
444 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
445 break;
446 default:
447 opt = 0;
448 break;
449 }
450
451 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
452 opt |= L2CAP_LM_MASTER;
453
454 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
455 opt |= L2CAP_LM_RELIABLE;
456
457 if (put_user(opt, (u32 __user *) optval))
458 err = -EFAULT;
459
460 break;
461
462 case L2CAP_CONNINFO:
463 if (sk->sk_state != BT_CONNECTED &&
464 !(sk->sk_state == BT_CONNECT2 &&
465 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
466 err = -ENOTCONN;
467 break;
468 }
469
470 memset(&cinfo, 0, sizeof(cinfo));
471 cinfo.hci_handle = chan->conn->hcon->handle;
472 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
473
474 len = min_t(unsigned int, len, sizeof(cinfo));
475 if (copy_to_user(optval, (char *) &cinfo, len))
476 err = -EFAULT;
477
478 break;
479
480 default:
481 err = -ENOPROTOOPT;
482 break;
483 }
484
485 release_sock(sk);
486 return err;
487 }
488
489 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
490 char __user *optval, int __user *optlen)
491 {
492 struct sock *sk = sock->sk;
493 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
494 struct bt_security sec;
495 struct bt_power pwr;
496 int len, err = 0;
497
498 BT_DBG("sk %p", sk);
499
500 if (level == SOL_L2CAP)
501 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
502
503 if (level != SOL_BLUETOOTH)
504 return -ENOPROTOOPT;
505
506 if (get_user(len, optlen))
507 return -EFAULT;
508
509 lock_sock(sk);
510
511 switch (optname) {
512 case BT_SECURITY:
513 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
514 chan->chan_type != L2CAP_CHAN_FIXED &&
515 chan->chan_type != L2CAP_CHAN_RAW) {
516 err = -EINVAL;
517 break;
518 }
519
520 memset(&sec, 0, sizeof(sec));
521 if (chan->conn) {
522 sec.level = chan->conn->hcon->sec_level;
523
524 if (sk->sk_state == BT_CONNECTED)
525 sec.key_size = chan->conn->hcon->enc_key_size;
526 } else {
527 sec.level = chan->sec_level;
528 }
529
530 len = min_t(unsigned int, len, sizeof(sec));
531 if (copy_to_user(optval, (char *) &sec, len))
532 err = -EFAULT;
533
534 break;
535
536 case BT_DEFER_SETUP:
537 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
538 err = -EINVAL;
539 break;
540 }
541
542 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
543 (u32 __user *) optval))
544 err = -EFAULT;
545
546 break;
547
548 case BT_FLUSHABLE:
549 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
550 (u32 __user *) optval))
551 err = -EFAULT;
552
553 break;
554
555 case BT_POWER:
556 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
557 && sk->sk_type != SOCK_RAW) {
558 err = -EINVAL;
559 break;
560 }
561
562 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
563
564 len = min_t(unsigned int, len, sizeof(pwr));
565 if (copy_to_user(optval, (char *) &pwr, len))
566 err = -EFAULT;
567
568 break;
569
570 case BT_CHANNEL_POLICY:
571 if (put_user(chan->chan_policy, (u32 __user *) optval))
572 err = -EFAULT;
573 break;
574
575 case BT_SNDMTU:
576 if (!bdaddr_type_is_le(chan->src_type)) {
577 err = -EINVAL;
578 break;
579 }
580
581 if (sk->sk_state != BT_CONNECTED) {
582 err = -ENOTCONN;
583 break;
584 }
585
586 if (put_user(chan->omtu, (u16 __user *) optval))
587 err = -EFAULT;
588 break;
589
590 case BT_RCVMTU:
591 if (!bdaddr_type_is_le(chan->src_type)) {
592 err = -EINVAL;
593 break;
594 }
595
596 if (put_user(chan->imtu, (u16 __user *) optval))
597 err = -EFAULT;
598 break;
599
600 default:
601 err = -ENOPROTOOPT;
602 break;
603 }
604
605 release_sock(sk);
606 return err;
607 }
608
609 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
610 {
611 switch (chan->scid) {
612 case L2CAP_CID_ATT:
613 if (mtu < L2CAP_LE_MIN_MTU)
614 return false;
615 break;
616
617 default:
618 if (mtu < L2CAP_DEFAULT_MIN_MTU)
619 return false;
620 }
621
622 return true;
623 }
624
625 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
626 char __user *optval, unsigned int optlen)
627 {
628 struct sock *sk = sock->sk;
629 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
630 struct l2cap_options opts;
631 int len, err = 0;
632 u32 opt;
633
634 BT_DBG("sk %p", sk);
635
636 lock_sock(sk);
637
638 switch (optname) {
639 case L2CAP_OPTIONS:
640 if (bdaddr_type_is_le(chan->src_type)) {
641 err = -EINVAL;
642 break;
643 }
644
645 if (sk->sk_state == BT_CONNECTED) {
646 err = -EINVAL;
647 break;
648 }
649
650 opts.imtu = chan->imtu;
651 opts.omtu = chan->omtu;
652 opts.flush_to = chan->flush_to;
653 opts.mode = chan->mode;
654 opts.fcs = chan->fcs;
655 opts.max_tx = chan->max_tx;
656 opts.txwin_size = chan->tx_win;
657
658 len = min_t(unsigned int, sizeof(opts), optlen);
659 if (copy_from_user((char *) &opts, optval, len)) {
660 err = -EFAULT;
661 break;
662 }
663
664 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
665 err = -EINVAL;
666 break;
667 }
668
669 if (!l2cap_valid_mtu(chan, opts.imtu)) {
670 err = -EINVAL;
671 break;
672 }
673
674 chan->mode = opts.mode;
675 switch (chan->mode) {
676 case L2CAP_MODE_LE_FLOWCTL:
677 break;
678 case L2CAP_MODE_BASIC:
679 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
680 break;
681 case L2CAP_MODE_ERTM:
682 case L2CAP_MODE_STREAMING:
683 if (!disable_ertm)
684 break;
685 /* fall through */
686 default:
687 err = -EINVAL;
688 break;
689 }
690
691 chan->imtu = opts.imtu;
692 chan->omtu = opts.omtu;
693 chan->fcs = opts.fcs;
694 chan->max_tx = opts.max_tx;
695 chan->tx_win = opts.txwin_size;
696 chan->flush_to = opts.flush_to;
697 break;
698
699 case L2CAP_LM:
700 if (get_user(opt, (u32 __user *) optval)) {
701 err = -EFAULT;
702 break;
703 }
704
705 if (opt & L2CAP_LM_FIPS) {
706 err = -EINVAL;
707 break;
708 }
709
710 if (opt & L2CAP_LM_AUTH)
711 chan->sec_level = BT_SECURITY_LOW;
712 if (opt & L2CAP_LM_ENCRYPT)
713 chan->sec_level = BT_SECURITY_MEDIUM;
714 if (opt & L2CAP_LM_SECURE)
715 chan->sec_level = BT_SECURITY_HIGH;
716
717 if (opt & L2CAP_LM_MASTER)
718 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
719 else
720 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
721
722 if (opt & L2CAP_LM_RELIABLE)
723 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
724 else
725 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
726 break;
727
728 default:
729 err = -ENOPROTOOPT;
730 break;
731 }
732
733 release_sock(sk);
734 return err;
735 }
736
737 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
738 char __user *optval, unsigned int optlen)
739 {
740 struct sock *sk = sock->sk;
741 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
742 struct bt_security sec;
743 struct bt_power pwr;
744 struct l2cap_conn *conn;
745 int len, err = 0;
746 u32 opt;
747
748 BT_DBG("sk %p", sk);
749
750 if (level == SOL_L2CAP)
751 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
752
753 if (level != SOL_BLUETOOTH)
754 return -ENOPROTOOPT;
755
756 lock_sock(sk);
757
758 switch (optname) {
759 case BT_SECURITY:
760 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
761 chan->chan_type != L2CAP_CHAN_FIXED &&
762 chan->chan_type != L2CAP_CHAN_RAW) {
763 err = -EINVAL;
764 break;
765 }
766
767 sec.level = BT_SECURITY_LOW;
768
769 len = min_t(unsigned int, sizeof(sec), optlen);
770 if (copy_from_user((char *) &sec, optval, len)) {
771 err = -EFAULT;
772 break;
773 }
774
775 if (sec.level < BT_SECURITY_LOW ||
776 sec.level > BT_SECURITY_HIGH) {
777 err = -EINVAL;
778 break;
779 }
780
781 chan->sec_level = sec.level;
782
783 if (!chan->conn)
784 break;
785
786 conn = chan->conn;
787
788 /*change security for LE channels */
789 if (chan->scid == L2CAP_CID_ATT) {
790 if (smp_conn_security(conn->hcon, sec.level))
791 break;
792 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
793 sk->sk_state = BT_CONFIG;
794 chan->state = BT_CONFIG;
795
796 /* or for ACL link */
797 } else if ((sk->sk_state == BT_CONNECT2 &&
798 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
799 sk->sk_state == BT_CONNECTED) {
800 if (!l2cap_chan_check_security(chan, true))
801 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
802 else
803 sk->sk_state_change(sk);
804 } else {
805 err = -EINVAL;
806 }
807 break;
808
809 case BT_DEFER_SETUP:
810 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
811 err = -EINVAL;
812 break;
813 }
814
815 if (get_user(opt, (u32 __user *) optval)) {
816 err = -EFAULT;
817 break;
818 }
819
820 if (opt) {
821 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
822 set_bit(FLAG_DEFER_SETUP, &chan->flags);
823 } else {
824 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
825 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
826 }
827 break;
828
829 case BT_FLUSHABLE:
830 if (get_user(opt, (u32 __user *) optval)) {
831 err = -EFAULT;
832 break;
833 }
834
835 if (opt > BT_FLUSHABLE_ON) {
836 err = -EINVAL;
837 break;
838 }
839
840 if (opt == BT_FLUSHABLE_OFF) {
841 conn = chan->conn;
842 /* proceed further only when we have l2cap_conn and
843 No Flush support in the LM */
844 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
845 err = -EINVAL;
846 break;
847 }
848 }
849
850 if (opt)
851 set_bit(FLAG_FLUSHABLE, &chan->flags);
852 else
853 clear_bit(FLAG_FLUSHABLE, &chan->flags);
854 break;
855
856 case BT_POWER:
857 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
858 chan->chan_type != L2CAP_CHAN_RAW) {
859 err = -EINVAL;
860 break;
861 }
862
863 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
864
865 len = min_t(unsigned int, sizeof(pwr), optlen);
866 if (copy_from_user((char *) &pwr, optval, len)) {
867 err = -EFAULT;
868 break;
869 }
870
871 if (pwr.force_active)
872 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
873 else
874 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
875 break;
876
877 case BT_CHANNEL_POLICY:
878 if (get_user(opt, (u32 __user *) optval)) {
879 err = -EFAULT;
880 break;
881 }
882
883 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
884 err = -EINVAL;
885 break;
886 }
887
888 if (chan->mode != L2CAP_MODE_ERTM &&
889 chan->mode != L2CAP_MODE_STREAMING) {
890 err = -EOPNOTSUPP;
891 break;
892 }
893
894 chan->chan_policy = (u8) opt;
895
896 if (sk->sk_state == BT_CONNECTED &&
897 chan->move_role == L2CAP_MOVE_ROLE_NONE)
898 l2cap_move_start(chan);
899
900 break;
901
902 case BT_SNDMTU:
903 if (!bdaddr_type_is_le(chan->src_type)) {
904 err = -EINVAL;
905 break;
906 }
907
908 /* Setting is not supported as it's the remote side that
909 * decides this.
910 */
911 err = -EPERM;
912 break;
913
914 case BT_RCVMTU:
915 if (!bdaddr_type_is_le(chan->src_type)) {
916 err = -EINVAL;
917 break;
918 }
919
920 if (sk->sk_state == BT_CONNECTED) {
921 err = -EISCONN;
922 break;
923 }
924
925 if (get_user(opt, (u32 __user *) optval)) {
926 err = -EFAULT;
927 break;
928 }
929
930 chan->imtu = opt;
931 break;
932
933 default:
934 err = -ENOPROTOOPT;
935 break;
936 }
937
938 release_sock(sk);
939 return err;
940 }
941
942 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
943 struct msghdr *msg, size_t len)
944 {
945 struct sock *sk = sock->sk;
946 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
947 int err;
948
949 BT_DBG("sock %p, sk %p", sock, sk);
950
951 err = sock_error(sk);
952 if (err)
953 return err;
954
955 if (msg->msg_flags & MSG_OOB)
956 return -EOPNOTSUPP;
957
958 if (sk->sk_state != BT_CONNECTED)
959 return -ENOTCONN;
960
961 lock_sock(sk);
962 err = bt_sock_wait_ready(sk, msg->msg_flags);
963 release_sock(sk);
964 if (err)
965 return err;
966
967 l2cap_chan_lock(chan);
968 err = l2cap_chan_send(chan, msg, len);
969 l2cap_chan_unlock(chan);
970
971 return err;
972 }
973
974 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
975 struct msghdr *msg, size_t len, int flags)
976 {
977 struct sock *sk = sock->sk;
978 struct l2cap_pinfo *pi = l2cap_pi(sk);
979 int err;
980
981 lock_sock(sk);
982
983 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
984 &bt_sk(sk)->flags)) {
985 if (bdaddr_type_is_le(pi->chan->src_type)) {
986 sk->sk_state = BT_CONNECTED;
987 pi->chan->state = BT_CONNECTED;
988 __l2cap_le_connect_rsp_defer(pi->chan);
989 } else {
990 sk->sk_state = BT_CONFIG;
991 pi->chan->state = BT_CONFIG;
992 __l2cap_connect_rsp_defer(pi->chan);
993 }
994
995 err = 0;
996 goto done;
997 }
998
999 release_sock(sk);
1000
1001 if (sock->type == SOCK_STREAM)
1002 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1003 else
1004 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
1005
1006 if (pi->chan->mode != L2CAP_MODE_ERTM)
1007 return err;
1008
1009 /* Attempt to put pending rx data in the socket buffer */
1010
1011 lock_sock(sk);
1012
1013 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1014 goto done;
1015
1016 if (pi->rx_busy_skb) {
1017 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1018 pi->rx_busy_skb = NULL;
1019 else
1020 goto done;
1021 }
1022
1023 /* Restore data flow when half of the receive buffer is
1024 * available. This avoids resending large numbers of
1025 * frames.
1026 */
1027 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1028 l2cap_chan_busy(pi->chan, 0);
1029
1030 done:
1031 release_sock(sk);
1032 return err;
1033 }
1034
1035 /* Kill socket (only if zapped and orphan)
1036 * Must be called on unlocked socket.
1037 */
1038 static void l2cap_sock_kill(struct sock *sk)
1039 {
1040 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1041 return;
1042
1043 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1044
1045 /* Kill poor orphan */
1046
1047 l2cap_chan_put(l2cap_pi(sk)->chan);
1048 sock_set_flag(sk, SOCK_DEAD);
1049 sock_put(sk);
1050 }
1051
1052 static int __l2cap_wait_ack(struct sock *sk)
1053 {
1054 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1055 DECLARE_WAITQUEUE(wait, current);
1056 int err = 0;
1057 int timeo = HZ/5;
1058
1059 add_wait_queue(sk_sleep(sk), &wait);
1060 set_current_state(TASK_INTERRUPTIBLE);
1061 while (chan->unacked_frames > 0 && chan->conn) {
1062 if (!timeo)
1063 timeo = HZ/5;
1064
1065 if (signal_pending(current)) {
1066 err = sock_intr_errno(timeo);
1067 break;
1068 }
1069
1070 release_sock(sk);
1071 timeo = schedule_timeout(timeo);
1072 lock_sock(sk);
1073 set_current_state(TASK_INTERRUPTIBLE);
1074
1075 err = sock_error(sk);
1076 if (err)
1077 break;
1078 }
1079 set_current_state(TASK_RUNNING);
1080 remove_wait_queue(sk_sleep(sk), &wait);
1081 return err;
1082 }
1083
1084 static int l2cap_sock_shutdown(struct socket *sock, int how)
1085 {
1086 struct sock *sk = sock->sk;
1087 struct l2cap_chan *chan;
1088 struct l2cap_conn *conn;
1089 int err = 0;
1090
1091 BT_DBG("sock %p, sk %p", sock, sk);
1092
1093 if (!sk)
1094 return 0;
1095
1096 chan = l2cap_pi(sk)->chan;
1097 conn = chan->conn;
1098
1099 if (conn)
1100 mutex_lock(&conn->chan_lock);
1101
1102 l2cap_chan_lock(chan);
1103 lock_sock(sk);
1104
1105 if (!sk->sk_shutdown) {
1106 if (chan->mode == L2CAP_MODE_ERTM)
1107 err = __l2cap_wait_ack(sk);
1108
1109 sk->sk_shutdown = SHUTDOWN_MASK;
1110
1111 release_sock(sk);
1112 l2cap_chan_close(chan, 0);
1113 lock_sock(sk);
1114
1115 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1116 !(current->flags & PF_EXITING))
1117 err = bt_sock_wait_state(sk, BT_CLOSED,
1118 sk->sk_lingertime);
1119 }
1120
1121 if (!err && sk->sk_err)
1122 err = -sk->sk_err;
1123
1124 release_sock(sk);
1125 l2cap_chan_unlock(chan);
1126
1127 if (conn)
1128 mutex_unlock(&conn->chan_lock);
1129
1130 return err;
1131 }
1132
1133 static int l2cap_sock_release(struct socket *sock)
1134 {
1135 struct sock *sk = sock->sk;
1136 int err;
1137
1138 BT_DBG("sock %p, sk %p", sock, sk);
1139
1140 if (!sk)
1141 return 0;
1142
1143 bt_sock_unlink(&l2cap_sk_list, sk);
1144
1145 err = l2cap_sock_shutdown(sock, 2);
1146
1147 sock_orphan(sk);
1148 l2cap_sock_kill(sk);
1149 return err;
1150 }
1151
1152 static void l2cap_sock_cleanup_listen(struct sock *parent)
1153 {
1154 struct sock *sk;
1155
1156 BT_DBG("parent %p", parent);
1157
1158 /* Close not yet accepted channels */
1159 while ((sk = bt_accept_dequeue(parent, NULL))) {
1160 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1161
1162 l2cap_chan_lock(chan);
1163 __clear_chan_timer(chan);
1164 l2cap_chan_close(chan, ECONNRESET);
1165 l2cap_chan_unlock(chan);
1166
1167 l2cap_sock_kill(sk);
1168 }
1169 }
1170
1171 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1172 {
1173 struct sock *sk, *parent = chan->data;
1174
1175 lock_sock(parent);
1176
1177 /* Check for backlog size */
1178 if (sk_acceptq_is_full(parent)) {
1179 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1180 release_sock(parent);
1181 return NULL;
1182 }
1183
1184 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1185 GFP_ATOMIC);
1186 if (!sk) {
1187 release_sock(parent);
1188 return NULL;
1189 }
1190
1191 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1192
1193 l2cap_sock_init(sk, parent);
1194
1195 bt_accept_enqueue(parent, sk);
1196
1197 release_sock(parent);
1198
1199 return l2cap_pi(sk)->chan;
1200 }
1201
1202 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1203 {
1204 struct sock *sk = chan->data;
1205 int err;
1206
1207 lock_sock(sk);
1208
1209 if (l2cap_pi(sk)->rx_busy_skb) {
1210 err = -ENOMEM;
1211 goto done;
1212 }
1213
1214 err = sock_queue_rcv_skb(sk, skb);
1215
1216 /* For ERTM, handle one skb that doesn't fit into the recv
1217 * buffer. This is important to do because the data frames
1218 * have already been acked, so the skb cannot be discarded.
1219 *
1220 * Notify the l2cap core that the buffer is full, so the
1221 * LOCAL_BUSY state is entered and no more frames are
1222 * acked and reassembled until there is buffer space
1223 * available.
1224 */
1225 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1226 l2cap_pi(sk)->rx_busy_skb = skb;
1227 l2cap_chan_busy(chan, 1);
1228 err = 0;
1229 }
1230
1231 done:
1232 release_sock(sk);
1233
1234 return err;
1235 }
1236
1237 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1238 {
1239 struct sock *sk = chan->data;
1240
1241 l2cap_sock_kill(sk);
1242 }
1243
1244 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1245 {
1246 struct sock *sk = chan->data;
1247 struct sock *parent;
1248
1249 lock_sock(sk);
1250
1251 parent = bt_sk(sk)->parent;
1252
1253 sock_set_flag(sk, SOCK_ZAPPED);
1254
1255 switch (chan->state) {
1256 case BT_OPEN:
1257 case BT_BOUND:
1258 case BT_CLOSED:
1259 break;
1260 case BT_LISTEN:
1261 l2cap_sock_cleanup_listen(sk);
1262 sk->sk_state = BT_CLOSED;
1263 chan->state = BT_CLOSED;
1264
1265 break;
1266 default:
1267 sk->sk_state = BT_CLOSED;
1268 chan->state = BT_CLOSED;
1269
1270 sk->sk_err = err;
1271
1272 if (parent) {
1273 bt_accept_unlink(sk);
1274 parent->sk_data_ready(parent);
1275 } else {
1276 sk->sk_state_change(sk);
1277 }
1278
1279 break;
1280 }
1281
1282 release_sock(sk);
1283 }
1284
1285 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1286 int err)
1287 {
1288 struct sock *sk = chan->data;
1289
1290 sk->sk_state = state;
1291
1292 if (err)
1293 sk->sk_err = err;
1294 }
1295
1296 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1297 unsigned long hdr_len,
1298 unsigned long len, int nb)
1299 {
1300 struct sock *sk = chan->data;
1301 struct sk_buff *skb;
1302 int err;
1303
1304 l2cap_chan_unlock(chan);
1305 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1306 l2cap_chan_lock(chan);
1307
1308 if (!skb)
1309 return ERR_PTR(err);
1310
1311 skb->priority = sk->sk_priority;
1312
1313 bt_cb(skb)->chan = chan;
1314
1315 return skb;
1316 }
1317
1318 static int l2cap_sock_memcpy_fromiovec_cb(struct l2cap_chan *chan,
1319 unsigned char *kdata,
1320 struct iovec *iov, int len)
1321 {
1322 return memcpy_fromiovec(kdata, iov, len);
1323 }
1324
1325 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1326 {
1327 struct sock *sk = chan->data;
1328 struct sock *parent;
1329
1330 lock_sock(sk);
1331
1332 parent = bt_sk(sk)->parent;
1333
1334 BT_DBG("sk %p, parent %p", sk, parent);
1335
1336 sk->sk_state = BT_CONNECTED;
1337 sk->sk_state_change(sk);
1338
1339 if (parent)
1340 parent->sk_data_ready(parent);
1341
1342 release_sock(sk);
1343 }
1344
1345 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1346 {
1347 struct sock *parent, *sk = chan->data;
1348
1349 lock_sock(sk);
1350
1351 parent = bt_sk(sk)->parent;
1352 if (parent)
1353 parent->sk_data_ready(parent);
1354
1355 release_sock(sk);
1356 }
1357
1358 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1359 {
1360 struct sock *sk = chan->data;
1361
1362 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1363 sk->sk_state = BT_CONNECTED;
1364 chan->state = BT_CONNECTED;
1365 }
1366
1367 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1368 sk->sk_state_change(sk);
1369 }
1370
1371 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1372 {
1373 struct sock *sk = chan->data;
1374
1375 lock_sock(sk);
1376 sk->sk_shutdown = SHUTDOWN_MASK;
1377 release_sock(sk);
1378 }
1379
1380 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1381 {
1382 struct sock *sk = chan->data;
1383
1384 return sk->sk_sndtimeo;
1385 }
1386
1387 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1388 {
1389 struct sock *sk = chan->data;
1390
1391 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1392 sk->sk_state_change(sk);
1393 }
1394
1395 static const struct l2cap_ops l2cap_chan_ops = {
1396 .name = "L2CAP Socket Interface",
1397 .new_connection = l2cap_sock_new_connection_cb,
1398 .recv = l2cap_sock_recv_cb,
1399 .close = l2cap_sock_close_cb,
1400 .teardown = l2cap_sock_teardown_cb,
1401 .state_change = l2cap_sock_state_change_cb,
1402 .ready = l2cap_sock_ready_cb,
1403 .defer = l2cap_sock_defer_cb,
1404 .resume = l2cap_sock_resume_cb,
1405 .suspend = l2cap_sock_suspend_cb,
1406 .set_shutdown = l2cap_sock_set_shutdown_cb,
1407 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1408 .alloc_skb = l2cap_sock_alloc_skb_cb,
1409 .memcpy_fromiovec = l2cap_sock_memcpy_fromiovec_cb,
1410 };
1411
1412 static void l2cap_sock_destruct(struct sock *sk)
1413 {
1414 BT_DBG("sk %p", sk);
1415
1416 if (l2cap_pi(sk)->chan)
1417 l2cap_chan_put(l2cap_pi(sk)->chan);
1418
1419 if (l2cap_pi(sk)->rx_busy_skb) {
1420 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1421 l2cap_pi(sk)->rx_busy_skb = NULL;
1422 }
1423
1424 skb_queue_purge(&sk->sk_receive_queue);
1425 skb_queue_purge(&sk->sk_write_queue);
1426 }
1427
1428 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1429 int *msg_namelen)
1430 {
1431 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1432
1433 memset(la, 0, sizeof(struct sockaddr_l2));
1434 la->l2_family = AF_BLUETOOTH;
1435 la->l2_psm = bt_cb(skb)->psm;
1436 bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1437
1438 *msg_namelen = sizeof(struct sockaddr_l2);
1439 }
1440
1441 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1442 {
1443 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1444
1445 BT_DBG("sk %p", sk);
1446
1447 if (parent) {
1448 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1449
1450 sk->sk_type = parent->sk_type;
1451 bt_sk(sk)->flags = bt_sk(parent)->flags;
1452
1453 chan->chan_type = pchan->chan_type;
1454 chan->imtu = pchan->imtu;
1455 chan->omtu = pchan->omtu;
1456 chan->conf_state = pchan->conf_state;
1457 chan->mode = pchan->mode;
1458 chan->fcs = pchan->fcs;
1459 chan->max_tx = pchan->max_tx;
1460 chan->tx_win = pchan->tx_win;
1461 chan->tx_win_max = pchan->tx_win_max;
1462 chan->sec_level = pchan->sec_level;
1463 chan->flags = pchan->flags;
1464 chan->tx_credits = pchan->tx_credits;
1465 chan->rx_credits = pchan->rx_credits;
1466
1467 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1468 chan->scid = pchan->scid;
1469 chan->dcid = pchan->scid;
1470 }
1471
1472 security_sk_clone(parent, sk);
1473 } else {
1474 switch (sk->sk_type) {
1475 case SOCK_RAW:
1476 chan->chan_type = L2CAP_CHAN_RAW;
1477 break;
1478 case SOCK_DGRAM:
1479 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1480 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1481 break;
1482 case SOCK_SEQPACKET:
1483 case SOCK_STREAM:
1484 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1485 break;
1486 }
1487
1488 chan->imtu = L2CAP_DEFAULT_MTU;
1489 chan->omtu = 0;
1490 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1491 chan->mode = L2CAP_MODE_ERTM;
1492 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1493 } else {
1494 chan->mode = L2CAP_MODE_BASIC;
1495 }
1496
1497 l2cap_chan_set_defaults(chan);
1498 }
1499
1500 /* Default config options */
1501 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1502
1503 chan->data = sk;
1504 chan->ops = &l2cap_chan_ops;
1505 }
1506
1507 static struct proto l2cap_proto = {
1508 .name = "L2CAP",
1509 .owner = THIS_MODULE,
1510 .obj_size = sizeof(struct l2cap_pinfo)
1511 };
1512
1513 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1514 int proto, gfp_t prio)
1515 {
1516 struct sock *sk;
1517 struct l2cap_chan *chan;
1518
1519 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1520 if (!sk)
1521 return NULL;
1522
1523 sock_init_data(sock, sk);
1524 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1525
1526 sk->sk_destruct = l2cap_sock_destruct;
1527 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1528
1529 sock_reset_flag(sk, SOCK_ZAPPED);
1530
1531 sk->sk_protocol = proto;
1532 sk->sk_state = BT_OPEN;
1533
1534 chan = l2cap_chan_create();
1535 if (!chan) {
1536 sk_free(sk);
1537 return NULL;
1538 }
1539
1540 l2cap_chan_hold(chan);
1541
1542 l2cap_pi(sk)->chan = chan;
1543
1544 return sk;
1545 }
1546
1547 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1548 int kern)
1549 {
1550 struct sock *sk;
1551
1552 BT_DBG("sock %p", sock);
1553
1554 sock->state = SS_UNCONNECTED;
1555
1556 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1557 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1558 return -ESOCKTNOSUPPORT;
1559
1560 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1561 return -EPERM;
1562
1563 sock->ops = &l2cap_sock_ops;
1564
1565 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1566 if (!sk)
1567 return -ENOMEM;
1568
1569 l2cap_sock_init(sk, NULL);
1570 bt_sock_link(&l2cap_sk_list, sk);
1571 return 0;
1572 }
1573
1574 static const struct proto_ops l2cap_sock_ops = {
1575 .family = PF_BLUETOOTH,
1576 .owner = THIS_MODULE,
1577 .release = l2cap_sock_release,
1578 .bind = l2cap_sock_bind,
1579 .connect = l2cap_sock_connect,
1580 .listen = l2cap_sock_listen,
1581 .accept = l2cap_sock_accept,
1582 .getname = l2cap_sock_getname,
1583 .sendmsg = l2cap_sock_sendmsg,
1584 .recvmsg = l2cap_sock_recvmsg,
1585 .poll = bt_sock_poll,
1586 .ioctl = bt_sock_ioctl,
1587 .mmap = sock_no_mmap,
1588 .socketpair = sock_no_socketpair,
1589 .shutdown = l2cap_sock_shutdown,
1590 .setsockopt = l2cap_sock_setsockopt,
1591 .getsockopt = l2cap_sock_getsockopt
1592 };
1593
1594 static const struct net_proto_family l2cap_sock_family_ops = {
1595 .family = PF_BLUETOOTH,
1596 .owner = THIS_MODULE,
1597 .create = l2cap_sock_create,
1598 };
1599
1600 int __init l2cap_init_sockets(void)
1601 {
1602 int err;
1603
1604 err = proto_register(&l2cap_proto, 0);
1605 if (err < 0)
1606 return err;
1607
1608 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1609 if (err < 0) {
1610 BT_ERR("L2CAP socket registration failed");
1611 goto error;
1612 }
1613
1614 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1615 NULL);
1616 if (err < 0) {
1617 BT_ERR("Failed to create L2CAP proc file");
1618 bt_sock_unregister(BTPROTO_L2CAP);
1619 goto error;
1620 }
1621
1622 BT_INFO("L2CAP socket layer initialized");
1623
1624 return 0;
1625
1626 error:
1627 proto_unregister(&l2cap_proto);
1628 return err;
1629 }
1630
1631 void l2cap_cleanup_sockets(void)
1632 {
1633 bt_procfs_cleanup(&init_net, "l2cap");
1634 bt_sock_unregister(BTPROTO_L2CAP);
1635 proto_unregister(&l2cap_proto);
1636 }
ubuntu-bionic-kernel mirror