projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix L2CAP socket lock nesting level
[deliverable/linux.git] / net / bluetooth / l2cap_sock.c
CommitLineData
bb58f747
GP		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
bb58f747
GP		 7
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
13
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
26*/
27
28/* Bluetooth L2CAP sockets. */
29
9149761a 30#include <linux/module.h>
bc3b2d7f 31#include <linux/export.h>
6230c9b4 32
bb58f747 33#include <net/bluetooth/bluetooth.h>
33575df7 34#include <net/bluetooth/hci_core.h>
bb58f747 35#include <net/bluetooth/l2cap.h>
ac4b7236
MH		 36
37#include "smp.h"
bb58f747 38
5b28d95c
MY		 39static struct bt_sock_list l2cap_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
41};
42
cf2f90f5 43static const struct proto_ops l2cap_sock_ops;
80808e43 44static void l2cap_sock_init(struct sock *sk, struct sock *parent);
2d792818
GP		 45static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
46 int proto, gfp_t prio);
cf2f90f5 47
b3916db3
DH		 48bool l2cap_is_socket(struct socket *sock)
49{
50 return sock && sock->ops == &l2cap_sock_ops;
51}
52EXPORT_SYMBOL(l2cap_is_socket);
53
4946096d
JH		 54static int l2cap_validate_bredr_psm(u16 psm)
55{
56 /* PSM must be odd and lsb of upper byte must be 0 */
57 if ((psm & 0x0101) != 0x0001)
58 return -EINVAL;
59
60 /* Restrict usage of well-known PSMs */
61 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
62 return -EACCES;
63
64 return 0;
65}
66
67static int l2cap_validate_le_psm(u16 psm)
68{
69 /* Valid LE_PSM ranges are defined only until 0x00ff */
70 if (psm > 0x00ff)
71 return -EINVAL;
72
73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74 if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
75 return -EACCES;
76
77 return 0;
78}
79
af6bcd82
GP		 80static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
81{
82 struct sock *sk = sock->sk;
4343478f 83 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
af6bcd82
GP		 84 struct sockaddr_l2 la;
85 int len, err = 0;
86
87 BT_DBG("sk %p", sk);
88
89 if (!addr || addr->sa_family != AF_BLUETOOTH)
90 return -EINVAL;
91
92 memset(&la, 0, sizeof(la));
93 len = min_t(unsigned int, sizeof(la), alen);
94 memcpy(&la, addr, len);
95
b62f328b 96 if (la.l2_cid && la.l2_psm)
af6bcd82
GP		 97 return -EINVAL;
98
80c1a2e7
JH		 99 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
100 return -EINVAL;
101
bfe4655f 102 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
bfe4655f 103 /* We only allow ATT user space socket */
9149761a 104 if (la.l2_cid &&
dcf4adbf 105 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
bfe4655f
JH		 106 return -EINVAL;
107 }
108
af6bcd82
GP		 109 lock_sock(sk);
110
111 if (sk->sk_state != BT_OPEN) {
112 err = -EBADFD;
113 goto done;
114 }
115
116 if (la.l2_psm) {
117 __u16 psm = __le16_to_cpu(la.l2_psm);
118
4946096d
JH		 119 if (la.l2_bdaddr_type == BDADDR_BREDR)
120 err = l2cap_validate_bredr_psm(psm);
121 else
122 err = l2cap_validate_le_psm(psm);
af6bcd82 123
4946096d 124 if (err)
af6bcd82 125 goto done;
af6bcd82
GP		 126 }
127
9e4425ff 128 if (la.l2_cid)
6e4aff10 129 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
9e4425ff
GP		 130 else
131 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
af6bcd82 132
9e4425ff
GP		 133 if (err < 0)
134 goto done;
af6bcd82 135
6a974b50 136 switch (chan->chan_type) {
3124b843
MH		 137 case L2CAP_CHAN_CONN_LESS:
138 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
139 chan->sec_level = BT_SECURITY_SDP;
140 break;
6a974b50
MH		 141 case L2CAP_CHAN_CONN_ORIENTED:
142 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
143 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
144 chan->sec_level = BT_SECURITY_SDP;
145 break;
cb6ca8e1
JH		 146 case L2CAP_CHAN_RAW:
147 chan->sec_level = BT_SECURITY_SDP;
148 break;
c16900cf
JH		 149 case L2CAP_CHAN_FIXED:
150 /* Fixed channels default to the L2CAP core not holding a
151 * hci_conn reference for them. For fixed channels mapping to
152 * L2CAP sockets we do want to hold a reference so set the
153 * appropriate flag to request it.
154 */
155 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
156 break;
6a974b50 157 }
b62f328b 158
7eafc59e 159 bacpy(&chan->src, &la.l2_bdaddr);
4f1654e0 160 chan->src_type = la.l2_bdaddr_type;
89bc500e 161
38319713 162 if (chan->psm && bdaddr_type_is_le(chan->src_type))
0ce43ce6 163 chan->mode = L2CAP_MODE_LE_FLOWCTL;
38319713 164
89bc500e 165 chan->state = BT_BOUND;
9e4425ff 166 sk->sk_state = BT_BOUND;
af6bcd82
GP		 167
168done:
169 release_sock(sk);
170 return err;
171}
172
2d792818
GP		 173static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
174 int alen, int flags)
4e34c50b
GP		 175{
176 struct sock *sk = sock->sk;
0c1bc5c6 177 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
4e34c50b
GP		 178 struct sockaddr_l2 la;
179 int len, err = 0;
180
181 BT_DBG("sk %p", sk);
182
183 if (!addr || alen < sizeof(addr->sa_family) ||
184 addr->sa_family != AF_BLUETOOTH)
185 return -EINVAL;
186
187 memset(&la, 0, sizeof(la));
188 len = min_t(unsigned int, sizeof(la), alen);
189 memcpy(&la, addr, len);
190
acd7d370 191 if (la.l2_cid && la.l2_psm)
4e34c50b
GP		 192 return -EINVAL;
193
80c1a2e7
JH		 194 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
195 return -EINVAL;
196
eb622495
JH		 197 /* Check that the socket wasn't bound to something that
198 * conflicts with the address given to connect(). If chan->src
199 * is BDADDR_ANY it means bind() was never used, in which case
200 * chan->src_type and la.l2_bdaddr_type do not need to match.
201 */
202 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
203 bdaddr_type_is_le(la.l2_bdaddr_type)) {
204 /* Old user space versions will try to incorrectly bind
205 * the ATT socket using BDADDR_BREDR. We need to accept
206 * this and fix up the source address type only when
207 * both the source CID and destination CID indicate
208 * ATT. Anything else is an invalid combination.
209 */
210 if (chan->scid != L2CAP_CID_ATT ||
dcf4adbf 211 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
eb622495
JH		 212 return -EINVAL;
213
214 /* We don't have the hdev available here to make a
215 * better decision on random vs public, but since all
216 * user space versions that exhibit this issue anyway do
217 * not support random local addresses assuming public
218 * here is good enough.
219 */
220 chan->src_type = BDADDR_LE_PUBLIC;
221 }
1f209383
JH		 222
223 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
224 return -EINVAL;
225
bfe4655f 226 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
bfe4655f 227 /* We only allow ATT user space socket */
9149761a 228 if (la.l2_cid &&
dcf4adbf 229 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
bfe4655f
JH		 230 return -EINVAL;
231 }
232
38319713 233 if (chan->psm && bdaddr_type_is_le(chan->src_type))
0ce43ce6 234 chan->mode = L2CAP_MODE_LE_FLOWCTL;
38319713 235
6e4aff10 236 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
8e9f9892 237 &la.l2_bdaddr, la.l2_bdaddr_type);
4e34c50b 238 if (err)
b3fb611e 239 return err;
4e34c50b 240
6be36555
AE		 241 lock_sock(sk);
242
4e34c50b 243 err = bt_sock_wait_state(sk, BT_CONNECTED,
2d792818 244 sock_sndtimeo(sk, flags & O_NONBLOCK));
b3fb611e
AE		 245
246 release_sock(sk);
247
4e34c50b
GP		 248 return err;
249}
250
af6bcd82
GP		 251static int l2cap_sock_listen(struct socket *sock, int backlog)
252{
253 struct sock *sk = sock->sk;
0c1bc5c6 254 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
af6bcd82
GP		 255 int err = 0;
256
257 BT_DBG("sk %p backlog %d", sk, backlog);
258
259 lock_sock(sk);
260
6b3af733 261 if (sk->sk_state != BT_BOUND) {
af6bcd82
GP		 262 err = -EBADFD;
263 goto done;
264 }
265
6b3af733
MH		 266 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
267 err = -EINVAL;
268 goto done;
269 }
270
0c1bc5c6 271 switch (chan->mode) {
af6bcd82 272 case L2CAP_MODE_BASIC:
38319713 273 case L2CAP_MODE_LE_FLOWCTL:
af6bcd82
GP		 274 break;
275 case L2CAP_MODE_ERTM:
276 case L2CAP_MODE_STREAMING:
277 if (!disable_ertm)
278 break;
279 /* fall through */
280 default:
beb19e4c 281 err = -EOPNOTSUPP;
af6bcd82
GP		 282 goto done;
283 }
284
af6bcd82
GP		 285 sk->sk_max_ack_backlog = backlog;
286 sk->sk_ack_backlog = 0;
89bc500e 287
abe84903
JH		 288 /* Listening channels need to use nested locking in order not to
289 * cause lockdep warnings when the created child channels end up
290 * being locked in the same thread as the parent channel.
291 */
292 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
293
89bc500e 294 chan->state = BT_LISTEN;
af6bcd82
GP		 295 sk->sk_state = BT_LISTEN;
296
297done:
298 release_sock(sk);
299 return err;
300}
301
2d792818
GP		 302static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
303 int flags)
c47b7c72
GP		 304{
305 DECLARE_WAITQUEUE(wait, current);
306 struct sock *sk = sock->sk, *nsk;
307 long timeo;
308 int err = 0;
309
3b2ab39e 310 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
c47b7c72 311
c47b7c72
GP		 312 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
313
314 BT_DBG("sk %p timeo %ld", sk, timeo);
315
316 /* Wait for an incoming connection. (wake-one). */
317 add_wait_queue_exclusive(sk_sleep(sk), &wait);
f9a3c20a 318 while (1) {
c47b7c72 319 set_current_state(TASK_INTERRUPTIBLE);
f9a3c20a
PH		 320
321 if (sk->sk_state != BT_LISTEN) {
322 err = -EBADFD;
c47b7c72
GP		 323 break;
324 }
325
f9a3c20a
PH		 326 nsk = bt_accept_dequeue(sk, newsock);
327 if (nsk)
328 break;
c47b7c72 329
f9a3c20a
PH		 330 if (!timeo) {
331 err = -EAGAIN;
c47b7c72
GP		 332 break;
333 }
334
335 if (signal_pending(current)) {
336 err = sock_intr_errno(timeo);
337 break;
338 }
f9a3c20a
PH		 339
340 release_sock(sk);
341 timeo = schedule_timeout(timeo);
3b2ab39e 342 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
c47b7c72 343 }
f9a3c20a 344 __set_current_state(TASK_RUNNING);
c47b7c72
GP		 345 remove_wait_queue(sk_sleep(sk), &wait);
346
347 if (err)
348 goto done;
349
350 newsock->state = SS_CONNECTED;
351
352 BT_DBG("new socket %p", nsk);
353
354done:
355 release_sock(sk);
356 return err;
357}
358
2d792818
GP		 359static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
360 int *len, int peer)
d7175d55
GP		 361{
362 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
363 struct sock *sk = sock->sk;
0c1bc5c6 364 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
d7175d55
GP		 365
366 BT_DBG("sock %p, sk %p", sock, sk);
367
e8b1ab9e 368 if (peer && sk->sk_state != BT_CONNECTED &&
bf19d51b
JH		 369 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
370 sk->sk_state != BT_CONFIG)
b783fbc3
JH		 371 return -ENOTCONN;
372
792039c7 373 memset(la, 0, sizeof(struct sockaddr_l2));
d7175d55
GP		 374 addr->sa_family = AF_BLUETOOTH;
375 *len = sizeof(struct sockaddr_l2);
376
d7e5e76b
JH		 377 la->l2_psm = chan->psm;
378
d7175d55 379 if (peer) {
7eafc59e 380 bacpy(&la->l2_bdaddr, &chan->dst);
fe4128e0 381 la->l2_cid = cpu_to_le16(chan->dcid);
4f1654e0 382 la->l2_bdaddr_type = chan->dst_type;
d7175d55 383 } else {
7eafc59e 384 bacpy(&la->l2_bdaddr, &chan->src);
fe4128e0 385 la->l2_cid = cpu_to_le16(chan->scid);
4f1654e0 386 la->l2_bdaddr_type = chan->src_type;
d7175d55
GP		 387 }
388
389 return 0;
390}
391
2d792818
GP		 392static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
393 char __user *optval, int __user *optlen)
99f4808d
GP		 394{
395 struct sock *sk = sock->sk;
4343478f 396 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
99f4808d
GP		 397 struct l2cap_options opts;
398 struct l2cap_conninfo cinfo;
399 int len, err = 0;
400 u32 opt;
401
402 BT_DBG("sk %p", sk);
403
404 if (get_user(len, optlen))
405 return -EFAULT;
406
407 lock_sock(sk);
408
409 switch (optname) {
410 case L2CAP_OPTIONS:
64b4f8dc
JH		 411 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
412 * legacy ATT code depends on getsockopt for
413 * L2CAP_OPTIONS we need to let this pass.
414 */
415 if (bdaddr_type_is_le(chan->src_type) &&
416 chan->scid != L2CAP_CID_ATT) {
417 err = -EINVAL;
418 break;
419 }
420
e3fb592b 421 memset(&opts, 0, sizeof(opts));
0c1bc5c6
GP		 422 opts.imtu = chan->imtu;
423 opts.omtu = chan->omtu;
424 opts.flush_to = chan->flush_to;
425 opts.mode = chan->mode;
47d1ec61
GP		 426 opts.fcs = chan->fcs;
427 opts.max_tx = chan->max_tx;
6327eb98 428 opts.txwin_size = chan->tx_win;
99f4808d
GP		 429
430 len = min_t(unsigned int, len, sizeof(opts));
431 if (copy_to_user(optval, (char *) &opts, len))
432 err = -EFAULT;
433
434 break;
435
436 case L2CAP_LM:
4343478f 437 switch (chan->sec_level) {
99f4808d
GP		 438 case BT_SECURITY_LOW:
439 opt = L2CAP_LM_AUTH;
440 break;
441 case BT_SECURITY_MEDIUM:
442 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
443 break;
444 case BT_SECURITY_HIGH:
445 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
2d792818 446 L2CAP_LM_SECURE;
99f4808d 447 break;
7d513e92
MH		 448 case BT_SECURITY_FIPS:
449 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
450 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
451 break;
99f4808d
GP		 452 default:
453 opt = 0;
454 break;
455 }
456
43bd0f32 457 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
99f4808d
GP		 458 opt |= L2CAP_LM_MASTER;
459
ecf61bdb 460 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
99f4808d
GP		 461 opt |= L2CAP_LM_RELIABLE;
462
463 if (put_user(opt, (u32 __user *) optval))
464 err = -EFAULT;
7d513e92 465
99f4808d
GP		 466 break;
467
468 case L2CAP_CONNINFO:
469 if (sk->sk_state != BT_CONNECTED &&
c5daa683
GP		 470 !(sk->sk_state == BT_CONNECT2 &&
471 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
99f4808d
GP		 472 err = -ENOTCONN;
473 break;
474 }
475
8d03e971 476 memset(&cinfo, 0, sizeof(cinfo));
8c1d787b
GP		 477 cinfo.hci_handle = chan->conn->hcon->handle;
478 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
99f4808d
GP		 479
480 len = min_t(unsigned int, len, sizeof(cinfo));
481 if (copy_to_user(optval, (char *) &cinfo, len))
482 err = -EFAULT;
483
484 break;
485
486 default:
487 err = -ENOPROTOOPT;
488 break;
489 }
490
491 release_sock(sk);
492 return err;
493}
494
2d792818
GP		 495static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
496 char __user *optval, int __user *optlen)
99f4808d
GP		 497{
498 struct sock *sk = sock->sk;
4343478f 499 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
99f4808d 500 struct bt_security sec;
14b12d0b 501 struct bt_power pwr;
99f4808d
GP		 502 int len, err = 0;
503
504 BT_DBG("sk %p", sk);
505
506 if (level == SOL_L2CAP)
507 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
508
509 if (level != SOL_BLUETOOTH)
510 return -ENOPROTOOPT;
511
512 if (get_user(len, optlen))
513 return -EFAULT;
514
515 lock_sock(sk);
516
517 switch (optname) {
518 case BT_SECURITY:
715ec005 519 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
e0c888ad 520 chan->chan_type != L2CAP_CHAN_FIXED &&
2d792818 521 chan->chan_type != L2CAP_CHAN_RAW) {
99f4808d
GP		 522 err = -EINVAL;
523 break;
524 }
525
8f360119 526 memset(&sec, 0, sizeof(sec));
85e34368 527 if (chan->conn) {
c6585a4d 528 sec.level = chan->conn->hcon->sec_level;
99f4808d 529
85e34368
AE		 530 if (sk->sk_state == BT_CONNECTED)
531 sec.key_size = chan->conn->hcon->enc_key_size;
532 } else {
533 sec.level = chan->sec_level;
534 }
8f360119 535
99f4808d
GP		 536 len = min_t(unsigned int, len, sizeof(sec));
537 if (copy_to_user(optval, (char *) &sec, len))
538 err = -EFAULT;
539
540 break;
541
542 case BT_DEFER_SETUP:
543 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
544 err = -EINVAL;
545 break;
546 }
547
c5daa683
GP		 548 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
549 (u32 __user *) optval))
99f4808d
GP		 550 err = -EFAULT;
551
552 break;
553
554 case BT_FLUSHABLE:
d57b0e8b 555 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
2d792818 556 (u32 __user *) optval))
99f4808d
GP		 557 err = -EFAULT;
558
559 break;
560
14b12d0b
JG		 561 case BT_POWER:
562 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
2d792818 563 && sk->sk_type != SOCK_RAW) {
14b12d0b
JG		 564 err = -EINVAL;
565 break;
566 }
567
15770b1a 568 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
14b12d0b
JG		 569
570 len = min_t(unsigned int, len, sizeof(pwr));
571 if (copy_to_user(optval, (char *) &pwr, len))
572 err = -EFAULT;
573
574 break;
575
2ea66482 576 case BT_CHANNEL_POLICY:
2ea66482
MM		 577 if (put_user(chan->chan_policy, (u32 __user *) optval))
578 err = -EFAULT;
579 break;
580
1f435424 581 case BT_SNDMTU:
1f435424
JH		 582 if (!bdaddr_type_is_le(chan->src_type)) {
583 err = -EINVAL;
584 break;
585 }
586
587 if (sk->sk_state != BT_CONNECTED) {
588 err = -ENOTCONN;
589 break;
590 }
591
592 if (put_user(chan->omtu, (u16 __user *) optval))
593 err = -EFAULT;
594 break;
595
596 case BT_RCVMTU:
1f435424
JH		 597 if (!bdaddr_type_is_le(chan->src_type)) {
598 err = -EINVAL;
599 break;
600 }
601
602 if (put_user(chan->imtu, (u16 __user *) optval))
603 err = -EFAULT;
604 break;
605
99f4808d
GP		 606 default:
607 err = -ENOPROTOOPT;
608 break;
609 }
610
611 release_sock(sk);
612 return err;
613}
614
682877c3
AG		 615static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
616{
617 switch (chan->scid) {
073d1cf3 618 case L2CAP_CID_ATT:
8c3a4f00 619 if (mtu < L2CAP_LE_MIN_MTU)
682877c3
AG		 620 return false;
621 break;
622
623 default:
624 if (mtu < L2CAP_DEFAULT_MIN_MTU)
625 return false;
626 }
627
628 return true;
629}
630
2d792818
GP		 631static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
632 char __user *optval, unsigned int optlen)
33575df7
GP		 633{
634 struct sock *sk = sock->sk;
b4450035 635 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
33575df7
GP		 636 struct l2cap_options opts;
637 int len, err = 0;
638 u32 opt;
639
640 BT_DBG("sk %p", sk);
641
642 lock_sock(sk);
643
644 switch (optname) {
645 case L2CAP_OPTIONS:
64b4f8dc
JH		 646 if (bdaddr_type_is_le(chan->src_type)) {
647 err = -EINVAL;
648 break;
649 }
650
33575df7
GP		 651 if (sk->sk_state == BT_CONNECTED) {
652 err = -EINVAL;
653 break;
654 }
655
0c1bc5c6
GP		 656 opts.imtu = chan->imtu;
657 opts.omtu = chan->omtu;
658 opts.flush_to = chan->flush_to;
659 opts.mode = chan->mode;
47d1ec61
GP		 660 opts.fcs = chan->fcs;
661 opts.max_tx = chan->max_tx;
6327eb98 662 opts.txwin_size = chan->tx_win;
33575df7
GP		 663
664 len = min_t(unsigned int, sizeof(opts), optlen);
665 if (copy_from_user((char *) &opts, optval, len)) {
666 err = -EFAULT;
667 break;
668 }
669
6327eb98 670 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
33575df7
GP		 671 err = -EINVAL;
672 break;
673 }
674
682877c3
AG		 675 if (!l2cap_valid_mtu(chan, opts.imtu)) {
676 err = -EINVAL;
677 break;
678 }
679
0c1bc5c6
GP		 680 chan->mode = opts.mode;
681 switch (chan->mode) {
38319713
JH		 682 case L2CAP_MODE_LE_FLOWCTL:
683 break;
33575df7 684 case L2CAP_MODE_BASIC:
c1360a1c 685 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
33575df7
GP		 686 break;
687 case L2CAP_MODE_ERTM:
688 case L2CAP_MODE_STREAMING:
689 if (!disable_ertm)
690 break;
691 /* fall through */
692 default:
693 err = -EINVAL;
694 break;
695 }
696
0c1bc5c6
GP		 697 chan->imtu = opts.imtu;
698 chan->omtu = opts.omtu;
47d1ec61
GP		 699 chan->fcs = opts.fcs;
700 chan->max_tx = opts.max_tx;
6327eb98 701 chan->tx_win = opts.txwin_size;
12d59781 702 chan->flush_to = opts.flush_to;
33575df7
GP		 703 break;
704
705 case L2CAP_LM:
706 if (get_user(opt, (u32 __user *) optval)) {
707 err = -EFAULT;
708 break;
709 }
710
7d513e92
MH		 711 if (opt & L2CAP_LM_FIPS) {
712 err = -EINVAL;
713 break;
714 }
715
33575df7 716 if (opt & L2CAP_LM_AUTH)
4343478f 717 chan->sec_level = BT_SECURITY_LOW;
33575df7 718 if (opt & L2CAP_LM_ENCRYPT)
4343478f 719 chan->sec_level = BT_SECURITY_MEDIUM;
33575df7 720 if (opt & L2CAP_LM_SECURE)
4343478f 721 chan->sec_level = BT_SECURITY_HIGH;
33575df7 722
43bd0f32
AE		 723 if (opt & L2CAP_LM_MASTER)
724 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
725 else
726 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
ecf61bdb
AE		 727
728 if (opt & L2CAP_LM_RELIABLE)
729 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
730 else
731 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
33575df7
GP		 732 break;
733
734 default:
735 err = -ENOPROTOOPT;
736 break;
737 }
738
739 release_sock(sk);
740 return err;
741}
742
2d792818
GP		 743static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
744 char __user *optval, unsigned int optlen)
33575df7
GP		 745{
746 struct sock *sk = sock->sk;
4343478f 747 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
33575df7 748 struct bt_security sec;
14b12d0b 749 struct bt_power pwr;
f1cb9af5 750 struct l2cap_conn *conn;
33575df7
GP		 751 int len, err = 0;
752 u32 opt;
753
754 BT_DBG("sk %p", sk);
755
756 if (level == SOL_L2CAP)
757 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
758
759 if (level != SOL_BLUETOOTH)
760 return -ENOPROTOOPT;
761
762 lock_sock(sk);
763
764 switch (optname) {
765 case BT_SECURITY:
715ec005 766 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
e0c888ad 767 chan->chan_type != L2CAP_CHAN_FIXED &&
2d792818 768 chan->chan_type != L2CAP_CHAN_RAW) {
33575df7
GP		 769 err = -EINVAL;
770 break;
771 }
772
773 sec.level = BT_SECURITY_LOW;
774
775 len = min_t(unsigned int, sizeof(sec), optlen);
776 if (copy_from_user((char *) &sec, optval, len)) {
777 err = -EFAULT;
778 break;
779 }
780
781 if (sec.level < BT_SECURITY_LOW ||
2d792818 782 sec.level > BT_SECURITY_HIGH) {
33575df7
GP		 783 err = -EINVAL;
784 break;
785 }
786
4343478f 787 chan->sec_level = sec.level;
f1cb9af5 788
0bee1d60
GP		 789 if (!chan->conn)
790 break;
791
f1cb9af5 792 conn = chan->conn;
0bee1d60
GP		 793
794 /*change security for LE channels */
073d1cf3 795 if (chan->scid == L2CAP_CID_ATT) {
cc110922 796 if (smp_conn_security(conn->hcon, sec.level))
f1cb9af5 797 break;
d52deb17 798 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
f1cb9af5 799 sk->sk_state = BT_CONFIG;
3542b854 800 chan->state = BT_CONFIG;
0bee1d60 801
a7d7723a
GP		 802 /* or for ACL link */
803 } else if ((sk->sk_state == BT_CONNECT2 &&
2d792818 804 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
a7d7723a 805 sk->sk_state == BT_CONNECTED) {
e7cafc45 806 if (!l2cap_chan_check_security(chan, true))
c5daa683 807 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
a7d7723a
GP		 808 else
809 sk->sk_state_change(sk);
0bee1d60
GP		 810 } else {
811 err = -EINVAL;
f1cb9af5 812 }
33575df7
GP		 813 break;
814
815 case BT_DEFER_SETUP:
816 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
817 err = -EINVAL;
818 break;
819 }
820
821 if (get_user(opt, (u32 __user *) optval)) {
822 err = -EFAULT;
823 break;
824 }
825
bdc25783 826 if (opt) {
c5daa683 827 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
bdc25783
MH		 828 set_bit(FLAG_DEFER_SETUP, &chan->flags);
829 } else {
c5daa683 830 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
bdc25783
MH		 831 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
832 }
33575df7
GP		 833 break;
834
835 case BT_FLUSHABLE:
836 if (get_user(opt, (u32 __user *) optval)) {
837 err = -EFAULT;
838 break;
839 }
840
841 if (opt > BT_FLUSHABLE_ON) {
842 err = -EINVAL;
843 break;
844 }
845
846 if (opt == BT_FLUSHABLE_OFF) {
c1f23a2b 847 conn = chan->conn;
25985edc 848 /* proceed further only when we have l2cap_conn and
33575df7
GP		 849 No Flush support in the LM */
850 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
851 err = -EINVAL;
852 break;
853 }
854 }
855
d57b0e8b
AE		 856 if (opt)
857 set_bit(FLAG_FLUSHABLE, &chan->flags);
858 else
859 clear_bit(FLAG_FLUSHABLE, &chan->flags);
33575df7
GP		 860 break;
861
14b12d0b
JG		 862 case BT_POWER:
863 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
2d792818 864 chan->chan_type != L2CAP_CHAN_RAW) {
14b12d0b
JG		 865 err = -EINVAL;
866 break;
867 }
868
869 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
870
871 len = min_t(unsigned int, sizeof(pwr), optlen);
872 if (copy_from_user((char *) &pwr, optval, len)) {
873 err = -EFAULT;
874 break;
875 }
15770b1a
AE		 876
877 if (pwr.force_active)
878 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
879 else
880 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
14b12d0b
JG		 881 break;
882
2ea66482 883 case BT_CHANNEL_POLICY:
2ea66482
MM		 884 if (get_user(opt, (u32 __user *) optval)) {
885 err = -EFAULT;
886 break;
887 }
888
889 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
890 err = -EINVAL;
891 break;
892 }
893
894 if (chan->mode != L2CAP_MODE_ERTM &&
2d792818 895 chan->mode != L2CAP_MODE_STREAMING) {
2ea66482
MM		 896 err = -EOPNOTSUPP;
897 break;
898 }
899
900 chan->chan_policy = (u8) opt;
3f7a56c4
MM		 901
902 if (sk->sk_state == BT_CONNECTED &&
903 chan->move_role == L2CAP_MOVE_ROLE_NONE)
904 l2cap_move_start(chan);
905
14b12d0b
JG		 906 break;
907
1f435424 908 case BT_SNDMTU:
1f435424
JH		 909 if (!bdaddr_type_is_le(chan->src_type)) {
910 err = -EINVAL;
911 break;
912 }
913
914 /* Setting is not supported as it's the remote side that
915 * decides this.
916 */
917 err = -EPERM;
918 break;
919
920 case BT_RCVMTU:
1f435424
JH		 921 if (!bdaddr_type_is_le(chan->src_type)) {
922 err = -EINVAL;
923 break;
924 }
925
926 if (sk->sk_state == BT_CONNECTED) {
927 err = -EISCONN;
928 break;
929 }
930
931 if (get_user(opt, (u32 __user *) optval)) {
932 err = -EFAULT;
933 break;
934 }
935
936 chan->imtu = opt;
937 break;
938
33575df7
GP		 939 default:
940 err = -ENOPROTOOPT;
941 break;
942 }
943
944 release_sock(sk);
945 return err;
946}
fd83ccdb 947
2d792818
GP		 948static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
949 struct msghdr *msg, size_t len)
fd83ccdb
GP		 950{
951 struct sock *sk = sock->sk;
0c1bc5c6 952 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
fd83ccdb
GP		 953 int err;
954
955 BT_DBG("sock %p, sk %p", sock, sk);
956
957 err = sock_error(sk);
958 if (err)
959 return err;
960
961 if (msg->msg_flags & MSG_OOB)
962 return -EOPNOTSUPP;
963
a6a5568c 964 if (sk->sk_state != BT_CONNECTED)
9a91a04a 965 return -ENOTCONN;
fd83ccdb 966
e793dcf0
JH		 967 lock_sock(sk);
968 err = bt_sock_wait_ready(sk, msg->msg_flags);
969 release_sock(sk);
970 if (err)
971 return err;
972
a6a5568c 973 l2cap_chan_lock(chan);
8d46321c 974 err = l2cap_chan_send(chan, msg, len);
a6a5568c 975 l2cap_chan_unlock(chan);
fd83ccdb 976
fd83ccdb
GP		 977 return err;
978}
33575df7 979
2d792818
GP		 980static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
981 struct msghdr *msg, size_t len, int flags)
68983259
GP		 982{
983 struct sock *sk = sock->sk;
e328140f
MM		 984 struct l2cap_pinfo *pi = l2cap_pi(sk);
985 int err;
68983259
GP		 986
987 lock_sock(sk);
988
c5daa683
GP		 989 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
990 &bt_sk(sk)->flags)) {
38319713
JH		 991 if (bdaddr_type_is_le(pi->chan->src_type)) {
992 sk->sk_state = BT_CONNECTED;
993 pi->chan->state = BT_CONNECTED;
994 __l2cap_le_connect_rsp_defer(pi->chan);
995 } else {
996 sk->sk_state = BT_CONFIG;
997 pi->chan->state = BT_CONFIG;
998 __l2cap_connect_rsp_defer(pi->chan);
999 }
8c1d787b 1000
970871bc
JH		 1001 err = 0;
1002 goto done;
68983259
GP		 1003 }
1004
1005 release_sock(sk);
1006
1007 if (sock->type == SOCK_STREAM)
e328140f
MM		 1008 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1009 else
1010 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
1011
1012 if (pi->chan->mode != L2CAP_MODE_ERTM)
1013 return err;
1014
1015 /* Attempt to put pending rx data in the socket buffer */
1016
1017 lock_sock(sk);
1018
1019 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1020 goto done;
1021
1022 if (pi->rx_busy_skb) {
1023 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1024 pi->rx_busy_skb = NULL;
1025 else
1026 goto done;
1027 }
1028
1029 /* Restore data flow when half of the receive buffer is
1030 * available. This avoids resending large numbers of
1031 * frames.
1032 */
1033 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1034 l2cap_chan_busy(pi->chan, 0);
68983259 1035
e328140f
MM		 1036done:
1037 release_sock(sk);
1038 return err;
68983259
GP		 1039}
1040
05fc1576
GP		 1041/* Kill socket (only if zapped and orphan)
1042 * Must be called on unlocked socket.
1043 */
ba3bd0ee 1044static void l2cap_sock_kill(struct sock *sk)
05fc1576
GP		 1045{
1046 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1047 return;
1048
e05dcc32 1049 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
05fc1576
GP		 1050
1051 /* Kill poor orphan */
6ff5abbf 1052
4af66c69 1053 l2cap_chan_put(l2cap_pi(sk)->chan);
05fc1576
GP		 1054 sock_set_flag(sk, SOCK_DEAD);
1055 sock_put(sk);
1056}
1057
dc25306b
GP		 1058static int __l2cap_wait_ack(struct sock *sk)
1059{
1060 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1061 DECLARE_WAITQUEUE(wait, current);
1062 int err = 0;
1063 int timeo = HZ/5;
1064
1065 add_wait_queue(sk_sleep(sk), &wait);
1066 set_current_state(TASK_INTERRUPTIBLE);
1067 while (chan->unacked_frames > 0 && chan->conn) {
1068 if (!timeo)
1069 timeo = HZ/5;
1070
1071 if (signal_pending(current)) {
1072 err = sock_intr_errno(timeo);
1073 break;
1074 }
1075
1076 release_sock(sk);
1077 timeo = schedule_timeout(timeo);
1078 lock_sock(sk);
1079 set_current_state(TASK_INTERRUPTIBLE);
1080
1081 err = sock_error(sk);
1082 if (err)
1083 break;
1084 }
1085 set_current_state(TASK_RUNNING);
1086 remove_wait_queue(sk_sleep(sk), &wait);
1087 return err;
1088}
1089
dcba0dba
GP		 1090static int l2cap_sock_shutdown(struct socket *sock, int how)
1091{
1092 struct sock *sk = sock->sk;
7ddb6e0f 1093 struct l2cap_chan *chan;
3df91ea2 1094 struct l2cap_conn *conn;
dcba0dba
GP		 1095 int err = 0;
1096
1097 BT_DBG("sock %p, sk %p", sock, sk);
1098
1099 if (!sk)
1100 return 0;
1101
7ddb6e0f 1102 chan = l2cap_pi(sk)->chan;
3df91ea2
AE		 1103 conn = chan->conn;
1104
1105 if (conn)
1106 mutex_lock(&conn->chan_lock);
7ddb6e0f 1107
6be36555 1108 l2cap_chan_lock(chan);
dcba0dba 1109 lock_sock(sk);
6be36555 1110
dcba0dba 1111 if (!sk->sk_shutdown) {
0c1bc5c6 1112 if (chan->mode == L2CAP_MODE_ERTM)
dcba0dba
GP		 1113 err = __l2cap_wait_ack(sk);
1114
1115 sk->sk_shutdown = SHUTDOWN_MASK;
3df91ea2 1116
6be36555 1117 release_sock(sk);
0f852724 1118 l2cap_chan_close(chan, 0);
6be36555 1119 lock_sock(sk);
dcba0dba 1120
093facf3
VD		 1121 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1122 !(current->flags & PF_EXITING))
dcba0dba 1123 err = bt_sock_wait_state(sk, BT_CLOSED,
2d792818 1124 sk->sk_lingertime);
dcba0dba
GP		 1125 }
1126
1127 if (!err && sk->sk_err)
1128 err = -sk->sk_err;
1129
1130 release_sock(sk);
6be36555 1131 l2cap_chan_unlock(chan);
3df91ea2
AE		 1132
1133 if (conn)
1134 mutex_unlock(&conn->chan_lock);
1135
dcba0dba
GP		 1136 return err;
1137}
1138
554f05bb
GP		 1139static int l2cap_sock_release(struct socket *sock)
1140{
1141 struct sock *sk = sock->sk;
1142 int err;
1143
1144 BT_DBG("sock %p, sk %p", sock, sk);
1145
1146 if (!sk)
1147 return 0;
1148
5b28d95c
MY		 1149 bt_sock_unlink(&l2cap_sk_list, sk);
1150
554f05bb
GP		 1151 err = l2cap_sock_shutdown(sock, 2);
1152
1153 sock_orphan(sk);
1154 l2cap_sock_kill(sk);
1155 return err;
1156}
1157
c0df7f6e
AE		 1158static void l2cap_sock_cleanup_listen(struct sock *parent)
1159{
1160 struct sock *sk;
1161
1162 BT_DBG("parent %p", parent);
1163
1164 /* Close not yet accepted channels */
1165 while ((sk = bt_accept_dequeue(parent, NULL))) {
1166 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1167
1168 l2cap_chan_lock(chan);
1169 __clear_chan_timer(chan);
1170 l2cap_chan_close(chan, ECONNRESET);
1171 l2cap_chan_unlock(chan);
1172
1173 l2cap_sock_kill(sk);
1174 }
1175}
1176
80b98027 1177static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
80808e43 1178{
80b98027 1179 struct sock *sk, *parent = chan->data;
80808e43 1180
8ffb9290
GP		 1181 lock_sock(parent);
1182
53826692
GP		 1183 /* Check for backlog size */
1184 if (sk_acceptq_is_full(parent)) {
1185 BT_DBG("backlog full %d", parent->sk_ack_backlog);
8a96f3cd 1186 release_sock(parent);
53826692
GP		 1187 return NULL;
1188 }
1189
80808e43 1190 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
2d792818 1191 GFP_ATOMIC);
8a96f3cd
JT		 1192 if (!sk) {
1193 release_sock(parent);
80808e43 1194 return NULL;
8a96f3cd 1195 }
80808e43 1196
d22015aa
OP		 1197 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1198
80808e43
GP		 1199 l2cap_sock_init(sk, parent);
1200
644912e1
GP		 1201 bt_accept_enqueue(parent, sk);
1202
8ffb9290
GP		 1203 release_sock(parent);
1204
80808e43
GP		 1205 return l2cap_pi(sk)->chan;
1206}
1207
80b98027 1208static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
23070494 1209{
80b98027 1210 struct sock *sk = chan->data;
84b34d98 1211 int err;
e328140f 1212
6be36555
AE		 1213 lock_sock(sk);
1214
84b34d98 1215 if (l2cap_pi(sk)->rx_busy_skb) {
6be36555
AE		 1216 err = -ENOMEM;
1217 goto done;
1218 }
e328140f
MM		 1219
1220 err = sock_queue_rcv_skb(sk, skb);
1221
1222 /* For ERTM, handle one skb that doesn't fit into the recv
1223 * buffer. This is important to do because the data frames
1224 * have already been acked, so the skb cannot be discarded.
1225 *
1226 * Notify the l2cap core that the buffer is full, so the
1227 * LOCAL_BUSY state is entered and no more frames are
1228 * acked and reassembled until there is buffer space
1229 * available.
1230 */
84b34d98
MH		 1231 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1232 l2cap_pi(sk)->rx_busy_skb = skb;
1233 l2cap_chan_busy(chan, 1);
e328140f
MM		 1234 err = 0;
1235 }
23070494 1236
6be36555
AE		 1237done:
1238 release_sock(sk);
1239
e328140f 1240 return err;
23070494
GP		 1241}
1242
80b98027 1243static void l2cap_sock_close_cb(struct l2cap_chan *chan)
ba3bd0ee 1244{
80b98027 1245 struct sock *sk = chan->data;
ba3bd0ee
GP		 1246
1247 l2cap_sock_kill(sk);
1248}
1249
c0df7f6e
AE		 1250static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1251{
1252 struct sock *sk = chan->data;
1253 struct sock *parent;
1254
3b2ab39e
JH		 1255 /* This callback can be called both for server (BT_LISTEN)
1256 * sockets as well as "normal" ones. To avoid lockdep warnings
1257 * with child socket locking (through l2cap_sock_cleanup_listen)
1258 * we need separation into separate nesting levels. The simplest
1259 * way to accomplish this is to inherit the nesting level used
1260 * for the channel.
1261 */
1262 lock_sock_nested(sk, atomic_read(&chan->nesting));
c0df7f6e
AE		 1263
1264 parent = bt_sk(sk)->parent;
1265
1266 sock_set_flag(sk, SOCK_ZAPPED);
1267
1268 switch (chan->state) {
1269 case BT_OPEN:
1270 case BT_BOUND:
1271 case BT_CLOSED:
1272 break;
1273 case BT_LISTEN:
1274 l2cap_sock_cleanup_listen(sk);
1275 sk->sk_state = BT_CLOSED;
1276 chan->state = BT_CLOSED;
1277
1278 break;
1279 default:
1280 sk->sk_state = BT_CLOSED;
1281 chan->state = BT_CLOSED;
1282
1283 sk->sk_err = err;
1284
1285 if (parent) {
1286 bt_accept_unlink(sk);
676d2369 1287 parent->sk_data_ready(parent);
c0df7f6e
AE		 1288 } else {
1289 sk->sk_state_change(sk);
1290 }
1291
1292 break;
1293 }
1294
1295 release_sock(sk);
1296}
1297
53f52121
GP		 1298static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1299 int err)
89bc500e 1300{
80b98027 1301 struct sock *sk = chan->data;
89bc500e
GP		 1302
1303 sk->sk_state = state;
53f52121
GP		 1304
1305 if (err)
1306 sk->sk_err = err;
89bc500e
GP		 1307}
1308
2f7719ce 1309static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
d9fbd02b 1310 unsigned long hdr_len,
90338947 1311 unsigned long len, int nb)
2f7719ce 1312{
0f2c6153 1313 struct sock *sk = chan->data;
90338947
GP		 1314 struct sk_buff *skb;
1315 int err;
1316
a6a5568c 1317 l2cap_chan_unlock(chan);
d9fbd02b 1318 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
a6a5568c
MM		 1319 l2cap_chan_lock(chan);
1320
90338947
GP		 1321 if (!skb)
1322 return ERR_PTR(err);
2f7719ce 1323
8d46321c
MH		 1324 skb->priority = sk->sk_priority;
1325
0e790c64
GP		 1326 bt_cb(skb)->chan = chan;
1327
90338947 1328 return skb;
2f7719ce
AE		 1329}
1330
0498878b
JR		 1331static int l2cap_sock_memcpy_fromiovec_cb(struct l2cap_chan *chan,
1332 unsigned char *kdata,
1333 struct iovec *iov, int len)
1334{
1335 return memcpy_fromiovec(kdata, iov, len);
1336}
1337
54a59aa2
AE		 1338static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1339{
1340 struct sock *sk = chan->data;
1341 struct sock *parent;
1342
1343 lock_sock(sk);
1344
1345 parent = bt_sk(sk)->parent;
1346
1347 BT_DBG("sk %p, parent %p", sk, parent);
1348
1349 sk->sk_state = BT_CONNECTED;
1350 sk->sk_state_change(sk);
1351
1352 if (parent)
676d2369 1353 parent->sk_data_ready(parent);
54a59aa2
AE		 1354
1355 release_sock(sk);
1356}
1357
2dc4e510
GP		 1358static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1359{
acdcabf5
GP		 1360 struct sock *parent, *sk = chan->data;
1361
1362 lock_sock(sk);
2dc4e510 1363
acdcabf5 1364 parent = bt_sk(sk)->parent;
2dc4e510 1365 if (parent)
676d2369 1366 parent->sk_data_ready(parent);
acdcabf5
GP		 1367
1368 release_sock(sk);
2dc4e510
GP		 1369}
1370
d97c899b
MH		 1371static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1372{
1373 struct sock *sk = chan->data;
1374
d52deb17
JH		 1375 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1376 sk->sk_state = BT_CONNECTED;
1377 chan->state = BT_CONNECTED;
1378 }
1379
d97c899b
MH		 1380 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1381 sk->sk_state_change(sk);
1382}
1383
5ec1bbe5
GP		 1384static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1385{
1386 struct sock *sk = chan->data;
1387
1388 lock_sock(sk);
1389 sk->sk_shutdown = SHUTDOWN_MASK;
1390 release_sock(sk);
1391}
1392
8d836d71
GP		 1393static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1394{
1395 struct sock *sk = chan->data;
1396
1397 return sk->sk_sndtimeo;
1398}
1399
837776f7
JH		 1400static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1401{
1402 struct sock *sk = chan->data;
1403
1404 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1405 sk->sk_state_change(sk);
1406}
1407
67f86a45 1408static const struct l2cap_ops l2cap_chan_ops = {
0498878b
JR		 1409 .name = "L2CAP Socket Interface",
1410 .new_connection = l2cap_sock_new_connection_cb,
1411 .recv = l2cap_sock_recv_cb,
1412 .close = l2cap_sock_close_cb,
1413 .teardown = l2cap_sock_teardown_cb,
1414 .state_change = l2cap_sock_state_change_cb,
1415 .ready = l2cap_sock_ready_cb,
1416 .defer = l2cap_sock_defer_cb,
1417 .resume = l2cap_sock_resume_cb,
1418 .suspend = l2cap_sock_suspend_cb,
1419 .set_shutdown = l2cap_sock_set_shutdown_cb,
1420 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1421 .alloc_skb = l2cap_sock_alloc_skb_cb,
1422 .memcpy_fromiovec = l2cap_sock_memcpy_fromiovec_cb,
80808e43
GP		 1423};
1424
bb58f747
GP		 1425static void l2cap_sock_destruct(struct sock *sk)
1426{
1427 BT_DBG("sk %p", sk);
1428
23d3a869
SL		 1429 if (l2cap_pi(sk)->chan)
1430 l2cap_chan_put(l2cap_pi(sk)->chan);
84b34d98 1431
e328140f
MM		 1432 if (l2cap_pi(sk)->rx_busy_skb) {
1433 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1434 l2cap_pi(sk)->rx_busy_skb = NULL;
1435 }
1436
bb58f747
GP		 1437 skb_queue_purge(&sk->sk_receive_queue);
1438 skb_queue_purge(&sk->sk_write_queue);
1439}
1440
2edf870d
MH		 1441static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1442 int *msg_namelen)
1443{
342dfc30 1444 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
2edf870d
MH		 1445
1446 memset(la, 0, sizeof(struct sockaddr_l2));
1447 la->l2_family = AF_BLUETOOTH;
1448 la->l2_psm = bt_cb(skb)->psm;
1449 bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1450
1451 *msg_namelen = sizeof(struct sockaddr_l2);
1452}
1453
80808e43 1454static void l2cap_sock_init(struct sock *sk, struct sock *parent)
bb58f747 1455{
84b34d98 1456 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
bb58f747
GP		 1457
1458 BT_DBG("sk %p", sk);
1459
1460 if (parent) {
b4450035
GP		 1461 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1462
bb58f747 1463 sk->sk_type = parent->sk_type;
c5daa683 1464 bt_sk(sk)->flags = bt_sk(parent)->flags;
bb58f747 1465
715ec005 1466 chan->chan_type = pchan->chan_type;
0c1bc5c6
GP		 1467 chan->imtu = pchan->imtu;
1468 chan->omtu = pchan->omtu;
b4450035 1469 chan->conf_state = pchan->conf_state;
0c1bc5c6 1470 chan->mode = pchan->mode;
47d1ec61
GP		 1471 chan->fcs = pchan->fcs;
1472 chan->max_tx = pchan->max_tx;
1473 chan->tx_win = pchan->tx_win;
6b3c7104 1474 chan->tx_win_max = pchan->tx_win_max;
4343478f 1475 chan->sec_level = pchan->sec_level;
d57b0e8b 1476 chan->flags = pchan->flags;
0cd75f7e
JH		 1477 chan->tx_credits = pchan->tx_credits;
1478 chan->rx_credits = pchan->rx_credits;
6230c9b4 1479
7a8e5a31
JH		 1480 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1481 chan->scid = pchan->scid;
1482 chan->dcid = pchan->scid;
1483 }
1484
6230c9b4 1485 security_sk_clone(parent, sk);
bb58f747 1486 } else {
715ec005
GP		 1487 switch (sk->sk_type) {
1488 case SOCK_RAW:
1489 chan->chan_type = L2CAP_CHAN_RAW;
1490 break;
1491 case SOCK_DGRAM:
1492 chan->chan_type = L2CAP_CHAN_CONN_LESS;
2edf870d 1493 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
715ec005
GP		 1494 break;
1495 case SOCK_SEQPACKET:
1496 case SOCK_STREAM:
1497 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1498 break;
1499 }
1500
0c1bc5c6
GP		 1501 chan->imtu = L2CAP_DEFAULT_MTU;
1502 chan->omtu = 0;
bb58f747 1503 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
0c1bc5c6 1504 chan->mode = L2CAP_MODE_ERTM;
c1360a1c 1505 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
bb58f747 1506 } else {
0c1bc5c6 1507 chan->mode = L2CAP_MODE_BASIC;
bb58f747 1508 }
bd4b1653
AE		 1509
1510 l2cap_chan_set_defaults(chan);
bb58f747
GP		 1511 }
1512
abe84903
JH		 1513 /* Set default lock nesting level */
1514 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
1515
bb58f747 1516 /* Default config options */
0c1bc5c6 1517 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
80808e43
GP		 1518
1519 chan->data = sk;
1520 chan->ops = &l2cap_chan_ops;
bb58f747
GP		 1521}
1522
1523static struct proto l2cap_proto = {
1524 .name = "L2CAP",
1525 .owner = THIS_MODULE,
1526 .obj_size = sizeof(struct l2cap_pinfo)
1527};
1528
2d792818
GP		 1529static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1530 int proto, gfp_t prio)
bb58f747
GP		 1531{
1532 struct sock *sk;
dc50a06d 1533 struct l2cap_chan *chan;
bb58f747
GP		 1534
1535 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1536 if (!sk)
1537 return NULL;
1538
1539 sock_init_data(sock, sk);
1540 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1541
1542 sk->sk_destruct = l2cap_sock_destruct;
ba13ccd9 1543 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
bb58f747
GP		 1544
1545 sock_reset_flag(sk, SOCK_ZAPPED);
1546
1547 sk->sk_protocol = proto;
1548 sk->sk_state = BT_OPEN;
1549
eef1d9b6 1550 chan = l2cap_chan_create();
dc50a06d 1551 if (!chan) {
49dfbb91 1552 sk_free(sk);
dc50a06d
GP		 1553 return NULL;
1554 }
1555
61d6ef3e
MM		 1556 l2cap_chan_hold(chan);
1557
dc50a06d
GP		 1558 l2cap_pi(sk)->chan = chan;
1559
bb58f747
GP		 1560 return sk;
1561}
1562
1563static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1564 int kern)
1565{
1566 struct sock *sk;
1567
1568 BT_DBG("sock %p", sock);
1569
1570 sock->state = SS_UNCONNECTED;
1571
1572 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
2d792818 1573 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
bb58f747
GP		 1574 return -ESOCKTNOSUPPORT;
1575
1576 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1577 return -EPERM;
1578
1579 sock->ops = &l2cap_sock_ops;
1580
1581 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1582 if (!sk)
1583 return -ENOMEM;
1584
1585 l2cap_sock_init(sk, NULL);
5b28d95c 1586 bt_sock_link(&l2cap_sk_list, sk);
bb58f747
GP		 1587 return 0;
1588}
1589
cf2f90f5 1590static const struct proto_ops l2cap_sock_ops = {
65390587
GP		 1591 .family = PF_BLUETOOTH,
1592 .owner = THIS_MODULE,
1593 .release = l2cap_sock_release,
1594 .bind = l2cap_sock_bind,
1595 .connect = l2cap_sock_connect,
1596 .listen = l2cap_sock_listen,
1597 .accept = l2cap_sock_accept,
1598 .getname = l2cap_sock_getname,
1599 .sendmsg = l2cap_sock_sendmsg,
1600 .recvmsg = l2cap_sock_recvmsg,
1601 .poll = bt_sock_poll,
1602 .ioctl = bt_sock_ioctl,
1603 .mmap = sock_no_mmap,
1604 .socketpair = sock_no_socketpair,
1605 .shutdown = l2cap_sock_shutdown,
1606 .setsockopt = l2cap_sock_setsockopt,
1607 .getsockopt = l2cap_sock_getsockopt
1608};
1609
bb58f747
GP		 1610static const struct net_proto_family l2cap_sock_family_ops = {
1611 .family = PF_BLUETOOTH,
1612 .owner = THIS_MODULE,
1613 .create = l2cap_sock_create,
1614};
1615
1616int __init l2cap_init_sockets(void)
1617{
e2174ca4 1618 int err;
bb58f747 1619
e2174ca4
GP		 1620 err = proto_register(&l2cap_proto, 0);
1621 if (err < 0)
1622 return err;
bb58f747 1623
e2174ca4 1624 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
5b28d95c
MY		 1625 if (err < 0) {
1626 BT_ERR("L2CAP socket registration failed");
e2174ca4 1627 goto error;
5b28d95c
MY		 1628 }
1629
b0316615 1630 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
2d792818 1631 NULL);
5b28d95c
MY		 1632 if (err < 0) {
1633 BT_ERR("Failed to create L2CAP proc file");
1634 bt_sock_unregister(BTPROTO_L2CAP);
1635 goto error;
1636 }
bb58f747 1637
e2174ca4 1638 BT_INFO("L2CAP socket layer initialized");
bb58f747 1639
e2174ca4 1640 return 0;
bb58f747
GP		 1641
1642error:
e2174ca4
GP		 1643 proto_unregister(&l2cap_proto);
1644 return err;
bb58f747
GP		 1645}
1646
1647void l2cap_cleanup_sockets(void)
1648{
5b28d95c 1649 bt_procfs_cleanup(&init_net, "l2cap");
5e9d7f86 1650 bt_sock_unregister(BTPROTO_L2CAP);
e2174ca4 1651 proto_unregister(&l2cap_proto);
bb58f747 1652}
Linux kernel - Deliverables
This page took 0.303525 seconds and 5 git commands to generate.