net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36
  37 #include "smp.h"
  38
  39 static struct bt_sock_list l2cap_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  41 };
  42
  43 static const struct proto_ops l2cap_sock_ops;
  44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  46                                      int proto, gfp_t prio, int kern);
  47
  48 bool l2cap_is_socket(struct socket *sock)
  49 {
  50         return sock && sock->ops == &l2cap_sock_ops;
  51 }
  52 EXPORT_SYMBOL(l2cap_is_socket);
  53
  54 static int l2cap_validate_bredr_psm(u16 psm)
  55 {
  56         /* PSM must be odd and lsb of upper byte must be 0 */
  57         if ((psm & 0x0101) != 0x0001)
  58                 return -EINVAL;
  59
  60         /* Restrict usage of well-known PSMs */
  61         if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
  62                 return -EACCES;
  63
  64         return 0;
  65 }
  66
  67 static int l2cap_validate_le_psm(u16 psm)
  68 {
  69         /* Valid LE_PSM ranges are defined only until 0x00ff */
  70         if (psm > 0x00ff)
  71                 return -EINVAL;
  72
  73         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  74         if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
  75                 return -EACCES;
  76
  77         return 0;
  78 }
  79
  80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  81 {
  82         struct sock *sk = sock->sk;
  83         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  84         struct sockaddr_l2 la;
  85         int len, err = 0;
  86
  87         BT_DBG("sk %p", sk);
  88
  89         if (!addr || addr->sa_family != AF_BLUETOOTH)
  90                 return -EINVAL;
  91
  92         memset(&la, 0, sizeof(la));
  93         len = min_t(unsigned int, sizeof(la), alen);
  94         memcpy(&la, addr, len);
  95
  96         if (la.l2_cid && la.l2_psm)
  97                 return -EINVAL;
  98
  99         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 100                 return -EINVAL;
 101
 102         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 103                 /* We only allow ATT user space socket */
 104                 if (la.l2_cid &&
 105                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 106                         return -EINVAL;
 107         }
 108
 109         lock_sock(sk);
 110
 111         if (sk->sk_state != BT_OPEN) {
 112                 err = -EBADFD;
 113                 goto done;
 114         }
 115
 116         if (la.l2_psm) {
 117                 __u16 psm = __le16_to_cpu(la.l2_psm);
 118
 119                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 120                         err = l2cap_validate_bredr_psm(psm);
 121                 else
 122                         err = l2cap_validate_le_psm(psm);
 123
 124                 if (err)
 125                         goto done;
 126         }
 127
 128         if (la.l2_cid)
 129                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 130         else
 131                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 132
 133         if (err < 0)
 134                 goto done;
 135
 136         switch (chan->chan_type) {
 137         case L2CAP_CHAN_CONN_LESS:
 138                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 139                         chan->sec_level = BT_SECURITY_SDP;
 140                 break;
 141         case L2CAP_CHAN_CONN_ORIENTED:
 142                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 143                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 144                         chan->sec_level = BT_SECURITY_SDP;
 145                 break;
 146         case L2CAP_CHAN_RAW:
 147                 chan->sec_level = BT_SECURITY_SDP;
 148                 break;
 149         case L2CAP_CHAN_FIXED:
 150                 /* Fixed channels default to the L2CAP core not holding a
 151                  * hci_conn reference for them. For fixed channels mapping to
 152                  * L2CAP sockets we do want to hold a reference so set the
 153                  * appropriate flag to request it.
 154                  */
 155                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 156                 break;
 157         }
 158
 159         bacpy(&chan->src, &la.l2_bdaddr);
 160         chan->src_type = la.l2_bdaddr_type;
 161
 162         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 163                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 164
 165         chan->state = BT_BOUND;
 166         sk->sk_state = BT_BOUND;
 167
 168 done:
 169         release_sock(sk);
 170         return err;
 171 }
 172
 173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 174                               int alen, int flags)
 175 {
 176         struct sock *sk = sock->sk;
 177         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 178         struct sockaddr_l2 la;
 179         int len, err = 0;
 180
 181         BT_DBG("sk %p", sk);
 182
 183         if (!addr || alen < sizeof(addr->sa_family) ||
 184             addr->sa_family != AF_BLUETOOTH)
 185                 return -EINVAL;
 186
 187         memset(&la, 0, sizeof(la));
 188         len = min_t(unsigned int, sizeof(la), alen);
 189         memcpy(&la, addr, len);
 190
 191         if (la.l2_cid && la.l2_psm)
 192                 return -EINVAL;
 193
 194         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 195                 return -EINVAL;
 196
 197         /* Check that the socket wasn't bound to something that
 198          * conflicts with the address given to connect(). If chan->src
 199          * is BDADDR_ANY it means bind() was never used, in which case
 200          * chan->src_type and la.l2_bdaddr_type do not need to match.
 201          */
 202         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 203             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 204                 /* Old user space versions will try to incorrectly bind
 205                  * the ATT socket using BDADDR_BREDR. We need to accept
 206                  * this and fix up the source address type only when
 207                  * both the source CID and destination CID indicate
 208                  * ATT. Anything else is an invalid combination.
 209                  */
 210                 if (chan->scid != L2CAP_CID_ATT ||
 211                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 212                         return -EINVAL;
 213
 214                 /* We don't have the hdev available here to make a
 215                  * better decision on random vs public, but since all
 216                  * user space versions that exhibit this issue anyway do
 217                  * not support random local addresses assuming public
 218                  * here is good enough.
 219                  */
 220                 chan->src_type = BDADDR_LE_PUBLIC;
 221         }
 222
 223         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 224                 return -EINVAL;
 225
 226         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 227                 /* We only allow ATT user space socket */
 228                 if (la.l2_cid &&
 229                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 230                         return -EINVAL;
 231         }
 232
 233         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 234                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 235
 236         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 237                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 238         if (err)
 239                 return err;
 240
 241         lock_sock(sk);
 242
 243         err = bt_sock_wait_state(sk, BT_CONNECTED,
 244                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 245
 246         release_sock(sk);
 247
 248         return err;
 249 }
 250
 251 static int l2cap_sock_listen(struct socket *sock, int backlog)
 252 {
 253         struct sock *sk = sock->sk;
 254         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 255         int err = 0;
 256
 257         BT_DBG("sk %p backlog %d", sk, backlog);
 258
 259         lock_sock(sk);
 260
 261         if (sk->sk_state != BT_BOUND) {
 262                 err = -EBADFD;
 263                 goto done;
 264         }
 265
 266         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 267                 err = -EINVAL;
 268                 goto done;
 269         }
 270
 271         switch (chan->mode) {
 272         case L2CAP_MODE_BASIC:
 273         case L2CAP_MODE_LE_FLOWCTL:
 274                 break;
 275         case L2CAP_MODE_ERTM:
 276         case L2CAP_MODE_STREAMING:
 277                 if (!disable_ertm)
 278                         break;
 279                 /* fall through */
 280         default:
 281                 err = -EOPNOTSUPP;
 282                 goto done;
 283         }
 284
 285         sk->sk_max_ack_backlog = backlog;
 286         sk->sk_ack_backlog = 0;
 287
 288         /* Listening channels need to use nested locking in order not to
 289          * cause lockdep warnings when the created child channels end up
 290          * being locked in the same thread as the parent channel.
 291          */
 292         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 293
 294         chan->state = BT_LISTEN;
 295         sk->sk_state = BT_LISTEN;
 296
 297 done:
 298         release_sock(sk);
 299         return err;
 300 }
 301
 302 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 303                              int flags)
 304 {
 305         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 306         struct sock *sk = sock->sk, *nsk;
 307         long timeo;
 308         int err = 0;
 309
 310         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 311
 312         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 313
 314         BT_DBG("sk %p timeo %ld", sk, timeo);
 315
 316         /* Wait for an incoming connection. (wake-one). */
 317         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 318         while (1) {
 319                 if (sk->sk_state != BT_LISTEN) {
 320                         err = -EBADFD;
 321                         break;
 322                 }
 323
 324                 nsk = bt_accept_dequeue(sk, newsock);
 325                 if (nsk)
 326                         break;
 327
 328                 if (!timeo) {
 329                         err = -EAGAIN;
 330                         break;
 331                 }
 332
 333                 if (signal_pending(current)) {
 334                         err = sock_intr_errno(timeo);
 335                         break;
 336                 }
 337
 338                 release_sock(sk);
 339
 340                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 341
 342                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 343         }
 344         remove_wait_queue(sk_sleep(sk), &wait);
 345
 346         if (err)
 347                 goto done;
 348
 349         newsock->state = SS_CONNECTED;
 350
 351         BT_DBG("new socket %p", nsk);
 352
 353 done:
 354         release_sock(sk);
 355         return err;
 356 }
 357
 358 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 359                               int *len, int peer)
 360 {
 361         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 362         struct sock *sk = sock->sk;
 363         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 364
 365         BT_DBG("sock %p, sk %p", sock, sk);
 366
 367         if (peer && sk->sk_state != BT_CONNECTED &&
 368             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 369             sk->sk_state != BT_CONFIG)
 370                 return -ENOTCONN;
 371
 372         memset(la, 0, sizeof(struct sockaddr_l2));
 373         addr->sa_family = AF_BLUETOOTH;
 374         *len = sizeof(struct sockaddr_l2);
 375
 376         la->l2_psm = chan->psm;
 377
 378         if (peer) {
 379                 bacpy(&la->l2_bdaddr, &chan->dst);
 380                 la->l2_cid = cpu_to_le16(chan->dcid);
 381                 la->l2_bdaddr_type = chan->dst_type;
 382         } else {
 383                 bacpy(&la->l2_bdaddr, &chan->src);
 384                 la->l2_cid = cpu_to_le16(chan->scid);
 385                 la->l2_bdaddr_type = chan->src_type;
 386         }
 387
 388         return 0;
 389 }
 390
 391 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 392                                      char __user *optval, int __user *optlen)
 393 {
 394         struct sock *sk = sock->sk;
 395         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 396         struct l2cap_options opts;
 397         struct l2cap_conninfo cinfo;
 398         int len, err = 0;
 399         u32 opt;
 400
 401         BT_DBG("sk %p", sk);
 402
 403         if (get_user(len, optlen))
 404                 return -EFAULT;
 405
 406         lock_sock(sk);
 407
 408         switch (optname) {
 409         case L2CAP_OPTIONS:
 410                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 411                  * legacy ATT code depends on getsockopt for
 412                  * L2CAP_OPTIONS we need to let this pass.
 413                  */
 414                 if (bdaddr_type_is_le(chan->src_type) &&
 415                     chan->scid != L2CAP_CID_ATT) {
 416                         err = -EINVAL;
 417                         break;
 418                 }
 419
 420                 memset(&opts, 0, sizeof(opts));
 421                 opts.imtu     = chan->imtu;
 422                 opts.omtu     = chan->omtu;
 423                 opts.flush_to = chan->flush_to;
 424                 opts.mode     = chan->mode;
 425                 opts.fcs      = chan->fcs;
 426                 opts.max_tx   = chan->max_tx;
 427                 opts.txwin_size = chan->tx_win;
 428
 429                 len = min_t(unsigned int, len, sizeof(opts));
 430                 if (copy_to_user(optval, (char *) &opts, len))
 431                         err = -EFAULT;
 432
 433                 break;
 434
 435         case L2CAP_LM:
 436                 switch (chan->sec_level) {
 437                 case BT_SECURITY_LOW:
 438                         opt = L2CAP_LM_AUTH;
 439                         break;
 440                 case BT_SECURITY_MEDIUM:
 441                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 442                         break;
 443                 case BT_SECURITY_HIGH:
 444                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 445                               L2CAP_LM_SECURE;
 446                         break;
 447                 case BT_SECURITY_FIPS:
 448                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 449                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 450                         break;
 451                 default:
 452                         opt = 0;
 453                         break;
 454                 }
 455
 456                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 457                         opt |= L2CAP_LM_MASTER;
 458
 459                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 460                         opt |= L2CAP_LM_RELIABLE;
 461
 462                 if (put_user(opt, (u32 __user *) optval))
 463                         err = -EFAULT;
 464
 465                 break;
 466
 467         case L2CAP_CONNINFO:
 468                 if (sk->sk_state != BT_CONNECTED &&
 469                     !(sk->sk_state == BT_CONNECT2 &&
 470                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 471                         err = -ENOTCONN;
 472                         break;
 473                 }
 474
 475                 memset(&cinfo, 0, sizeof(cinfo));
 476                 cinfo.hci_handle = chan->conn->hcon->handle;
 477                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 478
 479                 len = min_t(unsigned int, len, sizeof(cinfo));
 480                 if (copy_to_user(optval, (char *) &cinfo, len))
 481                         err = -EFAULT;
 482
 483                 break;
 484
 485         default:
 486                 err = -ENOPROTOOPT;
 487                 break;
 488         }
 489
 490         release_sock(sk);
 491         return err;
 492 }
 493
 494 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 495                                  char __user *optval, int __user *optlen)
 496 {
 497         struct sock *sk = sock->sk;
 498         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 499         struct bt_security sec;
 500         struct bt_power pwr;
 501         int len, err = 0;
 502
 503         BT_DBG("sk %p", sk);
 504
 505         if (level == SOL_L2CAP)
 506                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 507
 508         if (level != SOL_BLUETOOTH)
 509                 return -ENOPROTOOPT;
 510
 511         if (get_user(len, optlen))
 512                 return -EFAULT;
 513
 514         lock_sock(sk);
 515
 516         switch (optname) {
 517         case BT_SECURITY:
 518                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 519                     chan->chan_type != L2CAP_CHAN_FIXED &&
 520                     chan->chan_type != L2CAP_CHAN_RAW) {
 521                         err = -EINVAL;
 522                         break;
 523                 }
 524
 525                 memset(&sec, 0, sizeof(sec));
 526                 if (chan->conn) {
 527                         sec.level = chan->conn->hcon->sec_level;
 528
 529                         if (sk->sk_state == BT_CONNECTED)
 530                                 sec.key_size = chan->conn->hcon->enc_key_size;
 531                 } else {
 532                         sec.level = chan->sec_level;
 533                 }
 534
 535                 len = min_t(unsigned int, len, sizeof(sec));
 536                 if (copy_to_user(optval, (char *) &sec, len))
 537                         err = -EFAULT;
 538
 539                 break;
 540
 541         case BT_DEFER_SETUP:
 542                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 543                         err = -EINVAL;
 544                         break;
 545                 }
 546
 547                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 548                              (u32 __user *) optval))
 549                         err = -EFAULT;
 550
 551                 break;
 552
 553         case BT_FLUSHABLE:
 554                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 555                              (u32 __user *) optval))
 556                         err = -EFAULT;
 557
 558                 break;
 559
 560         case BT_POWER:
 561                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 562                     && sk->sk_type != SOCK_RAW) {
 563                         err = -EINVAL;
 564                         break;
 565                 }
 566
 567                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 568
 569                 len = min_t(unsigned int, len, sizeof(pwr));
 570                 if (copy_to_user(optval, (char *) &pwr, len))
 571                         err = -EFAULT;
 572
 573                 break;
 574
 575         case BT_CHANNEL_POLICY:
 576                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 577                         err = -EFAULT;
 578                 break;
 579
 580         case BT_SNDMTU:
 581                 if (!bdaddr_type_is_le(chan->src_type)) {
 582                         err = -EINVAL;
 583                         break;
 584                 }
 585
 586                 if (sk->sk_state != BT_CONNECTED) {
 587                         err = -ENOTCONN;
 588                         break;
 589                 }
 590
 591                 if (put_user(chan->omtu, (u16 __user *) optval))
 592                         err = -EFAULT;
 593                 break;
 594
 595         case BT_RCVMTU:
 596                 if (!bdaddr_type_is_le(chan->src_type)) {
 597                         err = -EINVAL;
 598                         break;
 599                 }
 600
 601                 if (put_user(chan->imtu, (u16 __user *) optval))
 602                         err = -EFAULT;
 603                 break;
 604
 605         default:
 606                 err = -ENOPROTOOPT;
 607                 break;
 608         }
 609
 610         release_sock(sk);
 611         return err;
 612 }
 613
 614 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 615 {
 616         switch (chan->scid) {
 617         case L2CAP_CID_ATT:
 618                 if (mtu < L2CAP_LE_MIN_MTU)
 619                         return false;
 620                 break;
 621
 622         default:
 623                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 624                         return false;
 625         }
 626
 627         return true;
 628 }
 629
 630 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 631                                      char __user *optval, unsigned int optlen)
 632 {
 633         struct sock *sk = sock->sk;
 634         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 635         struct l2cap_options opts;
 636         int len, err = 0;
 637         u32 opt;
 638
 639         BT_DBG("sk %p", sk);
 640
 641         lock_sock(sk);
 642
 643         switch (optname) {
 644         case L2CAP_OPTIONS:
 645                 if (bdaddr_type_is_le(chan->src_type)) {
 646                         err = -EINVAL;
 647                         break;
 648                 }
 649
 650                 if (sk->sk_state == BT_CONNECTED) {
 651                         err = -EINVAL;
 652                         break;
 653                 }
 654
 655                 opts.imtu     = chan->imtu;
 656                 opts.omtu     = chan->omtu;
 657                 opts.flush_to = chan->flush_to;
 658                 opts.mode     = chan->mode;
 659                 opts.fcs      = chan->fcs;
 660                 opts.max_tx   = chan->max_tx;
 661                 opts.txwin_size = chan->tx_win;
 662
 663                 len = min_t(unsigned int, sizeof(opts), optlen);
 664                 if (copy_from_user((char *) &opts, optval, len)) {
 665                         err = -EFAULT;
 666                         break;
 667                 }
 668
 669                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 670                         err = -EINVAL;
 671                         break;
 672                 }
 673
 674                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 675                         err = -EINVAL;
 676                         break;
 677                 }
 678
 679                 chan->mode = opts.mode;
 680                 switch (chan->mode) {
 681                 case L2CAP_MODE_LE_FLOWCTL:
 682                         break;
 683                 case L2CAP_MODE_BASIC:
 684                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 685                         break;
 686                 case L2CAP_MODE_ERTM:
 687                 case L2CAP_MODE_STREAMING:
 688                         if (!disable_ertm)
 689                                 break;
 690                         /* fall through */
 691                 default:
 692                         err = -EINVAL;
 693                         break;
 694                 }
 695
 696                 chan->imtu = opts.imtu;
 697                 chan->omtu = opts.omtu;
 698                 chan->fcs  = opts.fcs;
 699                 chan->max_tx = opts.max_tx;
 700                 chan->tx_win = opts.txwin_size;
 701                 chan->flush_to = opts.flush_to;
 702                 break;
 703
 704         case L2CAP_LM:
 705                 if (get_user(opt, (u32 __user *) optval)) {
 706                         err = -EFAULT;
 707                         break;
 708                 }
 709
 710                 if (opt & L2CAP_LM_FIPS) {
 711                         err = -EINVAL;
 712                         break;
 713                 }
 714
 715                 if (opt & L2CAP_LM_AUTH)
 716                         chan->sec_level = BT_SECURITY_LOW;
 717                 if (opt & L2CAP_LM_ENCRYPT)
 718                         chan->sec_level = BT_SECURITY_MEDIUM;
 719                 if (opt & L2CAP_LM_SECURE)
 720                         chan->sec_level = BT_SECURITY_HIGH;
 721
 722                 if (opt & L2CAP_LM_MASTER)
 723                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 724                 else
 725                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 726
 727                 if (opt & L2CAP_LM_RELIABLE)
 728                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 729                 else
 730                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 731                 break;
 732
 733         default:
 734                 err = -ENOPROTOOPT;
 735                 break;
 736         }
 737
 738         release_sock(sk);
 739         return err;
 740 }
 741
 742 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 743                                  char __user *optval, unsigned int optlen)
 744 {
 745         struct sock *sk = sock->sk;
 746         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 747         struct bt_security sec;
 748         struct bt_power pwr;
 749         struct l2cap_conn *conn;
 750         int len, err = 0;
 751         u32 opt;
 752
 753         BT_DBG("sk %p", sk);
 754
 755         if (level == SOL_L2CAP)
 756                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 757
 758         if (level != SOL_BLUETOOTH)
 759                 return -ENOPROTOOPT;
 760
 761         lock_sock(sk);
 762
 763         switch (optname) {
 764         case BT_SECURITY:
 765                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 766                     chan->chan_type != L2CAP_CHAN_FIXED &&
 767                     chan->chan_type != L2CAP_CHAN_RAW) {
 768                         err = -EINVAL;
 769                         break;
 770                 }
 771
 772                 sec.level = BT_SECURITY_LOW;
 773
 774                 len = min_t(unsigned int, sizeof(sec), optlen);
 775                 if (copy_from_user((char *) &sec, optval, len)) {
 776                         err = -EFAULT;
 777                         break;
 778                 }
 779
 780                 if (sec.level < BT_SECURITY_LOW ||
 781                     sec.level > BT_SECURITY_HIGH) {
 782                         err = -EINVAL;
 783                         break;
 784                 }
 785
 786                 chan->sec_level = sec.level;
 787
 788                 if (!chan->conn)
 789                         break;
 790
 791                 conn = chan->conn;
 792
 793                 /*change security for LE channels */
 794                 if (chan->scid == L2CAP_CID_ATT) {
 795                         if (smp_conn_security(conn->hcon, sec.level))
 796                                 break;
 797                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 798                         sk->sk_state = BT_CONFIG;
 799                         chan->state = BT_CONFIG;
 800
 801                 /* or for ACL link */
 802                 } else if ((sk->sk_state == BT_CONNECT2 &&
 803                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 804                            sk->sk_state == BT_CONNECTED) {
 805                         if (!l2cap_chan_check_security(chan, true))
 806                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 807                         else
 808                                 sk->sk_state_change(sk);
 809                 } else {
 810                         err = -EINVAL;
 811                 }
 812                 break;
 813
 814         case BT_DEFER_SETUP:
 815                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 816                         err = -EINVAL;
 817                         break;
 818                 }
 819
 820                 if (get_user(opt, (u32 __user *) optval)) {
 821                         err = -EFAULT;
 822                         break;
 823                 }
 824
 825                 if (opt) {
 826                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 827                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 828                 } else {
 829                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 830                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 831                 }
 832                 break;
 833
 834         case BT_FLUSHABLE:
 835                 if (get_user(opt, (u32 __user *) optval)) {
 836                         err = -EFAULT;
 837                         break;
 838                 }
 839
 840                 if (opt > BT_FLUSHABLE_ON) {
 841                         err = -EINVAL;
 842                         break;
 843                 }
 844
 845                 if (opt == BT_FLUSHABLE_OFF) {
 846                         conn = chan->conn;
 847                         /* proceed further only when we have l2cap_conn and
 848                            No Flush support in the LM */
 849                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 850                                 err = -EINVAL;
 851                                 break;
 852                         }
 853                 }
 854
 855                 if (opt)
 856                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 857                 else
 858                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 859                 break;
 860
 861         case BT_POWER:
 862                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 863                     chan->chan_type != L2CAP_CHAN_RAW) {
 864                         err = -EINVAL;
 865                         break;
 866                 }
 867
 868                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 869
 870                 len = min_t(unsigned int, sizeof(pwr), optlen);
 871                 if (copy_from_user((char *) &pwr, optval, len)) {
 872                         err = -EFAULT;
 873                         break;
 874                 }
 875
 876                 if (pwr.force_active)
 877                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 878                 else
 879                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 880                 break;
 881
 882         case BT_CHANNEL_POLICY:
 883                 if (get_user(opt, (u32 __user *) optval)) {
 884                         err = -EFAULT;
 885                         break;
 886                 }
 887
 888                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 889                         err = -EINVAL;
 890                         break;
 891                 }
 892
 893                 if (chan->mode != L2CAP_MODE_ERTM &&
 894                     chan->mode != L2CAP_MODE_STREAMING) {
 895                         err = -EOPNOTSUPP;
 896                         break;
 897                 }
 898
 899                 chan->chan_policy = (u8) opt;
 900
 901                 if (sk->sk_state == BT_CONNECTED &&
 902                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 903                         l2cap_move_start(chan);
 904
 905                 break;
 906
 907         case BT_SNDMTU:
 908                 if (!bdaddr_type_is_le(chan->src_type)) {
 909                         err = -EINVAL;
 910                         break;
 911                 }
 912
 913                 /* Setting is not supported as it's the remote side that
 914                  * decides this.
 915                  */
 916                 err = -EPERM;
 917                 break;
 918
 919         case BT_RCVMTU:
 920                 if (!bdaddr_type_is_le(chan->src_type)) {
 921                         err = -EINVAL;
 922                         break;
 923                 }
 924
 925                 if (sk->sk_state == BT_CONNECTED) {
 926                         err = -EISCONN;
 927                         break;
 928                 }
 929
 930                 if (get_user(opt, (u32 __user *) optval)) {
 931                         err = -EFAULT;
 932                         break;
 933                 }
 934
 935                 chan->imtu = opt;
 936                 break;
 937
 938         default:
 939                 err = -ENOPROTOOPT;
 940                 break;
 941         }
 942
 943         release_sock(sk);
 944         return err;
 945 }
 946
 947 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 948                               size_t len)
 949 {
 950         struct sock *sk = sock->sk;
 951         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 952         int err;
 953
 954         BT_DBG("sock %p, sk %p", sock, sk);
 955
 956         err = sock_error(sk);
 957         if (err)
 958                 return err;
 959
 960         if (msg->msg_flags & MSG_OOB)
 961                 return -EOPNOTSUPP;
 962
 963         if (sk->sk_state != BT_CONNECTED)
 964                 return -ENOTCONN;
 965
 966         lock_sock(sk);
 967         err = bt_sock_wait_ready(sk, msg->msg_flags);
 968         release_sock(sk);
 969         if (err)
 970                 return err;
 971
 972         l2cap_chan_lock(chan);
 973         err = l2cap_chan_send(chan, msg, len);
 974         l2cap_chan_unlock(chan);
 975
 976         return err;
 977 }
 978
 979 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 980                               size_t len, int flags)
 981 {
 982         struct sock *sk = sock->sk;
 983         struct l2cap_pinfo *pi = l2cap_pi(sk);
 984         int err;
 985
 986         lock_sock(sk);
 987
 988         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
 989                                                     &bt_sk(sk)->flags)) {
 990                 if (bdaddr_type_is_le(pi->chan->src_type)) {
 991                         sk->sk_state = BT_CONNECTED;
 992                         pi->chan->state = BT_CONNECTED;
 993                         __l2cap_le_connect_rsp_defer(pi->chan);
 994                 } else {
 995                         sk->sk_state = BT_CONFIG;
 996                         pi->chan->state = BT_CONFIG;
 997                         __l2cap_connect_rsp_defer(pi->chan);
 998                 }
 999
1000                 err = 0;
1001                 goto done;
1002         }
1003
1004         release_sock(sk);
1005
1006         if (sock->type == SOCK_STREAM)
1007                 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1008         else
1009                 err = bt_sock_recvmsg(sock, msg, len, flags);
1010
1011         if (pi->chan->mode != L2CAP_MODE_ERTM)
1012                 return err;
1013
1014         /* Attempt to put pending rx data in the socket buffer */
1015
1016         lock_sock(sk);
1017
1018         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1019                 goto done;
1020
1021         if (pi->rx_busy_skb) {
1022                 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1023                         pi->rx_busy_skb = NULL;
1024                 else
1025                         goto done;
1026         }
1027
1028         /* Restore data flow when half of the receive buffer is
1029          * available.  This avoids resending large numbers of
1030          * frames.
1031          */
1032         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1033                 l2cap_chan_busy(pi->chan, 0);
1034
1035 done:
1036         release_sock(sk);
1037         return err;
1038 }
1039
1040 /* Kill socket (only if zapped and orphan)
1041  * Must be called on unlocked socket.
1042  */
1043 static void l2cap_sock_kill(struct sock *sk)
1044 {
1045         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1046                 return;
1047
1048         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1049
1050         /* Kill poor orphan */
1051
1052         l2cap_chan_put(l2cap_pi(sk)->chan);
1053         sock_set_flag(sk, SOCK_DEAD);
1054         sock_put(sk);
1055 }
1056
1057 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1058 {
1059         DECLARE_WAITQUEUE(wait, current);
1060         int err = 0;
1061         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1062         /* Timeout to prevent infinite loop */
1063         unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1064
1065         add_wait_queue(sk_sleep(sk), &wait);
1066         set_current_state(TASK_INTERRUPTIBLE);
1067         do {
1068                 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1069                        chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1070                        jiffies_to_msecs(timeout - jiffies));
1071
1072                 if (!timeo)
1073                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1074
1075                 if (signal_pending(current)) {
1076                         err = sock_intr_errno(timeo);
1077                         break;
1078                 }
1079
1080                 release_sock(sk);
1081                 timeo = schedule_timeout(timeo);
1082                 lock_sock(sk);
1083                 set_current_state(TASK_INTERRUPTIBLE);
1084
1085                 err = sock_error(sk);
1086                 if (err)
1087                         break;
1088
1089                 if (time_after(jiffies, timeout)) {
1090                         err = -ENOLINK;
1091                         break;
1092                 }
1093
1094         } while (chan->unacked_frames > 0 &&
1095                  chan->state == BT_CONNECTED);
1096
1097         set_current_state(TASK_RUNNING);
1098         remove_wait_queue(sk_sleep(sk), &wait);
1099         return err;
1100 }
1101
1102 static int l2cap_sock_shutdown(struct socket *sock, int how)
1103 {
1104         struct sock *sk = sock->sk;
1105         struct l2cap_chan *chan;
1106         struct l2cap_conn *conn;
1107         int err = 0;
1108
1109         BT_DBG("sock %p, sk %p", sock, sk);
1110
1111         if (!sk)
1112                 return 0;
1113
1114         /* prevent sk structure from being freed whilst unlocked */
1115         sock_hold(sk);
1116
1117         chan = l2cap_pi(sk)->chan;
1118         /* prevent chan structure from being freed whilst unlocked */
1119         l2cap_chan_hold(chan);
1120         conn = chan->conn;
1121
1122         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1123
1124         if (conn)
1125                 mutex_lock(&conn->chan_lock);
1126
1127         l2cap_chan_lock(chan);
1128         lock_sock(sk);
1129
1130         if (!sk->sk_shutdown) {
1131                 if (chan->mode == L2CAP_MODE_ERTM &&
1132                     chan->unacked_frames > 0 &&
1133                     chan->state == BT_CONNECTED)
1134                         err = __l2cap_wait_ack(sk, chan);
1135
1136                 sk->sk_shutdown = SHUTDOWN_MASK;
1137
1138                 release_sock(sk);
1139                 l2cap_chan_close(chan, 0);
1140                 lock_sock(sk);
1141
1142                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1143                     !(current->flags & PF_EXITING))
1144                         err = bt_sock_wait_state(sk, BT_CLOSED,
1145                                                  sk->sk_lingertime);
1146         }
1147
1148         if (!err && sk->sk_err)
1149                 err = -sk->sk_err;
1150
1151         release_sock(sk);
1152         l2cap_chan_unlock(chan);
1153
1154         if (conn)
1155                 mutex_unlock(&conn->chan_lock);
1156
1157         l2cap_chan_put(chan);
1158         sock_put(sk);
1159
1160         BT_DBG("err: %d", err);
1161
1162         return err;
1163 }
1164
1165 static int l2cap_sock_release(struct socket *sock)
1166 {
1167         struct sock *sk = sock->sk;
1168         int err;
1169
1170         BT_DBG("sock %p, sk %p", sock, sk);
1171
1172         if (!sk)
1173                 return 0;
1174
1175         bt_sock_unlink(&l2cap_sk_list, sk);
1176
1177         err = l2cap_sock_shutdown(sock, 2);
1178
1179         sock_orphan(sk);
1180         l2cap_sock_kill(sk);
1181         return err;
1182 }
1183
1184 static void l2cap_sock_cleanup_listen(struct sock *parent)
1185 {
1186         struct sock *sk;
1187
1188         BT_DBG("parent %p state %s", parent,
1189                state_to_string(parent->sk_state));
1190
1191         /* Close not yet accepted channels */
1192         while ((sk = bt_accept_dequeue(parent, NULL))) {
1193                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1194
1195                 BT_DBG("child chan %p state %s", chan,
1196                        state_to_string(chan->state));
1197
1198                 l2cap_chan_lock(chan);
1199                 __clear_chan_timer(chan);
1200                 l2cap_chan_close(chan, ECONNRESET);
1201                 l2cap_chan_unlock(chan);
1202
1203                 l2cap_sock_kill(sk);
1204         }
1205 }
1206
1207 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1208 {
1209         struct sock *sk, *parent = chan->data;
1210
1211         lock_sock(parent);
1212
1213         /* Check for backlog size */
1214         if (sk_acceptq_is_full(parent)) {
1215                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1216                 release_sock(parent);
1217                 return NULL;
1218         }
1219
1220         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1221                               GFP_ATOMIC, 0);
1222         if (!sk) {
1223                 release_sock(parent);
1224                 return NULL;
1225         }
1226
1227         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1228
1229         l2cap_sock_init(sk, parent);
1230
1231         bt_accept_enqueue(parent, sk);
1232
1233         release_sock(parent);
1234
1235         return l2cap_pi(sk)->chan;
1236 }
1237
1238 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1239 {
1240         struct sock *sk = chan->data;
1241         int err;
1242
1243         lock_sock(sk);
1244
1245         if (l2cap_pi(sk)->rx_busy_skb) {
1246                 err = -ENOMEM;
1247                 goto done;
1248         }
1249
1250         err = sock_queue_rcv_skb(sk, skb);
1251
1252         /* For ERTM, handle one skb that doesn't fit into the recv
1253          * buffer.  This is important to do because the data frames
1254          * have already been acked, so the skb cannot be discarded.
1255          *
1256          * Notify the l2cap core that the buffer is full, so the
1257          * LOCAL_BUSY state is entered and no more frames are
1258          * acked and reassembled until there is buffer space
1259          * available.
1260          */
1261         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1262                 l2cap_pi(sk)->rx_busy_skb = skb;
1263                 l2cap_chan_busy(chan, 1);
1264                 err = 0;
1265         }
1266
1267 done:
1268         release_sock(sk);
1269
1270         return err;
1271 }
1272
1273 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1274 {
1275         struct sock *sk = chan->data;
1276
1277         l2cap_sock_kill(sk);
1278 }
1279
1280 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1281 {
1282         struct sock *sk = chan->data;
1283         struct sock *parent;
1284
1285         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1286
1287         /* This callback can be called both for server (BT_LISTEN)
1288          * sockets as well as "normal" ones. To avoid lockdep warnings
1289          * with child socket locking (through l2cap_sock_cleanup_listen)
1290          * we need separation into separate nesting levels. The simplest
1291          * way to accomplish this is to inherit the nesting level used
1292          * for the channel.
1293          */
1294         lock_sock_nested(sk, atomic_read(&chan->nesting));
1295
1296         parent = bt_sk(sk)->parent;
1297
1298         sock_set_flag(sk, SOCK_ZAPPED);
1299
1300         switch (chan->state) {
1301         case BT_OPEN:
1302         case BT_BOUND:
1303         case BT_CLOSED:
1304                 break;
1305         case BT_LISTEN:
1306                 l2cap_sock_cleanup_listen(sk);
1307                 sk->sk_state = BT_CLOSED;
1308                 chan->state = BT_CLOSED;
1309
1310                 break;
1311         default:
1312                 sk->sk_state = BT_CLOSED;
1313                 chan->state = BT_CLOSED;
1314
1315                 sk->sk_err = err;
1316
1317                 if (parent) {
1318                         bt_accept_unlink(sk);
1319                         parent->sk_data_ready(parent);
1320                 } else {
1321                         sk->sk_state_change(sk);
1322                 }
1323
1324                 break;
1325         }
1326
1327         release_sock(sk);
1328 }
1329
1330 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1331                                        int err)
1332 {
1333         struct sock *sk = chan->data;
1334
1335         sk->sk_state = state;
1336
1337         if (err)
1338                 sk->sk_err = err;
1339 }
1340
1341 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1342                                                unsigned long hdr_len,
1343                                                unsigned long len, int nb)
1344 {
1345         struct sock *sk = chan->data;
1346         struct sk_buff *skb;
1347         int err;
1348
1349         l2cap_chan_unlock(chan);
1350         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1351         l2cap_chan_lock(chan);
1352
1353         if (!skb)
1354                 return ERR_PTR(err);
1355
1356         skb->priority = sk->sk_priority;
1357
1358         bt_cb(skb)->l2cap.chan = chan;
1359
1360         return skb;
1361 }
1362
1363 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1364 {
1365         struct sock *sk = chan->data;
1366         struct sock *parent;
1367
1368         lock_sock(sk);
1369
1370         parent = bt_sk(sk)->parent;
1371
1372         BT_DBG("sk %p, parent %p", sk, parent);
1373
1374         sk->sk_state = BT_CONNECTED;
1375         sk->sk_state_change(sk);
1376
1377         if (parent)
1378                 parent->sk_data_ready(parent);
1379
1380         release_sock(sk);
1381 }
1382
1383 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1384 {
1385         struct sock *parent, *sk = chan->data;
1386
1387         lock_sock(sk);
1388
1389         parent = bt_sk(sk)->parent;
1390         if (parent)
1391                 parent->sk_data_ready(parent);
1392
1393         release_sock(sk);
1394 }
1395
1396 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1397 {
1398         struct sock *sk = chan->data;
1399
1400         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1401                 sk->sk_state = BT_CONNECTED;
1402                 chan->state = BT_CONNECTED;
1403         }
1404
1405         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1406         sk->sk_state_change(sk);
1407 }
1408
1409 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1410 {
1411         struct sock *sk = chan->data;
1412
1413         lock_sock(sk);
1414         sk->sk_shutdown = SHUTDOWN_MASK;
1415         release_sock(sk);
1416 }
1417
1418 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1419 {
1420         struct sock *sk = chan->data;
1421
1422         return sk->sk_sndtimeo;
1423 }
1424
1425 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1426 {
1427         struct sock *sk = chan->data;
1428
1429         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1430         sk->sk_state_change(sk);
1431 }
1432
1433 static const struct l2cap_ops l2cap_chan_ops = {
1434         .name                   = "L2CAP Socket Interface",
1435         .new_connection         = l2cap_sock_new_connection_cb,
1436         .recv                   = l2cap_sock_recv_cb,
1437         .close                  = l2cap_sock_close_cb,
1438         .teardown               = l2cap_sock_teardown_cb,
1439         .state_change           = l2cap_sock_state_change_cb,
1440         .ready                  = l2cap_sock_ready_cb,
1441         .defer                  = l2cap_sock_defer_cb,
1442         .resume                 = l2cap_sock_resume_cb,
1443         .suspend                = l2cap_sock_suspend_cb,
1444         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1445         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1446         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1447 };
1448
1449 static void l2cap_sock_destruct(struct sock *sk)
1450 {
1451         BT_DBG("sk %p", sk);
1452
1453         if (l2cap_pi(sk)->chan)
1454                 l2cap_chan_put(l2cap_pi(sk)->chan);
1455
1456         if (l2cap_pi(sk)->rx_busy_skb) {
1457                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1458                 l2cap_pi(sk)->rx_busy_skb = NULL;
1459         }
1460
1461         skb_queue_purge(&sk->sk_receive_queue);
1462         skb_queue_purge(&sk->sk_write_queue);
1463 }
1464
1465 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1466                                int *msg_namelen)
1467 {
1468         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1469
1470         memset(la, 0, sizeof(struct sockaddr_l2));
1471         la->l2_family = AF_BLUETOOTH;
1472         la->l2_psm = bt_cb(skb)->l2cap.psm;
1473         bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1474
1475         *msg_namelen = sizeof(struct sockaddr_l2);
1476 }
1477
1478 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1479 {
1480         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1481
1482         BT_DBG("sk %p", sk);
1483
1484         if (parent) {
1485                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1486
1487                 sk->sk_type = parent->sk_type;
1488                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1489
1490                 chan->chan_type = pchan->chan_type;
1491                 chan->imtu = pchan->imtu;
1492                 chan->omtu = pchan->omtu;
1493                 chan->conf_state = pchan->conf_state;
1494                 chan->mode = pchan->mode;
1495                 chan->fcs  = pchan->fcs;
1496                 chan->max_tx = pchan->max_tx;
1497                 chan->tx_win = pchan->tx_win;
1498                 chan->tx_win_max = pchan->tx_win_max;
1499                 chan->sec_level = pchan->sec_level;
1500                 chan->flags = pchan->flags;
1501                 chan->tx_credits = pchan->tx_credits;
1502                 chan->rx_credits = pchan->rx_credits;
1503
1504                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1505                         chan->scid = pchan->scid;
1506                         chan->dcid = pchan->scid;
1507                 }
1508
1509                 security_sk_clone(parent, sk);
1510         } else {
1511                 switch (sk->sk_type) {
1512                 case SOCK_RAW:
1513                         chan->chan_type = L2CAP_CHAN_RAW;
1514                         break;
1515                 case SOCK_DGRAM:
1516                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1517                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1518                         break;
1519                 case SOCK_SEQPACKET:
1520                 case SOCK_STREAM:
1521                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1522                         break;
1523                 }
1524
1525                 chan->imtu = L2CAP_DEFAULT_MTU;
1526                 chan->omtu = 0;
1527                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1528                         chan->mode = L2CAP_MODE_ERTM;
1529                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1530                 } else {
1531                         chan->mode = L2CAP_MODE_BASIC;
1532                 }
1533
1534                 l2cap_chan_set_defaults(chan);
1535         }
1536
1537         /* Default config options */
1538         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1539
1540         chan->data = sk;
1541         chan->ops = &l2cap_chan_ops;
1542 }
1543
1544 static struct proto l2cap_proto = {
1545         .name           = "L2CAP",
1546         .owner          = THIS_MODULE,
1547         .obj_size       = sizeof(struct l2cap_pinfo)
1548 };
1549
1550 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1551                                      int proto, gfp_t prio, int kern)
1552 {
1553         struct sock *sk;
1554         struct l2cap_chan *chan;
1555
1556         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1557         if (!sk)
1558                 return NULL;
1559
1560         sock_init_data(sock, sk);
1561         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1562
1563         sk->sk_destruct = l2cap_sock_destruct;
1564         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1565
1566         sock_reset_flag(sk, SOCK_ZAPPED);
1567
1568         sk->sk_protocol = proto;
1569         sk->sk_state = BT_OPEN;
1570
1571         chan = l2cap_chan_create();
1572         if (!chan) {
1573                 sk_free(sk);
1574                 return NULL;
1575         }
1576
1577         l2cap_chan_hold(chan);
1578
1579         l2cap_pi(sk)->chan = chan;
1580
1581         return sk;
1582 }
1583
1584 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1585                              int kern)
1586 {
1587         struct sock *sk;
1588
1589         BT_DBG("sock %p", sock);
1590
1591         sock->state = SS_UNCONNECTED;
1592
1593         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1594             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1595                 return -ESOCKTNOSUPPORT;
1596
1597         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1598                 return -EPERM;
1599
1600         sock->ops = &l2cap_sock_ops;
1601
1602         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1603         if (!sk)
1604                 return -ENOMEM;
1605
1606         l2cap_sock_init(sk, NULL);
1607         bt_sock_link(&l2cap_sk_list, sk);
1608         return 0;
1609 }
1610
1611 static const struct proto_ops l2cap_sock_ops = {
1612         .family         = PF_BLUETOOTH,
1613         .owner          = THIS_MODULE,
1614         .release        = l2cap_sock_release,
1615         .bind           = l2cap_sock_bind,
1616         .connect        = l2cap_sock_connect,
1617         .listen         = l2cap_sock_listen,
1618         .accept         = l2cap_sock_accept,
1619         .getname        = l2cap_sock_getname,
1620         .sendmsg        = l2cap_sock_sendmsg,
1621         .recvmsg        = l2cap_sock_recvmsg,
1622         .poll           = bt_sock_poll,
1623         .ioctl          = bt_sock_ioctl,
1624         .mmap           = sock_no_mmap,
1625         .socketpair     = sock_no_socketpair,
1626         .shutdown       = l2cap_sock_shutdown,
1627         .setsockopt     = l2cap_sock_setsockopt,
1628         .getsockopt     = l2cap_sock_getsockopt
1629 };
1630
1631 static const struct net_proto_family l2cap_sock_family_ops = {
1632         .family = PF_BLUETOOTH,
1633         .owner  = THIS_MODULE,
1634         .create = l2cap_sock_create,
1635 };
1636
1637 int __init l2cap_init_sockets(void)
1638 {
1639         int err;
1640
1641         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1642
1643         err = proto_register(&l2cap_proto, 0);
1644         if (err < 0)
1645                 return err;
1646
1647         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1648         if (err < 0) {
1649                 BT_ERR("L2CAP socket registration failed");
1650                 goto error;
1651         }
1652
1653         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1654                              NULL);
1655         if (err < 0) {
1656                 BT_ERR("Failed to create L2CAP proc file");
1657                 bt_sock_unregister(BTPROTO_L2CAP);
1658                 goto error;
1659         }
1660
1661         BT_INFO("L2CAP socket layer initialized");
1662
1663         return 0;
1664
1665 error:
1666         proto_unregister(&l2cap_proto);
1667         return err;
1668 }
1669
1670 void l2cap_cleanup_sockets(void)
1671 {
1672         bt_procfs_cleanup(&init_net, "l2cap");
1673         bt_sock_unregister(BTPROTO_L2CAP);
1674         proto_unregister(&l2cap_proto);
1675 }