net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36
  37 #include "smp.h"
  38
  39 static struct bt_sock_list l2cap_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  41 };
  42
  43 static const struct proto_ops l2cap_sock_ops;
  44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  46                                      int proto, gfp_t prio);
  47
  48 bool l2cap_is_socket(struct socket *sock)
  49 {
  50         return sock && sock->ops == &l2cap_sock_ops;
  51 }
  52 EXPORT_SYMBOL(l2cap_is_socket);
  53
  54 static int l2cap_validate_bredr_psm(u16 psm)
  55 {
  56         /* PSM must be odd and lsb of upper byte must be 0 */
  57         if ((psm & 0x0101) != 0x0001)
  58                 return -EINVAL;
  59
  60         /* Restrict usage of well-known PSMs */
  61         if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
  62                 return -EACCES;
  63
  64         return 0;
  65 }
  66
  67 static int l2cap_validate_le_psm(u16 psm)
  68 {
  69         /* Valid LE_PSM ranges are defined only until 0x00ff */
  70         if (psm > 0x00ff)
  71                 return -EINVAL;
  72
  73         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  74         if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
  75                 return -EACCES;
  76
  77         return 0;
  78 }
  79
  80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  81 {
  82         struct sock *sk = sock->sk;
  83         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  84         struct sockaddr_l2 la;
  85         int len, err = 0;
  86
  87         BT_DBG("sk %p", sk);
  88
  89         if (!addr || addr->sa_family != AF_BLUETOOTH)
  90                 return -EINVAL;
  91
  92         memset(&la, 0, sizeof(la));
  93         len = min_t(unsigned int, sizeof(la), alen);
  94         memcpy(&la, addr, len);
  95
  96         if (la.l2_cid && la.l2_psm)
  97                 return -EINVAL;
  98
  99         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 100                 return -EINVAL;
 101
 102         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 103                 /* We only allow ATT user space socket */
 104                 if (la.l2_cid &&
 105                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 106                         return -EINVAL;
 107         }
 108
 109         lock_sock(sk);
 110
 111         if (sk->sk_state != BT_OPEN) {
 112                 err = -EBADFD;
 113                 goto done;
 114         }
 115
 116         if (la.l2_psm) {
 117                 __u16 psm = __le16_to_cpu(la.l2_psm);
 118
 119                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 120                         err = l2cap_validate_bredr_psm(psm);
 121                 else
 122                         err = l2cap_validate_le_psm(psm);
 123
 124                 if (err)
 125                         goto done;
 126         }
 127
 128         if (la.l2_cid)
 129                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 130         else
 131                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 132
 133         if (err < 0)
 134                 goto done;
 135
 136         switch (chan->chan_type) {
 137         case L2CAP_CHAN_CONN_LESS:
 138                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 139                         chan->sec_level = BT_SECURITY_SDP;
 140                 break;
 141         case L2CAP_CHAN_CONN_ORIENTED:
 142                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 143                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 144                         chan->sec_level = BT_SECURITY_SDP;
 145                 break;
 146         case L2CAP_CHAN_RAW:
 147                 chan->sec_level = BT_SECURITY_SDP;
 148                 break;
 149         case L2CAP_CHAN_FIXED:
 150                 /* Fixed channels default to the L2CAP core not holding a
 151                  * hci_conn reference for them. For fixed channels mapping to
 152                  * L2CAP sockets we do want to hold a reference so set the
 153                  * appropriate flag to request it.
 154                  */
 155                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 156                 break;
 157         }
 158
 159         bacpy(&chan->src, &la.l2_bdaddr);
 160         chan->src_type = la.l2_bdaddr_type;
 161
 162         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 163                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 164
 165         chan->state = BT_BOUND;
 166         sk->sk_state = BT_BOUND;
 167
 168 done:
 169         release_sock(sk);
 170         return err;
 171 }
 172
 173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 174                               int alen, int flags)
 175 {
 176         struct sock *sk = sock->sk;
 177         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 178         struct sockaddr_l2 la;
 179         int len, err = 0;
 180
 181         BT_DBG("sk %p", sk);
 182
 183         if (!addr || alen < sizeof(addr->sa_family) ||
 184             addr->sa_family != AF_BLUETOOTH)
 185                 return -EINVAL;
 186
 187         memset(&la, 0, sizeof(la));
 188         len = min_t(unsigned int, sizeof(la), alen);
 189         memcpy(&la, addr, len);
 190
 191         if (la.l2_cid && la.l2_psm)
 192                 return -EINVAL;
 193
 194         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 195                 return -EINVAL;
 196
 197         /* Check that the socket wasn't bound to something that
 198          * conflicts with the address given to connect(). If chan->src
 199          * is BDADDR_ANY it means bind() was never used, in which case
 200          * chan->src_type and la.l2_bdaddr_type do not need to match.
 201          */
 202         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 203             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 204                 /* Old user space versions will try to incorrectly bind
 205                  * the ATT socket using BDADDR_BREDR. We need to accept
 206                  * this and fix up the source address type only when
 207                  * both the source CID and destination CID indicate
 208                  * ATT. Anything else is an invalid combination.
 209                  */
 210                 if (chan->scid != L2CAP_CID_ATT ||
 211                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 212                         return -EINVAL;
 213
 214                 /* We don't have the hdev available here to make a
 215                  * better decision on random vs public, but since all
 216                  * user space versions that exhibit this issue anyway do
 217                  * not support random local addresses assuming public
 218                  * here is good enough.
 219                  */
 220                 chan->src_type = BDADDR_LE_PUBLIC;
 221         }
 222
 223         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 224                 return -EINVAL;
 225
 226         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 227                 /* We only allow ATT user space socket */
 228                 if (la.l2_cid &&
 229                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 230                         return -EINVAL;
 231         }
 232
 233         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 234                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 235
 236         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 237                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 238         if (err)
 239                 return err;
 240
 241         lock_sock(sk);
 242
 243         err = bt_sock_wait_state(sk, BT_CONNECTED,
 244                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 245
 246         release_sock(sk);
 247
 248         return err;
 249 }
 250
 251 static int l2cap_sock_listen(struct socket *sock, int backlog)
 252 {
 253         struct sock *sk = sock->sk;
 254         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 255         int err = 0;
 256
 257         BT_DBG("sk %p backlog %d", sk, backlog);
 258
 259         lock_sock(sk);
 260
 261         if (sk->sk_state != BT_BOUND) {
 262                 err = -EBADFD;
 263                 goto done;
 264         }
 265
 266         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 267                 err = -EINVAL;
 268                 goto done;
 269         }
 270
 271         switch (chan->mode) {
 272         case L2CAP_MODE_BASIC:
 273         case L2CAP_MODE_LE_FLOWCTL:
 274                 break;
 275         case L2CAP_MODE_ERTM:
 276         case L2CAP_MODE_STREAMING:
 277                 if (!disable_ertm)
 278                         break;
 279                 /* fall through */
 280         default:
 281                 err = -EOPNOTSUPP;
 282                 goto done;
 283         }
 284
 285         sk->sk_max_ack_backlog = backlog;
 286         sk->sk_ack_backlog = 0;
 287
 288         /* Listening channels need to use nested locking in order not to
 289          * cause lockdep warnings when the created child channels end up
 290          * being locked in the same thread as the parent channel.
 291          */
 292         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 293
 294         chan->state = BT_LISTEN;
 295         sk->sk_state = BT_LISTEN;
 296
 297 done:
 298         release_sock(sk);
 299         return err;
 300 }
 301
 302 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 303                              int flags)
 304 {
 305         DECLARE_WAITQUEUE(wait, current);
 306         struct sock *sk = sock->sk, *nsk;
 307         long timeo;
 308         int err = 0;
 309
 310         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 311
 312         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 313
 314         BT_DBG("sk %p timeo %ld", sk, timeo);
 315
 316         /* Wait for an incoming connection. (wake-one). */
 317         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 318         while (1) {
 319                 set_current_state(TASK_INTERRUPTIBLE);
 320
 321                 if (sk->sk_state != BT_LISTEN) {
 322                         err = -EBADFD;
 323                         break;
 324                 }
 325
 326                 nsk = bt_accept_dequeue(sk, newsock);
 327                 if (nsk)
 328                         break;
 329
 330                 if (!timeo) {
 331                         err = -EAGAIN;
 332                         break;
 333                 }
 334
 335                 if (signal_pending(current)) {
 336                         err = sock_intr_errno(timeo);
 337                         break;
 338                 }
 339
 340                 release_sock(sk);
 341                 timeo = schedule_timeout(timeo);
 342                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 343         }
 344         __set_current_state(TASK_RUNNING);
 345         remove_wait_queue(sk_sleep(sk), &wait);
 346
 347         if (err)
 348                 goto done;
 349
 350         newsock->state = SS_CONNECTED;
 351
 352         BT_DBG("new socket %p", nsk);
 353
 354 done:
 355         release_sock(sk);
 356         return err;
 357 }
 358
 359 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 360                               int *len, int peer)
 361 {
 362         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 363         struct sock *sk = sock->sk;
 364         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 365
 366         BT_DBG("sock %p, sk %p", sock, sk);
 367
 368         if (peer && sk->sk_state != BT_CONNECTED &&
 369             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 370             sk->sk_state != BT_CONFIG)
 371                 return -ENOTCONN;
 372
 373         memset(la, 0, sizeof(struct sockaddr_l2));
 374         addr->sa_family = AF_BLUETOOTH;
 375         *len = sizeof(struct sockaddr_l2);
 376
 377         la->l2_psm = chan->psm;
 378
 379         if (peer) {
 380                 bacpy(&la->l2_bdaddr, &chan->dst);
 381                 la->l2_cid = cpu_to_le16(chan->dcid);
 382                 la->l2_bdaddr_type = chan->dst_type;
 383         } else {
 384                 bacpy(&la->l2_bdaddr, &chan->src);
 385                 la->l2_cid = cpu_to_le16(chan->scid);
 386                 la->l2_bdaddr_type = chan->src_type;
 387         }
 388
 389         return 0;
 390 }
 391
 392 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 393                                      char __user *optval, int __user *optlen)
 394 {
 395         struct sock *sk = sock->sk;
 396         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 397         struct l2cap_options opts;
 398         struct l2cap_conninfo cinfo;
 399         int len, err = 0;
 400         u32 opt;
 401
 402         BT_DBG("sk %p", sk);
 403
 404         if (get_user(len, optlen))
 405                 return -EFAULT;
 406
 407         lock_sock(sk);
 408
 409         switch (optname) {
 410         case L2CAP_OPTIONS:
 411                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 412                  * legacy ATT code depends on getsockopt for
 413                  * L2CAP_OPTIONS we need to let this pass.
 414                  */
 415                 if (bdaddr_type_is_le(chan->src_type) &&
 416                     chan->scid != L2CAP_CID_ATT) {
 417                         err = -EINVAL;
 418                         break;
 419                 }
 420
 421                 memset(&opts, 0, sizeof(opts));
 422                 opts.imtu     = chan->imtu;
 423                 opts.omtu     = chan->omtu;
 424                 opts.flush_to = chan->flush_to;
 425                 opts.mode     = chan->mode;
 426                 opts.fcs      = chan->fcs;
 427                 opts.max_tx   = chan->max_tx;
 428                 opts.txwin_size = chan->tx_win;
 429
 430                 len = min_t(unsigned int, len, sizeof(opts));
 431                 if (copy_to_user(optval, (char *) &opts, len))
 432                         err = -EFAULT;
 433
 434                 break;
 435
 436         case L2CAP_LM:
 437                 switch (chan->sec_level) {
 438                 case BT_SECURITY_LOW:
 439                         opt = L2CAP_LM_AUTH;
 440                         break;
 441                 case BT_SECURITY_MEDIUM:
 442                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 443                         break;
 444                 case BT_SECURITY_HIGH:
 445                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 446                               L2CAP_LM_SECURE;
 447                         break;
 448                 case BT_SECURITY_FIPS:
 449                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 450                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 451                         break;
 452                 default:
 453                         opt = 0;
 454                         break;
 455                 }
 456
 457                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 458                         opt |= L2CAP_LM_MASTER;
 459
 460                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 461                         opt |= L2CAP_LM_RELIABLE;
 462
 463                 if (put_user(opt, (u32 __user *) optval))
 464                         err = -EFAULT;
 465
 466                 break;
 467
 468         case L2CAP_CONNINFO:
 469                 if (sk->sk_state != BT_CONNECTED &&
 470                     !(sk->sk_state == BT_CONNECT2 &&
 471                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 472                         err = -ENOTCONN;
 473                         break;
 474                 }
 475
 476                 memset(&cinfo, 0, sizeof(cinfo));
 477                 cinfo.hci_handle = chan->conn->hcon->handle;
 478                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 479
 480                 len = min_t(unsigned int, len, sizeof(cinfo));
 481                 if (copy_to_user(optval, (char *) &cinfo, len))
 482                         err = -EFAULT;
 483
 484                 break;
 485
 486         default:
 487                 err = -ENOPROTOOPT;
 488                 break;
 489         }
 490
 491         release_sock(sk);
 492         return err;
 493 }
 494
 495 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 496                                  char __user *optval, int __user *optlen)
 497 {
 498         struct sock *sk = sock->sk;
 499         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 500         struct bt_security sec;
 501         struct bt_power pwr;
 502         int len, err = 0;
 503
 504         BT_DBG("sk %p", sk);
 505
 506         if (level == SOL_L2CAP)
 507                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 508
 509         if (level != SOL_BLUETOOTH)
 510                 return -ENOPROTOOPT;
 511
 512         if (get_user(len, optlen))
 513                 return -EFAULT;
 514
 515         lock_sock(sk);
 516
 517         switch (optname) {
 518         case BT_SECURITY:
 519                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 520                     chan->chan_type != L2CAP_CHAN_FIXED &&
 521                     chan->chan_type != L2CAP_CHAN_RAW) {
 522                         err = -EINVAL;
 523                         break;
 524                 }
 525
 526                 memset(&sec, 0, sizeof(sec));
 527                 if (chan->conn) {
 528                         sec.level = chan->conn->hcon->sec_level;
 529
 530                         if (sk->sk_state == BT_CONNECTED)
 531                                 sec.key_size = chan->conn->hcon->enc_key_size;
 532                 } else {
 533                         sec.level = chan->sec_level;
 534                 }
 535
 536                 len = min_t(unsigned int, len, sizeof(sec));
 537                 if (copy_to_user(optval, (char *) &sec, len))
 538                         err = -EFAULT;
 539
 540                 break;
 541
 542         case BT_DEFER_SETUP:
 543                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 544                         err = -EINVAL;
 545                         break;
 546                 }
 547
 548                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 549                              (u32 __user *) optval))
 550                         err = -EFAULT;
 551
 552                 break;
 553
 554         case BT_FLUSHABLE:
 555                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 556                              (u32 __user *) optval))
 557                         err = -EFAULT;
 558
 559                 break;
 560
 561         case BT_POWER:
 562                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 563                     && sk->sk_type != SOCK_RAW) {
 564                         err = -EINVAL;
 565                         break;
 566                 }
 567
 568                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 569
 570                 len = min_t(unsigned int, len, sizeof(pwr));
 571                 if (copy_to_user(optval, (char *) &pwr, len))
 572                         err = -EFAULT;
 573
 574                 break;
 575
 576         case BT_CHANNEL_POLICY:
 577                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 578                         err = -EFAULT;
 579                 break;
 580
 581         case BT_SNDMTU:
 582                 if (!bdaddr_type_is_le(chan->src_type)) {
 583                         err = -EINVAL;
 584                         break;
 585                 }
 586
 587                 if (sk->sk_state != BT_CONNECTED) {
 588                         err = -ENOTCONN;
 589                         break;
 590                 }
 591
 592                 if (put_user(chan->omtu, (u16 __user *) optval))
 593                         err = -EFAULT;
 594                 break;
 595
 596         case BT_RCVMTU:
 597                 if (!bdaddr_type_is_le(chan->src_type)) {
 598                         err = -EINVAL;
 599                         break;
 600                 }
 601
 602                 if (put_user(chan->imtu, (u16 __user *) optval))
 603                         err = -EFAULT;
 604                 break;
 605
 606         default:
 607                 err = -ENOPROTOOPT;
 608                 break;
 609         }
 610
 611         release_sock(sk);
 612         return err;
 613 }
 614
 615 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 616 {
 617         switch (chan->scid) {
 618         case L2CAP_CID_ATT:
 619                 if (mtu < L2CAP_LE_MIN_MTU)
 620                         return false;
 621                 break;
 622
 623         default:
 624                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 625                         return false;
 626         }
 627
 628         return true;
 629 }
 630
 631 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 632                                      char __user *optval, unsigned int optlen)
 633 {
 634         struct sock *sk = sock->sk;
 635         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 636         struct l2cap_options opts;
 637         int len, err = 0;
 638         u32 opt;
 639
 640         BT_DBG("sk %p", sk);
 641
 642         lock_sock(sk);
 643
 644         switch (optname) {
 645         case L2CAP_OPTIONS:
 646                 if (bdaddr_type_is_le(chan->src_type)) {
 647                         err = -EINVAL;
 648                         break;
 649                 }
 650
 651                 if (sk->sk_state == BT_CONNECTED) {
 652                         err = -EINVAL;
 653                         break;
 654                 }
 655
 656                 opts.imtu     = chan->imtu;
 657                 opts.omtu     = chan->omtu;
 658                 opts.flush_to = chan->flush_to;
 659                 opts.mode     = chan->mode;
 660                 opts.fcs      = chan->fcs;
 661                 opts.max_tx   = chan->max_tx;
 662                 opts.txwin_size = chan->tx_win;
 663
 664                 len = min_t(unsigned int, sizeof(opts), optlen);
 665                 if (copy_from_user((char *) &opts, optval, len)) {
 666                         err = -EFAULT;
 667                         break;
 668                 }
 669
 670                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 671                         err = -EINVAL;
 672                         break;
 673                 }
 674
 675                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 676                         err = -EINVAL;
 677                         break;
 678                 }
 679
 680                 chan->mode = opts.mode;
 681                 switch (chan->mode) {
 682                 case L2CAP_MODE_LE_FLOWCTL:
 683                         break;
 684                 case L2CAP_MODE_BASIC:
 685                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 686                         break;
 687                 case L2CAP_MODE_ERTM:
 688                 case L2CAP_MODE_STREAMING:
 689                         if (!disable_ertm)
 690                                 break;
 691                         /* fall through */
 692                 default:
 693                         err = -EINVAL;
 694                         break;
 695                 }
 696
 697                 chan->imtu = opts.imtu;
 698                 chan->omtu = opts.omtu;
 699                 chan->fcs  = opts.fcs;
 700                 chan->max_tx = opts.max_tx;
 701                 chan->tx_win = opts.txwin_size;
 702                 chan->flush_to = opts.flush_to;
 703                 break;
 704
 705         case L2CAP_LM:
 706                 if (get_user(opt, (u32 __user *) optval)) {
 707                         err = -EFAULT;
 708                         break;
 709                 }
 710
 711                 if (opt & L2CAP_LM_FIPS) {
 712                         err = -EINVAL;
 713                         break;
 714                 }
 715
 716                 if (opt & L2CAP_LM_AUTH)
 717                         chan->sec_level = BT_SECURITY_LOW;
 718                 if (opt & L2CAP_LM_ENCRYPT)
 719                         chan->sec_level = BT_SECURITY_MEDIUM;
 720                 if (opt & L2CAP_LM_SECURE)
 721                         chan->sec_level = BT_SECURITY_HIGH;
 722
 723                 if (opt & L2CAP_LM_MASTER)
 724                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 725                 else
 726                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 727
 728                 if (opt & L2CAP_LM_RELIABLE)
 729                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 730                 else
 731                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 732                 break;
 733
 734         default:
 735                 err = -ENOPROTOOPT;
 736                 break;
 737         }
 738
 739         release_sock(sk);
 740         return err;
 741 }
 742
 743 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 744                                  char __user *optval, unsigned int optlen)
 745 {
 746         struct sock *sk = sock->sk;
 747         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 748         struct bt_security sec;
 749         struct bt_power pwr;
 750         struct l2cap_conn *conn;
 751         int len, err = 0;
 752         u32 opt;
 753
 754         BT_DBG("sk %p", sk);
 755
 756         if (level == SOL_L2CAP)
 757                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 758
 759         if (level != SOL_BLUETOOTH)
 760                 return -ENOPROTOOPT;
 761
 762         lock_sock(sk);
 763
 764         switch (optname) {
 765         case BT_SECURITY:
 766                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 767                     chan->chan_type != L2CAP_CHAN_FIXED &&
 768                     chan->chan_type != L2CAP_CHAN_RAW) {
 769                         err = -EINVAL;
 770                         break;
 771                 }
 772
 773                 sec.level = BT_SECURITY_LOW;
 774
 775                 len = min_t(unsigned int, sizeof(sec), optlen);
 776                 if (copy_from_user((char *) &sec, optval, len)) {
 777                         err = -EFAULT;
 778                         break;
 779                 }
 780
 781                 if (sec.level < BT_SECURITY_LOW ||
 782                     sec.level > BT_SECURITY_HIGH) {
 783                         err = -EINVAL;
 784                         break;
 785                 }
 786
 787                 chan->sec_level = sec.level;
 788
 789                 if (!chan->conn)
 790                         break;
 791
 792                 conn = chan->conn;
 793
 794                 /*change security for LE channels */
 795                 if (chan->scid == L2CAP_CID_ATT) {
 796                         if (smp_conn_security(conn->hcon, sec.level))
 797                                 break;
 798                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 799                         sk->sk_state = BT_CONFIG;
 800                         chan->state = BT_CONFIG;
 801
 802                 /* or for ACL link */
 803                 } else if ((sk->sk_state == BT_CONNECT2 &&
 804                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 805                            sk->sk_state == BT_CONNECTED) {
 806                         if (!l2cap_chan_check_security(chan, true))
 807                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 808                         else
 809                                 sk->sk_state_change(sk);
 810                 } else {
 811                         err = -EINVAL;
 812                 }
 813                 break;
 814
 815         case BT_DEFER_SETUP:
 816                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 817                         err = -EINVAL;
 818                         break;
 819                 }
 820
 821                 if (get_user(opt, (u32 __user *) optval)) {
 822                         err = -EFAULT;
 823                         break;
 824                 }
 825
 826                 if (opt) {
 827                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 828                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 829                 } else {
 830                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 831                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 832                 }
 833                 break;
 834
 835         case BT_FLUSHABLE:
 836                 if (get_user(opt, (u32 __user *) optval)) {
 837                         err = -EFAULT;
 838                         break;
 839                 }
 840
 841                 if (opt > BT_FLUSHABLE_ON) {
 842                         err = -EINVAL;
 843                         break;
 844                 }
 845
 846                 if (opt == BT_FLUSHABLE_OFF) {
 847                         conn = chan->conn;
 848                         /* proceed further only when we have l2cap_conn and
 849                            No Flush support in the LM */
 850                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 851                                 err = -EINVAL;
 852                                 break;
 853                         }
 854                 }
 855
 856                 if (opt)
 857                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 858                 else
 859                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 860                 break;
 861
 862         case BT_POWER:
 863                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 864                     chan->chan_type != L2CAP_CHAN_RAW) {
 865                         err = -EINVAL;
 866                         break;
 867                 }
 868
 869                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 870
 871                 len = min_t(unsigned int, sizeof(pwr), optlen);
 872                 if (copy_from_user((char *) &pwr, optval, len)) {
 873                         err = -EFAULT;
 874                         break;
 875                 }
 876
 877                 if (pwr.force_active)
 878                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 879                 else
 880                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 881                 break;
 882
 883         case BT_CHANNEL_POLICY:
 884                 if (get_user(opt, (u32 __user *) optval)) {
 885                         err = -EFAULT;
 886                         break;
 887                 }
 888
 889                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 890                         err = -EINVAL;
 891                         break;
 892                 }
 893
 894                 if (chan->mode != L2CAP_MODE_ERTM &&
 895                     chan->mode != L2CAP_MODE_STREAMING) {
 896                         err = -EOPNOTSUPP;
 897                         break;
 898                 }
 899
 900                 chan->chan_policy = (u8) opt;
 901
 902                 if (sk->sk_state == BT_CONNECTED &&
 903                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 904                         l2cap_move_start(chan);
 905
 906                 break;
 907
 908         case BT_SNDMTU:
 909                 if (!bdaddr_type_is_le(chan->src_type)) {
 910                         err = -EINVAL;
 911                         break;
 912                 }
 913
 914                 /* Setting is not supported as it's the remote side that
 915                  * decides this.
 916                  */
 917                 err = -EPERM;
 918                 break;
 919
 920         case BT_RCVMTU:
 921                 if (!bdaddr_type_is_le(chan->src_type)) {
 922                         err = -EINVAL;
 923                         break;
 924                 }
 925
 926                 if (sk->sk_state == BT_CONNECTED) {
 927                         err = -EISCONN;
 928                         break;
 929                 }
 930
 931                 if (get_user(opt, (u32 __user *) optval)) {
 932                         err = -EFAULT;
 933                         break;
 934                 }
 935
 936                 chan->imtu = opt;
 937                 break;
 938
 939         default:
 940                 err = -ENOPROTOOPT;
 941                 break;
 942         }
 943
 944         release_sock(sk);
 945         return err;
 946 }
 947
 948 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 949                               struct msghdr *msg, size_t len)
 950 {
 951         struct sock *sk = sock->sk;
 952         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 953         int err;
 954
 955         BT_DBG("sock %p, sk %p", sock, sk);
 956
 957         err = sock_error(sk);
 958         if (err)
 959                 return err;
 960
 961         if (msg->msg_flags & MSG_OOB)
 962                 return -EOPNOTSUPP;
 963
 964         if (sk->sk_state != BT_CONNECTED)
 965                 return -ENOTCONN;
 966
 967         lock_sock(sk);
 968         err = bt_sock_wait_ready(sk, msg->msg_flags);
 969         release_sock(sk);
 970         if (err)
 971                 return err;
 972
 973         l2cap_chan_lock(chan);
 974         err = l2cap_chan_send(chan, msg, len);
 975         l2cap_chan_unlock(chan);
 976
 977         return err;
 978 }
 979
 980 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 981                               struct msghdr *msg, size_t len, int flags)
 982 {
 983         struct sock *sk = sock->sk;
 984         struct l2cap_pinfo *pi = l2cap_pi(sk);
 985         int err;
 986
 987         lock_sock(sk);
 988
 989         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
 990                                                     &bt_sk(sk)->flags)) {
 991                 if (bdaddr_type_is_le(pi->chan->src_type)) {
 992                         sk->sk_state = BT_CONNECTED;
 993                         pi->chan->state = BT_CONNECTED;
 994                         __l2cap_le_connect_rsp_defer(pi->chan);
 995                 } else {
 996                         sk->sk_state = BT_CONFIG;
 997                         pi->chan->state = BT_CONFIG;
 998                         __l2cap_connect_rsp_defer(pi->chan);
 999                 }
1000
1001                 err = 0;
1002                 goto done;
1003         }
1004
1005         release_sock(sk);
1006
1007         if (sock->type == SOCK_STREAM)
1008                 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1009         else
1010                 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
1011
1012         if (pi->chan->mode != L2CAP_MODE_ERTM)
1013                 return err;
1014
1015         /* Attempt to put pending rx data in the socket buffer */
1016
1017         lock_sock(sk);
1018
1019         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1020                 goto done;
1021
1022         if (pi->rx_busy_skb) {
1023                 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1024                         pi->rx_busy_skb = NULL;
1025                 else
1026                         goto done;
1027         }
1028
1029         /* Restore data flow when half of the receive buffer is
1030          * available.  This avoids resending large numbers of
1031          * frames.
1032          */
1033         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1034                 l2cap_chan_busy(pi->chan, 0);
1035
1036 done:
1037         release_sock(sk);
1038         return err;
1039 }
1040
1041 /* Kill socket (only if zapped and orphan)
1042  * Must be called on unlocked socket.
1043  */
1044 static void l2cap_sock_kill(struct sock *sk)
1045 {
1046         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1047                 return;
1048
1049         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1050
1051         /* Kill poor orphan */
1052
1053         l2cap_chan_put(l2cap_pi(sk)->chan);
1054         sock_set_flag(sk, SOCK_DEAD);
1055         sock_put(sk);
1056 }
1057
1058 static int __l2cap_wait_ack(struct sock *sk)
1059 {
1060         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1061         DECLARE_WAITQUEUE(wait, current);
1062         int err = 0;
1063         int timeo = HZ/5;
1064
1065         add_wait_queue(sk_sleep(sk), &wait);
1066         set_current_state(TASK_INTERRUPTIBLE);
1067         while (chan->unacked_frames > 0 && chan->conn) {
1068                 if (!timeo)
1069                         timeo = HZ/5;
1070
1071                 if (signal_pending(current)) {
1072                         err = sock_intr_errno(timeo);
1073                         break;
1074                 }
1075
1076                 release_sock(sk);
1077                 timeo = schedule_timeout(timeo);
1078                 lock_sock(sk);
1079                 set_current_state(TASK_INTERRUPTIBLE);
1080
1081                 err = sock_error(sk);
1082                 if (err)
1083                         break;
1084         }
1085         set_current_state(TASK_RUNNING);
1086         remove_wait_queue(sk_sleep(sk), &wait);
1087         return err;
1088 }
1089
1090 static int l2cap_sock_shutdown(struct socket *sock, int how)
1091 {
1092         struct sock *sk = sock->sk;
1093         struct l2cap_chan *chan;
1094         struct l2cap_conn *conn;
1095         int err = 0;
1096
1097         BT_DBG("sock %p, sk %p", sock, sk);
1098
1099         if (!sk)
1100                 return 0;
1101
1102         chan = l2cap_pi(sk)->chan;
1103         conn = chan->conn;
1104
1105         if (conn)
1106                 mutex_lock(&conn->chan_lock);
1107
1108         l2cap_chan_lock(chan);
1109         lock_sock(sk);
1110
1111         if (!sk->sk_shutdown) {
1112                 if (chan->mode == L2CAP_MODE_ERTM)
1113                         err = __l2cap_wait_ack(sk);
1114
1115                 sk->sk_shutdown = SHUTDOWN_MASK;
1116
1117                 release_sock(sk);
1118                 l2cap_chan_close(chan, 0);
1119                 lock_sock(sk);
1120
1121                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1122                     !(current->flags & PF_EXITING))
1123                         err = bt_sock_wait_state(sk, BT_CLOSED,
1124                                                  sk->sk_lingertime);
1125         }
1126
1127         if (!err && sk->sk_err)
1128                 err = -sk->sk_err;
1129
1130         release_sock(sk);
1131         l2cap_chan_unlock(chan);
1132
1133         if (conn)
1134                 mutex_unlock(&conn->chan_lock);
1135
1136         return err;
1137 }
1138
1139 static int l2cap_sock_release(struct socket *sock)
1140 {
1141         struct sock *sk = sock->sk;
1142         int err;
1143
1144         BT_DBG("sock %p, sk %p", sock, sk);
1145
1146         if (!sk)
1147                 return 0;
1148
1149         bt_sock_unlink(&l2cap_sk_list, sk);
1150
1151         err = l2cap_sock_shutdown(sock, 2);
1152
1153         sock_orphan(sk);
1154         l2cap_sock_kill(sk);
1155         return err;
1156 }
1157
1158 static void l2cap_sock_cleanup_listen(struct sock *parent)
1159 {
1160         struct sock *sk;
1161
1162         BT_DBG("parent %p", parent);
1163
1164         /* Close not yet accepted channels */
1165         while ((sk = bt_accept_dequeue(parent, NULL))) {
1166                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1167
1168                 l2cap_chan_lock(chan);
1169                 __clear_chan_timer(chan);
1170                 l2cap_chan_close(chan, ECONNRESET);
1171                 l2cap_chan_unlock(chan);
1172
1173                 l2cap_sock_kill(sk);
1174         }
1175 }
1176
1177 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1178 {
1179         struct sock *sk, *parent = chan->data;
1180
1181         lock_sock(parent);
1182
1183         /* Check for backlog size */
1184         if (sk_acceptq_is_full(parent)) {
1185                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1186                 release_sock(parent);
1187                 return NULL;
1188         }
1189
1190         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1191                               GFP_ATOMIC);
1192         if (!sk) {
1193                 release_sock(parent);
1194                 return NULL;
1195         }
1196
1197         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1198
1199         l2cap_sock_init(sk, parent);
1200
1201         bt_accept_enqueue(parent, sk);
1202
1203         release_sock(parent);
1204
1205         return l2cap_pi(sk)->chan;
1206 }
1207
1208 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1209 {
1210         struct sock *sk = chan->data;
1211         int err;
1212
1213         lock_sock(sk);
1214
1215         if (l2cap_pi(sk)->rx_busy_skb) {
1216                 err = -ENOMEM;
1217                 goto done;
1218         }
1219
1220         err = sock_queue_rcv_skb(sk, skb);
1221
1222         /* For ERTM, handle one skb that doesn't fit into the recv
1223          * buffer.  This is important to do because the data frames
1224          * have already been acked, so the skb cannot be discarded.
1225          *
1226          * Notify the l2cap core that the buffer is full, so the
1227          * LOCAL_BUSY state is entered and no more frames are
1228          * acked and reassembled until there is buffer space
1229          * available.
1230          */
1231         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1232                 l2cap_pi(sk)->rx_busy_skb = skb;
1233                 l2cap_chan_busy(chan, 1);
1234                 err = 0;
1235         }
1236
1237 done:
1238         release_sock(sk);
1239
1240         return err;
1241 }
1242
1243 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1244 {
1245         struct sock *sk = chan->data;
1246
1247         l2cap_sock_kill(sk);
1248 }
1249
1250 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1251 {
1252         struct sock *sk = chan->data;
1253         struct sock *parent;
1254
1255         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1256
1257         parent = bt_sk(sk)->parent;
1258
1259         sock_set_flag(sk, SOCK_ZAPPED);
1260
1261         switch (chan->state) {
1262         case BT_OPEN:
1263         case BT_BOUND:
1264         case BT_CLOSED:
1265                 break;
1266         case BT_LISTEN:
1267                 l2cap_sock_cleanup_listen(sk);
1268                 sk->sk_state = BT_CLOSED;
1269                 chan->state = BT_CLOSED;
1270
1271                 break;
1272         default:
1273                 sk->sk_state = BT_CLOSED;
1274                 chan->state = BT_CLOSED;
1275
1276                 sk->sk_err = err;
1277
1278                 if (parent) {
1279                         bt_accept_unlink(sk);
1280                         parent->sk_data_ready(parent);
1281                 } else {
1282                         sk->sk_state_change(sk);
1283                 }
1284
1285                 break;
1286         }
1287
1288         release_sock(sk);
1289 }
1290
1291 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1292                                        int err)
1293 {
1294         struct sock *sk = chan->data;
1295
1296         sk->sk_state = state;
1297
1298         if (err)
1299                 sk->sk_err = err;
1300 }
1301
1302 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1303                                                unsigned long hdr_len,
1304                                                unsigned long len, int nb)
1305 {
1306         struct sock *sk = chan->data;
1307         struct sk_buff *skb;
1308         int err;
1309
1310         l2cap_chan_unlock(chan);
1311         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1312         l2cap_chan_lock(chan);
1313
1314         if (!skb)
1315                 return ERR_PTR(err);
1316
1317         skb->priority = sk->sk_priority;
1318
1319         bt_cb(skb)->chan = chan;
1320
1321         return skb;
1322 }
1323
1324 static int l2cap_sock_memcpy_fromiovec_cb(struct l2cap_chan *chan,
1325                                           unsigned char *kdata,
1326                                           struct iovec *iov, int len)
1327 {
1328         return memcpy_fromiovec(kdata, iov, len);
1329 }
1330
1331 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1332 {
1333         struct sock *sk = chan->data;
1334         struct sock *parent;
1335
1336         lock_sock(sk);
1337
1338         parent = bt_sk(sk)->parent;
1339
1340         BT_DBG("sk %p, parent %p", sk, parent);
1341
1342         sk->sk_state = BT_CONNECTED;
1343         sk->sk_state_change(sk);
1344
1345         if (parent)
1346                 parent->sk_data_ready(parent);
1347
1348         release_sock(sk);
1349 }
1350
1351 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1352 {
1353         struct sock *parent, *sk = chan->data;
1354
1355         lock_sock(sk);
1356
1357         parent = bt_sk(sk)->parent;
1358         if (parent)
1359                 parent->sk_data_ready(parent);
1360
1361         release_sock(sk);
1362 }
1363
1364 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1365 {
1366         struct sock *sk = chan->data;
1367
1368         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1369                 sk->sk_state = BT_CONNECTED;
1370                 chan->state = BT_CONNECTED;
1371         }
1372
1373         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1374         sk->sk_state_change(sk);
1375 }
1376
1377 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1378 {
1379         struct sock *sk = chan->data;
1380
1381         lock_sock(sk);
1382         sk->sk_shutdown = SHUTDOWN_MASK;
1383         release_sock(sk);
1384 }
1385
1386 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1387 {
1388         struct sock *sk = chan->data;
1389
1390         return sk->sk_sndtimeo;
1391 }
1392
1393 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1394 {
1395         struct sock *sk = chan->data;
1396
1397         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1398         sk->sk_state_change(sk);
1399 }
1400
1401 static const struct l2cap_ops l2cap_chan_ops = {
1402         .name                   = "L2CAP Socket Interface",
1403         .new_connection         = l2cap_sock_new_connection_cb,
1404         .recv                   = l2cap_sock_recv_cb,
1405         .close                  = l2cap_sock_close_cb,
1406         .teardown               = l2cap_sock_teardown_cb,
1407         .state_change           = l2cap_sock_state_change_cb,
1408         .ready                  = l2cap_sock_ready_cb,
1409         .defer                  = l2cap_sock_defer_cb,
1410         .resume                 = l2cap_sock_resume_cb,
1411         .suspend                = l2cap_sock_suspend_cb,
1412         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1413         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1414         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1415         .memcpy_fromiovec       = l2cap_sock_memcpy_fromiovec_cb,
1416 };
1417
1418 static void l2cap_sock_destruct(struct sock *sk)
1419 {
1420         BT_DBG("sk %p", sk);
1421
1422         if (l2cap_pi(sk)->chan)
1423                 l2cap_chan_put(l2cap_pi(sk)->chan);
1424
1425         if (l2cap_pi(sk)->rx_busy_skb) {
1426                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1427                 l2cap_pi(sk)->rx_busy_skb = NULL;
1428         }
1429
1430         skb_queue_purge(&sk->sk_receive_queue);
1431         skb_queue_purge(&sk->sk_write_queue);
1432 }
1433
1434 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1435                                int *msg_namelen)
1436 {
1437         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1438
1439         memset(la, 0, sizeof(struct sockaddr_l2));
1440         la->l2_family = AF_BLUETOOTH;
1441         la->l2_psm = bt_cb(skb)->psm;
1442         bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1443
1444         *msg_namelen = sizeof(struct sockaddr_l2);
1445 }
1446
1447 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1448 {
1449         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1450
1451         BT_DBG("sk %p", sk);
1452
1453         if (parent) {
1454                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1455
1456                 sk->sk_type = parent->sk_type;
1457                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1458
1459                 chan->chan_type = pchan->chan_type;
1460                 chan->imtu = pchan->imtu;
1461                 chan->omtu = pchan->omtu;
1462                 chan->conf_state = pchan->conf_state;
1463                 chan->mode = pchan->mode;
1464                 chan->fcs  = pchan->fcs;
1465                 chan->max_tx = pchan->max_tx;
1466                 chan->tx_win = pchan->tx_win;
1467                 chan->tx_win_max = pchan->tx_win_max;
1468                 chan->sec_level = pchan->sec_level;
1469                 chan->flags = pchan->flags;
1470                 chan->tx_credits = pchan->tx_credits;
1471                 chan->rx_credits = pchan->rx_credits;
1472
1473                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1474                         chan->scid = pchan->scid;
1475                         chan->dcid = pchan->scid;
1476                 }
1477
1478                 security_sk_clone(parent, sk);
1479         } else {
1480                 switch (sk->sk_type) {
1481                 case SOCK_RAW:
1482                         chan->chan_type = L2CAP_CHAN_RAW;
1483                         break;
1484                 case SOCK_DGRAM:
1485                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1486                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1487                         break;
1488                 case SOCK_SEQPACKET:
1489                 case SOCK_STREAM:
1490                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1491                         break;
1492                 }
1493
1494                 chan->imtu = L2CAP_DEFAULT_MTU;
1495                 chan->omtu = 0;
1496                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1497                         chan->mode = L2CAP_MODE_ERTM;
1498                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1499                 } else {
1500                         chan->mode = L2CAP_MODE_BASIC;
1501                 }
1502
1503                 l2cap_chan_set_defaults(chan);
1504         }
1505
1506         /* Set default lock nesting level */
1507         atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
1508
1509         /* Default config options */
1510         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1511
1512         chan->data = sk;
1513         chan->ops = &l2cap_chan_ops;
1514 }
1515
1516 static struct proto l2cap_proto = {
1517         .name           = "L2CAP",
1518         .owner          = THIS_MODULE,
1519         .obj_size       = sizeof(struct l2cap_pinfo)
1520 };
1521
1522 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1523                                      int proto, gfp_t prio)
1524 {
1525         struct sock *sk;
1526         struct l2cap_chan *chan;
1527
1528         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1529         if (!sk)
1530                 return NULL;
1531
1532         sock_init_data(sock, sk);
1533         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1534
1535         sk->sk_destruct = l2cap_sock_destruct;
1536         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1537
1538         sock_reset_flag(sk, SOCK_ZAPPED);
1539
1540         sk->sk_protocol = proto;
1541         sk->sk_state = BT_OPEN;
1542
1543         chan = l2cap_chan_create();
1544         if (!chan) {
1545                 sk_free(sk);
1546                 return NULL;
1547         }
1548
1549         l2cap_chan_hold(chan);
1550
1551         l2cap_pi(sk)->chan = chan;
1552
1553         return sk;
1554 }
1555
1556 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1557                              int kern)
1558 {
1559         struct sock *sk;
1560
1561         BT_DBG("sock %p", sock);
1562
1563         sock->state = SS_UNCONNECTED;
1564
1565         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1566             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1567                 return -ESOCKTNOSUPPORT;
1568
1569         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1570                 return -EPERM;
1571
1572         sock->ops = &l2cap_sock_ops;
1573
1574         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1575         if (!sk)
1576                 return -ENOMEM;
1577
1578         l2cap_sock_init(sk, NULL);
1579         bt_sock_link(&l2cap_sk_list, sk);
1580         return 0;
1581 }
1582
1583 static const struct proto_ops l2cap_sock_ops = {
1584         .family         = PF_BLUETOOTH,
1585         .owner          = THIS_MODULE,
1586         .release        = l2cap_sock_release,
1587         .bind           = l2cap_sock_bind,
1588         .connect        = l2cap_sock_connect,
1589         .listen         = l2cap_sock_listen,
1590         .accept         = l2cap_sock_accept,
1591         .getname        = l2cap_sock_getname,
1592         .sendmsg        = l2cap_sock_sendmsg,
1593         .recvmsg        = l2cap_sock_recvmsg,
1594         .poll           = bt_sock_poll,
1595         .ioctl          = bt_sock_ioctl,
1596         .mmap           = sock_no_mmap,
1597         .socketpair     = sock_no_socketpair,
1598         .shutdown       = l2cap_sock_shutdown,
1599         .setsockopt     = l2cap_sock_setsockopt,
1600         .getsockopt     = l2cap_sock_getsockopt
1601 };
1602
1603 static const struct net_proto_family l2cap_sock_family_ops = {
1604         .family = PF_BLUETOOTH,
1605         .owner  = THIS_MODULE,
1606         .create = l2cap_sock_create,
1607 };
1608
1609 int __init l2cap_init_sockets(void)
1610 {
1611         int err;
1612
1613         err = proto_register(&l2cap_proto, 0);
1614         if (err < 0)
1615                 return err;
1616
1617         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1618         if (err < 0) {
1619                 BT_ERR("L2CAP socket registration failed");
1620                 goto error;
1621         }
1622
1623         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1624                              NULL);
1625         if (err < 0) {
1626                 BT_ERR("Failed to create L2CAP proc file");
1627                 bt_sock_unregister(BTPROTO_L2CAP);
1628                 goto error;
1629         }
1630
1631         BT_INFO("L2CAP socket layer initialized");
1632
1633         return 0;
1634
1635 error:
1636         proto_unregister(&l2cap_proto);
1637         return err;
1638 }
1639
1640 void l2cap_cleanup_sockets(void)
1641 {
1642         bt_procfs_cleanup(&init_net, "l2cap");
1643         bt_sock_unregister(BTPROTO_L2CAP);
1644         proto_unregister(&l2cap_proto);
1645 }