1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26 SOFTWARE IS DISCLAIMED.
27 */
28
29 /* Bluetooth L2CAP core. */
30
31 #include <linux/module.h>
32
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
35 #include <linux/filter.h>
36
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
40
41 #include "smp.h"
42
43 #define LE_FLOWCTL_MAX_CREDITS 65535
44
45 bool disable_ertm;
46 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED);
47
48 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
49
50 static LIST_HEAD(chan_list);
51 static DEFINE_RWLOCK(chan_list_lock);
52
53 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
54 u8 code, u8 ident, u16 dlen, void *data);
55 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
56 void *data);
57 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
58 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
59
60 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
61 struct sk_buff_head *skbs, u8 event);
62 static void l2cap_retrans_timeout(struct work_struct *work);
63 static void l2cap_monitor_timeout(struct work_struct *work);
64 static void l2cap_ack_timeout(struct work_struct *work);
65
bdaddr_type(u8 link_type,u8 bdaddr_type)66 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
67 {
68 if (link_type == LE_LINK) {
69 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
70 return BDADDR_LE_PUBLIC;
71 else
72 return BDADDR_LE_RANDOM;
73 }
74
75 return BDADDR_BREDR;
76 }
77
bdaddr_src_type(struct hci_conn * hcon)78 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
79 {
80 return bdaddr_type(hcon->type, hcon->src_type);
81 }
82
bdaddr_dst_type(struct hci_conn * hcon)83 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
84 {
85 return bdaddr_type(hcon->type, hcon->dst_type);
86 }
87
88 /* ---- L2CAP channels ---- */
89
__l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)90 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
91 u16 cid)
92 {
93 struct l2cap_chan *c;
94
95 list_for_each_entry(c, &conn->chan_l, list) {
96 if (c->dcid == cid)
97 return c;
98 }
99 return NULL;
100 }
101
__l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)102 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
103 u16 cid)
104 {
105 struct l2cap_chan *c;
106
107 list_for_each_entry(c, &conn->chan_l, list) {
108 if (c->scid == cid)
109 return c;
110 }
111 return NULL;
112 }
113
114 /* Find channel with given SCID.
115 * Returns a reference locked channel.
116 */
l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)117 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
118 u16 cid)
119 {
120 struct l2cap_chan *c;
121
122 mutex_lock(&conn->chan_lock);
123 c = __l2cap_get_chan_by_scid(conn, cid);
124 if (c) {
125 /* Only lock if chan reference is not 0 */
126 c = l2cap_chan_hold_unless_zero(c);
127 if (c)
128 l2cap_chan_lock(c);
129 }
130 mutex_unlock(&conn->chan_lock);
131
132 return c;
133 }
134
135 /* Find channel with given DCID.
136 * Returns a reference locked channel.
137 */
l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)138 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
139 u16 cid)
140 {
141 struct l2cap_chan *c;
142
143 mutex_lock(&conn->chan_lock);
144 c = __l2cap_get_chan_by_dcid(conn, cid);
145 if (c) {
146 /* Only lock if chan reference is not 0 */
147 c = l2cap_chan_hold_unless_zero(c);
148 if (c)
149 l2cap_chan_lock(c);
150 }
151 mutex_unlock(&conn->chan_lock);
152
153 return c;
154 }
155
__l2cap_get_chan_by_ident(struct l2cap_conn * conn,u8 ident)156 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
157 u8 ident)
158 {
159 struct l2cap_chan *c;
160
161 list_for_each_entry(c, &conn->chan_l, list) {
162 if (c->ident == ident)
163 return c;
164 }
165 return NULL;
166 }
167
__l2cap_global_chan_by_addr(__le16 psm,bdaddr_t * src,u8 src_type)168 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
169 u8 src_type)
170 {
171 struct l2cap_chan *c;
172
173 list_for_each_entry(c, &chan_list, global_l) {
174 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
175 continue;
176
177 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
178 continue;
179
180 if (c->sport == psm && !bacmp(&c->src, src))
181 return c;
182 }
183 return NULL;
184 }
185
l2cap_add_psm(struct l2cap_chan * chan,bdaddr_t * src,__le16 psm)186 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
187 {
188 int err;
189
190 write_lock(&chan_list_lock);
191
192 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
193 err = -EADDRINUSE;
194 goto done;
195 }
196
197 if (psm) {
198 chan->psm = psm;
199 chan->sport = psm;
200 err = 0;
201 } else {
202 u16 p, start, end, incr;
203
204 if (chan->src_type == BDADDR_BREDR) {
205 start = L2CAP_PSM_DYN_START;
206 end = L2CAP_PSM_AUTO_END;
207 incr = 2;
208 } else {
209 start = L2CAP_PSM_LE_DYN_START;
210 end = L2CAP_PSM_LE_DYN_END;
211 incr = 1;
212 }
213
214 err = -EINVAL;
215 for (p = start; p <= end; p += incr)
216 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
217 chan->src_type)) {
218 chan->psm = cpu_to_le16(p);
219 chan->sport = cpu_to_le16(p);
220 err = 0;
221 break;
222 }
223 }
224
225 done:
226 write_unlock(&chan_list_lock);
227 return err;
228 }
229 EXPORT_SYMBOL_GPL(l2cap_add_psm);
230
l2cap_add_scid(struct l2cap_chan * chan,__u16 scid)231 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
232 {
233 write_lock(&chan_list_lock);
234
235 /* Override the defaults (which are for conn-oriented) */
236 chan->omtu = L2CAP_DEFAULT_MTU;
237 chan->chan_type = L2CAP_CHAN_FIXED;
238
239 chan->scid = scid;
240
241 write_unlock(&chan_list_lock);
242
243 return 0;
244 }
245
l2cap_alloc_cid(struct l2cap_conn * conn)246 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
247 {
248 u16 cid, dyn_end;
249
250 if (conn->hcon->type == LE_LINK)
251 dyn_end = L2CAP_CID_LE_DYN_END;
252 else
253 dyn_end = L2CAP_CID_DYN_END;
254
255 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
256 if (!__l2cap_get_chan_by_scid(conn, cid))
257 return cid;
258 }
259
260 return 0;
261 }
262
l2cap_state_change(struct l2cap_chan * chan,int state)263 static void l2cap_state_change(struct l2cap_chan *chan, int state)
264 {
265 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
266 state_to_string(state));
267
268 chan->state = state;
269 chan->ops->state_change(chan, state, 0);
270 }
271
l2cap_state_change_and_error(struct l2cap_chan * chan,int state,int err)272 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
273 int state, int err)
274 {
275 chan->state = state;
276 chan->ops->state_change(chan, chan->state, err);
277 }
278
l2cap_chan_set_err(struct l2cap_chan * chan,int err)279 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
280 {
281 chan->ops->state_change(chan, chan->state, err);
282 }
283
__set_retrans_timer(struct l2cap_chan * chan)284 static void __set_retrans_timer(struct l2cap_chan *chan)
285 {
286 if (!delayed_work_pending(&chan->monitor_timer) &&
287 chan->retrans_timeout) {
288 l2cap_set_timer(chan, &chan->retrans_timer,
289 msecs_to_jiffies(chan->retrans_timeout));
290 }
291 }
292
__set_monitor_timer(struct l2cap_chan * chan)293 static void __set_monitor_timer(struct l2cap_chan *chan)
294 {
295 __clear_retrans_timer(chan);
296 if (chan->monitor_timeout) {
297 l2cap_set_timer(chan, &chan->monitor_timer,
298 msecs_to_jiffies(chan->monitor_timeout));
299 }
300 }
301
l2cap_ertm_seq_in_queue(struct sk_buff_head * head,u16 seq)302 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
303 u16 seq)
304 {
305 struct sk_buff *skb;
306
307 skb_queue_walk(head, skb) {
308 if (bt_cb(skb)->l2cap.txseq == seq)
309 return skb;
310 }
311
312 return NULL;
313 }
314
315 /* ---- L2CAP sequence number lists ---- */
316
317 /* For ERTM, ordered lists of sequence numbers must be tracked for
318 * SREJ requests that are received and for frames that are to be
319 * retransmitted. These seq_list functions implement a singly-linked
320 * list in an array, where membership in the list can also be checked
321 * in constant time. Items can also be added to the tail of the list
322 * and removed from the head in constant time, without further memory
323 * allocs or frees.
324 */
325
l2cap_seq_list_init(struct l2cap_seq_list * seq_list,u16 size)326 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
327 {
328 size_t alloc_size, i;
329
330 /* Allocated size is a power of 2 to map sequence numbers
331 * (which may be up to 14 bits) in to a smaller array that is
332 * sized for the negotiated ERTM transmit windows.
333 */
334 alloc_size = roundup_pow_of_two(size);
335
336 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
337 if (!seq_list->list)
338 return -ENOMEM;
339
340 seq_list->mask = alloc_size - 1;
341 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
342 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
343 for (i = 0; i < alloc_size; i++)
344 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
345
346 return 0;
347 }
348
l2cap_seq_list_free(struct l2cap_seq_list * seq_list)349 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
350 {
351 kfree(seq_list->list);
352 }
353
l2cap_seq_list_contains(struct l2cap_seq_list * seq_list,u16 seq)354 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
355 u16 seq)
356 {
357 /* Constant-time check for list membership */
358 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
359 }
360
l2cap_seq_list_pop(struct l2cap_seq_list * seq_list)361 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
362 {
363 u16 seq = seq_list->head;
364 u16 mask = seq_list->mask;
365
366 seq_list->head = seq_list->list[seq & mask];
367 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
368
369 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
370 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
371 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
372 }
373
374 return seq;
375 }
376
l2cap_seq_list_clear(struct l2cap_seq_list * seq_list)377 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
378 {
379 u16 i;
380
381 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
382 return;
383
384 for (i = 0; i <= seq_list->mask; i++)
385 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
386
387 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
388 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
389 }
390
l2cap_seq_list_append(struct l2cap_seq_list * seq_list,u16 seq)391 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
392 {
393 u16 mask = seq_list->mask;
394
395 /* All appends happen in constant time */
396
397 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
398 return;
399
400 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
401 seq_list->head = seq;
402 else
403 seq_list->list[seq_list->tail & mask] = seq;
404
405 seq_list->tail = seq;
406 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
407 }
408
l2cap_chan_timeout(struct work_struct * work)409 static void l2cap_chan_timeout(struct work_struct *work)
410 {
411 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
412 chan_timer.work);
413 struct l2cap_conn *conn = chan->conn;
414 int reason;
415
416 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
417
418 if (!conn)
419 return;
420
421 mutex_lock(&conn->chan_lock);
422 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
423 * this work. No need to call l2cap_chan_hold(chan) here again.
424 */
425 l2cap_chan_lock(chan);
426
427 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
428 reason = ECONNREFUSED;
429 else if (chan->state == BT_CONNECT &&
430 chan->sec_level != BT_SECURITY_SDP)
431 reason = ECONNREFUSED;
432 else
433 reason = ETIMEDOUT;
434
435 l2cap_chan_close(chan, reason);
436
437 chan->ops->close(chan);
438
439 l2cap_chan_unlock(chan);
440 l2cap_chan_put(chan);
441
442 mutex_unlock(&conn->chan_lock);
443 }
444
l2cap_chan_create(void)445 struct l2cap_chan *l2cap_chan_create(void)
446 {
447 struct l2cap_chan *chan;
448
449 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
450 if (!chan)
451 return NULL;
452
453 skb_queue_head_init(&chan->tx_q);
454 skb_queue_head_init(&chan->srej_q);
455 mutex_init(&chan->lock);
456
457 /* Set default lock nesting level */
458 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
459
460 /* Available receive buffer space is initially unknown */
461 chan->rx_avail = -1;
462
463 write_lock(&chan_list_lock);
464 list_add(&chan->global_l, &chan_list);
465 write_unlock(&chan_list_lock);
466
467 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
468 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
469 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
470 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
471
472 chan->state = BT_OPEN;
473
474 kref_init(&chan->kref);
475
476 /* This flag is cleared in l2cap_chan_ready() */
477 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
478
479 BT_DBG("chan %p", chan);
480
481 return chan;
482 }
483 EXPORT_SYMBOL_GPL(l2cap_chan_create);
484
l2cap_chan_destroy(struct kref * kref)485 static void l2cap_chan_destroy(struct kref *kref)
486 {
487 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
488
489 BT_DBG("chan %p", chan);
490
491 write_lock(&chan_list_lock);
492 list_del(&chan->global_l);
493 write_unlock(&chan_list_lock);
494
495 kfree(chan);
496 }
497
l2cap_chan_hold(struct l2cap_chan * c)498 void l2cap_chan_hold(struct l2cap_chan *c)
499 {
500 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
501
502 kref_get(&c->kref);
503 }
504
l2cap_chan_hold_unless_zero(struct l2cap_chan * c)505 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
506 {
507 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
508
509 if (!kref_get_unless_zero(&c->kref))
510 return NULL;
511
512 return c;
513 }
514
l2cap_chan_put(struct l2cap_chan * c)515 void l2cap_chan_put(struct l2cap_chan *c)
516 {
517 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
518
519 kref_put(&c->kref, l2cap_chan_destroy);
520 }
521 EXPORT_SYMBOL_GPL(l2cap_chan_put);
522
l2cap_chan_set_defaults(struct l2cap_chan * chan)523 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
524 {
525 chan->fcs = L2CAP_FCS_CRC16;
526 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
527 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
528 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
529 chan->remote_max_tx = chan->max_tx;
530 chan->remote_tx_win = chan->tx_win;
531 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
532 chan->sec_level = BT_SECURITY_LOW;
533 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
534 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
535 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
536
537 chan->conf_state = 0;
538 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
539
540 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
541 }
542 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
543
l2cap_le_rx_credits(struct l2cap_chan * chan)544 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan)
545 {
546 size_t sdu_len = chan->sdu ? chan->sdu->len : 0;
547
548 if (chan->mps == 0)
549 return 0;
550
551 /* If we don't know the available space in the receiver buffer, give
552 * enough credits for a full packet.
553 */
554 if (chan->rx_avail == -1)
555 return (chan->imtu / chan->mps) + 1;
556
557 /* If we know how much space is available in the receive buffer, give
558 * out as many credits as would fill the buffer.
559 */
560 if (chan->rx_avail <= sdu_len)
561 return 0;
562
563 return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps);
564 }
565
l2cap_le_flowctl_init(struct l2cap_chan * chan,u16 tx_credits)566 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
567 {
568 chan->sdu = NULL;
569 chan->sdu_last_frag = NULL;
570 chan->sdu_len = 0;
571 chan->tx_credits = tx_credits;
572 /* Derive MPS from connection MTU to stop HCI fragmentation */
573 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
574 chan->rx_credits = l2cap_le_rx_credits(chan);
575
576 skb_queue_head_init(&chan->tx_q);
577 }
578
l2cap_ecred_init(struct l2cap_chan * chan,u16 tx_credits)579 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
580 {
581 l2cap_le_flowctl_init(chan, tx_credits);
582
583 /* L2CAP implementations shall support a minimum MPS of 64 octets */
584 if (chan->mps < L2CAP_ECRED_MIN_MPS) {
585 chan->mps = L2CAP_ECRED_MIN_MPS;
586 chan->rx_credits = l2cap_le_rx_credits(chan);
587 }
588 }
589
__l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)590 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
591 {
592 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
593 __le16_to_cpu(chan->psm), chan->dcid);
594
595 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
596
597 chan->conn = conn;
598
599 switch (chan->chan_type) {
600 case L2CAP_CHAN_CONN_ORIENTED:
601 /* Alloc CID for connection-oriented socket */
602 chan->scid = l2cap_alloc_cid(conn);
603 if (conn->hcon->type == ACL_LINK)
604 chan->omtu = L2CAP_DEFAULT_MTU;
605 break;
606
607 case L2CAP_CHAN_CONN_LESS:
608 /* Connectionless socket */
609 chan->scid = L2CAP_CID_CONN_LESS;
610 chan->dcid = L2CAP_CID_CONN_LESS;
611 chan->omtu = L2CAP_DEFAULT_MTU;
612 break;
613
614 case L2CAP_CHAN_FIXED:
615 /* Caller will set CID and CID specific MTU values */
616 break;
617
618 default:
619 /* Raw socket can send/recv signalling messages only */
620 chan->scid = L2CAP_CID_SIGNALING;
621 chan->dcid = L2CAP_CID_SIGNALING;
622 chan->omtu = L2CAP_DEFAULT_MTU;
623 }
624
625 chan->local_id = L2CAP_BESTEFFORT_ID;
626 chan->local_stype = L2CAP_SERV_BESTEFFORT;
627 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
628 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
629 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
630 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
631
632 l2cap_chan_hold(chan);
633
634 /* Only keep a reference for fixed channels if they requested it */
635 if (chan->chan_type != L2CAP_CHAN_FIXED ||
636 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
637 hci_conn_hold(conn->hcon);
638
639 /* Append to the list since the order matters for ECRED */
640 list_add_tail(&chan->list, &conn->chan_l);
641 }
642
l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)643 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
644 {
645 mutex_lock(&conn->chan_lock);
646 __l2cap_chan_add(conn, chan);
647 mutex_unlock(&conn->chan_lock);
648 }
649
l2cap_chan_del(struct l2cap_chan * chan,int err)650 void l2cap_chan_del(struct l2cap_chan *chan, int err)
651 {
652 struct l2cap_conn *conn = chan->conn;
653
654 __clear_chan_timer(chan);
655
656 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
657 state_to_string(chan->state));
658
659 chan->ops->teardown(chan, err);
660
661 if (conn) {
662 /* Delete from channel list */
663 list_del(&chan->list);
664
665 l2cap_chan_put(chan);
666
667 chan->conn = NULL;
668
669 /* Reference was only held for non-fixed channels or
670 * fixed channels that explicitly requested it using the
671 * FLAG_HOLD_HCI_CONN flag.
672 */
673 if (chan->chan_type != L2CAP_CHAN_FIXED ||
674 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
675 hci_conn_drop(conn->hcon);
676 }
677
678 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
679 return;
680
681 switch (chan->mode) {
682 case L2CAP_MODE_BASIC:
683 break;
684
685 case L2CAP_MODE_LE_FLOWCTL:
686 case L2CAP_MODE_EXT_FLOWCTL:
687 skb_queue_purge(&chan->tx_q);
688 break;
689
690 case L2CAP_MODE_ERTM:
691 __clear_retrans_timer(chan);
692 __clear_monitor_timer(chan);
693 __clear_ack_timer(chan);
694
695 skb_queue_purge(&chan->srej_q);
696
697 l2cap_seq_list_free(&chan->srej_list);
698 l2cap_seq_list_free(&chan->retrans_list);
699 fallthrough;
700
701 case L2CAP_MODE_STREAMING:
702 skb_queue_purge(&chan->tx_q);
703 break;
704 }
705 }
706 EXPORT_SYMBOL_GPL(l2cap_chan_del);
707
__l2cap_chan_list_id(struct l2cap_conn * conn,u16 id,l2cap_chan_func_t func,void * data)708 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
709 l2cap_chan_func_t func, void *data)
710 {
711 struct l2cap_chan *chan, *l;
712
713 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
714 if (chan->ident == id)
715 func(chan, data);
716 }
717 }
718
__l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)719 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
720 void *data)
721 {
722 struct l2cap_chan *chan;
723
724 list_for_each_entry(chan, &conn->chan_l, list) {
725 func(chan, data);
726 }
727 }
728
l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)729 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
730 void *data)
731 {
732 if (!conn)
733 return;
734
735 mutex_lock(&conn->chan_lock);
736 __l2cap_chan_list(conn, func, data);
737 mutex_unlock(&conn->chan_lock);
738 }
739
740 EXPORT_SYMBOL_GPL(l2cap_chan_list);
741
l2cap_conn_update_id_addr(struct work_struct * work)742 static void l2cap_conn_update_id_addr(struct work_struct *work)
743 {
744 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
745 id_addr_timer.work);
746 struct hci_conn *hcon = conn->hcon;
747 struct l2cap_chan *chan;
748
749 mutex_lock(&conn->chan_lock);
750
751 list_for_each_entry(chan, &conn->chan_l, list) {
752 l2cap_chan_lock(chan);
753 bacpy(&chan->dst, &hcon->dst);
754 chan->dst_type = bdaddr_dst_type(hcon);
755 l2cap_chan_unlock(chan);
756 }
757
758 mutex_unlock(&conn->chan_lock);
759 }
760
l2cap_chan_le_connect_reject(struct l2cap_chan * chan)761 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
762 {
763 struct l2cap_conn *conn = chan->conn;
764 struct l2cap_le_conn_rsp rsp;
765 u16 result;
766
767 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
768 result = L2CAP_CR_LE_AUTHORIZATION;
769 else
770 result = L2CAP_CR_LE_BAD_PSM;
771
772 l2cap_state_change(chan, BT_DISCONN);
773
774 rsp.dcid = cpu_to_le16(chan->scid);
775 rsp.mtu = cpu_to_le16(chan->imtu);
776 rsp.mps = cpu_to_le16(chan->mps);
777 rsp.credits = cpu_to_le16(chan->rx_credits);
778 rsp.result = cpu_to_le16(result);
779
780 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
781 &rsp);
782 }
783
l2cap_chan_ecred_connect_reject(struct l2cap_chan * chan)784 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
785 {
786 l2cap_state_change(chan, BT_DISCONN);
787
788 __l2cap_ecred_conn_rsp_defer(chan);
789 }
790
l2cap_chan_connect_reject(struct l2cap_chan * chan)791 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
792 {
793 struct l2cap_conn *conn = chan->conn;
794 struct l2cap_conn_rsp rsp;
795 u16 result;
796
797 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
798 result = L2CAP_CR_SEC_BLOCK;
799 else
800 result = L2CAP_CR_BAD_PSM;
801
802 l2cap_state_change(chan, BT_DISCONN);
803
804 rsp.scid = cpu_to_le16(chan->dcid);
805 rsp.dcid = cpu_to_le16(chan->scid);
806 rsp.result = cpu_to_le16(result);
807 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
808
809 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
810 }
811
l2cap_chan_close(struct l2cap_chan * chan,int reason)812 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
813 {
814 struct l2cap_conn *conn = chan->conn;
815
816 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
817
818 switch (chan->state) {
819 case BT_LISTEN:
820 chan->ops->teardown(chan, 0);
821 break;
822
823 case BT_CONNECTED:
824 case BT_CONFIG:
825 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
826 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
827 l2cap_send_disconn_req(chan, reason);
828 } else
829 l2cap_chan_del(chan, reason);
830 break;
831
832 case BT_CONNECT2:
833 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
834 if (conn->hcon->type == ACL_LINK)
835 l2cap_chan_connect_reject(chan);
836 else if (conn->hcon->type == LE_LINK) {
837 switch (chan->mode) {
838 case L2CAP_MODE_LE_FLOWCTL:
839 l2cap_chan_le_connect_reject(chan);
840 break;
841 case L2CAP_MODE_EXT_FLOWCTL:
842 l2cap_chan_ecred_connect_reject(chan);
843 return;
844 }
845 }
846 }
847
848 l2cap_chan_del(chan, reason);
849 break;
850
851 case BT_CONNECT:
852 case BT_DISCONN:
853 l2cap_chan_del(chan, reason);
854 break;
855
856 default:
857 chan->ops->teardown(chan, 0);
858 break;
859 }
860 }
861 EXPORT_SYMBOL(l2cap_chan_close);
862
l2cap_get_auth_type(struct l2cap_chan * chan)863 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
864 {
865 switch (chan->chan_type) {
866 case L2CAP_CHAN_RAW:
867 switch (chan->sec_level) {
868 case BT_SECURITY_HIGH:
869 case BT_SECURITY_FIPS:
870 return HCI_AT_DEDICATED_BONDING_MITM;
871 case BT_SECURITY_MEDIUM:
872 return HCI_AT_DEDICATED_BONDING;
873 default:
874 return HCI_AT_NO_BONDING;
875 }
876 break;
877 case L2CAP_CHAN_CONN_LESS:
878 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
879 if (chan->sec_level == BT_SECURITY_LOW)
880 chan->sec_level = BT_SECURITY_SDP;
881 }
882 if (chan->sec_level == BT_SECURITY_HIGH ||
883 chan->sec_level == BT_SECURITY_FIPS)
884 return HCI_AT_NO_BONDING_MITM;
885 else
886 return HCI_AT_NO_BONDING;
887 break;
888 case L2CAP_CHAN_CONN_ORIENTED:
889 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
890 if (chan->sec_level == BT_SECURITY_LOW)
891 chan->sec_level = BT_SECURITY_SDP;
892
893 if (chan->sec_level == BT_SECURITY_HIGH ||
894 chan->sec_level == BT_SECURITY_FIPS)
895 return HCI_AT_NO_BONDING_MITM;
896 else
897 return HCI_AT_NO_BONDING;
898 }
899 fallthrough;
900
901 default:
902 switch (chan->sec_level) {
903 case BT_SECURITY_HIGH:
904 case BT_SECURITY_FIPS:
905 return HCI_AT_GENERAL_BONDING_MITM;
906 case BT_SECURITY_MEDIUM:
907 return HCI_AT_GENERAL_BONDING;
908 default:
909 return HCI_AT_NO_BONDING;
910 }
911 break;
912 }
913 }
914
915 /* Service level security */
l2cap_chan_check_security(struct l2cap_chan * chan,bool initiator)916 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
917 {
918 struct l2cap_conn *conn = chan->conn;
919 __u8 auth_type;
920
921 if (conn->hcon->type == LE_LINK)
922 return smp_conn_security(conn->hcon, chan->sec_level);
923
924 auth_type = l2cap_get_auth_type(chan);
925
926 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
927 initiator);
928 }
929
l2cap_get_ident(struct l2cap_conn * conn)930 static u8 l2cap_get_ident(struct l2cap_conn *conn)
931 {
932 u8 id;
933
934 /* Get next available identificator.
935 * 1 - 128 are used by kernel.
936 * 129 - 199 are reserved.
937 * 200 - 254 are used by utilities like l2ping, etc.
938 */
939
940 mutex_lock(&conn->ident_lock);
941
942 if (++conn->tx_ident > 128)
943 conn->tx_ident = 1;
944
945 id = conn->tx_ident;
946
947 mutex_unlock(&conn->ident_lock);
948
949 return id;
950 }
951
l2cap_send_cmd(struct l2cap_conn * conn,u8 ident,u8 code,u16 len,void * data)952 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
953 void *data)
954 {
955 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
956 u8 flags;
957
958 BT_DBG("code 0x%2.2x", code);
959
960 if (!skb)
961 return;
962
963 /* Use NO_FLUSH if supported or we have an LE link (which does
964 * not support auto-flushing packets) */
965 if (lmp_no_flush_capable(conn->hcon->hdev) ||
966 conn->hcon->type == LE_LINK)
967 flags = ACL_START_NO_FLUSH;
968 else
969 flags = ACL_START;
970
971 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
972 skb->priority = HCI_PRIO_MAX;
973
974 hci_send_acl(conn->hchan, skb, flags);
975 }
976
l2cap_do_send(struct l2cap_chan * chan,struct sk_buff * skb)977 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
978 {
979 struct hci_conn *hcon = chan->conn->hcon;
980 u16 flags;
981
982 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
983 skb->priority);
984
985 /* Use NO_FLUSH for LE links (where this is the only option) or
986 * if the BR/EDR link supports it and flushing has not been
987 * explicitly requested (through FLAG_FLUSHABLE).
988 */
989 if (hcon->type == LE_LINK ||
990 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
991 lmp_no_flush_capable(hcon->hdev)))
992 flags = ACL_START_NO_FLUSH;
993 else
994 flags = ACL_START;
995
996 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
997 hci_send_acl(chan->conn->hchan, skb, flags);
998 }
999
__unpack_enhanced_control(u16 enh,struct l2cap_ctrl * control)1000 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
1001 {
1002 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
1003 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
1004
1005 if (enh & L2CAP_CTRL_FRAME_TYPE) {
1006 /* S-Frame */
1007 control->sframe = 1;
1008 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1009 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1010
1011 control->sar = 0;
1012 control->txseq = 0;
1013 } else {
1014 /* I-Frame */
1015 control->sframe = 0;
1016 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1017 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1018
1019 control->poll = 0;
1020 control->super = 0;
1021 }
1022 }
1023
__unpack_extended_control(u32 ext,struct l2cap_ctrl * control)1024 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1025 {
1026 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1027 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1028
1029 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1030 /* S-Frame */
1031 control->sframe = 1;
1032 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1033 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1034
1035 control->sar = 0;
1036 control->txseq = 0;
1037 } else {
1038 /* I-Frame */
1039 control->sframe = 0;
1040 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1041 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1042
1043 control->poll = 0;
1044 control->super = 0;
1045 }
1046 }
1047
__unpack_control(struct l2cap_chan * chan,struct sk_buff * skb)1048 static inline void __unpack_control(struct l2cap_chan *chan,
1049 struct sk_buff *skb)
1050 {
1051 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1052 __unpack_extended_control(get_unaligned_le32(skb->data),
1053 &bt_cb(skb)->l2cap);
1054 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1055 } else {
1056 __unpack_enhanced_control(get_unaligned_le16(skb->data),
1057 &bt_cb(skb)->l2cap);
1058 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1059 }
1060 }
1061
__pack_extended_control(struct l2cap_ctrl * control)1062 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1063 {
1064 u32 packed;
1065
1066 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1067 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1068
1069 if (control->sframe) {
1070 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1071 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1072 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1073 } else {
1074 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1075 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1076 }
1077
1078 return packed;
1079 }
1080
__pack_enhanced_control(struct l2cap_ctrl * control)1081 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1082 {
1083 u16 packed;
1084
1085 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1086 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1087
1088 if (control->sframe) {
1089 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1090 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1091 packed |= L2CAP_CTRL_FRAME_TYPE;
1092 } else {
1093 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1094 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1095 }
1096
1097 return packed;
1098 }
1099
__pack_control(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)1100 static inline void __pack_control(struct l2cap_chan *chan,
1101 struct l2cap_ctrl *control,
1102 struct sk_buff *skb)
1103 {
1104 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1105 put_unaligned_le32(__pack_extended_control(control),
1106 skb->data + L2CAP_HDR_SIZE);
1107 } else {
1108 put_unaligned_le16(__pack_enhanced_control(control),
1109 skb->data + L2CAP_HDR_SIZE);
1110 }
1111 }
1112
__ertm_hdr_size(struct l2cap_chan * chan)1113 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1114 {
1115 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1116 return L2CAP_EXT_HDR_SIZE;
1117 else
1118 return L2CAP_ENH_HDR_SIZE;
1119 }
1120
l2cap_create_sframe_pdu(struct l2cap_chan * chan,u32 control)1121 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1122 u32 control)
1123 {
1124 struct sk_buff *skb;
1125 struct l2cap_hdr *lh;
1126 int hlen = __ertm_hdr_size(chan);
1127
1128 if (chan->fcs == L2CAP_FCS_CRC16)
1129 hlen += L2CAP_FCS_SIZE;
1130
1131 skb = bt_skb_alloc(hlen, GFP_KERNEL);
1132
1133 if (!skb)
1134 return ERR_PTR(-ENOMEM);
1135
1136 lh = skb_put(skb, L2CAP_HDR_SIZE);
1137 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1138 lh->cid = cpu_to_le16(chan->dcid);
1139
1140 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1141 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1142 else
1143 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1144
1145 if (chan->fcs == L2CAP_FCS_CRC16) {
1146 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1147 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1148 }
1149
1150 skb->priority = HCI_PRIO_MAX;
1151 return skb;
1152 }
1153
l2cap_send_sframe(struct l2cap_chan * chan,struct l2cap_ctrl * control)1154 static void l2cap_send_sframe(struct l2cap_chan *chan,
1155 struct l2cap_ctrl *control)
1156 {
1157 struct sk_buff *skb;
1158 u32 control_field;
1159
1160 BT_DBG("chan %p, control %p", chan, control);
1161
1162 if (!control->sframe)
1163 return;
1164
1165 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1166 !control->poll)
1167 control->final = 1;
1168
1169 if (control->super == L2CAP_SUPER_RR)
1170 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1171 else if (control->super == L2CAP_SUPER_RNR)
1172 set_bit(CONN_RNR_SENT, &chan->conn_state);
1173
1174 if (control->super != L2CAP_SUPER_SREJ) {
1175 chan->last_acked_seq = control->reqseq;
1176 __clear_ack_timer(chan);
1177 }
1178
1179 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1180 control->final, control->poll, control->super);
1181
1182 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1183 control_field = __pack_extended_control(control);
1184 else
1185 control_field = __pack_enhanced_control(control);
1186
1187 skb = l2cap_create_sframe_pdu(chan, control_field);
1188 if (!IS_ERR(skb))
1189 l2cap_do_send(chan, skb);
1190 }
1191
l2cap_send_rr_or_rnr(struct l2cap_chan * chan,bool poll)1192 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1193 {
1194 struct l2cap_ctrl control;
1195
1196 BT_DBG("chan %p, poll %d", chan, poll);
1197
1198 memset(&control, 0, sizeof(control));
1199 control.sframe = 1;
1200 control.poll = poll;
1201
1202 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1203 control.super = L2CAP_SUPER_RNR;
1204 else
1205 control.super = L2CAP_SUPER_RR;
1206
1207 control.reqseq = chan->buffer_seq;
1208 l2cap_send_sframe(chan, &control);
1209 }
1210
__l2cap_no_conn_pending(struct l2cap_chan * chan)1211 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1212 {
1213 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1214 return true;
1215
1216 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1217 }
1218
l2cap_send_conn_req(struct l2cap_chan * chan)1219 void l2cap_send_conn_req(struct l2cap_chan *chan)
1220 {
1221 struct l2cap_conn *conn = chan->conn;
1222 struct l2cap_conn_req req;
1223
1224 req.scid = cpu_to_le16(chan->scid);
1225 req.psm = chan->psm;
1226
1227 chan->ident = l2cap_get_ident(conn);
1228
1229 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1230
1231 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1232 }
1233
l2cap_chan_ready(struct l2cap_chan * chan)1234 static void l2cap_chan_ready(struct l2cap_chan *chan)
1235 {
1236 /* The channel may have already been flagged as connected in
1237 * case of receiving data before the L2CAP info req/rsp
1238 * procedure is complete.
1239 */
1240 if (chan->state == BT_CONNECTED)
1241 return;
1242
1243 /* This clears all conf flags, including CONF_NOT_COMPLETE */
1244 chan->conf_state = 0;
1245 __clear_chan_timer(chan);
1246
1247 switch (chan->mode) {
1248 case L2CAP_MODE_LE_FLOWCTL:
1249 case L2CAP_MODE_EXT_FLOWCTL:
1250 if (!chan->tx_credits)
1251 chan->ops->suspend(chan);
1252 break;
1253 }
1254
1255 chan->state = BT_CONNECTED;
1256
1257 chan->ops->ready(chan);
1258 }
1259
l2cap_le_connect(struct l2cap_chan * chan)1260 static void l2cap_le_connect(struct l2cap_chan *chan)
1261 {
1262 struct l2cap_conn *conn = chan->conn;
1263 struct l2cap_le_conn_req req;
1264
1265 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1266 return;
1267
1268 if (!chan->imtu)
1269 chan->imtu = chan->conn->mtu;
1270
1271 l2cap_le_flowctl_init(chan, 0);
1272
1273 memset(&req, 0, sizeof(req));
1274 req.psm = chan->psm;
1275 req.scid = cpu_to_le16(chan->scid);
1276 req.mtu = cpu_to_le16(chan->imtu);
1277 req.mps = cpu_to_le16(chan->mps);
1278 req.credits = cpu_to_le16(chan->rx_credits);
1279
1280 chan->ident = l2cap_get_ident(conn);
1281
1282 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1283 sizeof(req), &req);
1284 }
1285
1286 struct l2cap_ecred_conn_data {
1287 struct {
1288 struct l2cap_ecred_conn_req req;
1289 __le16 scid[5];
1290 } __packed pdu;
1291 struct l2cap_chan *chan;
1292 struct pid *pid;
1293 int count;
1294 };
1295
l2cap_ecred_defer_connect(struct l2cap_chan * chan,void * data)1296 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1297 {
1298 struct l2cap_ecred_conn_data *conn = data;
1299 struct pid *pid;
1300
1301 if (chan == conn->chan)
1302 return;
1303
1304 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1305 return;
1306
1307 pid = chan->ops->get_peer_pid(chan);
1308
1309 /* Only add deferred channels with the same PID/PSM */
1310 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1311 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1312 return;
1313
1314 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1315 return;
1316
1317 l2cap_ecred_init(chan, 0);
1318
1319 /* Set the same ident so we can match on the rsp */
1320 chan->ident = conn->chan->ident;
1321
1322 /* Include all channels deferred */
1323 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1324
1325 conn->count++;
1326 }
1327
l2cap_ecred_connect(struct l2cap_chan * chan)1328 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1329 {
1330 struct l2cap_conn *conn = chan->conn;
1331 struct l2cap_ecred_conn_data data;
1332
1333 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1334 return;
1335
1336 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1337 return;
1338
1339 l2cap_ecred_init(chan, 0);
1340
1341 memset(&data, 0, sizeof(data));
1342 data.pdu.req.psm = chan->psm;
1343 data.pdu.req.mtu = cpu_to_le16(chan->imtu);
1344 data.pdu.req.mps = cpu_to_le16(chan->mps);
1345 data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1346 data.pdu.scid[0] = cpu_to_le16(chan->scid);
1347
1348 chan->ident = l2cap_get_ident(conn);
1349
1350 data.count = 1;
1351 data.chan = chan;
1352 data.pid = chan->ops->get_peer_pid(chan);
1353
1354 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1355
1356 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1357 sizeof(data.pdu.req) + data.count * sizeof(__le16),
1358 &data.pdu);
1359 }
1360
l2cap_le_start(struct l2cap_chan * chan)1361 static void l2cap_le_start(struct l2cap_chan *chan)
1362 {
1363 struct l2cap_conn *conn = chan->conn;
1364
1365 if (!smp_conn_security(conn->hcon, chan->sec_level))
1366 return;
1367
1368 if (!chan->psm) {
1369 l2cap_chan_ready(chan);
1370 return;
1371 }
1372
1373 if (chan->state == BT_CONNECT) {
1374 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1375 l2cap_ecred_connect(chan);
1376 else
1377 l2cap_le_connect(chan);
1378 }
1379 }
1380
l2cap_start_connection(struct l2cap_chan * chan)1381 static void l2cap_start_connection(struct l2cap_chan *chan)
1382 {
1383 if (chan->conn->hcon->type == LE_LINK) {
1384 l2cap_le_start(chan);
1385 } else {
1386 l2cap_send_conn_req(chan);
1387 }
1388 }
1389
l2cap_request_info(struct l2cap_conn * conn)1390 static void l2cap_request_info(struct l2cap_conn *conn)
1391 {
1392 struct l2cap_info_req req;
1393
1394 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1395 return;
1396
1397 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1398
1399 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1400 conn->info_ident = l2cap_get_ident(conn);
1401
1402 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1403
1404 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1405 sizeof(req), &req);
1406 }
1407
l2cap_check_enc_key_size(struct hci_conn * hcon)1408 static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1409 {
1410 /* The minimum encryption key size needs to be enforced by the
1411 * host stack before establishing any L2CAP connections. The
1412 * specification in theory allows a minimum of 1, but to align
1413 * BR/EDR and LE transports, a minimum of 7 is chosen.
1414 *
1415 * This check might also be called for unencrypted connections
1416 * that have no key size requirements. Ensure that the link is
1417 * actually encrypted before enforcing a key size.
1418 */
1419 int min_key_size = hcon->hdev->min_enc_key_size;
1420
1421 /* On FIPS security level, key size must be 16 bytes */
1422 if (hcon->sec_level == BT_SECURITY_FIPS)
1423 min_key_size = 16;
1424
1425 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1426 hcon->enc_key_size >= min_key_size);
1427 }
1428
l2cap_do_start(struct l2cap_chan * chan)1429 static void l2cap_do_start(struct l2cap_chan *chan)
1430 {
1431 struct l2cap_conn *conn = chan->conn;
1432
1433 if (conn->hcon->type == LE_LINK) {
1434 l2cap_le_start(chan);
1435 return;
1436 }
1437
1438 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1439 l2cap_request_info(conn);
1440 return;
1441 }
1442
1443 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1444 return;
1445
1446 if (!l2cap_chan_check_security(chan, true) ||
1447 !__l2cap_no_conn_pending(chan))
1448 return;
1449
1450 if (l2cap_check_enc_key_size(conn->hcon))
1451 l2cap_start_connection(chan);
1452 else
1453 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1454 }
1455
l2cap_mode_supported(__u8 mode,__u32 feat_mask)1456 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1457 {
1458 u32 local_feat_mask = l2cap_feat_mask;
1459 if (!disable_ertm)
1460 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1461
1462 switch (mode) {
1463 case L2CAP_MODE_ERTM:
1464 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1465 case L2CAP_MODE_STREAMING:
1466 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1467 default:
1468 return 0x00;
1469 }
1470 }
1471
l2cap_send_disconn_req(struct l2cap_chan * chan,int err)1472 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1473 {
1474 struct l2cap_conn *conn = chan->conn;
1475 struct l2cap_disconn_req req;
1476
1477 if (!conn)
1478 return;
1479
1480 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1481 __clear_retrans_timer(chan);
1482 __clear_monitor_timer(chan);
1483 __clear_ack_timer(chan);
1484 }
1485
1486 req.dcid = cpu_to_le16(chan->dcid);
1487 req.scid = cpu_to_le16(chan->scid);
1488 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1489 sizeof(req), &req);
1490
1491 l2cap_state_change_and_error(chan, BT_DISCONN, err);
1492 }
1493
1494 /* ---- L2CAP connections ---- */
l2cap_conn_start(struct l2cap_conn * conn)1495 static void l2cap_conn_start(struct l2cap_conn *conn)
1496 {
1497 struct l2cap_chan *chan, *tmp;
1498
1499 BT_DBG("conn %p", conn);
1500
1501 mutex_lock(&conn->chan_lock);
1502
1503 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1504 l2cap_chan_lock(chan);
1505
1506 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1507 l2cap_chan_ready(chan);
1508 l2cap_chan_unlock(chan);
1509 continue;
1510 }
1511
1512 if (chan->state == BT_CONNECT) {
1513 if (!l2cap_chan_check_security(chan, true) ||
1514 !__l2cap_no_conn_pending(chan)) {
1515 l2cap_chan_unlock(chan);
1516 continue;
1517 }
1518
1519 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1520 && test_bit(CONF_STATE2_DEVICE,
1521 &chan->conf_state)) {
1522 l2cap_chan_close(chan, ECONNRESET);
1523 l2cap_chan_unlock(chan);
1524 continue;
1525 }
1526
1527 if (l2cap_check_enc_key_size(conn->hcon))
1528 l2cap_start_connection(chan);
1529 else
1530 l2cap_chan_close(chan, ECONNREFUSED);
1531
1532 } else if (chan->state == BT_CONNECT2) {
1533 struct l2cap_conn_rsp rsp;
1534 char buf[128];
1535 rsp.scid = cpu_to_le16(chan->dcid);
1536 rsp.dcid = cpu_to_le16(chan->scid);
1537
1538 if (l2cap_chan_check_security(chan, false)) {
1539 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1540 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1541 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1542 chan->ops->defer(chan);
1543
1544 } else {
1545 l2cap_state_change(chan, BT_CONFIG);
1546 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1547 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1548 }
1549 } else {
1550 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1551 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1552 }
1553
1554 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1555 sizeof(rsp), &rsp);
1556
1557 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1558 rsp.result != L2CAP_CR_SUCCESS) {
1559 l2cap_chan_unlock(chan);
1560 continue;
1561 }
1562
1563 set_bit(CONF_REQ_SENT, &chan->conf_state);
1564 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1565 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1566 chan->num_conf_req++;
1567 }
1568
1569 l2cap_chan_unlock(chan);
1570 }
1571
1572 mutex_unlock(&conn->chan_lock);
1573 }
1574
l2cap_le_conn_ready(struct l2cap_conn * conn)1575 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1576 {
1577 struct hci_conn *hcon = conn->hcon;
1578 struct hci_dev *hdev = hcon->hdev;
1579
1580 BT_DBG("%s conn %p", hdev->name, conn);
1581
1582 /* For outgoing pairing which doesn't necessarily have an
1583 * associated socket (e.g. mgmt_pair_device).
1584 */
1585 if (hcon->out)
1586 smp_conn_security(hcon, hcon->pending_sec_level);
1587
1588 /* For LE peripheral connections, make sure the connection interval
1589 * is in the range of the minimum and maximum interval that has
1590 * been configured for this connection. If not, then trigger
1591 * the connection update procedure.
1592 */
1593 if (hcon->role == HCI_ROLE_SLAVE &&
1594 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1595 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1596 struct l2cap_conn_param_update_req req;
1597
1598 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1599 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1600 req.latency = cpu_to_le16(hcon->le_conn_latency);
1601 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1602
1603 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1604 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1605 }
1606 }
1607
l2cap_conn_ready(struct l2cap_conn * conn)1608 static void l2cap_conn_ready(struct l2cap_conn *conn)
1609 {
1610 struct l2cap_chan *chan;
1611 struct hci_conn *hcon = conn->hcon;
1612
1613 BT_DBG("conn %p", conn);
1614
1615 if (hcon->type == ACL_LINK)
1616 l2cap_request_info(conn);
1617
1618 mutex_lock(&conn->chan_lock);
1619
1620 list_for_each_entry(chan, &conn->chan_l, list) {
1621
1622 l2cap_chan_lock(chan);
1623
1624 if (hcon->type == LE_LINK) {
1625 l2cap_le_start(chan);
1626 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1627 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1628 l2cap_chan_ready(chan);
1629 } else if (chan->state == BT_CONNECT) {
1630 l2cap_do_start(chan);
1631 }
1632
1633 l2cap_chan_unlock(chan);
1634 }
1635
1636 mutex_unlock(&conn->chan_lock);
1637
1638 if (hcon->type == LE_LINK)
1639 l2cap_le_conn_ready(conn);
1640
1641 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1642 }
1643
1644 /* Notify sockets that we cannot guaranty reliability anymore */
l2cap_conn_unreliable(struct l2cap_conn * conn,int err)1645 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1646 {
1647 struct l2cap_chan *chan;
1648
1649 BT_DBG("conn %p", conn);
1650
1651 mutex_lock(&conn->chan_lock);
1652
1653 list_for_each_entry(chan, &conn->chan_l, list) {
1654 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1655 l2cap_chan_set_err(chan, err);
1656 }
1657
1658 mutex_unlock(&conn->chan_lock);
1659 }
1660
l2cap_info_timeout(struct work_struct * work)1661 static void l2cap_info_timeout(struct work_struct *work)
1662 {
1663 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1664 info_timer.work);
1665
1666 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1667 conn->info_ident = 0;
1668
1669 l2cap_conn_start(conn);
1670 }
1671
1672 /*
1673 * l2cap_user
1674 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1675 * callback is called during registration. The ->remove callback is called
1676 * during unregistration.
1677 * An l2cap_user object can either be explicitly unregistered or when the
1678 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1679 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1680 * External modules must own a reference to the l2cap_conn object if they intend
1681 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1682 * any time if they don't.
1683 */
1684
l2cap_register_user(struct l2cap_conn * conn,struct l2cap_user * user)1685 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1686 {
1687 struct hci_dev *hdev = conn->hcon->hdev;
1688 int ret;
1689
1690 /* We need to check whether l2cap_conn is registered. If it is not, we
1691 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1692 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1693 * relies on the parent hci_conn object to be locked. This itself relies
1694 * on the hci_dev object to be locked. So we must lock the hci device
1695 * here, too. */
1696
1697 hci_dev_lock(hdev);
1698
1699 if (!list_empty(&user->list)) {
1700 ret = -EINVAL;
1701 goto out_unlock;
1702 }
1703
1704 /* conn->hchan is NULL after l2cap_conn_del() was called */
1705 if (!conn->hchan) {
1706 ret = -ENODEV;
1707 goto out_unlock;
1708 }
1709
1710 ret = user->probe(conn, user);
1711 if (ret)
1712 goto out_unlock;
1713
1714 list_add(&user->list, &conn->users);
1715 ret = 0;
1716
1717 out_unlock:
1718 hci_dev_unlock(hdev);
1719 return ret;
1720 }
1721 EXPORT_SYMBOL(l2cap_register_user);
1722
l2cap_unregister_user(struct l2cap_conn * conn,struct l2cap_user * user)1723 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1724 {
1725 struct hci_dev *hdev = conn->hcon->hdev;
1726
1727 hci_dev_lock(hdev);
1728
1729 if (list_empty(&user->list))
1730 goto out_unlock;
1731
1732 list_del_init(&user->list);
1733 user->remove(conn, user);
1734
1735 out_unlock:
1736 hci_dev_unlock(hdev);
1737 }
1738 EXPORT_SYMBOL(l2cap_unregister_user);
1739
l2cap_unregister_all_users(struct l2cap_conn * conn)1740 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1741 {
1742 struct l2cap_user *user;
1743
1744 while (!list_empty(&conn->users)) {
1745 user = list_first_entry(&conn->users, struct l2cap_user, list);
1746 list_del_init(&user->list);
1747 user->remove(conn, user);
1748 }
1749 }
1750
l2cap_conn_del(struct hci_conn * hcon,int err)1751 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1752 {
1753 struct l2cap_conn *conn = hcon->l2cap_data;
1754 struct l2cap_chan *chan, *l;
1755
1756 if (!conn)
1757 return;
1758
1759 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1760
1761 kfree_skb(conn->rx_skb);
1762
1763 skb_queue_purge(&conn->pending_rx);
1764
1765 /* We can not call flush_work(&conn->pending_rx_work) here since we
1766 * might block if we are running on a worker from the same workqueue
1767 * pending_rx_work is waiting on.
1768 */
1769 if (work_pending(&conn->pending_rx_work))
1770 cancel_work_sync(&conn->pending_rx_work);
1771
1772 cancel_delayed_work_sync(&conn->id_addr_timer);
1773
1774 l2cap_unregister_all_users(conn);
1775
1776 /* Force the connection to be immediately dropped */
1777 hcon->disc_timeout = 0;
1778
1779 mutex_lock(&conn->chan_lock);
1780
1781 /* Kill channels */
1782 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1783 l2cap_chan_hold(chan);
1784 l2cap_chan_lock(chan);
1785
1786 l2cap_chan_del(chan, err);
1787
1788 chan->ops->close(chan);
1789
1790 l2cap_chan_unlock(chan);
1791 l2cap_chan_put(chan);
1792 }
1793
1794 mutex_unlock(&conn->chan_lock);
1795
1796 hci_chan_del(conn->hchan);
1797
1798 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1799 cancel_delayed_work_sync(&conn->info_timer);
1800
1801 hcon->l2cap_data = NULL;
1802 conn->hchan = NULL;
1803 l2cap_conn_put(conn);
1804 }
1805
l2cap_conn_free(struct kref * ref)1806 static void l2cap_conn_free(struct kref *ref)
1807 {
1808 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1809
1810 hci_conn_put(conn->hcon);
1811 kfree(conn);
1812 }
1813
l2cap_conn_get(struct l2cap_conn * conn)1814 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1815 {
1816 kref_get(&conn->ref);
1817 return conn;
1818 }
1819 EXPORT_SYMBOL(l2cap_conn_get);
1820
l2cap_conn_put(struct l2cap_conn * conn)1821 void l2cap_conn_put(struct l2cap_conn *conn)
1822 {
1823 kref_put(&conn->ref, l2cap_conn_free);
1824 }
1825 EXPORT_SYMBOL(l2cap_conn_put);
1826
1827 /* ---- Socket interface ---- */
1828
1829 /* Find socket with psm and source / destination bdaddr.
1830 * Returns closest match.
1831 */
l2cap_global_chan_by_psm(int state,__le16 psm,bdaddr_t * src,bdaddr_t * dst,u8 link_type)1832 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1833 bdaddr_t *src,
1834 bdaddr_t *dst,
1835 u8 link_type)
1836 {
1837 struct l2cap_chan *c, *tmp, *c1 = NULL;
1838
1839 read_lock(&chan_list_lock);
1840
1841 list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1842 if (state && c->state != state)
1843 continue;
1844
1845 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1846 continue;
1847
1848 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1849 continue;
1850
1851 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
1852 int src_match, dst_match;
1853 int src_any, dst_any;
1854
1855 /* Exact match. */
1856 src_match = !bacmp(&c->src, src);
1857 dst_match = !bacmp(&c->dst, dst);
1858 if (src_match && dst_match) {
1859 if (!l2cap_chan_hold_unless_zero(c))
1860 continue;
1861
1862 read_unlock(&chan_list_lock);
1863 return c;
1864 }
1865
1866 /* Closest match */
1867 src_any = !bacmp(&c->src, BDADDR_ANY);
1868 dst_any = !bacmp(&c->dst, BDADDR_ANY);
1869 if ((src_match && dst_any) || (src_any && dst_match) ||
1870 (src_any && dst_any))
1871 c1 = c;
1872 }
1873 }
1874
1875 if (c1)
1876 c1 = l2cap_chan_hold_unless_zero(c1);
1877
1878 read_unlock(&chan_list_lock);
1879
1880 return c1;
1881 }
1882
l2cap_monitor_timeout(struct work_struct * work)1883 static void l2cap_monitor_timeout(struct work_struct *work)
1884 {
1885 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1886 monitor_timer.work);
1887
1888 BT_DBG("chan %p", chan);
1889
1890 l2cap_chan_lock(chan);
1891
1892 if (!chan->conn) {
1893 l2cap_chan_unlock(chan);
1894 l2cap_chan_put(chan);
1895 return;
1896 }
1897
1898 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1899
1900 l2cap_chan_unlock(chan);
1901 l2cap_chan_put(chan);
1902 }
1903
l2cap_retrans_timeout(struct work_struct * work)1904 static void l2cap_retrans_timeout(struct work_struct *work)
1905 {
1906 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1907 retrans_timer.work);
1908
1909 BT_DBG("chan %p", chan);
1910
1911 l2cap_chan_lock(chan);
1912
1913 if (!chan->conn) {
1914 l2cap_chan_unlock(chan);
1915 l2cap_chan_put(chan);
1916 return;
1917 }
1918
1919 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1920 l2cap_chan_unlock(chan);
1921 l2cap_chan_put(chan);
1922 }
1923
l2cap_streaming_send(struct l2cap_chan * chan,struct sk_buff_head * skbs)1924 static void l2cap_streaming_send(struct l2cap_chan *chan,
1925 struct sk_buff_head *skbs)
1926 {
1927 struct sk_buff *skb;
1928 struct l2cap_ctrl *control;
1929
1930 BT_DBG("chan %p, skbs %p", chan, skbs);
1931
1932 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1933
1934 while (!skb_queue_empty(&chan->tx_q)) {
1935
1936 skb = skb_dequeue(&chan->tx_q);
1937
1938 bt_cb(skb)->l2cap.retries = 1;
1939 control = &bt_cb(skb)->l2cap;
1940
1941 control->reqseq = 0;
1942 control->txseq = chan->next_tx_seq;
1943
1944 __pack_control(chan, control, skb);
1945
1946 if (chan->fcs == L2CAP_FCS_CRC16) {
1947 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1948 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1949 }
1950
1951 l2cap_do_send(chan, skb);
1952
1953 BT_DBG("Sent txseq %u", control->txseq);
1954
1955 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1956 chan->frames_sent++;
1957 }
1958 }
1959
l2cap_ertm_send(struct l2cap_chan * chan)1960 static int l2cap_ertm_send(struct l2cap_chan *chan)
1961 {
1962 struct sk_buff *skb, *tx_skb;
1963 struct l2cap_ctrl *control;
1964 int sent = 0;
1965
1966 BT_DBG("chan %p", chan);
1967
1968 if (chan->state != BT_CONNECTED)
1969 return -ENOTCONN;
1970
1971 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1972 return 0;
1973
1974 while (chan->tx_send_head &&
1975 chan->unacked_frames < chan->remote_tx_win &&
1976 chan->tx_state == L2CAP_TX_STATE_XMIT) {
1977
1978 skb = chan->tx_send_head;
1979
1980 bt_cb(skb)->l2cap.retries = 1;
1981 control = &bt_cb(skb)->l2cap;
1982
1983 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1984 control->final = 1;
1985
1986 control->reqseq = chan->buffer_seq;
1987 chan->last_acked_seq = chan->buffer_seq;
1988 control->txseq = chan->next_tx_seq;
1989
1990 __pack_control(chan, control, skb);
1991
1992 if (chan->fcs == L2CAP_FCS_CRC16) {
1993 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1994 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1995 }
1996
1997 /* Clone after data has been modified. Data is assumed to be
1998 read-only (for locking purposes) on cloned sk_buffs.
1999 */
2000 tx_skb = skb_clone(skb, GFP_KERNEL);
2001
2002 if (!tx_skb)
2003 break;
2004
2005 __set_retrans_timer(chan);
2006
2007 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2008 chan->unacked_frames++;
2009 chan->frames_sent++;
2010 sent++;
2011
2012 if (skb_queue_is_last(&chan->tx_q, skb))
2013 chan->tx_send_head = NULL;
2014 else
2015 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2016
2017 l2cap_do_send(chan, tx_skb);
2018 BT_DBG("Sent txseq %u", control->txseq);
2019 }
2020
2021 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2022 chan->unacked_frames, skb_queue_len(&chan->tx_q));
2023
2024 return sent;
2025 }
2026
l2cap_ertm_resend(struct l2cap_chan * chan)2027 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2028 {
2029 struct l2cap_ctrl control;
2030 struct sk_buff *skb;
2031 struct sk_buff *tx_skb;
2032 u16 seq;
2033
2034 BT_DBG("chan %p", chan);
2035
2036 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2037 return;
2038
2039 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2040 seq = l2cap_seq_list_pop(&chan->retrans_list);
2041
2042 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2043 if (!skb) {
2044 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2045 seq);
2046 continue;
2047 }
2048
2049 bt_cb(skb)->l2cap.retries++;
2050 control = bt_cb(skb)->l2cap;
2051
2052 if (chan->max_tx != 0 &&
2053 bt_cb(skb)->l2cap.retries > chan->max_tx) {
2054 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2055 l2cap_send_disconn_req(chan, ECONNRESET);
2056 l2cap_seq_list_clear(&chan->retrans_list);
2057 break;
2058 }
2059
2060 control.reqseq = chan->buffer_seq;
2061 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2062 control.final = 1;
2063 else
2064 control.final = 0;
2065
2066 if (skb_cloned(skb)) {
2067 /* Cloned sk_buffs are read-only, so we need a
2068 * writeable copy
2069 */
2070 tx_skb = skb_copy(skb, GFP_KERNEL);
2071 } else {
2072 tx_skb = skb_clone(skb, GFP_KERNEL);
2073 }
2074
2075 if (!tx_skb) {
2076 l2cap_seq_list_clear(&chan->retrans_list);
2077 break;
2078 }
2079
2080 /* Update skb contents */
2081 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2082 put_unaligned_le32(__pack_extended_control(&control),
2083 tx_skb->data + L2CAP_HDR_SIZE);
2084 } else {
2085 put_unaligned_le16(__pack_enhanced_control(&control),
2086 tx_skb->data + L2CAP_HDR_SIZE);
2087 }
2088
2089 /* Update FCS */
2090 if (chan->fcs == L2CAP_FCS_CRC16) {
2091 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2092 tx_skb->len - L2CAP_FCS_SIZE);
2093 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2094 L2CAP_FCS_SIZE);
2095 }
2096
2097 l2cap_do_send(chan, tx_skb);
2098
2099 BT_DBG("Resent txseq %d", control.txseq);
2100
2101 chan->last_acked_seq = chan->buffer_seq;
2102 }
2103 }
2104
l2cap_retransmit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2105 static void l2cap_retransmit(struct l2cap_chan *chan,
2106 struct l2cap_ctrl *control)
2107 {
2108 BT_DBG("chan %p, control %p", chan, control);
2109
2110 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2111 l2cap_ertm_resend(chan);
2112 }
2113
l2cap_retransmit_all(struct l2cap_chan * chan,struct l2cap_ctrl * control)2114 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2115 struct l2cap_ctrl *control)
2116 {
2117 struct sk_buff *skb;
2118
2119 BT_DBG("chan %p, control %p", chan, control);
2120
2121 if (control->poll)
2122 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2123
2124 l2cap_seq_list_clear(&chan->retrans_list);
2125
2126 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2127 return;
2128
2129 if (chan->unacked_frames) {
2130 skb_queue_walk(&chan->tx_q, skb) {
2131 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2132 skb == chan->tx_send_head)
2133 break;
2134 }
2135
2136 skb_queue_walk_from(&chan->tx_q, skb) {
2137 if (skb == chan->tx_send_head)
2138 break;
2139
2140 l2cap_seq_list_append(&chan->retrans_list,
2141 bt_cb(skb)->l2cap.txseq);
2142 }
2143
2144 l2cap_ertm_resend(chan);
2145 }
2146 }
2147
l2cap_send_ack(struct l2cap_chan * chan)2148 static void l2cap_send_ack(struct l2cap_chan *chan)
2149 {
2150 struct l2cap_ctrl control;
2151 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2152 chan->last_acked_seq);
2153 int threshold;
2154
2155 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2156 chan, chan->last_acked_seq, chan->buffer_seq);
2157
2158 memset(&control, 0, sizeof(control));
2159 control.sframe = 1;
2160
2161 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2162 chan->rx_state == L2CAP_RX_STATE_RECV) {
2163 __clear_ack_timer(chan);
2164 control.super = L2CAP_SUPER_RNR;
2165 control.reqseq = chan->buffer_seq;
2166 l2cap_send_sframe(chan, &control);
2167 } else {
2168 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2169 l2cap_ertm_send(chan);
2170 /* If any i-frames were sent, they included an ack */
2171 if (chan->buffer_seq == chan->last_acked_seq)
2172 frames_to_ack = 0;
2173 }
2174
2175 /* Ack now if the window is 3/4ths full.
2176 * Calculate without mul or div
2177 */
2178 threshold = chan->ack_win;
2179 threshold += threshold << 1;
2180 threshold >>= 2;
2181
2182 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2183 threshold);
2184
2185 if (frames_to_ack >= threshold) {
2186 __clear_ack_timer(chan);
2187 control.super = L2CAP_SUPER_RR;
2188 control.reqseq = chan->buffer_seq;
2189 l2cap_send_sframe(chan, &control);
2190 frames_to_ack = 0;
2191 }
2192
2193 if (frames_to_ack)
2194 __set_ack_timer(chan);
2195 }
2196 }
2197
l2cap_skbuff_fromiovec(struct l2cap_chan * chan,struct msghdr * msg,int len,int count,struct sk_buff * skb)2198 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2199 struct msghdr *msg, int len,
2200 int count, struct sk_buff *skb)
2201 {
2202 struct l2cap_conn *conn = chan->conn;
2203 struct sk_buff **frag;
2204 int sent = 0;
2205
2206 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2207 return -EFAULT;
2208
2209 sent += count;
2210 len -= count;
2211
2212 /* Continuation fragments (no L2CAP header) */
2213 frag = &skb_shinfo(skb)->frag_list;
2214 while (len) {
2215 struct sk_buff *tmp;
2216
2217 count = min_t(unsigned int, conn->mtu, len);
2218
2219 tmp = chan->ops->alloc_skb(chan, 0, count,
2220 msg->msg_flags & MSG_DONTWAIT);
2221 if (IS_ERR(tmp))
2222 return PTR_ERR(tmp);
2223
2224 *frag = tmp;
2225
2226 if (!copy_from_iter_full(skb_put(*frag, count), count,
2227 &msg->msg_iter))
2228 return -EFAULT;
2229
2230 sent += count;
2231 len -= count;
2232
2233 skb->len += (*frag)->len;
2234 skb->data_len += (*frag)->len;
2235
2236 frag = &(*frag)->next;
2237 }
2238
2239 return sent;
2240 }
2241
l2cap_create_connless_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2242 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2243 struct msghdr *msg, size_t len)
2244 {
2245 struct l2cap_conn *conn = chan->conn;
2246 struct sk_buff *skb;
2247 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2248 struct l2cap_hdr *lh;
2249
2250 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2251 __le16_to_cpu(chan->psm), len);
2252
2253 count = min_t(unsigned int, (conn->mtu - hlen), len);
2254
2255 skb = chan->ops->alloc_skb(chan, hlen, count,
2256 msg->msg_flags & MSG_DONTWAIT);
2257 if (IS_ERR(skb))
2258 return skb;
2259
2260 /* Create L2CAP header */
2261 lh = skb_put(skb, L2CAP_HDR_SIZE);
2262 lh->cid = cpu_to_le16(chan->dcid);
2263 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2264 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2265
2266 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2267 if (unlikely(err < 0)) {
2268 kfree_skb(skb);
2269 return ERR_PTR(err);
2270 }
2271 return skb;
2272 }
2273
l2cap_create_basic_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2274 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2275 struct msghdr *msg, size_t len)
2276 {
2277 struct l2cap_conn *conn = chan->conn;
2278 struct sk_buff *skb;
2279 int err, count;
2280 struct l2cap_hdr *lh;
2281
2282 BT_DBG("chan %p len %zu", chan, len);
2283
2284 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2285
2286 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2287 msg->msg_flags & MSG_DONTWAIT);
2288 if (IS_ERR(skb))
2289 return skb;
2290
2291 /* Create L2CAP header */
2292 lh = skb_put(skb, L2CAP_HDR_SIZE);
2293 lh->cid = cpu_to_le16(chan->dcid);
2294 lh->len = cpu_to_le16(len);
2295
2296 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2297 if (unlikely(err < 0)) {
2298 kfree_skb(skb);
2299 return ERR_PTR(err);
2300 }
2301 return skb;
2302 }
2303
l2cap_create_iframe_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2304 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2305 struct msghdr *msg, size_t len,
2306 u16 sdulen)
2307 {
2308 struct l2cap_conn *conn = chan->conn;
2309 struct sk_buff *skb;
2310 int err, count, hlen;
2311 struct l2cap_hdr *lh;
2312
2313 BT_DBG("chan %p len %zu", chan, len);
2314
2315 if (!conn)
2316 return ERR_PTR(-ENOTCONN);
2317
2318 hlen = __ertm_hdr_size(chan);
2319
2320 if (sdulen)
2321 hlen += L2CAP_SDULEN_SIZE;
2322
2323 if (chan->fcs == L2CAP_FCS_CRC16)
2324 hlen += L2CAP_FCS_SIZE;
2325
2326 count = min_t(unsigned int, (conn->mtu - hlen), len);
2327
2328 skb = chan->ops->alloc_skb(chan, hlen, count,
2329 msg->msg_flags & MSG_DONTWAIT);
2330 if (IS_ERR(skb))
2331 return skb;
2332
2333 /* Create L2CAP header */
2334 lh = skb_put(skb, L2CAP_HDR_SIZE);
2335 lh->cid = cpu_to_le16(chan->dcid);
2336 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2337
2338 /* Control header is populated later */
2339 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2340 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2341 else
2342 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2343
2344 if (sdulen)
2345 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2346
2347 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2348 if (unlikely(err < 0)) {
2349 kfree_skb(skb);
2350 return ERR_PTR(err);
2351 }
2352
2353 bt_cb(skb)->l2cap.fcs = chan->fcs;
2354 bt_cb(skb)->l2cap.retries = 0;
2355 return skb;
2356 }
2357
l2cap_segment_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2358 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2359 struct sk_buff_head *seg_queue,
2360 struct msghdr *msg, size_t len)
2361 {
2362 struct sk_buff *skb;
2363 u16 sdu_len;
2364 size_t pdu_len;
2365 u8 sar;
2366
2367 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2368
2369 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2370 * so fragmented skbs are not used. The HCI layer's handling
2371 * of fragmented skbs is not compatible with ERTM's queueing.
2372 */
2373
2374 /* PDU size is derived from the HCI MTU */
2375 pdu_len = chan->conn->mtu;
2376
2377 /* Constrain PDU size for BR/EDR connections */
2378 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2379
2380 /* Adjust for largest possible L2CAP overhead. */
2381 if (chan->fcs)
2382 pdu_len -= L2CAP_FCS_SIZE;
2383
2384 pdu_len -= __ertm_hdr_size(chan);
2385
2386 /* Remote device may have requested smaller PDUs */
2387 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2388
2389 if (len <= pdu_len) {
2390 sar = L2CAP_SAR_UNSEGMENTED;
2391 sdu_len = 0;
2392 pdu_len = len;
2393 } else {
2394 sar = L2CAP_SAR_START;
2395 sdu_len = len;
2396 }
2397
2398 while (len > 0) {
2399 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2400
2401 if (IS_ERR(skb)) {
2402 __skb_queue_purge(seg_queue);
2403 return PTR_ERR(skb);
2404 }
2405
2406 bt_cb(skb)->l2cap.sar = sar;
2407 __skb_queue_tail(seg_queue, skb);
2408
2409 len -= pdu_len;
2410 if (sdu_len)
2411 sdu_len = 0;
2412
2413 if (len <= pdu_len) {
2414 sar = L2CAP_SAR_END;
2415 pdu_len = len;
2416 } else {
2417 sar = L2CAP_SAR_CONTINUE;
2418 }
2419 }
2420
2421 return 0;
2422 }
2423
l2cap_create_le_flowctl_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2424 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2425 struct msghdr *msg,
2426 size_t len, u16 sdulen)
2427 {
2428 struct l2cap_conn *conn = chan->conn;
2429 struct sk_buff *skb;
2430 int err, count, hlen;
2431 struct l2cap_hdr *lh;
2432
2433 BT_DBG("chan %p len %zu", chan, len);
2434
2435 if (!conn)
2436 return ERR_PTR(-ENOTCONN);
2437
2438 hlen = L2CAP_HDR_SIZE;
2439
2440 if (sdulen)
2441 hlen += L2CAP_SDULEN_SIZE;
2442
2443 count = min_t(unsigned int, (conn->mtu - hlen), len);
2444
2445 skb = chan->ops->alloc_skb(chan, hlen, count,
2446 msg->msg_flags & MSG_DONTWAIT);
2447 if (IS_ERR(skb))
2448 return skb;
2449
2450 /* Create L2CAP header */
2451 lh = skb_put(skb, L2CAP_HDR_SIZE);
2452 lh->cid = cpu_to_le16(chan->dcid);
2453 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2454
2455 if (sdulen)
2456 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2457
2458 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2459 if (unlikely(err < 0)) {
2460 kfree_skb(skb);
2461 return ERR_PTR(err);
2462 }
2463
2464 return skb;
2465 }
2466
l2cap_segment_le_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2467 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2468 struct sk_buff_head *seg_queue,
2469 struct msghdr *msg, size_t len)
2470 {
2471 struct sk_buff *skb;
2472 size_t pdu_len;
2473 u16 sdu_len;
2474
2475 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2476
2477 sdu_len = len;
2478 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2479
2480 while (len > 0) {
2481 if (len <= pdu_len)
2482 pdu_len = len;
2483
2484 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2485 if (IS_ERR(skb)) {
2486 __skb_queue_purge(seg_queue);
2487 return PTR_ERR(skb);
2488 }
2489
2490 __skb_queue_tail(seg_queue, skb);
2491
2492 len -= pdu_len;
2493
2494 if (sdu_len) {
2495 sdu_len = 0;
2496 pdu_len += L2CAP_SDULEN_SIZE;
2497 }
2498 }
2499
2500 return 0;
2501 }
2502
l2cap_le_flowctl_send(struct l2cap_chan * chan)2503 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2504 {
2505 int sent = 0;
2506
2507 BT_DBG("chan %p", chan);
2508
2509 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2510 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2511 chan->tx_credits--;
2512 sent++;
2513 }
2514
2515 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2516 skb_queue_len(&chan->tx_q));
2517 }
2518
l2cap_chan_send(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2519 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2520 {
2521 struct sk_buff *skb;
2522 int err;
2523 struct sk_buff_head seg_queue;
2524
2525 if (!chan->conn)
2526 return -ENOTCONN;
2527
2528 /* Connectionless channel */
2529 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2530 skb = l2cap_create_connless_pdu(chan, msg, len);
2531 if (IS_ERR(skb))
2532 return PTR_ERR(skb);
2533
2534 l2cap_do_send(chan, skb);
2535 return len;
2536 }
2537
2538 switch (chan->mode) {
2539 case L2CAP_MODE_LE_FLOWCTL:
2540 case L2CAP_MODE_EXT_FLOWCTL:
2541 /* Check outgoing MTU */
2542 if (len > chan->omtu)
2543 return -EMSGSIZE;
2544
2545 __skb_queue_head_init(&seg_queue);
2546
2547 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2548
2549 if (chan->state != BT_CONNECTED) {
2550 __skb_queue_purge(&seg_queue);
2551 err = -ENOTCONN;
2552 }
2553
2554 if (err)
2555 return err;
2556
2557 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2558
2559 l2cap_le_flowctl_send(chan);
2560
2561 if (!chan->tx_credits)
2562 chan->ops->suspend(chan);
2563
2564 err = len;
2565
2566 break;
2567
2568 case L2CAP_MODE_BASIC:
2569 /* Check outgoing MTU */
2570 if (len > chan->omtu)
2571 return -EMSGSIZE;
2572
2573 /* Create a basic PDU */
2574 skb = l2cap_create_basic_pdu(chan, msg, len);
2575 if (IS_ERR(skb))
2576 return PTR_ERR(skb);
2577
2578 l2cap_do_send(chan, skb);
2579 err = len;
2580 break;
2581
2582 case L2CAP_MODE_ERTM:
2583 case L2CAP_MODE_STREAMING:
2584 /* Check outgoing MTU */
2585 if (len > chan->omtu) {
2586 err = -EMSGSIZE;
2587 break;
2588 }
2589
2590 __skb_queue_head_init(&seg_queue);
2591
2592 /* Do segmentation before calling in to the state machine,
2593 * since it's possible to block while waiting for memory
2594 * allocation.
2595 */
2596 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2597
2598 if (err)
2599 break;
2600
2601 if (chan->mode == L2CAP_MODE_ERTM)
2602 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2603 else
2604 l2cap_streaming_send(chan, &seg_queue);
2605
2606 err = len;
2607
2608 /* If the skbs were not queued for sending, they'll still be in
2609 * seg_queue and need to be purged.
2610 */
2611 __skb_queue_purge(&seg_queue);
2612 break;
2613
2614 default:
2615 BT_DBG("bad state %1.1x", chan->mode);
2616 err = -EBADFD;
2617 }
2618
2619 return err;
2620 }
2621 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2622
l2cap_send_srej(struct l2cap_chan * chan,u16 txseq)2623 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2624 {
2625 struct l2cap_ctrl control;
2626 u16 seq;
2627
2628 BT_DBG("chan %p, txseq %u", chan, txseq);
2629
2630 memset(&control, 0, sizeof(control));
2631 control.sframe = 1;
2632 control.super = L2CAP_SUPER_SREJ;
2633
2634 for (seq = chan->expected_tx_seq; seq != txseq;
2635 seq = __next_seq(chan, seq)) {
2636 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2637 control.reqseq = seq;
2638 l2cap_send_sframe(chan, &control);
2639 l2cap_seq_list_append(&chan->srej_list, seq);
2640 }
2641 }
2642
2643 chan->expected_tx_seq = __next_seq(chan, txseq);
2644 }
2645
l2cap_send_srej_tail(struct l2cap_chan * chan)2646 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2647 {
2648 struct l2cap_ctrl control;
2649
2650 BT_DBG("chan %p", chan);
2651
2652 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2653 return;
2654
2655 memset(&control, 0, sizeof(control));
2656 control.sframe = 1;
2657 control.super = L2CAP_SUPER_SREJ;
2658 control.reqseq = chan->srej_list.tail;
2659 l2cap_send_sframe(chan, &control);
2660 }
2661
l2cap_send_srej_list(struct l2cap_chan * chan,u16 txseq)2662 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2663 {
2664 struct l2cap_ctrl control;
2665 u16 initial_head;
2666 u16 seq;
2667
2668 BT_DBG("chan %p, txseq %u", chan, txseq);
2669
2670 memset(&control, 0, sizeof(control));
2671 control.sframe = 1;
2672 control.super = L2CAP_SUPER_SREJ;
2673
2674 /* Capture initial list head to allow only one pass through the list. */
2675 initial_head = chan->srej_list.head;
2676
2677 do {
2678 seq = l2cap_seq_list_pop(&chan->srej_list);
2679 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2680 break;
2681
2682 control.reqseq = seq;
2683 l2cap_send_sframe(chan, &control);
2684 l2cap_seq_list_append(&chan->srej_list, seq);
2685 } while (chan->srej_list.head != initial_head);
2686 }
2687
l2cap_process_reqseq(struct l2cap_chan * chan,u16 reqseq)2688 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2689 {
2690 struct sk_buff *acked_skb;
2691 u16 ackseq;
2692
2693 BT_DBG("chan %p, reqseq %u", chan, reqseq);
2694
2695 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2696 return;
2697
2698 BT_DBG("expected_ack_seq %u, unacked_frames %u",
2699 chan->expected_ack_seq, chan->unacked_frames);
2700
2701 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2702 ackseq = __next_seq(chan, ackseq)) {
2703
2704 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2705 if (acked_skb) {
2706 skb_unlink(acked_skb, &chan->tx_q);
2707 kfree_skb(acked_skb);
2708 chan->unacked_frames--;
2709 }
2710 }
2711
2712 chan->expected_ack_seq = reqseq;
2713
2714 if (chan->unacked_frames == 0)
2715 __clear_retrans_timer(chan);
2716
2717 BT_DBG("unacked_frames %u", chan->unacked_frames);
2718 }
2719
l2cap_abort_rx_srej_sent(struct l2cap_chan * chan)2720 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2721 {
2722 BT_DBG("chan %p", chan);
2723
2724 chan->expected_tx_seq = chan->buffer_seq;
2725 l2cap_seq_list_clear(&chan->srej_list);
2726 skb_queue_purge(&chan->srej_q);
2727 chan->rx_state = L2CAP_RX_STATE_RECV;
2728 }
2729
l2cap_tx_state_xmit(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2730 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2731 struct l2cap_ctrl *control,
2732 struct sk_buff_head *skbs, u8 event)
2733 {
2734 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2735 event);
2736
2737 switch (event) {
2738 case L2CAP_EV_DATA_REQUEST:
2739 if (chan->tx_send_head == NULL)
2740 chan->tx_send_head = skb_peek(skbs);
2741
2742 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2743 l2cap_ertm_send(chan);
2744 break;
2745 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2746 BT_DBG("Enter LOCAL_BUSY");
2747 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2748
2749 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2750 /* The SREJ_SENT state must be aborted if we are to
2751 * enter the LOCAL_BUSY state.
2752 */
2753 l2cap_abort_rx_srej_sent(chan);
2754 }
2755
2756 l2cap_send_ack(chan);
2757
2758 break;
2759 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2760 BT_DBG("Exit LOCAL_BUSY");
2761 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2762
2763 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2764 struct l2cap_ctrl local_control;
2765
2766 memset(&local_control, 0, sizeof(local_control));
2767 local_control.sframe = 1;
2768 local_control.super = L2CAP_SUPER_RR;
2769 local_control.poll = 1;
2770 local_control.reqseq = chan->buffer_seq;
2771 l2cap_send_sframe(chan, &local_control);
2772
2773 chan->retry_count = 1;
2774 __set_monitor_timer(chan);
2775 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2776 }
2777 break;
2778 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2779 l2cap_process_reqseq(chan, control->reqseq);
2780 break;
2781 case L2CAP_EV_EXPLICIT_POLL:
2782 l2cap_send_rr_or_rnr(chan, 1);
2783 chan->retry_count = 1;
2784 __set_monitor_timer(chan);
2785 __clear_ack_timer(chan);
2786 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2787 break;
2788 case L2CAP_EV_RETRANS_TO:
2789 l2cap_send_rr_or_rnr(chan, 1);
2790 chan->retry_count = 1;
2791 __set_monitor_timer(chan);
2792 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2793 break;
2794 case L2CAP_EV_RECV_FBIT:
2795 /* Nothing to process */
2796 break;
2797 default:
2798 break;
2799 }
2800 }
2801
l2cap_tx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2802 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2803 struct l2cap_ctrl *control,
2804 struct sk_buff_head *skbs, u8 event)
2805 {
2806 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2807 event);
2808
2809 switch (event) {
2810 case L2CAP_EV_DATA_REQUEST:
2811 if (chan->tx_send_head == NULL)
2812 chan->tx_send_head = skb_peek(skbs);
2813 /* Queue data, but don't send. */
2814 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2815 break;
2816 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2817 BT_DBG("Enter LOCAL_BUSY");
2818 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2819
2820 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2821 /* The SREJ_SENT state must be aborted if we are to
2822 * enter the LOCAL_BUSY state.
2823 */
2824 l2cap_abort_rx_srej_sent(chan);
2825 }
2826
2827 l2cap_send_ack(chan);
2828
2829 break;
2830 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2831 BT_DBG("Exit LOCAL_BUSY");
2832 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2833
2834 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2835 struct l2cap_ctrl local_control;
2836 memset(&local_control, 0, sizeof(local_control));
2837 local_control.sframe = 1;
2838 local_control.super = L2CAP_SUPER_RR;
2839 local_control.poll = 1;
2840 local_control.reqseq = chan->buffer_seq;
2841 l2cap_send_sframe(chan, &local_control);
2842
2843 chan->retry_count = 1;
2844 __set_monitor_timer(chan);
2845 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2846 }
2847 break;
2848 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2849 l2cap_process_reqseq(chan, control->reqseq);
2850 fallthrough;
2851
2852 case L2CAP_EV_RECV_FBIT:
2853 if (control && control->final) {
2854 __clear_monitor_timer(chan);
2855 if (chan->unacked_frames > 0)
2856 __set_retrans_timer(chan);
2857 chan->retry_count = 0;
2858 chan->tx_state = L2CAP_TX_STATE_XMIT;
2859 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2860 }
2861 break;
2862 case L2CAP_EV_EXPLICIT_POLL:
2863 /* Ignore */
2864 break;
2865 case L2CAP_EV_MONITOR_TO:
2866 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2867 l2cap_send_rr_or_rnr(chan, 1);
2868 __set_monitor_timer(chan);
2869 chan->retry_count++;
2870 } else {
2871 l2cap_send_disconn_req(chan, ECONNABORTED);
2872 }
2873 break;
2874 default:
2875 break;
2876 }
2877 }
2878
l2cap_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2879 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2880 struct sk_buff_head *skbs, u8 event)
2881 {
2882 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2883 chan, control, skbs, event, chan->tx_state);
2884
2885 switch (chan->tx_state) {
2886 case L2CAP_TX_STATE_XMIT:
2887 l2cap_tx_state_xmit(chan, control, skbs, event);
2888 break;
2889 case L2CAP_TX_STATE_WAIT_F:
2890 l2cap_tx_state_wait_f(chan, control, skbs, event);
2891 break;
2892 default:
2893 /* Ignore event */
2894 break;
2895 }
2896 }
2897
l2cap_pass_to_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control)2898 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2899 struct l2cap_ctrl *control)
2900 {
2901 BT_DBG("chan %p, control %p", chan, control);
2902 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2903 }
2904
l2cap_pass_to_tx_fbit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2905 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2906 struct l2cap_ctrl *control)
2907 {
2908 BT_DBG("chan %p, control %p", chan, control);
2909 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2910 }
2911
2912 /* Copy frame to all raw sockets on that connection */
l2cap_raw_recv(struct l2cap_conn * conn,struct sk_buff * skb)2913 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2914 {
2915 struct sk_buff *nskb;
2916 struct l2cap_chan *chan;
2917
2918 BT_DBG("conn %p", conn);
2919
2920 mutex_lock(&conn->chan_lock);
2921
2922 list_for_each_entry(chan, &conn->chan_l, list) {
2923 if (chan->chan_type != L2CAP_CHAN_RAW)
2924 continue;
2925
2926 /* Don't send frame to the channel it came from */
2927 if (bt_cb(skb)->l2cap.chan == chan)
2928 continue;
2929
2930 nskb = skb_clone(skb, GFP_KERNEL);
2931 if (!nskb)
2932 continue;
2933 if (chan->ops->recv(chan, nskb))
2934 kfree_skb(nskb);
2935 }
2936
2937 mutex_unlock(&conn->chan_lock);
2938 }
2939
2940 /* ---- L2CAP signalling commands ---- */
l2cap_build_cmd(struct l2cap_conn * conn,u8 code,u8 ident,u16 dlen,void * data)2941 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2942 u8 ident, u16 dlen, void *data)
2943 {
2944 struct sk_buff *skb, **frag;
2945 struct l2cap_cmd_hdr *cmd;
2946 struct l2cap_hdr *lh;
2947 int len, count;
2948
2949 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2950 conn, code, ident, dlen);
2951
2952 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2953 return NULL;
2954
2955 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2956 count = min_t(unsigned int, conn->mtu, len);
2957
2958 skb = bt_skb_alloc(count, GFP_KERNEL);
2959 if (!skb)
2960 return NULL;
2961
2962 lh = skb_put(skb, L2CAP_HDR_SIZE);
2963 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2964
2965 if (conn->hcon->type == LE_LINK)
2966 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2967 else
2968 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2969
2970 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
2971 cmd->code = code;
2972 cmd->ident = ident;
2973 cmd->len = cpu_to_le16(dlen);
2974
2975 if (dlen) {
2976 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2977 skb_put_data(skb, data, count);
2978 data += count;
2979 }
2980
2981 len -= skb->len;
2982
2983 /* Continuation fragments (no L2CAP header) */
2984 frag = &skb_shinfo(skb)->frag_list;
2985 while (len) {
2986 count = min_t(unsigned int, conn->mtu, len);
2987
2988 *frag = bt_skb_alloc(count, GFP_KERNEL);
2989 if (!*frag)
2990 goto fail;
2991
2992 skb_put_data(*frag, data, count);
2993
2994 len -= count;
2995 data += count;
2996
2997 frag = &(*frag)->next;
2998 }
2999
3000 return skb;
3001
3002 fail:
3003 kfree_skb(skb);
3004 return NULL;
3005 }
3006
l2cap_get_conf_opt(void ** ptr,int * type,int * olen,unsigned long * val)3007 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3008 unsigned long *val)
3009 {
3010 struct l2cap_conf_opt *opt = *ptr;
3011 int len;
3012
3013 len = L2CAP_CONF_OPT_SIZE + opt->len;
3014 *ptr += len;
3015
3016 *type = opt->type;
3017 *olen = opt->len;
3018
3019 switch (opt->len) {
3020 case 1:
3021 *val = *((u8 *) opt->val);
3022 break;
3023
3024 case 2:
3025 *val = get_unaligned_le16(opt->val);
3026 break;
3027
3028 case 4:
3029 *val = get_unaligned_le32(opt->val);
3030 break;
3031
3032 default:
3033 *val = (unsigned long) opt->val;
3034 break;
3035 }
3036
3037 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3038 return len;
3039 }
3040
l2cap_add_conf_opt(void ** ptr,u8 type,u8 len,unsigned long val,size_t size)3041 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3042 {
3043 struct l2cap_conf_opt *opt = *ptr;
3044
3045 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3046
3047 if (size < L2CAP_CONF_OPT_SIZE + len)
3048 return;
3049
3050 opt->type = type;
3051 opt->len = len;
3052
3053 switch (len) {
3054 case 1:
3055 *((u8 *) opt->val) = val;
3056 break;
3057
3058 case 2:
3059 put_unaligned_le16(val, opt->val);
3060 break;
3061
3062 case 4:
3063 put_unaligned_le32(val, opt->val);
3064 break;
3065
3066 default:
3067 memcpy(opt->val, (void *) val, len);
3068 break;
3069 }
3070
3071 *ptr += L2CAP_CONF_OPT_SIZE + len;
3072 }
3073
l2cap_add_opt_efs(void ** ptr,struct l2cap_chan * chan,size_t size)3074 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3075 {
3076 struct l2cap_conf_efs efs;
3077
3078 switch (chan->mode) {
3079 case L2CAP_MODE_ERTM:
3080 efs.id = chan->local_id;
3081 efs.stype = chan->local_stype;
3082 efs.msdu = cpu_to_le16(chan->local_msdu);
3083 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3084 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3085 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3086 break;
3087
3088 case L2CAP_MODE_STREAMING:
3089 efs.id = 1;
3090 efs.stype = L2CAP_SERV_BESTEFFORT;
3091 efs.msdu = cpu_to_le16(chan->local_msdu);
3092 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3093 efs.acc_lat = 0;
3094 efs.flush_to = 0;
3095 break;
3096
3097 default:
3098 return;
3099 }
3100
3101 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3102 (unsigned long) &efs, size);
3103 }
3104
l2cap_ack_timeout(struct work_struct * work)3105 static void l2cap_ack_timeout(struct work_struct *work)
3106 {
3107 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3108 ack_timer.work);
3109 u16 frames_to_ack;
3110
3111 BT_DBG("chan %p", chan);
3112
3113 l2cap_chan_lock(chan);
3114
3115 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3116 chan->last_acked_seq);
3117
3118 if (frames_to_ack)
3119 l2cap_send_rr_or_rnr(chan, 0);
3120
3121 l2cap_chan_unlock(chan);
3122 l2cap_chan_put(chan);
3123 }
3124
l2cap_ertm_init(struct l2cap_chan * chan)3125 int l2cap_ertm_init(struct l2cap_chan *chan)
3126 {
3127 int err;
3128
3129 chan->next_tx_seq = 0;
3130 chan->expected_tx_seq = 0;
3131 chan->expected_ack_seq = 0;
3132 chan->unacked_frames = 0;
3133 chan->buffer_seq = 0;
3134 chan->frames_sent = 0;
3135 chan->last_acked_seq = 0;
3136 chan->sdu = NULL;
3137 chan->sdu_last_frag = NULL;
3138 chan->sdu_len = 0;
3139
3140 skb_queue_head_init(&chan->tx_q);
3141
3142 if (chan->mode != L2CAP_MODE_ERTM)
3143 return 0;
3144
3145 chan->rx_state = L2CAP_RX_STATE_RECV;
3146 chan->tx_state = L2CAP_TX_STATE_XMIT;
3147
3148 skb_queue_head_init(&chan->srej_q);
3149
3150 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3151 if (err < 0)
3152 return err;
3153
3154 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3155 if (err < 0)
3156 l2cap_seq_list_free(&chan->srej_list);
3157
3158 return err;
3159 }
3160
l2cap_select_mode(__u8 mode,__u16 remote_feat_mask)3161 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3162 {
3163 switch (mode) {
3164 case L2CAP_MODE_STREAMING:
3165 case L2CAP_MODE_ERTM:
3166 if (l2cap_mode_supported(mode, remote_feat_mask))
3167 return mode;
3168 fallthrough;
3169 default:
3170 return L2CAP_MODE_BASIC;
3171 }
3172 }
3173
__l2cap_ews_supported(struct l2cap_conn * conn)3174 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3175 {
3176 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
3177 }
3178
__l2cap_efs_supported(struct l2cap_conn * conn)3179 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3180 {
3181 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
3182 }
3183
__l2cap_set_ertm_timeouts(struct l2cap_chan * chan,struct l2cap_conf_rfc * rfc)3184 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3185 struct l2cap_conf_rfc *rfc)
3186 {
3187 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3188 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3189 }
3190
l2cap_txwin_setup(struct l2cap_chan * chan)3191 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3192 {
3193 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3194 __l2cap_ews_supported(chan->conn)) {
3195 /* use extended control field */
3196 set_bit(FLAG_EXT_CTRL, &chan->flags);
3197 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3198 } else {
3199 chan->tx_win = min_t(u16, chan->tx_win,
3200 L2CAP_DEFAULT_TX_WINDOW);
3201 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3202 }
3203 chan->ack_win = chan->tx_win;
3204 }
3205
l2cap_mtu_auto(struct l2cap_chan * chan)3206 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3207 {
3208 struct hci_conn *conn = chan->conn->hcon;
3209
3210 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3211
3212 /* The 2-DH1 packet has between 2 and 56 information bytes
3213 * (including the 2-byte payload header)
3214 */
3215 if (!(conn->pkt_type & HCI_2DH1))
3216 chan->imtu = 54;
3217
3218 /* The 3-DH1 packet has between 2 and 85 information bytes
3219 * (including the 2-byte payload header)
3220 */
3221 if (!(conn->pkt_type & HCI_3DH1))
3222 chan->imtu = 83;
3223
3224 /* The 2-DH3 packet has between 2 and 369 information bytes
3225 * (including the 2-byte payload header)
3226 */
3227 if (!(conn->pkt_type & HCI_2DH3))
3228 chan->imtu = 367;
3229
3230 /* The 3-DH3 packet has between 2 and 554 information bytes
3231 * (including the 2-byte payload header)
3232 */
3233 if (!(conn->pkt_type & HCI_3DH3))
3234 chan->imtu = 552;
3235
3236 /* The 2-DH5 packet has between 2 and 681 information bytes
3237 * (including the 2-byte payload header)
3238 */
3239 if (!(conn->pkt_type & HCI_2DH5))
3240 chan->imtu = 679;
3241
3242 /* The 3-DH5 packet has between 2 and 1023 information bytes
3243 * (including the 2-byte payload header)
3244 */
3245 if (!(conn->pkt_type & HCI_3DH5))
3246 chan->imtu = 1021;
3247 }
3248
l2cap_build_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3249 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3250 {
3251 struct l2cap_conf_req *req = data;
3252 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3253 void *ptr = req->data;
3254 void *endptr = data + data_size;
3255 u16 size;
3256
3257 BT_DBG("chan %p", chan);
3258
3259 if (chan->num_conf_req || chan->num_conf_rsp)
3260 goto done;
3261
3262 switch (chan->mode) {
3263 case L2CAP_MODE_STREAMING:
3264 case L2CAP_MODE_ERTM:
3265 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3266 break;
3267
3268 if (__l2cap_efs_supported(chan->conn))
3269 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3270
3271 fallthrough;
3272 default:
3273 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3274 break;
3275 }
3276
3277 done:
3278 if (chan->imtu != L2CAP_DEFAULT_MTU) {
3279 if (!chan->imtu)
3280 l2cap_mtu_auto(chan);
3281 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3282 endptr - ptr);
3283 }
3284
3285 switch (chan->mode) {
3286 case L2CAP_MODE_BASIC:
3287 if (disable_ertm)
3288 break;
3289
3290 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3291 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3292 break;
3293
3294 rfc.mode = L2CAP_MODE_BASIC;
3295 rfc.txwin_size = 0;
3296 rfc.max_transmit = 0;
3297 rfc.retrans_timeout = 0;
3298 rfc.monitor_timeout = 0;
3299 rfc.max_pdu_size = 0;
3300
3301 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3302 (unsigned long) &rfc, endptr - ptr);
3303 break;
3304
3305 case L2CAP_MODE_ERTM:
3306 rfc.mode = L2CAP_MODE_ERTM;
3307 rfc.max_transmit = chan->max_tx;
3308
3309 __l2cap_set_ertm_timeouts(chan, &rfc);
3310
3311 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3312 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3313 L2CAP_FCS_SIZE);
3314 rfc.max_pdu_size = cpu_to_le16(size);
3315
3316 l2cap_txwin_setup(chan);
3317
3318 rfc.txwin_size = min_t(u16, chan->tx_win,
3319 L2CAP_DEFAULT_TX_WINDOW);
3320
3321 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3322 (unsigned long) &rfc, endptr - ptr);
3323
3324 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3325 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3326
3327 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3328 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3329 chan->tx_win, endptr - ptr);
3330
3331 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3332 if (chan->fcs == L2CAP_FCS_NONE ||
3333 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3334 chan->fcs = L2CAP_FCS_NONE;
3335 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3336 chan->fcs, endptr - ptr);
3337 }
3338 break;
3339
3340 case L2CAP_MODE_STREAMING:
3341 l2cap_txwin_setup(chan);
3342 rfc.mode = L2CAP_MODE_STREAMING;
3343 rfc.txwin_size = 0;
3344 rfc.max_transmit = 0;
3345 rfc.retrans_timeout = 0;
3346 rfc.monitor_timeout = 0;
3347
3348 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3349 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3350 L2CAP_FCS_SIZE);
3351 rfc.max_pdu_size = cpu_to_le16(size);
3352
3353 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3354 (unsigned long) &rfc, endptr - ptr);
3355
3356 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3357 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3358
3359 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3360 if (chan->fcs == L2CAP_FCS_NONE ||
3361 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3362 chan->fcs = L2CAP_FCS_NONE;
3363 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3364 chan->fcs, endptr - ptr);
3365 }
3366 break;
3367 }
3368
3369 req->dcid = cpu_to_le16(chan->dcid);
3370 req->flags = cpu_to_le16(0);
3371
3372 return ptr - data;
3373 }
3374
l2cap_parse_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3375 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3376 {
3377 struct l2cap_conf_rsp *rsp = data;
3378 void *ptr = rsp->data;
3379 void *endptr = data + data_size;
3380 void *req = chan->conf_req;
3381 int len = chan->conf_len;
3382 int type, hint, olen;
3383 unsigned long val;
3384 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3385 struct l2cap_conf_efs efs;
3386 u8 remote_efs = 0;
3387 u16 mtu = L2CAP_DEFAULT_MTU;
3388 u16 result = L2CAP_CONF_SUCCESS;
3389 u16 size;
3390
3391 BT_DBG("chan %p", chan);
3392
3393 while (len >= L2CAP_CONF_OPT_SIZE) {
3394 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3395 if (len < 0)
3396 break;
3397
3398 hint = type & L2CAP_CONF_HINT;
3399 type &= L2CAP_CONF_MASK;
3400
3401 switch (type) {
3402 case L2CAP_CONF_MTU:
3403 if (olen != 2)
3404 break;
3405 mtu = val;
3406 break;
3407
3408 case L2CAP_CONF_FLUSH_TO:
3409 if (olen != 2)
3410 break;
3411 chan->flush_to = val;
3412 break;
3413
3414 case L2CAP_CONF_QOS:
3415 break;
3416
3417 case L2CAP_CONF_RFC:
3418 if (olen != sizeof(rfc))
3419 break;
3420 memcpy(&rfc, (void *) val, olen);
3421 break;
3422
3423 case L2CAP_CONF_FCS:
3424 if (olen != 1)
3425 break;
3426 if (val == L2CAP_FCS_NONE)
3427 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3428 break;
3429
3430 case L2CAP_CONF_EFS:
3431 if (olen != sizeof(efs))
3432 break;
3433 remote_efs = 1;
3434 memcpy(&efs, (void *) val, olen);
3435 break;
3436
3437 case L2CAP_CONF_EWS:
3438 if (olen != 2)
3439 break;
3440 return -ECONNREFUSED;
3441
3442 default:
3443 if (hint)
3444 break;
3445 result = L2CAP_CONF_UNKNOWN;
3446 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3447 break;
3448 }
3449 }
3450
3451 if (chan->num_conf_rsp || chan->num_conf_req > 1)
3452 goto done;
3453
3454 switch (chan->mode) {
3455 case L2CAP_MODE_STREAMING:
3456 case L2CAP_MODE_ERTM:
3457 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3458 chan->mode = l2cap_select_mode(rfc.mode,
3459 chan->conn->feat_mask);
3460 break;
3461 }
3462
3463 if (remote_efs) {
3464 if (__l2cap_efs_supported(chan->conn))
3465 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3466 else
3467 return -ECONNREFUSED;
3468 }
3469
3470 if (chan->mode != rfc.mode)
3471 return -ECONNREFUSED;
3472
3473 break;
3474 }
3475
3476 done:
3477 if (chan->mode != rfc.mode) {
3478 result = L2CAP_CONF_UNACCEPT;
3479 rfc.mode = chan->mode;
3480
3481 if (chan->num_conf_rsp == 1)
3482 return -ECONNREFUSED;
3483
3484 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3485 (unsigned long) &rfc, endptr - ptr);
3486 }
3487
3488 if (result == L2CAP_CONF_SUCCESS) {
3489 /* Configure output options and let the other side know
3490 * which ones we don't like. */
3491
3492 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3493 result = L2CAP_CONF_UNACCEPT;
3494 else {
3495 chan->omtu = mtu;
3496 set_bit(CONF_MTU_DONE, &chan->conf_state);
3497 }
3498 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3499
3500 if (remote_efs) {
3501 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3502 efs.stype != L2CAP_SERV_NOTRAFIC &&
3503 efs.stype != chan->local_stype) {
3504
3505 result = L2CAP_CONF_UNACCEPT;
3506
3507 if (chan->num_conf_req >= 1)
3508 return -ECONNREFUSED;
3509
3510 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3511 sizeof(efs),
3512 (unsigned long) &efs, endptr - ptr);
3513 } else {
3514 /* Send PENDING Conf Rsp */
3515 result = L2CAP_CONF_PENDING;
3516 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3517 }
3518 }
3519
3520 switch (rfc.mode) {
3521 case L2CAP_MODE_BASIC:
3522 chan->fcs = L2CAP_FCS_NONE;
3523 set_bit(CONF_MODE_DONE, &chan->conf_state);
3524 break;
3525
3526 case L2CAP_MODE_ERTM:
3527 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3528 chan->remote_tx_win = rfc.txwin_size;
3529 else
3530 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3531
3532 chan->remote_max_tx = rfc.max_transmit;
3533
3534 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3535 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3536 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3537 rfc.max_pdu_size = cpu_to_le16(size);
3538 chan->remote_mps = size;
3539
3540 __l2cap_set_ertm_timeouts(chan, &rfc);
3541
3542 set_bit(CONF_MODE_DONE, &chan->conf_state);
3543
3544 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3545 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3546
3547 if (remote_efs &&
3548 test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3549 chan->remote_id = efs.id;
3550 chan->remote_stype = efs.stype;
3551 chan->remote_msdu = le16_to_cpu(efs.msdu);
3552 chan->remote_flush_to =
3553 le32_to_cpu(efs.flush_to);
3554 chan->remote_acc_lat =
3555 le32_to_cpu(efs.acc_lat);
3556 chan->remote_sdu_itime =
3557 le32_to_cpu(efs.sdu_itime);
3558 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3559 sizeof(efs),
3560 (unsigned long) &efs, endptr - ptr);
3561 }
3562 break;
3563
3564 case L2CAP_MODE_STREAMING:
3565 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3566 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3567 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3568 rfc.max_pdu_size = cpu_to_le16(size);
3569 chan->remote_mps = size;
3570
3571 set_bit(CONF_MODE_DONE, &chan->conf_state);
3572
3573 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3574 (unsigned long) &rfc, endptr - ptr);
3575
3576 break;
3577
3578 default:
3579 result = L2CAP_CONF_UNACCEPT;
3580
3581 memset(&rfc, 0, sizeof(rfc));
3582 rfc.mode = chan->mode;
3583 }
3584
3585 if (result == L2CAP_CONF_SUCCESS)
3586 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3587 }
3588 rsp->scid = cpu_to_le16(chan->dcid);
3589 rsp->result = cpu_to_le16(result);
3590 rsp->flags = cpu_to_le16(0);
3591
3592 return ptr - data;
3593 }
3594
l2cap_parse_conf_rsp(struct l2cap_chan * chan,void * rsp,int len,void * data,size_t size,u16 * result)3595 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3596 void *data, size_t size, u16 *result)
3597 {
3598 struct l2cap_conf_req *req = data;
3599 void *ptr = req->data;
3600 void *endptr = data + size;
3601 int type, olen;
3602 unsigned long val;
3603 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3604 struct l2cap_conf_efs efs;
3605
3606 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3607
3608 while (len >= L2CAP_CONF_OPT_SIZE) {
3609 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3610 if (len < 0)
3611 break;
3612
3613 switch (type) {
3614 case L2CAP_CONF_MTU:
3615 if (olen != 2)
3616 break;
3617 if (val < L2CAP_DEFAULT_MIN_MTU) {
3618 *result = L2CAP_CONF_UNACCEPT;
3619 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3620 } else
3621 chan->imtu = val;
3622 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3623 endptr - ptr);
3624 break;
3625
3626 case L2CAP_CONF_FLUSH_TO:
3627 if (olen != 2)
3628 break;
3629 chan->flush_to = val;
3630 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3631 chan->flush_to, endptr - ptr);
3632 break;
3633
3634 case L2CAP_CONF_RFC:
3635 if (olen != sizeof(rfc))
3636 break;
3637 memcpy(&rfc, (void *)val, olen);
3638 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3639 rfc.mode != chan->mode)
3640 return -ECONNREFUSED;
3641 chan->fcs = 0;
3642 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3643 (unsigned long) &rfc, endptr - ptr);
3644 break;
3645
3646 case L2CAP_CONF_EWS:
3647 if (olen != 2)
3648 break;
3649 chan->ack_win = min_t(u16, val, chan->ack_win);
3650 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3651 chan->tx_win, endptr - ptr);
3652 break;
3653
3654 case L2CAP_CONF_EFS:
3655 if (olen != sizeof(efs))
3656 break;
3657 memcpy(&efs, (void *)val, olen);
3658 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3659 efs.stype != L2CAP_SERV_NOTRAFIC &&
3660 efs.stype != chan->local_stype)
3661 return -ECONNREFUSED;
3662 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3663 (unsigned long) &efs, endptr - ptr);
3664 break;
3665
3666 case L2CAP_CONF_FCS:
3667 if (olen != 1)
3668 break;
3669 if (*result == L2CAP_CONF_PENDING)
3670 if (val == L2CAP_FCS_NONE)
3671 set_bit(CONF_RECV_NO_FCS,
3672 &chan->conf_state);
3673 break;
3674 }
3675 }
3676
3677 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3678 return -ECONNREFUSED;
3679
3680 chan->mode = rfc.mode;
3681
3682 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3683 switch (rfc.mode) {
3684 case L2CAP_MODE_ERTM:
3685 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3686 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3687 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3688 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3689 chan->ack_win = min_t(u16, chan->ack_win,
3690 rfc.txwin_size);
3691
3692 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3693 chan->local_msdu = le16_to_cpu(efs.msdu);
3694 chan->local_sdu_itime =
3695 le32_to_cpu(efs.sdu_itime);
3696 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3697 chan->local_flush_to =
3698 le32_to_cpu(efs.flush_to);
3699 }
3700 break;
3701
3702 case L2CAP_MODE_STREAMING:
3703 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3704 }
3705 }
3706
3707 req->dcid = cpu_to_le16(chan->dcid);
3708 req->flags = cpu_to_le16(0);
3709
3710 return ptr - data;
3711 }
3712
l2cap_build_conf_rsp(struct l2cap_chan * chan,void * data,u16 result,u16 flags)3713 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3714 u16 result, u16 flags)
3715 {
3716 struct l2cap_conf_rsp *rsp = data;
3717 void *ptr = rsp->data;
3718
3719 BT_DBG("chan %p", chan);
3720
3721 rsp->scid = cpu_to_le16(chan->dcid);
3722 rsp->result = cpu_to_le16(result);
3723 rsp->flags = cpu_to_le16(flags);
3724
3725 return ptr - data;
3726 }
3727
__l2cap_le_connect_rsp_defer(struct l2cap_chan * chan)3728 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3729 {
3730 struct l2cap_le_conn_rsp rsp;
3731 struct l2cap_conn *conn = chan->conn;
3732
3733 BT_DBG("chan %p", chan);
3734
3735 rsp.dcid = cpu_to_le16(chan->scid);
3736 rsp.mtu = cpu_to_le16(chan->imtu);
3737 rsp.mps = cpu_to_le16(chan->mps);
3738 rsp.credits = cpu_to_le16(chan->rx_credits);
3739 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3740
3741 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3742 &rsp);
3743 }
3744
l2cap_ecred_list_defer(struct l2cap_chan * chan,void * data)3745 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
3746 {
3747 int *result = data;
3748
3749 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3750 return;
3751
3752 switch (chan->state) {
3753 case BT_CONNECT2:
3754 /* If channel still pending accept add to result */
3755 (*result)++;
3756 return;
3757 case BT_CONNECTED:
3758 return;
3759 default:
3760 /* If not connected or pending accept it has been refused */
3761 *result = -ECONNREFUSED;
3762 return;
3763 }
3764 }
3765
3766 struct l2cap_ecred_rsp_data {
3767 struct {
3768 struct l2cap_ecred_conn_rsp rsp;
3769 __le16 scid[L2CAP_ECRED_MAX_CID];
3770 } __packed pdu;
3771 int count;
3772 };
3773
l2cap_ecred_rsp_defer(struct l2cap_chan * chan,void * data)3774 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
3775 {
3776 struct l2cap_ecred_rsp_data *rsp = data;
3777
3778 /* Check if channel for outgoing connection or if it wasn't deferred
3779 * since in those cases it must be skipped.
3780 */
3781 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags) ||
3782 !test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
3783 return;
3784
3785 /* Reset ident so only one response is sent */
3786 chan->ident = 0;
3787
3788 /* Include all channels pending with the same ident */
3789 if (!rsp->pdu.rsp.result)
3790 rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
3791 else
3792 l2cap_chan_del(chan, ECONNRESET);
3793 }
3794
__l2cap_ecred_conn_rsp_defer(struct l2cap_chan * chan)3795 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3796 {
3797 struct l2cap_conn *conn = chan->conn;
3798 struct l2cap_ecred_rsp_data data;
3799 u16 id = chan->ident;
3800 int result = 0;
3801
3802 if (!id)
3803 return;
3804
3805 BT_DBG("chan %p id %d", chan, id);
3806
3807 memset(&data, 0, sizeof(data));
3808
3809 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu);
3810 data.pdu.rsp.mps = cpu_to_le16(chan->mps);
3811 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3812 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3813
3814 /* Verify that all channels are ready */
3815 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
3816
3817 if (result > 0)
3818 return;
3819
3820 if (result < 0)
3821 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
3822
3823 /* Build response */
3824 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
3825
3826 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
3827 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
3828 &data.pdu);
3829 }
3830
__l2cap_connect_rsp_defer(struct l2cap_chan * chan)3831 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3832 {
3833 struct l2cap_conn_rsp rsp;
3834 struct l2cap_conn *conn = chan->conn;
3835 u8 buf[128];
3836 u8 rsp_code;
3837
3838 rsp.scid = cpu_to_le16(chan->dcid);
3839 rsp.dcid = cpu_to_le16(chan->scid);
3840 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3841 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3842 rsp_code = L2CAP_CONN_RSP;
3843
3844 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3845
3846 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3847
3848 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3849 return;
3850
3851 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3852 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
3853 chan->num_conf_req++;
3854 }
3855
l2cap_conf_rfc_get(struct l2cap_chan * chan,void * rsp,int len)3856 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3857 {
3858 int type, olen;
3859 unsigned long val;
3860 /* Use sane default values in case a misbehaving remote device
3861 * did not send an RFC or extended window size option.
3862 */
3863 u16 txwin_ext = chan->ack_win;
3864 struct l2cap_conf_rfc rfc = {
3865 .mode = chan->mode,
3866 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3867 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3868 .max_pdu_size = cpu_to_le16(chan->imtu),
3869 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3870 };
3871
3872 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3873
3874 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3875 return;
3876
3877 while (len >= L2CAP_CONF_OPT_SIZE) {
3878 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3879 if (len < 0)
3880 break;
3881
3882 switch (type) {
3883 case L2CAP_CONF_RFC:
3884 if (olen != sizeof(rfc))
3885 break;
3886 memcpy(&rfc, (void *)val, olen);
3887 break;
3888 case L2CAP_CONF_EWS:
3889 if (olen != 2)
3890 break;
3891 txwin_ext = val;
3892 break;
3893 }
3894 }
3895
3896 switch (rfc.mode) {
3897 case L2CAP_MODE_ERTM:
3898 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3899 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3900 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3901 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3902 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3903 else
3904 chan->ack_win = min_t(u16, chan->ack_win,
3905 rfc.txwin_size);
3906 break;
3907 case L2CAP_MODE_STREAMING:
3908 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3909 }
3910 }
3911
l2cap_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)3912 static inline int l2cap_command_rej(struct l2cap_conn *conn,
3913 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3914 u8 *data)
3915 {
3916 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3917
3918 if (cmd_len < sizeof(*rej))
3919 return -EPROTO;
3920
3921 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3922 return 0;
3923
3924 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3925 cmd->ident == conn->info_ident) {
3926 cancel_delayed_work(&conn->info_timer);
3927
3928 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3929 conn->info_ident = 0;
3930
3931 l2cap_conn_start(conn);
3932 }
3933
3934 return 0;
3935 }
3936
l2cap_connect(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u8 * data,u8 rsp_code)3937 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
3938 u8 *data, u8 rsp_code)
3939 {
3940 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3941 struct l2cap_conn_rsp rsp;
3942 struct l2cap_chan *chan = NULL, *pchan = NULL;
3943 int result, status = L2CAP_CS_NO_INFO;
3944
3945 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3946 __le16 psm = req->psm;
3947
3948 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3949
3950 /* Check if we have socket listening on psm */
3951 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
3952 &conn->hcon->dst, ACL_LINK);
3953 if (!pchan) {
3954 result = L2CAP_CR_BAD_PSM;
3955 goto response;
3956 }
3957
3958 mutex_lock(&conn->chan_lock);
3959 l2cap_chan_lock(pchan);
3960
3961 /* Check if the ACL is secure enough (if not SDP) */
3962 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3963 !hci_conn_check_link_mode(conn->hcon)) {
3964 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3965 result = L2CAP_CR_SEC_BLOCK;
3966 goto response;
3967 }
3968
3969 result = L2CAP_CR_NO_MEM;
3970
3971 /* Check for valid dynamic CID range (as per Erratum 3253) */
3972 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
3973 result = L2CAP_CR_INVALID_SCID;
3974 goto response;
3975 }
3976
3977 /* Check if we already have channel with that dcid */
3978 if (__l2cap_get_chan_by_dcid(conn, scid)) {
3979 result = L2CAP_CR_SCID_IN_USE;
3980 goto response;
3981 }
3982
3983 chan = pchan->ops->new_connection(pchan);
3984 if (!chan)
3985 goto response;
3986
3987 /* For certain devices (ex: HID mouse), support for authentication,
3988 * pairing and bonding is optional. For such devices, inorder to avoid
3989 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3990 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3991 */
3992 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3993
3994 bacpy(&chan->src, &conn->hcon->src);
3995 bacpy(&chan->dst, &conn->hcon->dst);
3996 chan->src_type = bdaddr_src_type(conn->hcon);
3997 chan->dst_type = bdaddr_dst_type(conn->hcon);
3998 chan->psm = psm;
3999 chan->dcid = scid;
4000
4001 __l2cap_chan_add(conn, chan);
4002
4003 dcid = chan->scid;
4004
4005 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4006
4007 chan->ident = cmd->ident;
4008
4009 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4010 if (l2cap_chan_check_security(chan, false)) {
4011 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4012 l2cap_state_change(chan, BT_CONNECT2);
4013 result = L2CAP_CR_PEND;
4014 status = L2CAP_CS_AUTHOR_PEND;
4015 chan->ops->defer(chan);
4016 } else {
4017 l2cap_state_change(chan, BT_CONFIG);
4018 result = L2CAP_CR_SUCCESS;
4019 status = L2CAP_CS_NO_INFO;
4020 }
4021 } else {
4022 l2cap_state_change(chan, BT_CONNECT2);
4023 result = L2CAP_CR_PEND;
4024 status = L2CAP_CS_AUTHEN_PEND;
4025 }
4026 } else {
4027 l2cap_state_change(chan, BT_CONNECT2);
4028 result = L2CAP_CR_PEND;
4029 status = L2CAP_CS_NO_INFO;
4030 }
4031
4032 response:
4033 rsp.scid = cpu_to_le16(scid);
4034 rsp.dcid = cpu_to_le16(dcid);
4035 rsp.result = cpu_to_le16(result);
4036 rsp.status = cpu_to_le16(status);
4037 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4038
4039 if (!pchan)
4040 return;
4041
4042 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4043 struct l2cap_info_req info;
4044 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4045
4046 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4047 conn->info_ident = l2cap_get_ident(conn);
4048
4049 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4050
4051 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4052 sizeof(info), &info);
4053 }
4054
4055 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4056 result == L2CAP_CR_SUCCESS) {
4057 u8 buf[128];
4058 set_bit(CONF_REQ_SENT, &chan->conf_state);
4059 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4060 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4061 chan->num_conf_req++;
4062 }
4063
4064 l2cap_chan_unlock(pchan);
4065 mutex_unlock(&conn->chan_lock);
4066 l2cap_chan_put(pchan);
4067 }
4068
l2cap_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4069 static int l2cap_connect_req(struct l2cap_conn *conn,
4070 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4071 {
4072 if (cmd_len < sizeof(struct l2cap_conn_req))
4073 return -EPROTO;
4074
4075 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
4076 return 0;
4077 }
4078
l2cap_connect_create_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4079 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4080 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4081 u8 *data)
4082 {
4083 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4084 u16 scid, dcid, result, status;
4085 struct l2cap_chan *chan;
4086 u8 req[128];
4087 int err;
4088
4089 if (cmd_len < sizeof(*rsp))
4090 return -EPROTO;
4091
4092 scid = __le16_to_cpu(rsp->scid);
4093 dcid = __le16_to_cpu(rsp->dcid);
4094 result = __le16_to_cpu(rsp->result);
4095 status = __le16_to_cpu(rsp->status);
4096
4097 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
4098 dcid > L2CAP_CID_DYN_END))
4099 return -EPROTO;
4100
4101 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4102 dcid, scid, result, status);
4103
4104 mutex_lock(&conn->chan_lock);
4105
4106 if (scid) {
4107 chan = __l2cap_get_chan_by_scid(conn, scid);
4108 if (!chan) {
4109 err = -EBADSLT;
4110 goto unlock;
4111 }
4112 } else {
4113 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4114 if (!chan) {
4115 err = -EBADSLT;
4116 goto unlock;
4117 }
4118 }
4119
4120 chan = l2cap_chan_hold_unless_zero(chan);
4121 if (!chan) {
4122 err = -EBADSLT;
4123 goto unlock;
4124 }
4125
4126 err = 0;
4127
4128 l2cap_chan_lock(chan);
4129
4130 switch (result) {
4131 case L2CAP_CR_SUCCESS:
4132 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4133 err = -EBADSLT;
4134 break;
4135 }
4136
4137 l2cap_state_change(chan, BT_CONFIG);
4138 chan->ident = 0;
4139 chan->dcid = dcid;
4140 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4141
4142 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4143 break;
4144
4145 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4146 l2cap_build_conf_req(chan, req, sizeof(req)), req);
4147 chan->num_conf_req++;
4148 break;
4149
4150 case L2CAP_CR_PEND:
4151 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4152 break;
4153
4154 default:
4155 l2cap_chan_del(chan, ECONNREFUSED);
4156 break;
4157 }
4158
4159 l2cap_chan_unlock(chan);
4160 l2cap_chan_put(chan);
4161
4162 unlock:
4163 mutex_unlock(&conn->chan_lock);
4164
4165 return err;
4166 }
4167
set_default_fcs(struct l2cap_chan * chan)4168 static inline void set_default_fcs(struct l2cap_chan *chan)
4169 {
4170 /* FCS is enabled only in ERTM or streaming mode, if one or both
4171 * sides request it.
4172 */
4173 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4174 chan->fcs = L2CAP_FCS_NONE;
4175 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4176 chan->fcs = L2CAP_FCS_CRC16;
4177 }
4178
l2cap_send_efs_conf_rsp(struct l2cap_chan * chan,void * data,u8 ident,u16 flags)4179 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4180 u8 ident, u16 flags)
4181 {
4182 struct l2cap_conn *conn = chan->conn;
4183
4184 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4185 flags);
4186
4187 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4188 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4189
4190 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4191 l2cap_build_conf_rsp(chan, data,
4192 L2CAP_CONF_SUCCESS, flags), data);
4193 }
4194
cmd_reject_invalid_cid(struct l2cap_conn * conn,u8 ident,u16 scid,u16 dcid)4195 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4196 u16 scid, u16 dcid)
4197 {
4198 struct l2cap_cmd_rej_cid rej;
4199
4200 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4201 rej.scid = __cpu_to_le16(scid);
4202 rej.dcid = __cpu_to_le16(dcid);
4203
4204 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4205 }
4206
l2cap_config_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4207 static inline int l2cap_config_req(struct l2cap_conn *conn,
4208 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4209 u8 *data)
4210 {
4211 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4212 u16 dcid, flags;
4213 u8 rsp[64];
4214 struct l2cap_chan *chan;
4215 int len, err = 0;
4216
4217 if (cmd_len < sizeof(*req))
4218 return -EPROTO;
4219
4220 dcid = __le16_to_cpu(req->dcid);
4221 flags = __le16_to_cpu(req->flags);
4222
4223 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4224
4225 chan = l2cap_get_chan_by_scid(conn, dcid);
4226 if (!chan) {
4227 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4228 return 0;
4229 }
4230
4231 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4232 chan->state != BT_CONNECTED) {
4233 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4234 chan->dcid);
4235 goto unlock;
4236 }
4237
4238 /* Reject if config buffer is too small. */
4239 len = cmd_len - sizeof(*req);
4240 if (chan->conf_len + len > sizeof(chan->conf_req)) {
4241 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4242 l2cap_build_conf_rsp(chan, rsp,
4243 L2CAP_CONF_REJECT, flags), rsp);
4244 goto unlock;
4245 }
4246
4247 /* Store config. */
4248 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4249 chan->conf_len += len;
4250
4251 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4252 /* Incomplete config. Send empty response. */
4253 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4254 l2cap_build_conf_rsp(chan, rsp,
4255 L2CAP_CONF_SUCCESS, flags), rsp);
4256 goto unlock;
4257 }
4258
4259 /* Complete config. */
4260 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4261 if (len < 0) {
4262 l2cap_send_disconn_req(chan, ECONNRESET);
4263 goto unlock;
4264 }
4265
4266 chan->ident = cmd->ident;
4267 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4268 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4269 chan->num_conf_rsp++;
4270
4271 /* Reset config buffer. */
4272 chan->conf_len = 0;
4273
4274 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4275 goto unlock;
4276
4277 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4278 set_default_fcs(chan);
4279
4280 if (chan->mode == L2CAP_MODE_ERTM ||
4281 chan->mode == L2CAP_MODE_STREAMING)
4282 err = l2cap_ertm_init(chan);
4283
4284 if (err < 0)
4285 l2cap_send_disconn_req(chan, -err);
4286 else
4287 l2cap_chan_ready(chan);
4288
4289 goto unlock;
4290 }
4291
4292 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4293 u8 buf[64];
4294 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4295 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4296 chan->num_conf_req++;
4297 }
4298
4299 /* Got Conf Rsp PENDING from remote side and assume we sent
4300 Conf Rsp PENDING in the code above */
4301 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4302 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4303
4304 /* check compatibility */
4305
4306 /* Send rsp for BR/EDR channel */
4307 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4308 }
4309
4310 unlock:
4311 l2cap_chan_unlock(chan);
4312 l2cap_chan_put(chan);
4313 return err;
4314 }
4315
l2cap_config_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4316 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4317 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4318 u8 *data)
4319 {
4320 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4321 u16 scid, flags, result;
4322 struct l2cap_chan *chan;
4323 int len = cmd_len - sizeof(*rsp);
4324 int err = 0;
4325
4326 if (cmd_len < sizeof(*rsp))
4327 return -EPROTO;
4328
4329 scid = __le16_to_cpu(rsp->scid);
4330 flags = __le16_to_cpu(rsp->flags);
4331 result = __le16_to_cpu(rsp->result);
4332
4333 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4334 result, len);
4335
4336 chan = l2cap_get_chan_by_scid(conn, scid);
4337 if (!chan)
4338 return 0;
4339
4340 switch (result) {
4341 case L2CAP_CONF_SUCCESS:
4342 l2cap_conf_rfc_get(chan, rsp->data, len);
4343 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4344 break;
4345
4346 case L2CAP_CONF_PENDING:
4347 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4348
4349 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4350 char buf[64];
4351
4352 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4353 buf, sizeof(buf), &result);
4354 if (len < 0) {
4355 l2cap_send_disconn_req(chan, ECONNRESET);
4356 goto done;
4357 }
4358
4359 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
4360 }
4361 goto done;
4362
4363 case L2CAP_CONF_UNKNOWN:
4364 case L2CAP_CONF_UNACCEPT:
4365 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4366 char req[64];
4367
4368 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4369 l2cap_send_disconn_req(chan, ECONNRESET);
4370 goto done;
4371 }
4372
4373 /* throw out any old stored conf requests */
4374 result = L2CAP_CONF_SUCCESS;
4375 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4376 req, sizeof(req), &result);
4377 if (len < 0) {
4378 l2cap_send_disconn_req(chan, ECONNRESET);
4379 goto done;
4380 }
4381
4382 l2cap_send_cmd(conn, l2cap_get_ident(conn),
4383 L2CAP_CONF_REQ, len, req);
4384 chan->num_conf_req++;
4385 if (result != L2CAP_CONF_SUCCESS)
4386 goto done;
4387 break;
4388 }
4389 fallthrough;
4390
4391 default:
4392 l2cap_chan_set_err(chan, ECONNRESET);
4393
4394 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4395 l2cap_send_disconn_req(chan, ECONNRESET);
4396 goto done;
4397 }
4398
4399 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4400 goto done;
4401
4402 set_bit(CONF_INPUT_DONE, &chan->conf_state);
4403
4404 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4405 set_default_fcs(chan);
4406
4407 if (chan->mode == L2CAP_MODE_ERTM ||
4408 chan->mode == L2CAP_MODE_STREAMING)
4409 err = l2cap_ertm_init(chan);
4410
4411 if (err < 0)
4412 l2cap_send_disconn_req(chan, -err);
4413 else
4414 l2cap_chan_ready(chan);
4415 }
4416
4417 done:
4418 l2cap_chan_unlock(chan);
4419 l2cap_chan_put(chan);
4420 return err;
4421 }
4422
l2cap_disconnect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4423 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4424 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4425 u8 *data)
4426 {
4427 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4428 struct l2cap_disconn_rsp rsp;
4429 u16 dcid, scid;
4430 struct l2cap_chan *chan;
4431
4432 if (cmd_len != sizeof(*req))
4433 return -EPROTO;
4434
4435 scid = __le16_to_cpu(req->scid);
4436 dcid = __le16_to_cpu(req->dcid);
4437
4438 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4439
4440 chan = l2cap_get_chan_by_scid(conn, dcid);
4441 if (!chan) {
4442 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4443 return 0;
4444 }
4445
4446 rsp.dcid = cpu_to_le16(chan->scid);
4447 rsp.scid = cpu_to_le16(chan->dcid);
4448 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4449
4450 chan->ops->set_shutdown(chan);
4451
4452 l2cap_chan_unlock(chan);
4453 mutex_lock(&conn->chan_lock);
4454 l2cap_chan_lock(chan);
4455 l2cap_chan_del(chan, ECONNRESET);
4456 mutex_unlock(&conn->chan_lock);
4457
4458 chan->ops->close(chan);
4459
4460 l2cap_chan_unlock(chan);
4461 l2cap_chan_put(chan);
4462
4463 return 0;
4464 }
4465
l2cap_disconnect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4466 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4467 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4468 u8 *data)
4469 {
4470 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4471 u16 dcid, scid;
4472 struct l2cap_chan *chan;
4473
4474 if (cmd_len != sizeof(*rsp))
4475 return -EPROTO;
4476
4477 scid = __le16_to_cpu(rsp->scid);
4478 dcid = __le16_to_cpu(rsp->dcid);
4479
4480 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4481
4482 chan = l2cap_get_chan_by_scid(conn, scid);
4483 if (!chan) {
4484 return 0;
4485 }
4486
4487 if (chan->state != BT_DISCONN) {
4488 l2cap_chan_unlock(chan);
4489 l2cap_chan_put(chan);
4490 return 0;
4491 }
4492
4493 l2cap_chan_unlock(chan);
4494 mutex_lock(&conn->chan_lock);
4495 l2cap_chan_lock(chan);
4496 l2cap_chan_del(chan, 0);
4497 mutex_unlock(&conn->chan_lock);
4498
4499 chan->ops->close(chan);
4500
4501 l2cap_chan_unlock(chan);
4502 l2cap_chan_put(chan);
4503
4504 return 0;
4505 }
4506
l2cap_information_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4507 static inline int l2cap_information_req(struct l2cap_conn *conn,
4508 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4509 u8 *data)
4510 {
4511 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4512 u16 type;
4513
4514 if (cmd_len != sizeof(*req))
4515 return -EPROTO;
4516
4517 type = __le16_to_cpu(req->type);
4518
4519 BT_DBG("type 0x%4.4x", type);
4520
4521 if (type == L2CAP_IT_FEAT_MASK) {
4522 u8 buf[8];
4523 u32 feat_mask = l2cap_feat_mask;
4524 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4525 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4526 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4527 if (!disable_ertm)
4528 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4529 | L2CAP_FEAT_FCS;
4530
4531 put_unaligned_le32(feat_mask, rsp->data);
4532 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4533 buf);
4534 } else if (type == L2CAP_IT_FIXED_CHAN) {
4535 u8 buf[12];
4536 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4537
4538 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4539 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4540 rsp->data[0] = conn->local_fixed_chan;
4541 memset(rsp->data + 1, 0, 7);
4542 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4543 buf);
4544 } else {
4545 struct l2cap_info_rsp rsp;
4546 rsp.type = cpu_to_le16(type);
4547 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4548 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4549 &rsp);
4550 }
4551
4552 return 0;
4553 }
4554
l2cap_information_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4555 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4556 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4557 u8 *data)
4558 {
4559 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4560 u16 type, result;
4561
4562 if (cmd_len < sizeof(*rsp))
4563 return -EPROTO;
4564
4565 type = __le16_to_cpu(rsp->type);
4566 result = __le16_to_cpu(rsp->result);
4567
4568 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4569
4570 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4571 if (cmd->ident != conn->info_ident ||
4572 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4573 return 0;
4574
4575 cancel_delayed_work(&conn->info_timer);
4576
4577 if (result != L2CAP_IR_SUCCESS) {
4578 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4579 conn->info_ident = 0;
4580
4581 l2cap_conn_start(conn);
4582
4583 return 0;
4584 }
4585
4586 switch (type) {
4587 case L2CAP_IT_FEAT_MASK:
4588 conn->feat_mask = get_unaligned_le32(rsp->data);
4589
4590 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4591 struct l2cap_info_req req;
4592 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4593
4594 conn->info_ident = l2cap_get_ident(conn);
4595
4596 l2cap_send_cmd(conn, conn->info_ident,
4597 L2CAP_INFO_REQ, sizeof(req), &req);
4598 } else {
4599 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4600 conn->info_ident = 0;
4601
4602 l2cap_conn_start(conn);
4603 }
4604 break;
4605
4606 case L2CAP_IT_FIXED_CHAN:
4607 conn->remote_fixed_chan = rsp->data[0];
4608 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4609 conn->info_ident = 0;
4610
4611 l2cap_conn_start(conn);
4612 break;
4613 }
4614
4615 return 0;
4616 }
4617
l2cap_conn_param_update_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4618 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4619 struct l2cap_cmd_hdr *cmd,
4620 u16 cmd_len, u8 *data)
4621 {
4622 struct hci_conn *hcon = conn->hcon;
4623 struct l2cap_conn_param_update_req *req;
4624 struct l2cap_conn_param_update_rsp rsp;
4625 u16 min, max, latency, to_multiplier;
4626 int err;
4627
4628 if (hcon->role != HCI_ROLE_MASTER)
4629 return -EINVAL;
4630
4631 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4632 return -EPROTO;
4633
4634 req = (struct l2cap_conn_param_update_req *) data;
4635 min = __le16_to_cpu(req->min);
4636 max = __le16_to_cpu(req->max);
4637 latency = __le16_to_cpu(req->latency);
4638 to_multiplier = __le16_to_cpu(req->to_multiplier);
4639
4640 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4641 min, max, latency, to_multiplier);
4642
4643 memset(&rsp, 0, sizeof(rsp));
4644
4645 err = hci_check_conn_params(min, max, latency, to_multiplier);
4646 if (err)
4647 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4648 else
4649 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4650
4651 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4652 sizeof(rsp), &rsp);
4653
4654 if (!err) {
4655 u8 store_hint;
4656
4657 store_hint = hci_le_conn_update(hcon, min, max, latency,
4658 to_multiplier);
4659 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
4660 store_hint, min, max, latency,
4661 to_multiplier);
4662
4663 }
4664
4665 return 0;
4666 }
4667
l2cap_le_connect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4668 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
4669 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4670 u8 *data)
4671 {
4672 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
4673 struct hci_conn *hcon = conn->hcon;
4674 u16 dcid, mtu, mps, credits, result;
4675 struct l2cap_chan *chan;
4676 int err, sec_level;
4677
4678 if (cmd_len < sizeof(*rsp))
4679 return -EPROTO;
4680
4681 dcid = __le16_to_cpu(rsp->dcid);
4682 mtu = __le16_to_cpu(rsp->mtu);
4683 mps = __le16_to_cpu(rsp->mps);
4684 credits = __le16_to_cpu(rsp->credits);
4685 result = __le16_to_cpu(rsp->result);
4686
4687 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
4688 dcid < L2CAP_CID_DYN_START ||
4689 dcid > L2CAP_CID_LE_DYN_END))
4690 return -EPROTO;
4691
4692 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4693 dcid, mtu, mps, credits, result);
4694
4695 mutex_lock(&conn->chan_lock);
4696
4697 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4698 if (!chan) {
4699 err = -EBADSLT;
4700 goto unlock;
4701 }
4702
4703 err = 0;
4704
4705 l2cap_chan_lock(chan);
4706
4707 switch (result) {
4708 case L2CAP_CR_LE_SUCCESS:
4709 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4710 err = -EBADSLT;
4711 break;
4712 }
4713
4714 chan->ident = 0;
4715 chan->dcid = dcid;
4716 chan->omtu = mtu;
4717 chan->remote_mps = mps;
4718 chan->tx_credits = credits;
4719 l2cap_chan_ready(chan);
4720 break;
4721
4722 case L2CAP_CR_LE_AUTHENTICATION:
4723 case L2CAP_CR_LE_ENCRYPTION:
4724 /* If we already have MITM protection we can't do
4725 * anything.
4726 */
4727 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
4728 l2cap_chan_del(chan, ECONNREFUSED);
4729 break;
4730 }
4731
4732 sec_level = hcon->sec_level + 1;
4733 if (chan->sec_level < sec_level)
4734 chan->sec_level = sec_level;
4735
4736 /* We'll need to send a new Connect Request */
4737 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
4738
4739 smp_conn_security(hcon, chan->sec_level);
4740 break;
4741
4742 default:
4743 l2cap_chan_del(chan, ECONNREFUSED);
4744 break;
4745 }
4746
4747 l2cap_chan_unlock(chan);
4748
4749 unlock:
4750 mutex_unlock(&conn->chan_lock);
4751
4752 return err;
4753 }
4754
l2cap_bredr_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4755 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4756 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4757 u8 *data)
4758 {
4759 int err = 0;
4760
4761 switch (cmd->code) {
4762 case L2CAP_COMMAND_REJ:
4763 l2cap_command_rej(conn, cmd, cmd_len, data);
4764 break;
4765
4766 case L2CAP_CONN_REQ:
4767 err = l2cap_connect_req(conn, cmd, cmd_len, data);
4768 break;
4769
4770 case L2CAP_CONN_RSP:
4771 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
4772 break;
4773
4774 case L2CAP_CONF_REQ:
4775 err = l2cap_config_req(conn, cmd, cmd_len, data);
4776 break;
4777
4778 case L2CAP_CONF_RSP:
4779 l2cap_config_rsp(conn, cmd, cmd_len, data);
4780 break;
4781
4782 case L2CAP_DISCONN_REQ:
4783 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
4784 break;
4785
4786 case L2CAP_DISCONN_RSP:
4787 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
4788 break;
4789
4790 case L2CAP_ECHO_REQ:
4791 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4792 break;
4793
4794 case L2CAP_ECHO_RSP:
4795 break;
4796
4797 case L2CAP_INFO_REQ:
4798 err = l2cap_information_req(conn, cmd, cmd_len, data);
4799 break;
4800
4801 case L2CAP_INFO_RSP:
4802 l2cap_information_rsp(conn, cmd, cmd_len, data);
4803 break;
4804
4805 default:
4806 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4807 err = -EINVAL;
4808 break;
4809 }
4810
4811 return err;
4812 }
4813
l2cap_le_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4814 static int l2cap_le_connect_req(struct l2cap_conn *conn,
4815 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4816 u8 *data)
4817 {
4818 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
4819 struct l2cap_le_conn_rsp rsp;
4820 struct l2cap_chan *chan, *pchan;
4821 u16 dcid, scid, credits, mtu, mps;
4822 __le16 psm;
4823 u8 result;
4824
4825 if (cmd_len != sizeof(*req))
4826 return -EPROTO;
4827
4828 scid = __le16_to_cpu(req->scid);
4829 mtu = __le16_to_cpu(req->mtu);
4830 mps = __le16_to_cpu(req->mps);
4831 psm = req->psm;
4832 dcid = 0;
4833 credits = 0;
4834
4835 if (mtu < 23 || mps < 23)
4836 return -EPROTO;
4837
4838 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
4839 scid, mtu, mps);
4840
4841 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
4842 * page 1059:
4843 *
4844 * Valid range: 0x0001-0x00ff
4845 *
4846 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
4847 */
4848 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
4849 result = L2CAP_CR_LE_BAD_PSM;
4850 chan = NULL;
4851 goto response;
4852 }
4853
4854 /* Check if we have socket listening on psm */
4855 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4856 &conn->hcon->dst, LE_LINK);
4857 if (!pchan) {
4858 result = L2CAP_CR_LE_BAD_PSM;
4859 chan = NULL;
4860 goto response;
4861 }
4862
4863 mutex_lock(&conn->chan_lock);
4864 l2cap_chan_lock(pchan);
4865
4866 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
4867 SMP_ALLOW_STK)) {
4868 result = L2CAP_CR_LE_AUTHENTICATION;
4869 chan = NULL;
4870 goto response_unlock;
4871 }
4872
4873 /* Check for valid dynamic CID range */
4874 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
4875 result = L2CAP_CR_LE_INVALID_SCID;
4876 chan = NULL;
4877 goto response_unlock;
4878 }
4879
4880 /* Check if we already have channel with that dcid */
4881 if (__l2cap_get_chan_by_dcid(conn, scid)) {
4882 result = L2CAP_CR_LE_SCID_IN_USE;
4883 chan = NULL;
4884 goto response_unlock;
4885 }
4886
4887 chan = pchan->ops->new_connection(pchan);
4888 if (!chan) {
4889 result = L2CAP_CR_LE_NO_MEM;
4890 goto response_unlock;
4891 }
4892
4893 bacpy(&chan->src, &conn->hcon->src);
4894 bacpy(&chan->dst, &conn->hcon->dst);
4895 chan->src_type = bdaddr_src_type(conn->hcon);
4896 chan->dst_type = bdaddr_dst_type(conn->hcon);
4897 chan->psm = psm;
4898 chan->dcid = scid;
4899 chan->omtu = mtu;
4900 chan->remote_mps = mps;
4901
4902 __l2cap_chan_add(conn, chan);
4903
4904 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
4905
4906 dcid = chan->scid;
4907 credits = chan->rx_credits;
4908
4909 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4910
4911 chan->ident = cmd->ident;
4912
4913 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4914 l2cap_state_change(chan, BT_CONNECT2);
4915 /* The following result value is actually not defined
4916 * for LE CoC but we use it to let the function know
4917 * that it should bail out after doing its cleanup
4918 * instead of sending a response.
4919 */
4920 result = L2CAP_CR_PEND;
4921 chan->ops->defer(chan);
4922 } else {
4923 l2cap_chan_ready(chan);
4924 result = L2CAP_CR_LE_SUCCESS;
4925 }
4926
4927 response_unlock:
4928 l2cap_chan_unlock(pchan);
4929 mutex_unlock(&conn->chan_lock);
4930 l2cap_chan_put(pchan);
4931
4932 if (result == L2CAP_CR_PEND)
4933 return 0;
4934
4935 response:
4936 if (chan) {
4937 rsp.mtu = cpu_to_le16(chan->imtu);
4938 rsp.mps = cpu_to_le16(chan->mps);
4939 } else {
4940 rsp.mtu = 0;
4941 rsp.mps = 0;
4942 }
4943
4944 rsp.dcid = cpu_to_le16(dcid);
4945 rsp.credits = cpu_to_le16(credits);
4946 rsp.result = cpu_to_le16(result);
4947
4948 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
4949
4950 return 0;
4951 }
4952
l2cap_le_credits(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4953 static inline int l2cap_le_credits(struct l2cap_conn *conn,
4954 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4955 u8 *data)
4956 {
4957 struct l2cap_le_credits *pkt;
4958 struct l2cap_chan *chan;
4959 u16 cid, credits, max_credits;
4960
4961 if (cmd_len != sizeof(*pkt))
4962 return -EPROTO;
4963
4964 pkt = (struct l2cap_le_credits *) data;
4965 cid = __le16_to_cpu(pkt->cid);
4966 credits = __le16_to_cpu(pkt->credits);
4967
4968 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
4969
4970 chan = l2cap_get_chan_by_dcid(conn, cid);
4971 if (!chan)
4972 return -EBADSLT;
4973
4974 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
4975 if (credits > max_credits) {
4976 BT_ERR("LE credits overflow");
4977 l2cap_send_disconn_req(chan, ECONNRESET);
4978
4979 /* Return 0 so that we don't trigger an unnecessary
4980 * command reject packet.
4981 */
4982 goto unlock;
4983 }
4984
4985 chan->tx_credits += credits;
4986
4987 /* Resume sending */
4988 l2cap_le_flowctl_send(chan);
4989
4990 if (chan->tx_credits)
4991 chan->ops->resume(chan);
4992
4993 unlock:
4994 l2cap_chan_unlock(chan);
4995 l2cap_chan_put(chan);
4996
4997 return 0;
4998 }
4999
l2cap_ecred_conn_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5000 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
5001 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5002 u8 *data)
5003 {
5004 struct l2cap_ecred_conn_req *req = (void *) data;
5005 struct {
5006 struct l2cap_ecred_conn_rsp rsp;
5007 __le16 dcid[L2CAP_ECRED_MAX_CID];
5008 } __packed pdu;
5009 struct l2cap_chan *chan, *pchan;
5010 u16 mtu, mps;
5011 __le16 psm;
5012 u8 result, len = 0;
5013 int i, num_scid;
5014 bool defer = false;
5015
5016 if (!enable_ecred)
5017 return -EINVAL;
5018
5019 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5020 result = L2CAP_CR_LE_INVALID_PARAMS;
5021 goto response;
5022 }
5023
5024 cmd_len -= sizeof(*req);
5025 num_scid = cmd_len / sizeof(u16);
5026
5027 if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5028 result = L2CAP_CR_LE_INVALID_PARAMS;
5029 goto response;
5030 }
5031
5032 mtu = __le16_to_cpu(req->mtu);
5033 mps = __le16_to_cpu(req->mps);
5034
5035 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5036 result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5037 goto response;
5038 }
5039
5040 psm = req->psm;
5041
5042 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
5043 * page 1059:
5044 *
5045 * Valid range: 0x0001-0x00ff
5046 *
5047 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
5048 */
5049 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
5050 result = L2CAP_CR_LE_BAD_PSM;
5051 goto response;
5052 }
5053
5054 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5055
5056 memset(&pdu, 0, sizeof(pdu));
5057
5058 /* Check if we have socket listening on psm */
5059 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5060 &conn->hcon->dst, LE_LINK);
5061 if (!pchan) {
5062 result = L2CAP_CR_LE_BAD_PSM;
5063 goto response;
5064 }
5065
5066 mutex_lock(&conn->chan_lock);
5067 l2cap_chan_lock(pchan);
5068
5069 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5070 SMP_ALLOW_STK)) {
5071 result = L2CAP_CR_LE_AUTHENTICATION;
5072 goto unlock;
5073 }
5074
5075 result = L2CAP_CR_LE_SUCCESS;
5076
5077 for (i = 0; i < num_scid; i++) {
5078 u16 scid = __le16_to_cpu(req->scid[i]);
5079
5080 BT_DBG("scid[%d] 0x%4.4x", i, scid);
5081
5082 pdu.dcid[i] = 0x0000;
5083 len += sizeof(*pdu.dcid);
5084
5085 /* Check for valid dynamic CID range */
5086 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5087 result = L2CAP_CR_LE_INVALID_SCID;
5088 continue;
5089 }
5090
5091 /* Check if we already have channel with that dcid */
5092 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5093 result = L2CAP_CR_LE_SCID_IN_USE;
5094 continue;
5095 }
5096
5097 chan = pchan->ops->new_connection(pchan);
5098 if (!chan) {
5099 result = L2CAP_CR_LE_NO_MEM;
5100 continue;
5101 }
5102
5103 bacpy(&chan->src, &conn->hcon->src);
5104 bacpy(&chan->dst, &conn->hcon->dst);
5105 chan->src_type = bdaddr_src_type(conn->hcon);
5106 chan->dst_type = bdaddr_dst_type(conn->hcon);
5107 chan->psm = psm;
5108 chan->dcid = scid;
5109 chan->omtu = mtu;
5110 chan->remote_mps = mps;
5111
5112 __l2cap_chan_add(conn, chan);
5113
5114 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
5115
5116 /* Init response */
5117 if (!pdu.rsp.credits) {
5118 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
5119 pdu.rsp.mps = cpu_to_le16(chan->mps);
5120 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
5121 }
5122
5123 pdu.dcid[i] = cpu_to_le16(chan->scid);
5124
5125 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5126
5127 chan->ident = cmd->ident;
5128 chan->mode = L2CAP_MODE_EXT_FLOWCTL;
5129
5130 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5131 l2cap_state_change(chan, BT_CONNECT2);
5132 defer = true;
5133 chan->ops->defer(chan);
5134 } else {
5135 l2cap_chan_ready(chan);
5136 }
5137 }
5138
5139 unlock:
5140 l2cap_chan_unlock(pchan);
5141 mutex_unlock(&conn->chan_lock);
5142 l2cap_chan_put(pchan);
5143
5144 response:
5145 pdu.rsp.result = cpu_to_le16(result);
5146
5147 if (defer)
5148 return 0;
5149
5150 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
5151 sizeof(pdu.rsp) + len, &pdu);
5152
5153 return 0;
5154 }
5155
l2cap_ecred_conn_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5156 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
5157 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5158 u8 *data)
5159 {
5160 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5161 struct hci_conn *hcon = conn->hcon;
5162 u16 mtu, mps, credits, result;
5163 struct l2cap_chan *chan, *tmp;
5164 int err = 0, sec_level;
5165 int i = 0;
5166
5167 if (cmd_len < sizeof(*rsp))
5168 return -EPROTO;
5169
5170 mtu = __le16_to_cpu(rsp->mtu);
5171 mps = __le16_to_cpu(rsp->mps);
5172 credits = __le16_to_cpu(rsp->credits);
5173 result = __le16_to_cpu(rsp->result);
5174
5175 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5176 result);
5177
5178 mutex_lock(&conn->chan_lock);
5179
5180 cmd_len -= sizeof(*rsp);
5181
5182 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5183 u16 dcid;
5184
5185 if (chan->ident != cmd->ident ||
5186 chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
5187 chan->state == BT_CONNECTED)
5188 continue;
5189
5190 l2cap_chan_lock(chan);
5191
5192 /* Check that there is a dcid for each pending channel */
5193 if (cmd_len < sizeof(dcid)) {
5194 l2cap_chan_del(chan, ECONNREFUSED);
5195 l2cap_chan_unlock(chan);
5196 continue;
5197 }
5198
5199 dcid = __le16_to_cpu(rsp->dcid[i++]);
5200 cmd_len -= sizeof(u16);
5201
5202 BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
5203
5204 /* Check if dcid is already in use */
5205 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
5206 /* If a device receives a
5207 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
5208 * already-assigned Destination CID, then both the
5209 * original channel and the new channel shall be
5210 * immediately discarded and not used.
5211 */
5212 l2cap_chan_del(chan, ECONNREFUSED);
5213 l2cap_chan_unlock(chan);
5214 chan = __l2cap_get_chan_by_dcid(conn, dcid);
5215 l2cap_chan_lock(chan);
5216 l2cap_chan_del(chan, ECONNRESET);
5217 l2cap_chan_unlock(chan);
5218 continue;
5219 }
5220
5221 switch (result) {
5222 case L2CAP_CR_LE_AUTHENTICATION:
5223 case L2CAP_CR_LE_ENCRYPTION:
5224 /* If we already have MITM protection we can't do
5225 * anything.
5226 */
5227 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5228 l2cap_chan_del(chan, ECONNREFUSED);
5229 break;
5230 }
5231
5232 sec_level = hcon->sec_level + 1;
5233 if (chan->sec_level < sec_level)
5234 chan->sec_level = sec_level;
5235
5236 /* We'll need to send a new Connect Request */
5237 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
5238
5239 smp_conn_security(hcon, chan->sec_level);
5240 break;
5241
5242 case L2CAP_CR_LE_BAD_PSM:
5243 l2cap_chan_del(chan, ECONNREFUSED);
5244 break;
5245
5246 default:
5247 /* If dcid was not set it means channels was refused */
5248 if (!dcid) {
5249 l2cap_chan_del(chan, ECONNREFUSED);
5250 break;
5251 }
5252
5253 chan->ident = 0;
5254 chan->dcid = dcid;
5255 chan->omtu = mtu;
5256 chan->remote_mps = mps;
5257 chan->tx_credits = credits;
5258 l2cap_chan_ready(chan);
5259 break;
5260 }
5261
5262 l2cap_chan_unlock(chan);
5263 }
5264
5265 mutex_unlock(&conn->chan_lock);
5266
5267 return err;
5268 }
5269
l2cap_ecred_reconf_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5270 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
5271 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5272 u8 *data)
5273 {
5274 struct l2cap_ecred_reconf_req *req = (void *) data;
5275 struct l2cap_ecred_reconf_rsp rsp;
5276 u16 mtu, mps, result;
5277 struct l2cap_chan *chan;
5278 int i, num_scid;
5279
5280 if (!enable_ecred)
5281 return -EINVAL;
5282
5283 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
5284 result = L2CAP_CR_LE_INVALID_PARAMS;
5285 goto respond;
5286 }
5287
5288 mtu = __le16_to_cpu(req->mtu);
5289 mps = __le16_to_cpu(req->mps);
5290
5291 BT_DBG("mtu %u mps %u", mtu, mps);
5292
5293 if (mtu < L2CAP_ECRED_MIN_MTU) {
5294 result = L2CAP_RECONF_INVALID_MTU;
5295 goto respond;
5296 }
5297
5298 if (mps < L2CAP_ECRED_MIN_MPS) {
5299 result = L2CAP_RECONF_INVALID_MPS;
5300 goto respond;
5301 }
5302
5303 cmd_len -= sizeof(*req);
5304 num_scid = cmd_len / sizeof(u16);
5305 result = L2CAP_RECONF_SUCCESS;
5306
5307 for (i = 0; i < num_scid; i++) {
5308 u16 scid;
5309
5310 scid = __le16_to_cpu(req->scid[i]);
5311 if (!scid)
5312 return -EPROTO;
5313
5314 chan = __l2cap_get_chan_by_dcid(conn, scid);
5315 if (!chan)
5316 continue;
5317
5318 /* If the MTU value is decreased for any of the included
5319 * channels, then the receiver shall disconnect all
5320 * included channels.
5321 */
5322 if (chan->omtu > mtu) {
5323 BT_ERR("chan %p decreased MTU %u -> %u", chan,
5324 chan->omtu, mtu);
5325 result = L2CAP_RECONF_INVALID_MTU;
5326 }
5327
5328 chan->omtu = mtu;
5329 chan->remote_mps = mps;
5330 }
5331
5332 respond:
5333 rsp.result = cpu_to_le16(result);
5334
5335 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
5336 &rsp);
5337
5338 return 0;
5339 }
5340
l2cap_ecred_reconf_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5341 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
5342 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5343 u8 *data)
5344 {
5345 struct l2cap_chan *chan, *tmp;
5346 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5347 u16 result;
5348
5349 if (cmd_len < sizeof(*rsp))
5350 return -EPROTO;
5351
5352 result = __le16_to_cpu(rsp->result);
5353
5354 BT_DBG("result 0x%4.4x", rsp->result);
5355
5356 if (!result)
5357 return 0;
5358
5359 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5360 if (chan->ident != cmd->ident)
5361 continue;
5362
5363 l2cap_chan_del(chan, ECONNRESET);
5364 }
5365
5366 return 0;
5367 }
5368
l2cap_le_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5369 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5370 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5371 u8 *data)
5372 {
5373 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5374 struct l2cap_chan *chan;
5375
5376 if (cmd_len < sizeof(*rej))
5377 return -EPROTO;
5378
5379 mutex_lock(&conn->chan_lock);
5380
5381 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5382 if (!chan)
5383 goto done;
5384
5385 chan = l2cap_chan_hold_unless_zero(chan);
5386 if (!chan)
5387 goto done;
5388
5389 l2cap_chan_lock(chan);
5390 l2cap_chan_del(chan, ECONNREFUSED);
5391 l2cap_chan_unlock(chan);
5392 l2cap_chan_put(chan);
5393
5394 done:
5395 mutex_unlock(&conn->chan_lock);
5396 return 0;
5397 }
5398
l2cap_le_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5399 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5400 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5401 u8 *data)
5402 {
5403 int err = 0;
5404
5405 switch (cmd->code) {
5406 case L2CAP_COMMAND_REJ:
5407 l2cap_le_command_rej(conn, cmd, cmd_len, data);
5408 break;
5409
5410 case L2CAP_CONN_PARAM_UPDATE_REQ:
5411 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5412 break;
5413
5414 case L2CAP_CONN_PARAM_UPDATE_RSP:
5415 break;
5416
5417 case L2CAP_LE_CONN_RSP:
5418 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5419 break;
5420
5421 case L2CAP_LE_CONN_REQ:
5422 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5423 break;
5424
5425 case L2CAP_LE_CREDITS:
5426 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5427 break;
5428
5429 case L2CAP_ECRED_CONN_REQ:
5430 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
5431 break;
5432
5433 case L2CAP_ECRED_CONN_RSP:
5434 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
5435 break;
5436
5437 case L2CAP_ECRED_RECONF_REQ:
5438 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
5439 break;
5440
5441 case L2CAP_ECRED_RECONF_RSP:
5442 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
5443 break;
5444
5445 case L2CAP_DISCONN_REQ:
5446 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5447 break;
5448
5449 case L2CAP_DISCONN_RSP:
5450 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5451 break;
5452
5453 default:
5454 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5455 err = -EINVAL;
5456 break;
5457 }
5458
5459 return err;
5460 }
5461
l2cap_le_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5462 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5463 struct sk_buff *skb)
5464 {
5465 struct hci_conn *hcon = conn->hcon;
5466 struct l2cap_cmd_hdr *cmd;
5467 u16 len;
5468 int err;
5469
5470 if (hcon->type != LE_LINK)
5471 goto drop;
5472
5473 if (skb->len < L2CAP_CMD_HDR_SIZE)
5474 goto drop;
5475
5476 cmd = (void *) skb->data;
5477 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5478
5479 len = le16_to_cpu(cmd->len);
5480
5481 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5482
5483 if (len != skb->len || !cmd->ident) {
5484 BT_DBG("corrupted command");
5485 goto drop;
5486 }
5487
5488 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5489 if (err) {
5490 struct l2cap_cmd_rej_unk rej;
5491
5492 BT_ERR("Wrong link type (%d)", err);
5493
5494 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5495 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5496 sizeof(rej), &rej);
5497 }
5498
5499 drop:
5500 kfree_skb(skb);
5501 }
5502
l2cap_sig_send_rej(struct l2cap_conn * conn,u16 ident)5503 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
5504 {
5505 struct l2cap_cmd_rej_unk rej;
5506
5507 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5508 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5509 }
5510
l2cap_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5511 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5512 struct sk_buff *skb)
5513 {
5514 struct hci_conn *hcon = conn->hcon;
5515 struct l2cap_cmd_hdr *cmd;
5516 int err;
5517
5518 l2cap_raw_recv(conn, skb);
5519
5520 if (hcon->type != ACL_LINK)
5521 goto drop;
5522
5523 while (skb->len >= L2CAP_CMD_HDR_SIZE) {
5524 u16 len;
5525
5526 cmd = (void *) skb->data;
5527 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5528
5529 len = le16_to_cpu(cmd->len);
5530
5531 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
5532 cmd->ident);
5533
5534 if (len > skb->len || !cmd->ident) {
5535 BT_DBG("corrupted command");
5536 l2cap_sig_send_rej(conn, cmd->ident);
5537 skb_pull(skb, len > skb->len ? skb->len : len);
5538 continue;
5539 }
5540
5541 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
5542 if (err) {
5543 BT_ERR("Wrong link type (%d)", err);
5544 l2cap_sig_send_rej(conn, cmd->ident);
5545 }
5546
5547 skb_pull(skb, len);
5548 }
5549
5550 if (skb->len > 0) {
5551 BT_DBG("corrupted command");
5552 l2cap_sig_send_rej(conn, 0);
5553 }
5554
5555 drop:
5556 kfree_skb(skb);
5557 }
5558
l2cap_check_fcs(struct l2cap_chan * chan,struct sk_buff * skb)5559 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
5560 {
5561 u16 our_fcs, rcv_fcs;
5562 int hdr_size;
5563
5564 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5565 hdr_size = L2CAP_EXT_HDR_SIZE;
5566 else
5567 hdr_size = L2CAP_ENH_HDR_SIZE;
5568
5569 if (chan->fcs == L2CAP_FCS_CRC16) {
5570 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5571 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5572 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5573
5574 if (our_fcs != rcv_fcs)
5575 return -EBADMSG;
5576 }
5577 return 0;
5578 }
5579
l2cap_send_i_or_rr_or_rnr(struct l2cap_chan * chan)5580 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5581 {
5582 struct l2cap_ctrl control;
5583
5584 BT_DBG("chan %p", chan);
5585
5586 memset(&control, 0, sizeof(control));
5587 control.sframe = 1;
5588 control.final = 1;
5589 control.reqseq = chan->buffer_seq;
5590 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5591
5592 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5593 control.super = L2CAP_SUPER_RNR;
5594 l2cap_send_sframe(chan, &control);
5595 }
5596
5597 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5598 chan->unacked_frames > 0)
5599 __set_retrans_timer(chan);
5600
5601 /* Send pending iframes */
5602 l2cap_ertm_send(chan);
5603
5604 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5605 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5606 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5607 * send it now.
5608 */
5609 control.super = L2CAP_SUPER_RR;
5610 l2cap_send_sframe(chan, &control);
5611 }
5612 }
5613
append_skb_frag(struct sk_buff * skb,struct sk_buff * new_frag,struct sk_buff ** last_frag)5614 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5615 struct sk_buff **last_frag)
5616 {
5617 /* skb->len reflects data in skb as well as all fragments
5618 * skb->data_len reflects only data in fragments
5619 */
5620 if (!skb_has_frag_list(skb))
5621 skb_shinfo(skb)->frag_list = new_frag;
5622
5623 new_frag->next = NULL;
5624
5625 (*last_frag)->next = new_frag;
5626 *last_frag = new_frag;
5627
5628 skb->len += new_frag->len;
5629 skb->data_len += new_frag->len;
5630 skb->truesize += new_frag->truesize;
5631 }
5632
l2cap_reassemble_sdu(struct l2cap_chan * chan,struct sk_buff * skb,struct l2cap_ctrl * control)5633 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5634 struct l2cap_ctrl *control)
5635 {
5636 int err = -EINVAL;
5637
5638 switch (control->sar) {
5639 case L2CAP_SAR_UNSEGMENTED:
5640 if (chan->sdu)
5641 break;
5642
5643 err = chan->ops->recv(chan, skb);
5644 break;
5645
5646 case L2CAP_SAR_START:
5647 if (chan->sdu)
5648 break;
5649
5650 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5651 break;
5652
5653 chan->sdu_len = get_unaligned_le16(skb->data);
5654 skb_pull(skb, L2CAP_SDULEN_SIZE);
5655
5656 if (chan->sdu_len > chan->imtu) {
5657 err = -EMSGSIZE;
5658 break;
5659 }
5660
5661 if (skb->len >= chan->sdu_len)
5662 break;
5663
5664 chan->sdu = skb;
5665 chan->sdu_last_frag = skb;
5666
5667 skb = NULL;
5668 err = 0;
5669 break;
5670
5671 case L2CAP_SAR_CONTINUE:
5672 if (!chan->sdu)
5673 break;
5674
5675 append_skb_frag(chan->sdu, skb,
5676 &chan->sdu_last_frag);
5677 skb = NULL;
5678
5679 if (chan->sdu->len >= chan->sdu_len)
5680 break;
5681
5682 err = 0;
5683 break;
5684
5685 case L2CAP_SAR_END:
5686 if (!chan->sdu)
5687 break;
5688
5689 append_skb_frag(chan->sdu, skb,
5690 &chan->sdu_last_frag);
5691 skb = NULL;
5692
5693 if (chan->sdu->len != chan->sdu_len)
5694 break;
5695
5696 err = chan->ops->recv(chan, chan->sdu);
5697
5698 if (!err) {
5699 /* Reassembly complete */
5700 chan->sdu = NULL;
5701 chan->sdu_last_frag = NULL;
5702 chan->sdu_len = 0;
5703 }
5704 break;
5705 }
5706
5707 if (err) {
5708 kfree_skb(skb);
5709 kfree_skb(chan->sdu);
5710 chan->sdu = NULL;
5711 chan->sdu_last_frag = NULL;
5712 chan->sdu_len = 0;
5713 }
5714
5715 return err;
5716 }
5717
l2cap_resegment(struct l2cap_chan * chan)5718 static int l2cap_resegment(struct l2cap_chan *chan)
5719 {
5720 /* Placeholder */
5721 return 0;
5722 }
5723
l2cap_chan_busy(struct l2cap_chan * chan,int busy)5724 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5725 {
5726 u8 event;
5727
5728 if (chan->mode != L2CAP_MODE_ERTM)
5729 return;
5730
5731 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5732 l2cap_tx(chan, NULL, NULL, event);
5733 }
5734
l2cap_rx_queued_iframes(struct l2cap_chan * chan)5735 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5736 {
5737 int err = 0;
5738 /* Pass sequential frames to l2cap_reassemble_sdu()
5739 * until a gap is encountered.
5740 */
5741
5742 BT_DBG("chan %p", chan);
5743
5744 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5745 struct sk_buff *skb;
5746 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5747 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5748
5749 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5750
5751 if (!skb)
5752 break;
5753
5754 skb_unlink(skb, &chan->srej_q);
5755 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5756 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
5757 if (err)
5758 break;
5759 }
5760
5761 if (skb_queue_empty(&chan->srej_q)) {
5762 chan->rx_state = L2CAP_RX_STATE_RECV;
5763 l2cap_send_ack(chan);
5764 }
5765
5766 return err;
5767 }
5768
l2cap_handle_srej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5769 static void l2cap_handle_srej(struct l2cap_chan *chan,
5770 struct l2cap_ctrl *control)
5771 {
5772 struct sk_buff *skb;
5773
5774 BT_DBG("chan %p, control %p", chan, control);
5775
5776 if (control->reqseq == chan->next_tx_seq) {
5777 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5778 l2cap_send_disconn_req(chan, ECONNRESET);
5779 return;
5780 }
5781
5782 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5783
5784 if (skb == NULL) {
5785 BT_DBG("Seq %d not available for retransmission",
5786 control->reqseq);
5787 return;
5788 }
5789
5790 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5791 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5792 l2cap_send_disconn_req(chan, ECONNRESET);
5793 return;
5794 }
5795
5796 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5797
5798 if (control->poll) {
5799 l2cap_pass_to_tx(chan, control);
5800
5801 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5802 l2cap_retransmit(chan, control);
5803 l2cap_ertm_send(chan);
5804
5805 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5806 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5807 chan->srej_save_reqseq = control->reqseq;
5808 }
5809 } else {
5810 l2cap_pass_to_tx_fbit(chan, control);
5811
5812 if (control->final) {
5813 if (chan->srej_save_reqseq != control->reqseq ||
5814 !test_and_clear_bit(CONN_SREJ_ACT,
5815 &chan->conn_state))
5816 l2cap_retransmit(chan, control);
5817 } else {
5818 l2cap_retransmit(chan, control);
5819 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5820 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5821 chan->srej_save_reqseq = control->reqseq;
5822 }
5823 }
5824 }
5825 }
5826
l2cap_handle_rej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5827 static void l2cap_handle_rej(struct l2cap_chan *chan,
5828 struct l2cap_ctrl *control)
5829 {
5830 struct sk_buff *skb;
5831
5832 BT_DBG("chan %p, control %p", chan, control);
5833
5834 if (control->reqseq == chan->next_tx_seq) {
5835 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5836 l2cap_send_disconn_req(chan, ECONNRESET);
5837 return;
5838 }
5839
5840 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5841
5842 if (chan->max_tx && skb &&
5843 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5844 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5845 l2cap_send_disconn_req(chan, ECONNRESET);
5846 return;
5847 }
5848
5849 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5850
5851 l2cap_pass_to_tx(chan, control);
5852
5853 if (control->final) {
5854 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5855 l2cap_retransmit_all(chan, control);
5856 } else {
5857 l2cap_retransmit_all(chan, control);
5858 l2cap_ertm_send(chan);
5859 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5860 set_bit(CONN_REJ_ACT, &chan->conn_state);
5861 }
5862 }
5863
l2cap_classify_txseq(struct l2cap_chan * chan,u16 txseq)5864 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5865 {
5866 BT_DBG("chan %p, txseq %d", chan, txseq);
5867
5868 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5869 chan->expected_tx_seq);
5870
5871 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5872 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5873 chan->tx_win) {
5874 /* See notes below regarding "double poll" and
5875 * invalid packets.
5876 */
5877 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5878 BT_DBG("Invalid/Ignore - after SREJ");
5879 return L2CAP_TXSEQ_INVALID_IGNORE;
5880 } else {
5881 BT_DBG("Invalid - in window after SREJ sent");
5882 return L2CAP_TXSEQ_INVALID;
5883 }
5884 }
5885
5886 if (chan->srej_list.head == txseq) {
5887 BT_DBG("Expected SREJ");
5888 return L2CAP_TXSEQ_EXPECTED_SREJ;
5889 }
5890
5891 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5892 BT_DBG("Duplicate SREJ - txseq already stored");
5893 return L2CAP_TXSEQ_DUPLICATE_SREJ;
5894 }
5895
5896 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5897 BT_DBG("Unexpected SREJ - not requested");
5898 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5899 }
5900 }
5901
5902 if (chan->expected_tx_seq == txseq) {
5903 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5904 chan->tx_win) {
5905 BT_DBG("Invalid - txseq outside tx window");
5906 return L2CAP_TXSEQ_INVALID;
5907 } else {
5908 BT_DBG("Expected");
5909 return L2CAP_TXSEQ_EXPECTED;
5910 }
5911 }
5912
5913 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
5914 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
5915 BT_DBG("Duplicate - expected_tx_seq later than txseq");
5916 return L2CAP_TXSEQ_DUPLICATE;
5917 }
5918
5919 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5920 /* A source of invalid packets is a "double poll" condition,
5921 * where delays cause us to send multiple poll packets. If
5922 * the remote stack receives and processes both polls,
5923 * sequence numbers can wrap around in such a way that a
5924 * resent frame has a sequence number that looks like new data
5925 * with a sequence gap. This would trigger an erroneous SREJ
5926 * request.
5927 *
5928 * Fortunately, this is impossible with a tx window that's
5929 * less than half of the maximum sequence number, which allows
5930 * invalid frames to be safely ignored.
5931 *
5932 * With tx window sizes greater than half of the tx window
5933 * maximum, the frame is invalid and cannot be ignored. This
5934 * causes a disconnect.
5935 */
5936
5937 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5938 BT_DBG("Invalid/Ignore - txseq outside tx window");
5939 return L2CAP_TXSEQ_INVALID_IGNORE;
5940 } else {
5941 BT_DBG("Invalid - txseq outside tx window");
5942 return L2CAP_TXSEQ_INVALID;
5943 }
5944 } else {
5945 BT_DBG("Unexpected - txseq indicates missing frames");
5946 return L2CAP_TXSEQ_UNEXPECTED;
5947 }
5948 }
5949
l2cap_rx_state_recv(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)5950 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5951 struct l2cap_ctrl *control,
5952 struct sk_buff *skb, u8 event)
5953 {
5954 struct l2cap_ctrl local_control;
5955 int err = 0;
5956 bool skb_in_use = false;
5957
5958 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5959 event);
5960
5961 switch (event) {
5962 case L2CAP_EV_RECV_IFRAME:
5963 switch (l2cap_classify_txseq(chan, control->txseq)) {
5964 case L2CAP_TXSEQ_EXPECTED:
5965 l2cap_pass_to_tx(chan, control);
5966
5967 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5968 BT_DBG("Busy, discarding expected seq %d",
5969 control->txseq);
5970 break;
5971 }
5972
5973 chan->expected_tx_seq = __next_seq(chan,
5974 control->txseq);
5975
5976 chan->buffer_seq = chan->expected_tx_seq;
5977 skb_in_use = true;
5978
5979 /* l2cap_reassemble_sdu may free skb, hence invalidate
5980 * control, so make a copy in advance to use it after
5981 * l2cap_reassemble_sdu returns and to avoid the race
5982 * condition, for example:
5983 *
5984 * The current thread calls:
5985 * l2cap_reassemble_sdu
5986 * chan->ops->recv == l2cap_sock_recv_cb
5987 * __sock_queue_rcv_skb
5988 * Another thread calls:
5989 * bt_sock_recvmsg
5990 * skb_recv_datagram
5991 * skb_free_datagram
5992 * Then the current thread tries to access control, but
5993 * it was freed by skb_free_datagram.
5994 */
5995 local_control = *control;
5996 err = l2cap_reassemble_sdu(chan, skb, control);
5997 if (err)
5998 break;
5999
6000 if (local_control.final) {
6001 if (!test_and_clear_bit(CONN_REJ_ACT,
6002 &chan->conn_state)) {
6003 local_control.final = 0;
6004 l2cap_retransmit_all(chan, &local_control);
6005 l2cap_ertm_send(chan);
6006 }
6007 }
6008
6009 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6010 l2cap_send_ack(chan);
6011 break;
6012 case L2CAP_TXSEQ_UNEXPECTED:
6013 l2cap_pass_to_tx(chan, control);
6014
6015 /* Can't issue SREJ frames in the local busy state.
6016 * Drop this frame, it will be seen as missing
6017 * when local busy is exited.
6018 */
6019 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6020 BT_DBG("Busy, discarding unexpected seq %d",
6021 control->txseq);
6022 break;
6023 }
6024
6025 /* There was a gap in the sequence, so an SREJ
6026 * must be sent for each missing frame. The
6027 * current frame is stored for later use.
6028 */
6029 skb_queue_tail(&chan->srej_q, skb);
6030 skb_in_use = true;
6031 BT_DBG("Queued %p (queue len %d)", skb,
6032 skb_queue_len(&chan->srej_q));
6033
6034 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6035 l2cap_seq_list_clear(&chan->srej_list);
6036 l2cap_send_srej(chan, control->txseq);
6037
6038 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6039 break;
6040 case L2CAP_TXSEQ_DUPLICATE:
6041 l2cap_pass_to_tx(chan, control);
6042 break;
6043 case L2CAP_TXSEQ_INVALID_IGNORE:
6044 break;
6045 case L2CAP_TXSEQ_INVALID:
6046 default:
6047 l2cap_send_disconn_req(chan, ECONNRESET);
6048 break;
6049 }
6050 break;
6051 case L2CAP_EV_RECV_RR:
6052 l2cap_pass_to_tx(chan, control);
6053 if (control->final) {
6054 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6055
6056 if (!test_and_clear_bit(CONN_REJ_ACT,
6057 &chan->conn_state)) {
6058 control->final = 0;
6059 l2cap_retransmit_all(chan, control);
6060 }
6061
6062 l2cap_ertm_send(chan);
6063 } else if (control->poll) {
6064 l2cap_send_i_or_rr_or_rnr(chan);
6065 } else {
6066 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6067 &chan->conn_state) &&
6068 chan->unacked_frames)
6069 __set_retrans_timer(chan);
6070
6071 l2cap_ertm_send(chan);
6072 }
6073 break;
6074 case L2CAP_EV_RECV_RNR:
6075 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6076 l2cap_pass_to_tx(chan, control);
6077 if (control && control->poll) {
6078 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6079 l2cap_send_rr_or_rnr(chan, 0);
6080 }
6081 __clear_retrans_timer(chan);
6082 l2cap_seq_list_clear(&chan->retrans_list);
6083 break;
6084 case L2CAP_EV_RECV_REJ:
6085 l2cap_handle_rej(chan, control);
6086 break;
6087 case L2CAP_EV_RECV_SREJ:
6088 l2cap_handle_srej(chan, control);
6089 break;
6090 default:
6091 break;
6092 }
6093
6094 if (skb && !skb_in_use) {
6095 BT_DBG("Freeing %p", skb);
6096 kfree_skb(skb);
6097 }
6098
6099 return err;
6100 }
6101
l2cap_rx_state_srej_sent(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6102 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6103 struct l2cap_ctrl *control,
6104 struct sk_buff *skb, u8 event)
6105 {
6106 int err = 0;
6107 u16 txseq = control->txseq;
6108 bool skb_in_use = false;
6109
6110 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6111 event);
6112
6113 switch (event) {
6114 case L2CAP_EV_RECV_IFRAME:
6115 switch (l2cap_classify_txseq(chan, txseq)) {
6116 case L2CAP_TXSEQ_EXPECTED:
6117 /* Keep frame for reassembly later */
6118 l2cap_pass_to_tx(chan, control);
6119 skb_queue_tail(&chan->srej_q, skb);
6120 skb_in_use = true;
6121 BT_DBG("Queued %p (queue len %d)", skb,
6122 skb_queue_len(&chan->srej_q));
6123
6124 chan->expected_tx_seq = __next_seq(chan, txseq);
6125 break;
6126 case L2CAP_TXSEQ_EXPECTED_SREJ:
6127 l2cap_seq_list_pop(&chan->srej_list);
6128
6129 l2cap_pass_to_tx(chan, control);
6130 skb_queue_tail(&chan->srej_q, skb);
6131 skb_in_use = true;
6132 BT_DBG("Queued %p (queue len %d)", skb,
6133 skb_queue_len(&chan->srej_q));
6134
6135 err = l2cap_rx_queued_iframes(chan);
6136 if (err)
6137 break;
6138
6139 break;
6140 case L2CAP_TXSEQ_UNEXPECTED:
6141 /* Got a frame that can't be reassembled yet.
6142 * Save it for later, and send SREJs to cover
6143 * the missing frames.
6144 */
6145 skb_queue_tail(&chan->srej_q, skb);
6146 skb_in_use = true;
6147 BT_DBG("Queued %p (queue len %d)", skb,
6148 skb_queue_len(&chan->srej_q));
6149
6150 l2cap_pass_to_tx(chan, control);
6151 l2cap_send_srej(chan, control->txseq);
6152 break;
6153 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6154 /* This frame was requested with an SREJ, but
6155 * some expected retransmitted frames are
6156 * missing. Request retransmission of missing
6157 * SREJ'd frames.
6158 */
6159 skb_queue_tail(&chan->srej_q, skb);
6160 skb_in_use = true;
6161 BT_DBG("Queued %p (queue len %d)", skb,
6162 skb_queue_len(&chan->srej_q));
6163
6164 l2cap_pass_to_tx(chan, control);
6165 l2cap_send_srej_list(chan, control->txseq);
6166 break;
6167 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6168 /* We've already queued this frame. Drop this copy. */
6169 l2cap_pass_to_tx(chan, control);
6170 break;
6171 case L2CAP_TXSEQ_DUPLICATE:
6172 /* Expecting a later sequence number, so this frame
6173 * was already received. Ignore it completely.
6174 */
6175 break;
6176 case L2CAP_TXSEQ_INVALID_IGNORE:
6177 break;
6178 case L2CAP_TXSEQ_INVALID:
6179 default:
6180 l2cap_send_disconn_req(chan, ECONNRESET);
6181 break;
6182 }
6183 break;
6184 case L2CAP_EV_RECV_RR:
6185 l2cap_pass_to_tx(chan, control);
6186 if (control->final) {
6187 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6188
6189 if (!test_and_clear_bit(CONN_REJ_ACT,
6190 &chan->conn_state)) {
6191 control->final = 0;
6192 l2cap_retransmit_all(chan, control);
6193 }
6194
6195 l2cap_ertm_send(chan);
6196 } else if (control->poll) {
6197 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6198 &chan->conn_state) &&
6199 chan->unacked_frames) {
6200 __set_retrans_timer(chan);
6201 }
6202
6203 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6204 l2cap_send_srej_tail(chan);
6205 } else {
6206 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6207 &chan->conn_state) &&
6208 chan->unacked_frames)
6209 __set_retrans_timer(chan);
6210
6211 l2cap_send_ack(chan);
6212 }
6213 break;
6214 case L2CAP_EV_RECV_RNR:
6215 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6216 l2cap_pass_to_tx(chan, control);
6217 if (control->poll) {
6218 l2cap_send_srej_tail(chan);
6219 } else {
6220 struct l2cap_ctrl rr_control;
6221 memset(&rr_control, 0, sizeof(rr_control));
6222 rr_control.sframe = 1;
6223 rr_control.super = L2CAP_SUPER_RR;
6224 rr_control.reqseq = chan->buffer_seq;
6225 l2cap_send_sframe(chan, &rr_control);
6226 }
6227
6228 break;
6229 case L2CAP_EV_RECV_REJ:
6230 l2cap_handle_rej(chan, control);
6231 break;
6232 case L2CAP_EV_RECV_SREJ:
6233 l2cap_handle_srej(chan, control);
6234 break;
6235 }
6236
6237 if (skb && !skb_in_use) {
6238 BT_DBG("Freeing %p", skb);
6239 kfree_skb(skb);
6240 }
6241
6242 return err;
6243 }
6244
l2cap_finish_move(struct l2cap_chan * chan)6245 static int l2cap_finish_move(struct l2cap_chan *chan)
6246 {
6247 BT_DBG("chan %p", chan);
6248
6249 chan->rx_state = L2CAP_RX_STATE_RECV;
6250 chan->conn->mtu = chan->conn->hcon->mtu;
6251
6252 return l2cap_resegment(chan);
6253 }
6254
l2cap_rx_state_wait_p(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6255 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6256 struct l2cap_ctrl *control,
6257 struct sk_buff *skb, u8 event)
6258 {
6259 int err;
6260
6261 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6262 event);
6263
6264 if (!control->poll)
6265 return -EPROTO;
6266
6267 l2cap_process_reqseq(chan, control->reqseq);
6268
6269 if (!skb_queue_empty(&chan->tx_q))
6270 chan->tx_send_head = skb_peek(&chan->tx_q);
6271 else
6272 chan->tx_send_head = NULL;
6273
6274 /* Rewind next_tx_seq to the point expected
6275 * by the receiver.
6276 */
6277 chan->next_tx_seq = control->reqseq;
6278 chan->unacked_frames = 0;
6279
6280 err = l2cap_finish_move(chan);
6281 if (err)
6282 return err;
6283
6284 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6285 l2cap_send_i_or_rr_or_rnr(chan);
6286
6287 if (event == L2CAP_EV_RECV_IFRAME)
6288 return -EPROTO;
6289
6290 return l2cap_rx_state_recv(chan, control, NULL, event);
6291 }
6292
l2cap_rx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6293 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6294 struct l2cap_ctrl *control,
6295 struct sk_buff *skb, u8 event)
6296 {
6297 int err;
6298
6299 if (!control->final)
6300 return -EPROTO;
6301
6302 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6303
6304 chan->rx_state = L2CAP_RX_STATE_RECV;
6305 l2cap_process_reqseq(chan, control->reqseq);
6306
6307 if (!skb_queue_empty(&chan->tx_q))
6308 chan->tx_send_head = skb_peek(&chan->tx_q);
6309 else
6310 chan->tx_send_head = NULL;
6311
6312 /* Rewind next_tx_seq to the point expected
6313 * by the receiver.
6314 */
6315 chan->next_tx_seq = control->reqseq;
6316 chan->unacked_frames = 0;
6317 chan->conn->mtu = chan->conn->hcon->mtu;
6318
6319 err = l2cap_resegment(chan);
6320
6321 if (!err)
6322 err = l2cap_rx_state_recv(chan, control, skb, event);
6323
6324 return err;
6325 }
6326
__valid_reqseq(struct l2cap_chan * chan,u16 reqseq)6327 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6328 {
6329 /* Make sure reqseq is for a packet that has been sent but not acked */
6330 u16 unacked;
6331
6332 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6333 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6334 }
6335
l2cap_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6336 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6337 struct sk_buff *skb, u8 event)
6338 {
6339 int err = 0;
6340
6341 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6342 control, skb, event, chan->rx_state);
6343
6344 if (__valid_reqseq(chan, control->reqseq)) {
6345 switch (chan->rx_state) {
6346 case L2CAP_RX_STATE_RECV:
6347 err = l2cap_rx_state_recv(chan, control, skb, event);
6348 break;
6349 case L2CAP_RX_STATE_SREJ_SENT:
6350 err = l2cap_rx_state_srej_sent(chan, control, skb,
6351 event);
6352 break;
6353 case L2CAP_RX_STATE_WAIT_P:
6354 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6355 break;
6356 case L2CAP_RX_STATE_WAIT_F:
6357 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6358 break;
6359 default:
6360 /* shut it down */
6361 break;
6362 }
6363 } else {
6364 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6365 control->reqseq, chan->next_tx_seq,
6366 chan->expected_ack_seq);
6367 l2cap_send_disconn_req(chan, ECONNRESET);
6368 }
6369
6370 return err;
6371 }
6372
l2cap_stream_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)6373 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6374 struct sk_buff *skb)
6375 {
6376 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6377 * the txseq field in advance to use it after l2cap_reassemble_sdu
6378 * returns and to avoid the race condition, for example:
6379 *
6380 * The current thread calls:
6381 * l2cap_reassemble_sdu
6382 * chan->ops->recv == l2cap_sock_recv_cb
6383 * __sock_queue_rcv_skb
6384 * Another thread calls:
6385 * bt_sock_recvmsg
6386 * skb_recv_datagram
6387 * skb_free_datagram
6388 * Then the current thread tries to access control, but it was freed by
6389 * skb_free_datagram.
6390 */
6391 u16 txseq = control->txseq;
6392
6393 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6394 chan->rx_state);
6395
6396 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
6397 l2cap_pass_to_tx(chan, control);
6398
6399 BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
6400 __next_seq(chan, chan->buffer_seq));
6401
6402 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6403
6404 l2cap_reassemble_sdu(chan, skb, control);
6405 } else {
6406 if (chan->sdu) {
6407 kfree_skb(chan->sdu);
6408 chan->sdu = NULL;
6409 }
6410 chan->sdu_last_frag = NULL;
6411 chan->sdu_len = 0;
6412
6413 if (skb) {
6414 BT_DBG("Freeing %p", skb);
6415 kfree_skb(skb);
6416 }
6417 }
6418
6419 chan->last_acked_seq = txseq;
6420 chan->expected_tx_seq = __next_seq(chan, txseq);
6421
6422 return 0;
6423 }
6424
l2cap_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6425 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6426 {
6427 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6428 u16 len;
6429 u8 event;
6430
6431 __unpack_control(chan, skb);
6432
6433 len = skb->len;
6434
6435 /*
6436 * We can just drop the corrupted I-frame here.
6437 * Receiver will miss it and start proper recovery
6438 * procedures and ask for retransmission.
6439 */
6440 if (l2cap_check_fcs(chan, skb))
6441 goto drop;
6442
6443 if (!control->sframe && control->sar == L2CAP_SAR_START)
6444 len -= L2CAP_SDULEN_SIZE;
6445
6446 if (chan->fcs == L2CAP_FCS_CRC16)
6447 len -= L2CAP_FCS_SIZE;
6448
6449 if (len > chan->mps) {
6450 l2cap_send_disconn_req(chan, ECONNRESET);
6451 goto drop;
6452 }
6453
6454 if (chan->ops->filter) {
6455 if (chan->ops->filter(chan, skb))
6456 goto drop;
6457 }
6458
6459 if (!control->sframe) {
6460 int err;
6461
6462 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6463 control->sar, control->reqseq, control->final,
6464 control->txseq);
6465
6466 /* Validate F-bit - F=0 always valid, F=1 only
6467 * valid in TX WAIT_F
6468 */
6469 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6470 goto drop;
6471
6472 if (chan->mode != L2CAP_MODE_STREAMING) {
6473 event = L2CAP_EV_RECV_IFRAME;
6474 err = l2cap_rx(chan, control, skb, event);
6475 } else {
6476 err = l2cap_stream_rx(chan, control, skb);
6477 }
6478
6479 if (err)
6480 l2cap_send_disconn_req(chan, ECONNRESET);
6481 } else {
6482 const u8 rx_func_to_event[4] = {
6483 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6484 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6485 };
6486
6487 /* Only I-frames are expected in streaming mode */
6488 if (chan->mode == L2CAP_MODE_STREAMING)
6489 goto drop;
6490
6491 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6492 control->reqseq, control->final, control->poll,
6493 control->super);
6494
6495 if (len != 0) {
6496 BT_ERR("Trailing bytes: %d in sframe", len);
6497 l2cap_send_disconn_req(chan, ECONNRESET);
6498 goto drop;
6499 }
6500
6501 /* Validate F and P bits */
6502 if (control->final && (control->poll ||
6503 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6504 goto drop;
6505
6506 event = rx_func_to_event[control->super];
6507 if (l2cap_rx(chan, control, skb, event))
6508 l2cap_send_disconn_req(chan, ECONNRESET);
6509 }
6510
6511 return 0;
6512
6513 drop:
6514 kfree_skb(skb);
6515 return 0;
6516 }
6517
l2cap_chan_le_send_credits(struct l2cap_chan * chan)6518 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6519 {
6520 struct l2cap_conn *conn = chan->conn;
6521 struct l2cap_le_credits pkt;
6522 u16 return_credits = l2cap_le_rx_credits(chan);
6523
6524 if (chan->rx_credits >= return_credits)
6525 return;
6526
6527 return_credits -= chan->rx_credits;
6528
6529 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6530
6531 chan->rx_credits += return_credits;
6532
6533 pkt.cid = cpu_to_le16(chan->scid);
6534 pkt.credits = cpu_to_le16(return_credits);
6535
6536 chan->ident = l2cap_get_ident(conn);
6537
6538 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6539 }
6540
l2cap_chan_rx_avail(struct l2cap_chan * chan,ssize_t rx_avail)6541 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
6542 {
6543 if (chan->rx_avail == rx_avail)
6544 return;
6545
6546 BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail);
6547
6548 chan->rx_avail = rx_avail;
6549
6550 if (chan->state == BT_CONNECTED)
6551 l2cap_chan_le_send_credits(chan);
6552 }
6553
l2cap_ecred_recv(struct l2cap_chan * chan,struct sk_buff * skb)6554 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
6555 {
6556 int err;
6557
6558 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
6559
6560 /* Wait recv to confirm reception before updating the credits */
6561 err = chan->ops->recv(chan, skb);
6562
6563 if (err < 0 && chan->rx_avail != -1) {
6564 BT_ERR("Queueing received LE L2CAP data failed");
6565 l2cap_send_disconn_req(chan, ECONNRESET);
6566 return err;
6567 }
6568
6569 /* Update credits whenever an SDU is received */
6570 l2cap_chan_le_send_credits(chan);
6571
6572 return err;
6573 }
6574
l2cap_ecred_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6575 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6576 {
6577 int err;
6578
6579 if (!chan->rx_credits) {
6580 BT_ERR("No credits to receive LE L2CAP data");
6581 l2cap_send_disconn_req(chan, ECONNRESET);
6582 return -ENOBUFS;
6583 }
6584
6585 if (chan->imtu < skb->len) {
6586 BT_ERR("Too big LE L2CAP PDU");
6587 return -ENOBUFS;
6588 }
6589
6590 chan->rx_credits--;
6591 BT_DBG("chan %p: rx_credits %u -> %u",
6592 chan, chan->rx_credits + 1, chan->rx_credits);
6593
6594 /* Update if remote had run out of credits, this should only happens
6595 * if the remote is not using the entire MPS.
6596 */
6597 if (!chan->rx_credits)
6598 l2cap_chan_le_send_credits(chan);
6599
6600 err = 0;
6601
6602 if (!chan->sdu) {
6603 u16 sdu_len;
6604
6605 sdu_len = get_unaligned_le16(skb->data);
6606 skb_pull(skb, L2CAP_SDULEN_SIZE);
6607
6608 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6609 sdu_len, skb->len, chan->imtu);
6610
6611 if (sdu_len > chan->imtu) {
6612 BT_ERR("Too big LE L2CAP SDU length received");
6613 err = -EMSGSIZE;
6614 goto failed;
6615 }
6616
6617 if (skb->len > sdu_len) {
6618 BT_ERR("Too much LE L2CAP data received");
6619 err = -EINVAL;
6620 goto failed;
6621 }
6622
6623 if (skb->len == sdu_len)
6624 return l2cap_ecred_recv(chan, skb);
6625
6626 chan->sdu = skb;
6627 chan->sdu_len = sdu_len;
6628 chan->sdu_last_frag = skb;
6629
6630 /* Detect if remote is not able to use the selected MPS */
6631 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
6632 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
6633
6634 /* Adjust the number of credits */
6635 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
6636 chan->mps = mps_len;
6637 l2cap_chan_le_send_credits(chan);
6638 }
6639
6640 return 0;
6641 }
6642
6643 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6644 chan->sdu->len, skb->len, chan->sdu_len);
6645
6646 if (chan->sdu->len + skb->len > chan->sdu_len) {
6647 BT_ERR("Too much LE L2CAP data received");
6648 err = -EINVAL;
6649 goto failed;
6650 }
6651
6652 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6653 skb = NULL;
6654
6655 if (chan->sdu->len == chan->sdu_len) {
6656 err = l2cap_ecred_recv(chan, chan->sdu);
6657 if (!err) {
6658 chan->sdu = NULL;
6659 chan->sdu_last_frag = NULL;
6660 chan->sdu_len = 0;
6661 }
6662 }
6663
6664 failed:
6665 if (err) {
6666 kfree_skb(skb);
6667 kfree_skb(chan->sdu);
6668 chan->sdu = NULL;
6669 chan->sdu_last_frag = NULL;
6670 chan->sdu_len = 0;
6671 }
6672
6673 /* We can't return an error here since we took care of the skb
6674 * freeing internally. An error return would cause the caller to
6675 * do a double-free of the skb.
6676 */
6677 return 0;
6678 }
6679
l2cap_data_channel(struct l2cap_conn * conn,u16 cid,struct sk_buff * skb)6680 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6681 struct sk_buff *skb)
6682 {
6683 struct l2cap_chan *chan;
6684
6685 chan = l2cap_get_chan_by_scid(conn, cid);
6686 if (!chan) {
6687 BT_DBG("unknown cid 0x%4.4x", cid);
6688 /* Drop packet and return */
6689 kfree_skb(skb);
6690 return;
6691 }
6692
6693 BT_DBG("chan %p, len %d", chan, skb->len);
6694
6695 /* If we receive data on a fixed channel before the info req/rsp
6696 * procedure is done simply assume that the channel is supported
6697 * and mark it as ready.
6698 */
6699 if (chan->chan_type == L2CAP_CHAN_FIXED)
6700 l2cap_chan_ready(chan);
6701
6702 if (chan->state != BT_CONNECTED)
6703 goto drop;
6704
6705 switch (chan->mode) {
6706 case L2CAP_MODE_LE_FLOWCTL:
6707 case L2CAP_MODE_EXT_FLOWCTL:
6708 if (l2cap_ecred_data_rcv(chan, skb) < 0)
6709 goto drop;
6710
6711 goto done;
6712
6713 case L2CAP_MODE_BASIC:
6714 /* If socket recv buffers overflows we drop data here
6715 * which is *bad* because L2CAP has to be reliable.
6716 * But we don't have any other choice. L2CAP doesn't
6717 * provide flow control mechanism. */
6718
6719 if (chan->imtu < skb->len) {
6720 BT_ERR("Dropping L2CAP data: receive buffer overflow");
6721 goto drop;
6722 }
6723
6724 if (!chan->ops->recv(chan, skb))
6725 goto done;
6726 break;
6727
6728 case L2CAP_MODE_ERTM:
6729 case L2CAP_MODE_STREAMING:
6730 l2cap_data_rcv(chan, skb);
6731 goto done;
6732
6733 default:
6734 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6735 break;
6736 }
6737
6738 drop:
6739 kfree_skb(skb);
6740
6741 done:
6742 l2cap_chan_unlock(chan);
6743 l2cap_chan_put(chan);
6744 }
6745
l2cap_conless_channel(struct l2cap_conn * conn,__le16 psm,struct sk_buff * skb)6746 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6747 struct sk_buff *skb)
6748 {
6749 struct hci_conn *hcon = conn->hcon;
6750 struct l2cap_chan *chan;
6751
6752 if (hcon->type != ACL_LINK)
6753 goto free_skb;
6754
6755 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6756 ACL_LINK);
6757 if (!chan)
6758 goto free_skb;
6759
6760 BT_DBG("chan %p, len %d", chan, skb->len);
6761
6762 l2cap_chan_lock(chan);
6763
6764 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6765 goto drop;
6766
6767 if (chan->imtu < skb->len)
6768 goto drop;
6769
6770 /* Store remote BD_ADDR and PSM for msg_name */
6771 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6772 bt_cb(skb)->l2cap.psm = psm;
6773
6774 if (!chan->ops->recv(chan, skb)) {
6775 l2cap_chan_unlock(chan);
6776 l2cap_chan_put(chan);
6777 return;
6778 }
6779
6780 drop:
6781 l2cap_chan_unlock(chan);
6782 l2cap_chan_put(chan);
6783 free_skb:
6784 kfree_skb(skb);
6785 }
6786
l2cap_recv_frame(struct l2cap_conn * conn,struct sk_buff * skb)6787 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6788 {
6789 struct l2cap_hdr *lh = (void *) skb->data;
6790 struct hci_conn *hcon = conn->hcon;
6791 u16 cid, len;
6792 __le16 psm;
6793
6794 if (hcon->state != BT_CONNECTED) {
6795 BT_DBG("queueing pending rx skb");
6796 skb_queue_tail(&conn->pending_rx, skb);
6797 return;
6798 }
6799
6800 skb_pull(skb, L2CAP_HDR_SIZE);
6801 cid = __le16_to_cpu(lh->cid);
6802 len = __le16_to_cpu(lh->len);
6803
6804 if (len != skb->len) {
6805 kfree_skb(skb);
6806 return;
6807 }
6808
6809 /* Since we can't actively block incoming LE connections we must
6810 * at least ensure that we ignore incoming data from them.
6811 */
6812 if (hcon->type == LE_LINK &&
6813 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
6814 bdaddr_dst_type(hcon))) {
6815 kfree_skb(skb);
6816 return;
6817 }
6818
6819 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6820
6821 switch (cid) {
6822 case L2CAP_CID_SIGNALING:
6823 l2cap_sig_channel(conn, skb);
6824 break;
6825
6826 case L2CAP_CID_CONN_LESS:
6827 psm = get_unaligned((__le16 *) skb->data);
6828 skb_pull(skb, L2CAP_PSMLEN_SIZE);
6829 l2cap_conless_channel(conn, psm, skb);
6830 break;
6831
6832 case L2CAP_CID_LE_SIGNALING:
6833 l2cap_le_sig_channel(conn, skb);
6834 break;
6835
6836 default:
6837 l2cap_data_channel(conn, cid, skb);
6838 break;
6839 }
6840 }
6841
process_pending_rx(struct work_struct * work)6842 static void process_pending_rx(struct work_struct *work)
6843 {
6844 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6845 pending_rx_work);
6846 struct sk_buff *skb;
6847
6848 BT_DBG("");
6849
6850 while ((skb = skb_dequeue(&conn->pending_rx)))
6851 l2cap_recv_frame(conn, skb);
6852 }
6853
l2cap_conn_add(struct hci_conn * hcon)6854 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6855 {
6856 struct l2cap_conn *conn = hcon->l2cap_data;
6857 struct hci_chan *hchan;
6858
6859 if (conn)
6860 return conn;
6861
6862 hchan = hci_chan_create(hcon);
6863 if (!hchan)
6864 return NULL;
6865
6866 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
6867 if (!conn) {
6868 hci_chan_del(hchan);
6869 return NULL;
6870 }
6871
6872 kref_init(&conn->ref);
6873 hcon->l2cap_data = conn;
6874 conn->hcon = hci_conn_get(hcon);
6875 conn->hchan = hchan;
6876
6877 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6878
6879 conn->mtu = hcon->mtu;
6880 conn->feat_mask = 0;
6881
6882 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
6883
6884 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
6885 (bredr_sc_enabled(hcon->hdev) ||
6886 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
6887 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
6888
6889 mutex_init(&conn->ident_lock);
6890 mutex_init(&conn->chan_lock);
6891
6892 INIT_LIST_HEAD(&conn->chan_l);
6893 INIT_LIST_HEAD(&conn->users);
6894
6895 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
6896
6897 skb_queue_head_init(&conn->pending_rx);
6898 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
6899 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
6900
6901 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
6902
6903 return conn;
6904 }
6905
is_valid_psm(u16 psm,u8 dst_type)6906 static bool is_valid_psm(u16 psm, u8 dst_type)
6907 {
6908 if (!psm)
6909 return false;
6910
6911 if (bdaddr_type_is_le(dst_type))
6912 return (psm <= 0x00ff);
6913
6914 /* PSM must be odd and lsb of upper byte must be 0 */
6915 return ((psm & 0x0101) == 0x0001);
6916 }
6917
6918 struct l2cap_chan_data {
6919 struct l2cap_chan *chan;
6920 struct pid *pid;
6921 int count;
6922 };
6923
l2cap_chan_by_pid(struct l2cap_chan * chan,void * data)6924 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
6925 {
6926 struct l2cap_chan_data *d = data;
6927 struct pid *pid;
6928
6929 if (chan == d->chan)
6930 return;
6931
6932 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
6933 return;
6934
6935 pid = chan->ops->get_peer_pid(chan);
6936
6937 /* Only count deferred channels with the same PID/PSM */
6938 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
6939 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
6940 return;
6941
6942 d->count++;
6943 }
6944
l2cap_chan_connect(struct l2cap_chan * chan,__le16 psm,u16 cid,bdaddr_t * dst,u8 dst_type)6945 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
6946 bdaddr_t *dst, u8 dst_type)
6947 {
6948 struct l2cap_conn *conn;
6949 struct hci_conn *hcon;
6950 struct hci_dev *hdev;
6951 int err;
6952
6953 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
6954 dst, dst_type, __le16_to_cpu(psm), chan->mode);
6955
6956 hdev = hci_get_route(dst, &chan->src, chan->src_type);
6957 if (!hdev)
6958 return -EHOSTUNREACH;
6959
6960 hci_dev_lock(hdev);
6961
6962 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
6963 chan->chan_type != L2CAP_CHAN_RAW) {
6964 err = -EINVAL;
6965 goto done;
6966 }
6967
6968 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
6969 err = -EINVAL;
6970 goto done;
6971 }
6972
6973 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
6974 err = -EINVAL;
6975 goto done;
6976 }
6977
6978 switch (chan->mode) {
6979 case L2CAP_MODE_BASIC:
6980 break;
6981 case L2CAP_MODE_LE_FLOWCTL:
6982 break;
6983 case L2CAP_MODE_EXT_FLOWCTL:
6984 if (!enable_ecred) {
6985 err = -EOPNOTSUPP;
6986 goto done;
6987 }
6988 break;
6989 case L2CAP_MODE_ERTM:
6990 case L2CAP_MODE_STREAMING:
6991 if (!disable_ertm)
6992 break;
6993 fallthrough;
6994 default:
6995 err = -EOPNOTSUPP;
6996 goto done;
6997 }
6998
6999 switch (chan->state) {
7000 case BT_CONNECT:
7001 case BT_CONNECT2:
7002 case BT_CONFIG:
7003 /* Already connecting */
7004 err = 0;
7005 goto done;
7006
7007 case BT_CONNECTED:
7008 /* Already connected */
7009 err = -EISCONN;
7010 goto done;
7011
7012 case BT_OPEN:
7013 case BT_BOUND:
7014 /* Can connect */
7015 break;
7016
7017 default:
7018 err = -EBADFD;
7019 goto done;
7020 }
7021
7022 /* Set destination address and psm */
7023 bacpy(&chan->dst, dst);
7024 chan->dst_type = dst_type;
7025
7026 chan->psm = psm;
7027 chan->dcid = cid;
7028
7029 if (bdaddr_type_is_le(dst_type)) {
7030 /* Convert from L2CAP channel address type to HCI address type
7031 */
7032 if (dst_type == BDADDR_LE_PUBLIC)
7033 dst_type = ADDR_LE_DEV_PUBLIC;
7034 else
7035 dst_type = ADDR_LE_DEV_RANDOM;
7036
7037 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7038 hcon = hci_connect_le(hdev, dst, dst_type, false,
7039 chan->sec_level,
7040 HCI_LE_CONN_TIMEOUT,
7041 HCI_ROLE_SLAVE);
7042 else
7043 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7044 chan->sec_level,
7045 HCI_LE_CONN_TIMEOUT,
7046 CONN_REASON_L2CAP_CHAN);
7047
7048 } else {
7049 u8 auth_type = l2cap_get_auth_type(chan);
7050 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7051 CONN_REASON_L2CAP_CHAN);
7052 }
7053
7054 if (IS_ERR(hcon)) {
7055 err = PTR_ERR(hcon);
7056 goto done;
7057 }
7058
7059 conn = l2cap_conn_add(hcon);
7060 if (!conn) {
7061 hci_conn_drop(hcon);
7062 err = -ENOMEM;
7063 goto done;
7064 }
7065
7066 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7067 struct l2cap_chan_data data;
7068
7069 data.chan = chan;
7070 data.pid = chan->ops->get_peer_pid(chan);
7071 data.count = 1;
7072
7073 l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7074
7075 /* Check if there isn't too many channels being connected */
7076 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7077 hci_conn_drop(hcon);
7078 err = -EPROTO;
7079 goto done;
7080 }
7081 }
7082
7083 mutex_lock(&conn->chan_lock);
7084 l2cap_chan_lock(chan);
7085
7086 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7087 hci_conn_drop(hcon);
7088 err = -EBUSY;
7089 goto chan_unlock;
7090 }
7091
7092 /* Update source addr of the socket */
7093 bacpy(&chan->src, &hcon->src);
7094 chan->src_type = bdaddr_src_type(hcon);
7095
7096 __l2cap_chan_add(conn, chan);
7097
7098 /* l2cap_chan_add takes its own ref so we can drop this one */
7099 hci_conn_drop(hcon);
7100
7101 l2cap_state_change(chan, BT_CONNECT);
7102 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7103
7104 /* Release chan->sport so that it can be reused by other
7105 * sockets (as it's only used for listening sockets).
7106 */
7107 write_lock(&chan_list_lock);
7108 chan->sport = 0;
7109 write_unlock(&chan_list_lock);
7110
7111 if (hcon->state == BT_CONNECTED) {
7112 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7113 __clear_chan_timer(chan);
7114 if (l2cap_chan_check_security(chan, true))
7115 l2cap_state_change(chan, BT_CONNECTED);
7116 } else
7117 l2cap_do_start(chan);
7118 }
7119
7120 err = 0;
7121
7122 chan_unlock:
7123 l2cap_chan_unlock(chan);
7124 mutex_unlock(&conn->chan_lock);
7125 done:
7126 hci_dev_unlock(hdev);
7127 hci_dev_put(hdev);
7128 return err;
7129 }
7130 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7131
l2cap_ecred_reconfigure(struct l2cap_chan * chan)7132 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
7133 {
7134 struct l2cap_conn *conn = chan->conn;
7135 struct {
7136 struct l2cap_ecred_reconf_req req;
7137 __le16 scid;
7138 } pdu;
7139
7140 pdu.req.mtu = cpu_to_le16(chan->imtu);
7141 pdu.req.mps = cpu_to_le16(chan->mps);
7142 pdu.scid = cpu_to_le16(chan->scid);
7143
7144 chan->ident = l2cap_get_ident(conn);
7145
7146 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
7147 sizeof(pdu), &pdu);
7148 }
7149
l2cap_chan_reconfigure(struct l2cap_chan * chan,__u16 mtu)7150 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
7151 {
7152 if (chan->imtu > mtu)
7153 return -EINVAL;
7154
7155 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
7156
7157 chan->imtu = mtu;
7158
7159 l2cap_ecred_reconfigure(chan);
7160
7161 return 0;
7162 }
7163
7164 /* ---- L2CAP interface with lower layer (HCI) ---- */
7165
l2cap_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr)7166 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7167 {
7168 int exact = 0, lm1 = 0, lm2 = 0;
7169 struct l2cap_chan *c;
7170
7171 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7172
7173 /* Find listening sockets and check their link_mode */
7174 read_lock(&chan_list_lock);
7175 list_for_each_entry(c, &chan_list, global_l) {
7176 if (c->state != BT_LISTEN)
7177 continue;
7178
7179 if (!bacmp(&c->src, &hdev->bdaddr)) {
7180 lm1 |= HCI_LM_ACCEPT;
7181 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7182 lm1 |= HCI_LM_MASTER;
7183 exact++;
7184 } else if (!bacmp(&c->src, BDADDR_ANY)) {
7185 lm2 |= HCI_LM_ACCEPT;
7186 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7187 lm2 |= HCI_LM_MASTER;
7188 }
7189 }
7190 read_unlock(&chan_list_lock);
7191
7192 return exact ? lm1 : lm2;
7193 }
7194
7195 /* Find the next fixed channel in BT_LISTEN state, continue iteration
7196 * from an existing channel in the list or from the beginning of the
7197 * global list (by passing NULL as first parameter).
7198 */
l2cap_global_fixed_chan(struct l2cap_chan * c,struct hci_conn * hcon)7199 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7200 struct hci_conn *hcon)
7201 {
7202 u8 src_type = bdaddr_src_type(hcon);
7203
7204 read_lock(&chan_list_lock);
7205
7206 if (c)
7207 c = list_next_entry(c, global_l);
7208 else
7209 c = list_entry(chan_list.next, typeof(*c), global_l);
7210
7211 list_for_each_entry_from(c, &chan_list, global_l) {
7212 if (c->chan_type != L2CAP_CHAN_FIXED)
7213 continue;
7214 if (c->state != BT_LISTEN)
7215 continue;
7216 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7217 continue;
7218 if (src_type != c->src_type)
7219 continue;
7220
7221 c = l2cap_chan_hold_unless_zero(c);
7222 read_unlock(&chan_list_lock);
7223 return c;
7224 }
7225
7226 read_unlock(&chan_list_lock);
7227
7228 return NULL;
7229 }
7230
l2cap_match(struct hci_conn * hcon)7231 static bool l2cap_match(struct hci_conn *hcon)
7232 {
7233 return hcon->type == ACL_LINK || hcon->type == LE_LINK;
7234 }
7235
l2cap_connect_cfm(struct hci_conn * hcon,u8 status)7236 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7237 {
7238 struct hci_dev *hdev = hcon->hdev;
7239 struct l2cap_conn *conn;
7240 struct l2cap_chan *pchan;
7241 u8 dst_type;
7242
7243 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7244
7245 if (status) {
7246 l2cap_conn_del(hcon, bt_to_errno(status));
7247 return;
7248 }
7249
7250 conn = l2cap_conn_add(hcon);
7251 if (!conn)
7252 return;
7253
7254 dst_type = bdaddr_dst_type(hcon);
7255
7256 /* If device is blocked, do not create channels for it */
7257 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
7258 return;
7259
7260 /* Find fixed channels and notify them of the new connection. We
7261 * use multiple individual lookups, continuing each time where
7262 * we left off, because the list lock would prevent calling the
7263 * potentially sleeping l2cap_chan_lock() function.
7264 */
7265 pchan = l2cap_global_fixed_chan(NULL, hcon);
7266 while (pchan) {
7267 struct l2cap_chan *chan, *next;
7268
7269 /* Client fixed channels should override server ones */
7270 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7271 goto next;
7272
7273 l2cap_chan_lock(pchan);
7274 chan = pchan->ops->new_connection(pchan);
7275 if (chan) {
7276 bacpy(&chan->src, &hcon->src);
7277 bacpy(&chan->dst, &hcon->dst);
7278 chan->src_type = bdaddr_src_type(hcon);
7279 chan->dst_type = dst_type;
7280
7281 __l2cap_chan_add(conn, chan);
7282 }
7283
7284 l2cap_chan_unlock(pchan);
7285 next:
7286 next = l2cap_global_fixed_chan(pchan, hcon);
7287 l2cap_chan_put(pchan);
7288 pchan = next;
7289 }
7290
7291 l2cap_conn_ready(conn);
7292 }
7293
l2cap_disconn_ind(struct hci_conn * hcon)7294 int l2cap_disconn_ind(struct hci_conn *hcon)
7295 {
7296 struct l2cap_conn *conn = hcon->l2cap_data;
7297
7298 BT_DBG("hcon %p", hcon);
7299
7300 if (!conn)
7301 return HCI_ERROR_REMOTE_USER_TERM;
7302 return conn->disc_reason;
7303 }
7304
l2cap_disconn_cfm(struct hci_conn * hcon,u8 reason)7305 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7306 {
7307 BT_DBG("hcon %p reason %d", hcon, reason);
7308
7309 l2cap_conn_del(hcon, bt_to_errno(reason));
7310 }
7311
l2cap_check_encryption(struct l2cap_chan * chan,u8 encrypt)7312 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7313 {
7314 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7315 return;
7316
7317 if (encrypt == 0x00) {
7318 if (chan->sec_level == BT_SECURITY_MEDIUM) {
7319 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7320 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7321 chan->sec_level == BT_SECURITY_FIPS)
7322 l2cap_chan_close(chan, ECONNREFUSED);
7323 } else {
7324 if (chan->sec_level == BT_SECURITY_MEDIUM)
7325 __clear_chan_timer(chan);
7326 }
7327 }
7328
l2cap_security_cfm(struct hci_conn * hcon,u8 status,u8 encrypt)7329 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7330 {
7331 struct l2cap_conn *conn = hcon->l2cap_data;
7332 struct l2cap_chan *chan;
7333
7334 if (!conn)
7335 return;
7336
7337 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7338
7339 mutex_lock(&conn->chan_lock);
7340
7341 list_for_each_entry(chan, &conn->chan_l, list) {
7342 l2cap_chan_lock(chan);
7343
7344 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7345 state_to_string(chan->state));
7346
7347 if (!status && encrypt)
7348 chan->sec_level = hcon->sec_level;
7349
7350 if (!__l2cap_no_conn_pending(chan)) {
7351 l2cap_chan_unlock(chan);
7352 continue;
7353 }
7354
7355 if (!status && (chan->state == BT_CONNECTED ||
7356 chan->state == BT_CONFIG)) {
7357 chan->ops->resume(chan);
7358 l2cap_check_encryption(chan, encrypt);
7359 l2cap_chan_unlock(chan);
7360 continue;
7361 }
7362
7363 if (chan->state == BT_CONNECT) {
7364 if (!status && l2cap_check_enc_key_size(hcon))
7365 l2cap_start_connection(chan);
7366 else
7367 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7368 } else if (chan->state == BT_CONNECT2 &&
7369 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
7370 chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
7371 struct l2cap_conn_rsp rsp;
7372 __u16 res, stat;
7373
7374 if (!status && l2cap_check_enc_key_size(hcon)) {
7375 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
7376 res = L2CAP_CR_PEND;
7377 stat = L2CAP_CS_AUTHOR_PEND;
7378 chan->ops->defer(chan);
7379 } else {
7380 l2cap_state_change(chan, BT_CONFIG);
7381 res = L2CAP_CR_SUCCESS;
7382 stat = L2CAP_CS_NO_INFO;
7383 }
7384 } else {
7385 l2cap_state_change(chan, BT_DISCONN);
7386 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7387 res = L2CAP_CR_SEC_BLOCK;
7388 stat = L2CAP_CS_NO_INFO;
7389 }
7390
7391 rsp.scid = cpu_to_le16(chan->dcid);
7392 rsp.dcid = cpu_to_le16(chan->scid);
7393 rsp.result = cpu_to_le16(res);
7394 rsp.status = cpu_to_le16(stat);
7395 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7396 sizeof(rsp), &rsp);
7397
7398 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7399 res == L2CAP_CR_SUCCESS) {
7400 char buf[128];
7401 set_bit(CONF_REQ_SENT, &chan->conf_state);
7402 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7403 L2CAP_CONF_REQ,
7404 l2cap_build_conf_req(chan, buf, sizeof(buf)),
7405 buf);
7406 chan->num_conf_req++;
7407 }
7408 }
7409
7410 l2cap_chan_unlock(chan);
7411 }
7412
7413 mutex_unlock(&conn->chan_lock);
7414 }
7415
7416 /* Append fragment into frame respecting the maximum len of rx_skb */
l2cap_recv_frag(struct l2cap_conn * conn,struct sk_buff * skb,u16 len)7417 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
7418 u16 len)
7419 {
7420 if (!conn->rx_skb) {
7421 /* Allocate skb for the complete frame (with header) */
7422 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7423 if (!conn->rx_skb)
7424 return -ENOMEM;
7425 /* Init rx_len */
7426 conn->rx_len = len;
7427 }
7428
7429 /* Copy as much as the rx_skb can hold */
7430 len = min_t(u16, len, skb->len);
7431 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
7432 skb_pull(skb, len);
7433 conn->rx_len -= len;
7434
7435 return len;
7436 }
7437
l2cap_recv_len(struct l2cap_conn * conn,struct sk_buff * skb)7438 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
7439 {
7440 struct sk_buff *rx_skb;
7441 int len;
7442
7443 /* Append just enough to complete the header */
7444 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
7445
7446 /* If header could not be read just continue */
7447 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
7448 return len;
7449
7450 rx_skb = conn->rx_skb;
7451 len = get_unaligned_le16(rx_skb->data);
7452
7453 /* Check if rx_skb has enough space to received all fragments */
7454 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
7455 /* Update expected len */
7456 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
7457 return L2CAP_LEN_SIZE;
7458 }
7459
7460 /* Reset conn->rx_skb since it will need to be reallocated in order to
7461 * fit all fragments.
7462 */
7463 conn->rx_skb = NULL;
7464
7465 /* Reallocates rx_skb using the exact expected length */
7466 len = l2cap_recv_frag(conn, rx_skb,
7467 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
7468 kfree_skb(rx_skb);
7469
7470 return len;
7471 }
7472
l2cap_recv_reset(struct l2cap_conn * conn)7473 static void l2cap_recv_reset(struct l2cap_conn *conn)
7474 {
7475 kfree_skb(conn->rx_skb);
7476 conn->rx_skb = NULL;
7477 conn->rx_len = 0;
7478 }
7479
l2cap_recv_acldata(struct hci_conn * hcon,struct sk_buff * skb,u16 flags)7480 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
7481 {
7482 struct l2cap_conn *conn = hcon->l2cap_data;
7483 int len;
7484
7485 if (!conn)
7486 conn = l2cap_conn_add(hcon);
7487
7488 if (!conn)
7489 goto drop;
7490
7491 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
7492
7493 switch (flags) {
7494 case ACL_START:
7495 case ACL_START_NO_FLUSH:
7496 case ACL_COMPLETE:
7497 if (conn->rx_skb) {
7498 BT_ERR("Unexpected start frame (len %d)", skb->len);
7499 l2cap_recv_reset(conn);
7500 l2cap_conn_unreliable(conn, ECOMM);
7501 }
7502
7503 /* Start fragment may not contain the L2CAP length so just
7504 * copy the initial byte when that happens and use conn->mtu as
7505 * expected length.
7506 */
7507 if (skb->len < L2CAP_LEN_SIZE) {
7508 l2cap_recv_frag(conn, skb, conn->mtu);
7509 break;
7510 }
7511
7512 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
7513
7514 if (len == skb->len) {
7515 /* Complete frame received */
7516 l2cap_recv_frame(conn, skb);
7517 return;
7518 }
7519
7520 BT_DBG("Start: total len %d, frag len %u", len, skb->len);
7521
7522 if (skb->len > len) {
7523 BT_ERR("Frame is too long (len %u, expected len %d)",
7524 skb->len, len);
7525 l2cap_conn_unreliable(conn, ECOMM);
7526 goto drop;
7527 }
7528
7529 /* Append fragment into frame (with header) */
7530 if (l2cap_recv_frag(conn, skb, len) < 0)
7531 goto drop;
7532
7533 break;
7534
7535 case ACL_CONT:
7536 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
7537
7538 if (!conn->rx_skb) {
7539 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7540 l2cap_conn_unreliable(conn, ECOMM);
7541 goto drop;
7542 }
7543
7544 /* Complete the L2CAP length if it has not been read */
7545 if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
7546 if (l2cap_recv_len(conn, skb) < 0) {
7547 l2cap_conn_unreliable(conn, ECOMM);
7548 goto drop;
7549 }
7550
7551 /* Header still could not be read just continue */
7552 if (conn->rx_skb->len < L2CAP_LEN_SIZE)
7553 break;
7554 }
7555
7556 if (skb->len > conn->rx_len) {
7557 BT_ERR("Fragment is too long (len %u, expected %u)",
7558 skb->len, conn->rx_len);
7559 l2cap_recv_reset(conn);
7560 l2cap_conn_unreliable(conn, ECOMM);
7561 goto drop;
7562 }
7563
7564 /* Append fragment into frame (with header) */
7565 l2cap_recv_frag(conn, skb, skb->len);
7566
7567 if (!conn->rx_len) {
7568 /* Complete frame received. l2cap_recv_frame
7569 * takes ownership of the skb so set the global
7570 * rx_skb pointer to NULL first.
7571 */
7572 struct sk_buff *rx_skb = conn->rx_skb;
7573 conn->rx_skb = NULL;
7574 l2cap_recv_frame(conn, rx_skb);
7575 }
7576 break;
7577 }
7578
7579 drop:
7580 kfree_skb(skb);
7581 }
7582
7583 static struct hci_cb l2cap_cb = {
7584 .name = "L2CAP",
7585 .match = l2cap_match,
7586 .connect_cfm = l2cap_connect_cfm,
7587 .disconn_cfm = l2cap_disconn_cfm,
7588 .security_cfm = l2cap_security_cfm,
7589 };
7590
l2cap_debugfs_show(struct seq_file * f,void * p)7591 static int l2cap_debugfs_show(struct seq_file *f, void *p)
7592 {
7593 struct l2cap_chan *c;
7594
7595 read_lock(&chan_list_lock);
7596
7597 list_for_each_entry(c, &chan_list, global_l) {
7598 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7599 &c->src, c->src_type, &c->dst, c->dst_type,
7600 c->state, __le16_to_cpu(c->psm),
7601 c->scid, c->dcid, c->imtu, c->omtu,
7602 c->sec_level, c->mode);
7603 }
7604
7605 read_unlock(&chan_list_lock);
7606
7607 return 0;
7608 }
7609
7610 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
7611
7612 static struct dentry *l2cap_debugfs;
7613
l2cap_init(void)7614 int __init l2cap_init(void)
7615 {
7616 int err;
7617
7618 err = l2cap_init_sockets();
7619 if (err < 0)
7620 return err;
7621
7622 hci_register_cb(&l2cap_cb);
7623
7624 if (IS_ERR_OR_NULL(bt_debugfs))
7625 return 0;
7626
7627 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7628 NULL, &l2cap_debugfs_fops);
7629
7630 return 0;
7631 }
7632
l2cap_exit(void)7633 void l2cap_exit(void)
7634 {
7635 debugfs_remove(l2cap_debugfs);
7636 hci_unregister_cb(&l2cap_cb);
7637 l2cap_cleanup_sockets();
7638 }
7639
7640 module_param(disable_ertm, bool, 0644);
7641 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
7642
7643 module_param(enable_ecred, bool, 0644);
7644 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
7645