1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26 SOFTWARE IS DISCLAIMED.
27 */
28
29 /* Bluetooth L2CAP core. */
30
31 #include <linux/module.h>
32
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
35 #include <linux/filter.h>
36
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
40
41 #include "smp.h"
42
43 #define LE_FLOWCTL_MAX_CREDITS 65535
44
45 bool disable_ertm;
46 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED);
47
48 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
49
50 static LIST_HEAD(chan_list);
51 static DEFINE_RWLOCK(chan_list_lock);
52
53 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
54 u8 code, u8 ident, u16 dlen, void *data);
55 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
56 void *data);
57 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
58 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
59
60 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
61 struct sk_buff_head *skbs, u8 event);
62 static void l2cap_retrans_timeout(struct work_struct *work);
63 static void l2cap_monitor_timeout(struct work_struct *work);
64 static void l2cap_ack_timeout(struct work_struct *work);
65
bdaddr_type(u8 link_type,u8 bdaddr_type)66 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
67 {
68 if (link_type == LE_LINK) {
69 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
70 return BDADDR_LE_PUBLIC;
71 else
72 return BDADDR_LE_RANDOM;
73 }
74
75 return BDADDR_BREDR;
76 }
77
bdaddr_src_type(struct hci_conn * hcon)78 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
79 {
80 return bdaddr_type(hcon->type, hcon->src_type);
81 }
82
bdaddr_dst_type(struct hci_conn * hcon)83 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
84 {
85 return bdaddr_type(hcon->type, hcon->dst_type);
86 }
87
88 /* ---- L2CAP channels ---- */
89
__l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)90 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
91 u16 cid)
92 {
93 struct l2cap_chan *c;
94
95 list_for_each_entry(c, &conn->chan_l, list) {
96 if (c->dcid == cid)
97 return c;
98 }
99 return NULL;
100 }
101
__l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)102 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
103 u16 cid)
104 {
105 struct l2cap_chan *c;
106
107 list_for_each_entry(c, &conn->chan_l, list) {
108 if (c->scid == cid)
109 return c;
110 }
111 return NULL;
112 }
113
114 /* Find channel with given SCID.
115 * Returns a reference locked channel.
116 */
l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)117 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
118 u16 cid)
119 {
120 struct l2cap_chan *c;
121
122 mutex_lock(&conn->chan_lock);
123 c = __l2cap_get_chan_by_scid(conn, cid);
124 if (c) {
125 /* Only lock if chan reference is not 0 */
126 c = l2cap_chan_hold_unless_zero(c);
127 if (c)
128 l2cap_chan_lock(c);
129 }
130 mutex_unlock(&conn->chan_lock);
131
132 return c;
133 }
134
135 /* Find channel with given DCID.
136 * Returns a reference locked channel.
137 */
l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)138 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
139 u16 cid)
140 {
141 struct l2cap_chan *c;
142
143 mutex_lock(&conn->chan_lock);
144 c = __l2cap_get_chan_by_dcid(conn, cid);
145 if (c) {
146 /* Only lock if chan reference is not 0 */
147 c = l2cap_chan_hold_unless_zero(c);
148 if (c)
149 l2cap_chan_lock(c);
150 }
151 mutex_unlock(&conn->chan_lock);
152
153 return c;
154 }
155
__l2cap_get_chan_by_ident(struct l2cap_conn * conn,u8 ident)156 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
157 u8 ident)
158 {
159 struct l2cap_chan *c;
160
161 list_for_each_entry(c, &conn->chan_l, list) {
162 if (c->ident == ident)
163 return c;
164 }
165 return NULL;
166 }
167
__l2cap_global_chan_by_addr(__le16 psm,bdaddr_t * src,u8 src_type)168 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
169 u8 src_type)
170 {
171 struct l2cap_chan *c;
172
173 list_for_each_entry(c, &chan_list, global_l) {
174 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
175 continue;
176
177 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
178 continue;
179
180 if (c->sport == psm && !bacmp(&c->src, src))
181 return c;
182 }
183 return NULL;
184 }
185
l2cap_add_psm(struct l2cap_chan * chan,bdaddr_t * src,__le16 psm)186 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
187 {
188 int err;
189
190 write_lock(&chan_list_lock);
191
192 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
193 err = -EADDRINUSE;
194 goto done;
195 }
196
197 if (psm) {
198 chan->psm = psm;
199 chan->sport = psm;
200 err = 0;
201 } else {
202 u16 p, start, end, incr;
203
204 if (chan->src_type == BDADDR_BREDR) {
205 start = L2CAP_PSM_DYN_START;
206 end = L2CAP_PSM_AUTO_END;
207 incr = 2;
208 } else {
209 start = L2CAP_PSM_LE_DYN_START;
210 end = L2CAP_PSM_LE_DYN_END;
211 incr = 1;
212 }
213
214 err = -EINVAL;
215 for (p = start; p <= end; p += incr)
216 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
217 chan->src_type)) {
218 chan->psm = cpu_to_le16(p);
219 chan->sport = cpu_to_le16(p);
220 err = 0;
221 break;
222 }
223 }
224
225 done:
226 write_unlock(&chan_list_lock);
227 return err;
228 }
229 EXPORT_SYMBOL_GPL(l2cap_add_psm);
230
l2cap_add_scid(struct l2cap_chan * chan,__u16 scid)231 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
232 {
233 write_lock(&chan_list_lock);
234
235 /* Override the defaults (which are for conn-oriented) */
236 chan->omtu = L2CAP_DEFAULT_MTU;
237 chan->chan_type = L2CAP_CHAN_FIXED;
238
239 chan->scid = scid;
240
241 write_unlock(&chan_list_lock);
242
243 return 0;
244 }
245
l2cap_alloc_cid(struct l2cap_conn * conn)246 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
247 {
248 u16 cid, dyn_end;
249
250 if (conn->hcon->type == LE_LINK)
251 dyn_end = L2CAP_CID_LE_DYN_END;
252 else
253 dyn_end = L2CAP_CID_DYN_END;
254
255 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
256 if (!__l2cap_get_chan_by_scid(conn, cid))
257 return cid;
258 }
259
260 return 0;
261 }
262
l2cap_state_change(struct l2cap_chan * chan,int state)263 static void l2cap_state_change(struct l2cap_chan *chan, int state)
264 {
265 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
266 state_to_string(state));
267
268 chan->state = state;
269 chan->ops->state_change(chan, state, 0);
270 }
271
l2cap_state_change_and_error(struct l2cap_chan * chan,int state,int err)272 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
273 int state, int err)
274 {
275 chan->state = state;
276 chan->ops->state_change(chan, chan->state, err);
277 }
278
l2cap_chan_set_err(struct l2cap_chan * chan,int err)279 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
280 {
281 chan->ops->state_change(chan, chan->state, err);
282 }
283
__set_retrans_timer(struct l2cap_chan * chan)284 static void __set_retrans_timer(struct l2cap_chan *chan)
285 {
286 if (!delayed_work_pending(&chan->monitor_timer) &&
287 chan->retrans_timeout) {
288 l2cap_set_timer(chan, &chan->retrans_timer,
289 msecs_to_jiffies(chan->retrans_timeout));
290 }
291 }
292
__set_monitor_timer(struct l2cap_chan * chan)293 static void __set_monitor_timer(struct l2cap_chan *chan)
294 {
295 __clear_retrans_timer(chan);
296 if (chan->monitor_timeout) {
297 l2cap_set_timer(chan, &chan->monitor_timer,
298 msecs_to_jiffies(chan->monitor_timeout));
299 }
300 }
301
l2cap_ertm_seq_in_queue(struct sk_buff_head * head,u16 seq)302 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
303 u16 seq)
304 {
305 struct sk_buff *skb;
306
307 skb_queue_walk(head, skb) {
308 if (bt_cb(skb)->l2cap.txseq == seq)
309 return skb;
310 }
311
312 return NULL;
313 }
314
315 /* ---- L2CAP sequence number lists ---- */
316
317 /* For ERTM, ordered lists of sequence numbers must be tracked for
318 * SREJ requests that are received and for frames that are to be
319 * retransmitted. These seq_list functions implement a singly-linked
320 * list in an array, where membership in the list can also be checked
321 * in constant time. Items can also be added to the tail of the list
322 * and removed from the head in constant time, without further memory
323 * allocs or frees.
324 */
325
l2cap_seq_list_init(struct l2cap_seq_list * seq_list,u16 size)326 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
327 {
328 size_t alloc_size, i;
329
330 /* Allocated size is a power of 2 to map sequence numbers
331 * (which may be up to 14 bits) in to a smaller array that is
332 * sized for the negotiated ERTM transmit windows.
333 */
334 alloc_size = roundup_pow_of_two(size);
335
336 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
337 if (!seq_list->list)
338 return -ENOMEM;
339
340 seq_list->mask = alloc_size - 1;
341 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
342 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
343 for (i = 0; i < alloc_size; i++)
344 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
345
346 return 0;
347 }
348
l2cap_seq_list_free(struct l2cap_seq_list * seq_list)349 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
350 {
351 kfree(seq_list->list);
352 }
353
l2cap_seq_list_contains(struct l2cap_seq_list * seq_list,u16 seq)354 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
355 u16 seq)
356 {
357 /* Constant-time check for list membership */
358 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
359 }
360
l2cap_seq_list_pop(struct l2cap_seq_list * seq_list)361 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
362 {
363 u16 seq = seq_list->head;
364 u16 mask = seq_list->mask;
365
366 seq_list->head = seq_list->list[seq & mask];
367 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
368
369 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
370 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
371 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
372 }
373
374 return seq;
375 }
376
l2cap_seq_list_clear(struct l2cap_seq_list * seq_list)377 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
378 {
379 u16 i;
380
381 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
382 return;
383
384 for (i = 0; i <= seq_list->mask; i++)
385 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
386
387 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
388 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
389 }
390
l2cap_seq_list_append(struct l2cap_seq_list * seq_list,u16 seq)391 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
392 {
393 u16 mask = seq_list->mask;
394
395 /* All appends happen in constant time */
396
397 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
398 return;
399
400 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
401 seq_list->head = seq;
402 else
403 seq_list->list[seq_list->tail & mask] = seq;
404
405 seq_list->tail = seq;
406 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
407 }
408
l2cap_chan_timeout(struct work_struct * work)409 static void l2cap_chan_timeout(struct work_struct *work)
410 {
411 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
412 chan_timer.work);
413 struct l2cap_conn *conn = chan->conn;
414 int reason;
415
416 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
417
418 if (!conn)
419 return;
420
421 mutex_lock(&conn->chan_lock);
422 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
423 * this work. No need to call l2cap_chan_hold(chan) here again.
424 */
425 l2cap_chan_lock(chan);
426
427 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
428 reason = ECONNREFUSED;
429 else if (chan->state == BT_CONNECT &&
430 chan->sec_level != BT_SECURITY_SDP)
431 reason = ECONNREFUSED;
432 else
433 reason = ETIMEDOUT;
434
435 l2cap_chan_close(chan, reason);
436
437 chan->ops->close(chan);
438
439 l2cap_chan_unlock(chan);
440 l2cap_chan_put(chan);
441
442 mutex_unlock(&conn->chan_lock);
443 }
444
l2cap_chan_create(void)445 struct l2cap_chan *l2cap_chan_create(void)
446 {
447 struct l2cap_chan *chan;
448
449 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
450 if (!chan)
451 return NULL;
452
453 skb_queue_head_init(&chan->tx_q);
454 skb_queue_head_init(&chan->srej_q);
455 mutex_init(&chan->lock);
456
457 /* Set default lock nesting level */
458 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
459
460 /* Available receive buffer space is initially unknown */
461 chan->rx_avail = -1;
462
463 write_lock(&chan_list_lock);
464 list_add(&chan->global_l, &chan_list);
465 write_unlock(&chan_list_lock);
466
467 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
468 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
469 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
470 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
471
472 chan->state = BT_OPEN;
473
474 kref_init(&chan->kref);
475
476 /* This flag is cleared in l2cap_chan_ready() */
477 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
478
479 BT_DBG("chan %p", chan);
480
481 return chan;
482 }
483 EXPORT_SYMBOL_GPL(l2cap_chan_create);
484
l2cap_chan_destroy(struct kref * kref)485 static void l2cap_chan_destroy(struct kref *kref)
486 {
487 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
488
489 BT_DBG("chan %p", chan);
490
491 write_lock(&chan_list_lock);
492 list_del(&chan->global_l);
493 write_unlock(&chan_list_lock);
494
495 kfree(chan);
496 }
497
l2cap_chan_hold(struct l2cap_chan * c)498 void l2cap_chan_hold(struct l2cap_chan *c)
499 {
500 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
501
502 kref_get(&c->kref);
503 }
504
l2cap_chan_hold_unless_zero(struct l2cap_chan * c)505 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
506 {
507 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
508
509 if (!kref_get_unless_zero(&c->kref))
510 return NULL;
511
512 return c;
513 }
514
l2cap_chan_put(struct l2cap_chan * c)515 void l2cap_chan_put(struct l2cap_chan *c)
516 {
517 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
518
519 kref_put(&c->kref, l2cap_chan_destroy);
520 }
521 EXPORT_SYMBOL_GPL(l2cap_chan_put);
522
l2cap_chan_set_defaults(struct l2cap_chan * chan)523 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
524 {
525 chan->fcs = L2CAP_FCS_CRC16;
526 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
527 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
528 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
529 chan->remote_max_tx = chan->max_tx;
530 chan->remote_tx_win = chan->tx_win;
531 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
532 chan->sec_level = BT_SECURITY_LOW;
533 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
534 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
535 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
536
537 chan->conf_state = 0;
538 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
539
540 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
541 }
542 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
543
l2cap_le_rx_credits(struct l2cap_chan * chan)544 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan)
545 {
546 size_t sdu_len = chan->sdu ? chan->sdu->len : 0;
547
548 if (chan->mps == 0)
549 return 0;
550
551 /* If we don't know the available space in the receiver buffer, give
552 * enough credits for a full packet.
553 */
554 if (chan->rx_avail == -1)
555 return (chan->imtu / chan->mps) + 1;
556
557 /* If we know how much space is available in the receive buffer, give
558 * out as many credits as would fill the buffer.
559 */
560 if (chan->rx_avail <= sdu_len)
561 return 0;
562
563 return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps);
564 }
565
l2cap_le_flowctl_init(struct l2cap_chan * chan,u16 tx_credits)566 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
567 {
568 chan->sdu = NULL;
569 chan->sdu_last_frag = NULL;
570 chan->sdu_len = 0;
571 chan->tx_credits = tx_credits;
572 /* Derive MPS from connection MTU to stop HCI fragmentation */
573 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
574 chan->rx_credits = l2cap_le_rx_credits(chan);
575
576 skb_queue_head_init(&chan->tx_q);
577 }
578
l2cap_ecred_init(struct l2cap_chan * chan,u16 tx_credits)579 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
580 {
581 l2cap_le_flowctl_init(chan, tx_credits);
582
583 /* L2CAP implementations shall support a minimum MPS of 64 octets */
584 if (chan->mps < L2CAP_ECRED_MIN_MPS) {
585 chan->mps = L2CAP_ECRED_MIN_MPS;
586 chan->rx_credits = l2cap_le_rx_credits(chan);
587 }
588 }
589
__l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)590 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
591 {
592 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
593 __le16_to_cpu(chan->psm), chan->dcid);
594
595 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
596
597 chan->conn = conn;
598
599 switch (chan->chan_type) {
600 case L2CAP_CHAN_CONN_ORIENTED:
601 /* Alloc CID for connection-oriented socket */
602 chan->scid = l2cap_alloc_cid(conn);
603 if (conn->hcon->type == ACL_LINK)
604 chan->omtu = L2CAP_DEFAULT_MTU;
605 break;
606
607 case L2CAP_CHAN_CONN_LESS:
608 /* Connectionless socket */
609 chan->scid = L2CAP_CID_CONN_LESS;
610 chan->dcid = L2CAP_CID_CONN_LESS;
611 chan->omtu = L2CAP_DEFAULT_MTU;
612 break;
613
614 case L2CAP_CHAN_FIXED:
615 /* Caller will set CID and CID specific MTU values */
616 break;
617
618 default:
619 /* Raw socket can send/recv signalling messages only */
620 chan->scid = L2CAP_CID_SIGNALING;
621 chan->dcid = L2CAP_CID_SIGNALING;
622 chan->omtu = L2CAP_DEFAULT_MTU;
623 }
624
625 chan->local_id = L2CAP_BESTEFFORT_ID;
626 chan->local_stype = L2CAP_SERV_BESTEFFORT;
627 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
628 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
629 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
630 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
631
632 l2cap_chan_hold(chan);
633
634 /* Only keep a reference for fixed channels if they requested it */
635 if (chan->chan_type != L2CAP_CHAN_FIXED ||
636 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
637 hci_conn_hold(conn->hcon);
638
639 list_add(&chan->list, &conn->chan_l);
640 }
641
l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)642 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643 {
644 mutex_lock(&conn->chan_lock);
645 __l2cap_chan_add(conn, chan);
646 mutex_unlock(&conn->chan_lock);
647 }
648
l2cap_chan_del(struct l2cap_chan * chan,int err)649 void l2cap_chan_del(struct l2cap_chan *chan, int err)
650 {
651 struct l2cap_conn *conn = chan->conn;
652
653 __clear_chan_timer(chan);
654
655 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
656 state_to_string(chan->state));
657
658 chan->ops->teardown(chan, err);
659
660 if (conn) {
661 /* Delete from channel list */
662 list_del(&chan->list);
663
664 l2cap_chan_put(chan);
665
666 chan->conn = NULL;
667
668 /* Reference was only held for non-fixed channels or
669 * fixed channels that explicitly requested it using the
670 * FLAG_HOLD_HCI_CONN flag.
671 */
672 if (chan->chan_type != L2CAP_CHAN_FIXED ||
673 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
674 hci_conn_drop(conn->hcon);
675 }
676
677 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
678 return;
679
680 switch (chan->mode) {
681 case L2CAP_MODE_BASIC:
682 break;
683
684 case L2CAP_MODE_LE_FLOWCTL:
685 case L2CAP_MODE_EXT_FLOWCTL:
686 skb_queue_purge(&chan->tx_q);
687 break;
688
689 case L2CAP_MODE_ERTM:
690 __clear_retrans_timer(chan);
691 __clear_monitor_timer(chan);
692 __clear_ack_timer(chan);
693
694 skb_queue_purge(&chan->srej_q);
695
696 l2cap_seq_list_free(&chan->srej_list);
697 l2cap_seq_list_free(&chan->retrans_list);
698 fallthrough;
699
700 case L2CAP_MODE_STREAMING:
701 skb_queue_purge(&chan->tx_q);
702 break;
703 }
704 }
705 EXPORT_SYMBOL_GPL(l2cap_chan_del);
706
__l2cap_chan_list_id(struct l2cap_conn * conn,u16 id,l2cap_chan_func_t func,void * data)707 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
708 l2cap_chan_func_t func, void *data)
709 {
710 struct l2cap_chan *chan, *l;
711
712 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
713 if (chan->ident == id)
714 func(chan, data);
715 }
716 }
717
__l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)718 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
719 void *data)
720 {
721 struct l2cap_chan *chan;
722
723 list_for_each_entry(chan, &conn->chan_l, list) {
724 func(chan, data);
725 }
726 }
727
l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)728 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
729 void *data)
730 {
731 if (!conn)
732 return;
733
734 mutex_lock(&conn->chan_lock);
735 __l2cap_chan_list(conn, func, data);
736 mutex_unlock(&conn->chan_lock);
737 }
738
739 EXPORT_SYMBOL_GPL(l2cap_chan_list);
740
l2cap_conn_update_id_addr(struct work_struct * work)741 static void l2cap_conn_update_id_addr(struct work_struct *work)
742 {
743 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
744 id_addr_timer.work);
745 struct hci_conn *hcon = conn->hcon;
746 struct l2cap_chan *chan;
747
748 mutex_lock(&conn->chan_lock);
749
750 list_for_each_entry(chan, &conn->chan_l, list) {
751 l2cap_chan_lock(chan);
752 bacpy(&chan->dst, &hcon->dst);
753 chan->dst_type = bdaddr_dst_type(hcon);
754 l2cap_chan_unlock(chan);
755 }
756
757 mutex_unlock(&conn->chan_lock);
758 }
759
l2cap_chan_le_connect_reject(struct l2cap_chan * chan)760 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
761 {
762 struct l2cap_conn *conn = chan->conn;
763 struct l2cap_le_conn_rsp rsp;
764 u16 result;
765
766 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
767 result = L2CAP_CR_LE_AUTHORIZATION;
768 else
769 result = L2CAP_CR_LE_BAD_PSM;
770
771 l2cap_state_change(chan, BT_DISCONN);
772
773 rsp.dcid = cpu_to_le16(chan->scid);
774 rsp.mtu = cpu_to_le16(chan->imtu);
775 rsp.mps = cpu_to_le16(chan->mps);
776 rsp.credits = cpu_to_le16(chan->rx_credits);
777 rsp.result = cpu_to_le16(result);
778
779 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
780 &rsp);
781 }
782
l2cap_chan_ecred_connect_reject(struct l2cap_chan * chan)783 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
784 {
785 l2cap_state_change(chan, BT_DISCONN);
786
787 __l2cap_ecred_conn_rsp_defer(chan);
788 }
789
l2cap_chan_connect_reject(struct l2cap_chan * chan)790 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
791 {
792 struct l2cap_conn *conn = chan->conn;
793 struct l2cap_conn_rsp rsp;
794 u16 result;
795
796 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
797 result = L2CAP_CR_SEC_BLOCK;
798 else
799 result = L2CAP_CR_BAD_PSM;
800
801 l2cap_state_change(chan, BT_DISCONN);
802
803 rsp.scid = cpu_to_le16(chan->dcid);
804 rsp.dcid = cpu_to_le16(chan->scid);
805 rsp.result = cpu_to_le16(result);
806 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
807
808 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
809 }
810
l2cap_chan_close(struct l2cap_chan * chan,int reason)811 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
812 {
813 struct l2cap_conn *conn = chan->conn;
814
815 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
816
817 switch (chan->state) {
818 case BT_LISTEN:
819 chan->ops->teardown(chan, 0);
820 break;
821
822 case BT_CONNECTED:
823 case BT_CONFIG:
824 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
825 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
826 l2cap_send_disconn_req(chan, reason);
827 } else
828 l2cap_chan_del(chan, reason);
829 break;
830
831 case BT_CONNECT2:
832 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
833 if (conn->hcon->type == ACL_LINK)
834 l2cap_chan_connect_reject(chan);
835 else if (conn->hcon->type == LE_LINK) {
836 switch (chan->mode) {
837 case L2CAP_MODE_LE_FLOWCTL:
838 l2cap_chan_le_connect_reject(chan);
839 break;
840 case L2CAP_MODE_EXT_FLOWCTL:
841 l2cap_chan_ecred_connect_reject(chan);
842 return;
843 }
844 }
845 }
846
847 l2cap_chan_del(chan, reason);
848 break;
849
850 case BT_CONNECT:
851 case BT_DISCONN:
852 l2cap_chan_del(chan, reason);
853 break;
854
855 default:
856 chan->ops->teardown(chan, 0);
857 break;
858 }
859 }
860 EXPORT_SYMBOL(l2cap_chan_close);
861
l2cap_get_auth_type(struct l2cap_chan * chan)862 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
863 {
864 switch (chan->chan_type) {
865 case L2CAP_CHAN_RAW:
866 switch (chan->sec_level) {
867 case BT_SECURITY_HIGH:
868 case BT_SECURITY_FIPS:
869 return HCI_AT_DEDICATED_BONDING_MITM;
870 case BT_SECURITY_MEDIUM:
871 return HCI_AT_DEDICATED_BONDING;
872 default:
873 return HCI_AT_NO_BONDING;
874 }
875 break;
876 case L2CAP_CHAN_CONN_LESS:
877 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
878 if (chan->sec_level == BT_SECURITY_LOW)
879 chan->sec_level = BT_SECURITY_SDP;
880 }
881 if (chan->sec_level == BT_SECURITY_HIGH ||
882 chan->sec_level == BT_SECURITY_FIPS)
883 return HCI_AT_NO_BONDING_MITM;
884 else
885 return HCI_AT_NO_BONDING;
886 break;
887 case L2CAP_CHAN_CONN_ORIENTED:
888 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
889 if (chan->sec_level == BT_SECURITY_LOW)
890 chan->sec_level = BT_SECURITY_SDP;
891
892 if (chan->sec_level == BT_SECURITY_HIGH ||
893 chan->sec_level == BT_SECURITY_FIPS)
894 return HCI_AT_NO_BONDING_MITM;
895 else
896 return HCI_AT_NO_BONDING;
897 }
898 fallthrough;
899
900 default:
901 switch (chan->sec_level) {
902 case BT_SECURITY_HIGH:
903 case BT_SECURITY_FIPS:
904 return HCI_AT_GENERAL_BONDING_MITM;
905 case BT_SECURITY_MEDIUM:
906 return HCI_AT_GENERAL_BONDING;
907 default:
908 return HCI_AT_NO_BONDING;
909 }
910 break;
911 }
912 }
913
914 /* Service level security */
l2cap_chan_check_security(struct l2cap_chan * chan,bool initiator)915 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
916 {
917 struct l2cap_conn *conn = chan->conn;
918 __u8 auth_type;
919
920 if (conn->hcon->type == LE_LINK)
921 return smp_conn_security(conn->hcon, chan->sec_level);
922
923 auth_type = l2cap_get_auth_type(chan);
924
925 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
926 initiator);
927 }
928
l2cap_get_ident(struct l2cap_conn * conn)929 static u8 l2cap_get_ident(struct l2cap_conn *conn)
930 {
931 u8 id;
932
933 /* Get next available identificator.
934 * 1 - 128 are used by kernel.
935 * 129 - 199 are reserved.
936 * 200 - 254 are used by utilities like l2ping, etc.
937 */
938
939 mutex_lock(&conn->ident_lock);
940
941 if (++conn->tx_ident > 128)
942 conn->tx_ident = 1;
943
944 id = conn->tx_ident;
945
946 mutex_unlock(&conn->ident_lock);
947
948 return id;
949 }
950
l2cap_send_cmd(struct l2cap_conn * conn,u8 ident,u8 code,u16 len,void * data)951 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
952 void *data)
953 {
954 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
955 u8 flags;
956
957 BT_DBG("code 0x%2.2x", code);
958
959 if (!skb)
960 return;
961
962 /* Use NO_FLUSH if supported or we have an LE link (which does
963 * not support auto-flushing packets) */
964 if (lmp_no_flush_capable(conn->hcon->hdev) ||
965 conn->hcon->type == LE_LINK)
966 flags = ACL_START_NO_FLUSH;
967 else
968 flags = ACL_START;
969
970 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
971 skb->priority = HCI_PRIO_MAX;
972
973 hci_send_acl(conn->hchan, skb, flags);
974 }
975
l2cap_do_send(struct l2cap_chan * chan,struct sk_buff * skb)976 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
977 {
978 struct hci_conn *hcon = chan->conn->hcon;
979 u16 flags;
980
981 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
982 skb->priority);
983
984 /* Use NO_FLUSH for LE links (where this is the only option) or
985 * if the BR/EDR link supports it and flushing has not been
986 * explicitly requested (through FLAG_FLUSHABLE).
987 */
988 if (hcon->type == LE_LINK ||
989 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
990 lmp_no_flush_capable(hcon->hdev)))
991 flags = ACL_START_NO_FLUSH;
992 else
993 flags = ACL_START;
994
995 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
996 hci_send_acl(chan->conn->hchan, skb, flags);
997 }
998
__unpack_enhanced_control(u16 enh,struct l2cap_ctrl * control)999 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
1000 {
1001 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
1002 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
1003
1004 if (enh & L2CAP_CTRL_FRAME_TYPE) {
1005 /* S-Frame */
1006 control->sframe = 1;
1007 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1008 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1009
1010 control->sar = 0;
1011 control->txseq = 0;
1012 } else {
1013 /* I-Frame */
1014 control->sframe = 0;
1015 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1016 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1017
1018 control->poll = 0;
1019 control->super = 0;
1020 }
1021 }
1022
__unpack_extended_control(u32 ext,struct l2cap_ctrl * control)1023 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1024 {
1025 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1026 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1027
1028 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1029 /* S-Frame */
1030 control->sframe = 1;
1031 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1032 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1033
1034 control->sar = 0;
1035 control->txseq = 0;
1036 } else {
1037 /* I-Frame */
1038 control->sframe = 0;
1039 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1040 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1041
1042 control->poll = 0;
1043 control->super = 0;
1044 }
1045 }
1046
__unpack_control(struct l2cap_chan * chan,struct sk_buff * skb)1047 static inline void __unpack_control(struct l2cap_chan *chan,
1048 struct sk_buff *skb)
1049 {
1050 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1051 __unpack_extended_control(get_unaligned_le32(skb->data),
1052 &bt_cb(skb)->l2cap);
1053 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1054 } else {
1055 __unpack_enhanced_control(get_unaligned_le16(skb->data),
1056 &bt_cb(skb)->l2cap);
1057 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1058 }
1059 }
1060
__pack_extended_control(struct l2cap_ctrl * control)1061 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1062 {
1063 u32 packed;
1064
1065 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1066 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1067
1068 if (control->sframe) {
1069 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1070 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1071 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1072 } else {
1073 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1074 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1075 }
1076
1077 return packed;
1078 }
1079
__pack_enhanced_control(struct l2cap_ctrl * control)1080 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1081 {
1082 u16 packed;
1083
1084 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1085 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1086
1087 if (control->sframe) {
1088 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1089 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1090 packed |= L2CAP_CTRL_FRAME_TYPE;
1091 } else {
1092 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1093 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1094 }
1095
1096 return packed;
1097 }
1098
__pack_control(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)1099 static inline void __pack_control(struct l2cap_chan *chan,
1100 struct l2cap_ctrl *control,
1101 struct sk_buff *skb)
1102 {
1103 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1104 put_unaligned_le32(__pack_extended_control(control),
1105 skb->data + L2CAP_HDR_SIZE);
1106 } else {
1107 put_unaligned_le16(__pack_enhanced_control(control),
1108 skb->data + L2CAP_HDR_SIZE);
1109 }
1110 }
1111
__ertm_hdr_size(struct l2cap_chan * chan)1112 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1113 {
1114 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1115 return L2CAP_EXT_HDR_SIZE;
1116 else
1117 return L2CAP_ENH_HDR_SIZE;
1118 }
1119
l2cap_create_sframe_pdu(struct l2cap_chan * chan,u32 control)1120 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1121 u32 control)
1122 {
1123 struct sk_buff *skb;
1124 struct l2cap_hdr *lh;
1125 int hlen = __ertm_hdr_size(chan);
1126
1127 if (chan->fcs == L2CAP_FCS_CRC16)
1128 hlen += L2CAP_FCS_SIZE;
1129
1130 skb = bt_skb_alloc(hlen, GFP_KERNEL);
1131
1132 if (!skb)
1133 return ERR_PTR(-ENOMEM);
1134
1135 lh = skb_put(skb, L2CAP_HDR_SIZE);
1136 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1137 lh->cid = cpu_to_le16(chan->dcid);
1138
1139 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1140 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1141 else
1142 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1143
1144 if (chan->fcs == L2CAP_FCS_CRC16) {
1145 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1146 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1147 }
1148
1149 skb->priority = HCI_PRIO_MAX;
1150 return skb;
1151 }
1152
l2cap_send_sframe(struct l2cap_chan * chan,struct l2cap_ctrl * control)1153 static void l2cap_send_sframe(struct l2cap_chan *chan,
1154 struct l2cap_ctrl *control)
1155 {
1156 struct sk_buff *skb;
1157 u32 control_field;
1158
1159 BT_DBG("chan %p, control %p", chan, control);
1160
1161 if (!control->sframe)
1162 return;
1163
1164 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1165 !control->poll)
1166 control->final = 1;
1167
1168 if (control->super == L2CAP_SUPER_RR)
1169 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1170 else if (control->super == L2CAP_SUPER_RNR)
1171 set_bit(CONN_RNR_SENT, &chan->conn_state);
1172
1173 if (control->super != L2CAP_SUPER_SREJ) {
1174 chan->last_acked_seq = control->reqseq;
1175 __clear_ack_timer(chan);
1176 }
1177
1178 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1179 control->final, control->poll, control->super);
1180
1181 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1182 control_field = __pack_extended_control(control);
1183 else
1184 control_field = __pack_enhanced_control(control);
1185
1186 skb = l2cap_create_sframe_pdu(chan, control_field);
1187 if (!IS_ERR(skb))
1188 l2cap_do_send(chan, skb);
1189 }
1190
l2cap_send_rr_or_rnr(struct l2cap_chan * chan,bool poll)1191 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1192 {
1193 struct l2cap_ctrl control;
1194
1195 BT_DBG("chan %p, poll %d", chan, poll);
1196
1197 memset(&control, 0, sizeof(control));
1198 control.sframe = 1;
1199 control.poll = poll;
1200
1201 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1202 control.super = L2CAP_SUPER_RNR;
1203 else
1204 control.super = L2CAP_SUPER_RR;
1205
1206 control.reqseq = chan->buffer_seq;
1207 l2cap_send_sframe(chan, &control);
1208 }
1209
__l2cap_no_conn_pending(struct l2cap_chan * chan)1210 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1211 {
1212 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1213 return true;
1214
1215 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1216 }
1217
l2cap_send_conn_req(struct l2cap_chan * chan)1218 void l2cap_send_conn_req(struct l2cap_chan *chan)
1219 {
1220 struct l2cap_conn *conn = chan->conn;
1221 struct l2cap_conn_req req;
1222
1223 req.scid = cpu_to_le16(chan->scid);
1224 req.psm = chan->psm;
1225
1226 chan->ident = l2cap_get_ident(conn);
1227
1228 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1229
1230 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1231 }
1232
l2cap_chan_ready(struct l2cap_chan * chan)1233 static void l2cap_chan_ready(struct l2cap_chan *chan)
1234 {
1235 /* The channel may have already been flagged as connected in
1236 * case of receiving data before the L2CAP info req/rsp
1237 * procedure is complete.
1238 */
1239 if (chan->state == BT_CONNECTED)
1240 return;
1241
1242 /* This clears all conf flags, including CONF_NOT_COMPLETE */
1243 chan->conf_state = 0;
1244 __clear_chan_timer(chan);
1245
1246 switch (chan->mode) {
1247 case L2CAP_MODE_LE_FLOWCTL:
1248 case L2CAP_MODE_EXT_FLOWCTL:
1249 if (!chan->tx_credits)
1250 chan->ops->suspend(chan);
1251 break;
1252 }
1253
1254 chan->state = BT_CONNECTED;
1255
1256 chan->ops->ready(chan);
1257 }
1258
l2cap_le_connect(struct l2cap_chan * chan)1259 static void l2cap_le_connect(struct l2cap_chan *chan)
1260 {
1261 struct l2cap_conn *conn = chan->conn;
1262 struct l2cap_le_conn_req req;
1263
1264 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1265 return;
1266
1267 if (!chan->imtu)
1268 chan->imtu = chan->conn->mtu;
1269
1270 l2cap_le_flowctl_init(chan, 0);
1271
1272 memset(&req, 0, sizeof(req));
1273 req.psm = chan->psm;
1274 req.scid = cpu_to_le16(chan->scid);
1275 req.mtu = cpu_to_le16(chan->imtu);
1276 req.mps = cpu_to_le16(chan->mps);
1277 req.credits = cpu_to_le16(chan->rx_credits);
1278
1279 chan->ident = l2cap_get_ident(conn);
1280
1281 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1282 sizeof(req), &req);
1283 }
1284
1285 struct l2cap_ecred_conn_data {
1286 struct {
1287 struct l2cap_ecred_conn_req req;
1288 __le16 scid[5];
1289 } __packed pdu;
1290 struct l2cap_chan *chan;
1291 struct pid *pid;
1292 int count;
1293 };
1294
l2cap_ecred_defer_connect(struct l2cap_chan * chan,void * data)1295 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1296 {
1297 struct l2cap_ecred_conn_data *conn = data;
1298 struct pid *pid;
1299
1300 if (chan == conn->chan)
1301 return;
1302
1303 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1304 return;
1305
1306 pid = chan->ops->get_peer_pid(chan);
1307
1308 /* Only add deferred channels with the same PID/PSM */
1309 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1310 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1311 return;
1312
1313 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1314 return;
1315
1316 l2cap_ecred_init(chan, 0);
1317
1318 /* Set the same ident so we can match on the rsp */
1319 chan->ident = conn->chan->ident;
1320
1321 /* Include all channels deferred */
1322 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1323
1324 conn->count++;
1325 }
1326
l2cap_ecred_connect(struct l2cap_chan * chan)1327 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1328 {
1329 struct l2cap_conn *conn = chan->conn;
1330 struct l2cap_ecred_conn_data data;
1331
1332 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1333 return;
1334
1335 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1336 return;
1337
1338 l2cap_ecred_init(chan, 0);
1339
1340 memset(&data, 0, sizeof(data));
1341 data.pdu.req.psm = chan->psm;
1342 data.pdu.req.mtu = cpu_to_le16(chan->imtu);
1343 data.pdu.req.mps = cpu_to_le16(chan->mps);
1344 data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1345 data.pdu.scid[0] = cpu_to_le16(chan->scid);
1346
1347 chan->ident = l2cap_get_ident(conn);
1348
1349 data.count = 1;
1350 data.chan = chan;
1351 data.pid = chan->ops->get_peer_pid(chan);
1352
1353 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1354
1355 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1356 sizeof(data.pdu.req) + data.count * sizeof(__le16),
1357 &data.pdu);
1358 }
1359
l2cap_le_start(struct l2cap_chan * chan)1360 static void l2cap_le_start(struct l2cap_chan *chan)
1361 {
1362 struct l2cap_conn *conn = chan->conn;
1363
1364 if (!smp_conn_security(conn->hcon, chan->sec_level))
1365 return;
1366
1367 if (!chan->psm) {
1368 l2cap_chan_ready(chan);
1369 return;
1370 }
1371
1372 if (chan->state == BT_CONNECT) {
1373 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1374 l2cap_ecred_connect(chan);
1375 else
1376 l2cap_le_connect(chan);
1377 }
1378 }
1379
l2cap_start_connection(struct l2cap_chan * chan)1380 static void l2cap_start_connection(struct l2cap_chan *chan)
1381 {
1382 if (chan->conn->hcon->type == LE_LINK) {
1383 l2cap_le_start(chan);
1384 } else {
1385 l2cap_send_conn_req(chan);
1386 }
1387 }
1388
l2cap_request_info(struct l2cap_conn * conn)1389 static void l2cap_request_info(struct l2cap_conn *conn)
1390 {
1391 struct l2cap_info_req req;
1392
1393 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1394 return;
1395
1396 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1397
1398 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1399 conn->info_ident = l2cap_get_ident(conn);
1400
1401 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1402
1403 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1404 sizeof(req), &req);
1405 }
1406
l2cap_check_enc_key_size(struct hci_conn * hcon)1407 static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1408 {
1409 /* The minimum encryption key size needs to be enforced by the
1410 * host stack before establishing any L2CAP connections. The
1411 * specification in theory allows a minimum of 1, but to align
1412 * BR/EDR and LE transports, a minimum of 7 is chosen.
1413 *
1414 * This check might also be called for unencrypted connections
1415 * that have no key size requirements. Ensure that the link is
1416 * actually encrypted before enforcing a key size.
1417 */
1418 int min_key_size = hcon->hdev->min_enc_key_size;
1419
1420 /* On FIPS security level, key size must be 16 bytes */
1421 if (hcon->sec_level == BT_SECURITY_FIPS)
1422 min_key_size = 16;
1423
1424 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1425 hcon->enc_key_size >= min_key_size);
1426 }
1427
l2cap_do_start(struct l2cap_chan * chan)1428 static void l2cap_do_start(struct l2cap_chan *chan)
1429 {
1430 struct l2cap_conn *conn = chan->conn;
1431
1432 if (conn->hcon->type == LE_LINK) {
1433 l2cap_le_start(chan);
1434 return;
1435 }
1436
1437 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1438 l2cap_request_info(conn);
1439 return;
1440 }
1441
1442 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1443 return;
1444
1445 if (!l2cap_chan_check_security(chan, true) ||
1446 !__l2cap_no_conn_pending(chan))
1447 return;
1448
1449 if (l2cap_check_enc_key_size(conn->hcon))
1450 l2cap_start_connection(chan);
1451 else
1452 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1453 }
1454
l2cap_mode_supported(__u8 mode,__u32 feat_mask)1455 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1456 {
1457 u32 local_feat_mask = l2cap_feat_mask;
1458 if (!disable_ertm)
1459 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1460
1461 switch (mode) {
1462 case L2CAP_MODE_ERTM:
1463 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1464 case L2CAP_MODE_STREAMING:
1465 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1466 default:
1467 return 0x00;
1468 }
1469 }
1470
l2cap_send_disconn_req(struct l2cap_chan * chan,int err)1471 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1472 {
1473 struct l2cap_conn *conn = chan->conn;
1474 struct l2cap_disconn_req req;
1475
1476 if (!conn)
1477 return;
1478
1479 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1480 __clear_retrans_timer(chan);
1481 __clear_monitor_timer(chan);
1482 __clear_ack_timer(chan);
1483 }
1484
1485 req.dcid = cpu_to_le16(chan->dcid);
1486 req.scid = cpu_to_le16(chan->scid);
1487 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1488 sizeof(req), &req);
1489
1490 l2cap_state_change_and_error(chan, BT_DISCONN, err);
1491 }
1492
1493 /* ---- L2CAP connections ---- */
l2cap_conn_start(struct l2cap_conn * conn)1494 static void l2cap_conn_start(struct l2cap_conn *conn)
1495 {
1496 struct l2cap_chan *chan, *tmp;
1497
1498 BT_DBG("conn %p", conn);
1499
1500 mutex_lock(&conn->chan_lock);
1501
1502 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1503 l2cap_chan_lock(chan);
1504
1505 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1506 l2cap_chan_ready(chan);
1507 l2cap_chan_unlock(chan);
1508 continue;
1509 }
1510
1511 if (chan->state == BT_CONNECT) {
1512 if (!l2cap_chan_check_security(chan, true) ||
1513 !__l2cap_no_conn_pending(chan)) {
1514 l2cap_chan_unlock(chan);
1515 continue;
1516 }
1517
1518 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1519 && test_bit(CONF_STATE2_DEVICE,
1520 &chan->conf_state)) {
1521 l2cap_chan_close(chan, ECONNRESET);
1522 l2cap_chan_unlock(chan);
1523 continue;
1524 }
1525
1526 if (l2cap_check_enc_key_size(conn->hcon))
1527 l2cap_start_connection(chan);
1528 else
1529 l2cap_chan_close(chan, ECONNREFUSED);
1530
1531 } else if (chan->state == BT_CONNECT2) {
1532 struct l2cap_conn_rsp rsp;
1533 char buf[128];
1534 rsp.scid = cpu_to_le16(chan->dcid);
1535 rsp.dcid = cpu_to_le16(chan->scid);
1536
1537 if (l2cap_chan_check_security(chan, false)) {
1538 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1539 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1540 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1541 chan->ops->defer(chan);
1542
1543 } else {
1544 l2cap_state_change(chan, BT_CONFIG);
1545 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1546 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1547 }
1548 } else {
1549 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1550 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1551 }
1552
1553 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1554 sizeof(rsp), &rsp);
1555
1556 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1557 rsp.result != L2CAP_CR_SUCCESS) {
1558 l2cap_chan_unlock(chan);
1559 continue;
1560 }
1561
1562 set_bit(CONF_REQ_SENT, &chan->conf_state);
1563 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1564 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1565 chan->num_conf_req++;
1566 }
1567
1568 l2cap_chan_unlock(chan);
1569 }
1570
1571 mutex_unlock(&conn->chan_lock);
1572 }
1573
l2cap_le_conn_ready(struct l2cap_conn * conn)1574 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1575 {
1576 struct hci_conn *hcon = conn->hcon;
1577 struct hci_dev *hdev = hcon->hdev;
1578
1579 BT_DBG("%s conn %p", hdev->name, conn);
1580
1581 /* For outgoing pairing which doesn't necessarily have an
1582 * associated socket (e.g. mgmt_pair_device).
1583 */
1584 if (hcon->out)
1585 smp_conn_security(hcon, hcon->pending_sec_level);
1586
1587 /* For LE peripheral connections, make sure the connection interval
1588 * is in the range of the minimum and maximum interval that has
1589 * been configured for this connection. If not, then trigger
1590 * the connection update procedure.
1591 */
1592 if (hcon->role == HCI_ROLE_SLAVE &&
1593 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1594 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1595 struct l2cap_conn_param_update_req req;
1596
1597 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1598 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1599 req.latency = cpu_to_le16(hcon->le_conn_latency);
1600 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1601
1602 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1603 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1604 }
1605 }
1606
l2cap_conn_ready(struct l2cap_conn * conn)1607 static void l2cap_conn_ready(struct l2cap_conn *conn)
1608 {
1609 struct l2cap_chan *chan;
1610 struct hci_conn *hcon = conn->hcon;
1611
1612 BT_DBG("conn %p", conn);
1613
1614 if (hcon->type == ACL_LINK)
1615 l2cap_request_info(conn);
1616
1617 mutex_lock(&conn->chan_lock);
1618
1619 list_for_each_entry(chan, &conn->chan_l, list) {
1620
1621 l2cap_chan_lock(chan);
1622
1623 if (hcon->type == LE_LINK) {
1624 l2cap_le_start(chan);
1625 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1626 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1627 l2cap_chan_ready(chan);
1628 } else if (chan->state == BT_CONNECT) {
1629 l2cap_do_start(chan);
1630 }
1631
1632 l2cap_chan_unlock(chan);
1633 }
1634
1635 mutex_unlock(&conn->chan_lock);
1636
1637 if (hcon->type == LE_LINK)
1638 l2cap_le_conn_ready(conn);
1639
1640 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1641 }
1642
1643 /* Notify sockets that we cannot guaranty reliability anymore */
l2cap_conn_unreliable(struct l2cap_conn * conn,int err)1644 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1645 {
1646 struct l2cap_chan *chan;
1647
1648 BT_DBG("conn %p", conn);
1649
1650 mutex_lock(&conn->chan_lock);
1651
1652 list_for_each_entry(chan, &conn->chan_l, list) {
1653 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1654 l2cap_chan_set_err(chan, err);
1655 }
1656
1657 mutex_unlock(&conn->chan_lock);
1658 }
1659
l2cap_info_timeout(struct work_struct * work)1660 static void l2cap_info_timeout(struct work_struct *work)
1661 {
1662 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1663 info_timer.work);
1664
1665 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1666 conn->info_ident = 0;
1667
1668 l2cap_conn_start(conn);
1669 }
1670
1671 /*
1672 * l2cap_user
1673 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1674 * callback is called during registration. The ->remove callback is called
1675 * during unregistration.
1676 * An l2cap_user object can either be explicitly unregistered or when the
1677 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1678 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1679 * External modules must own a reference to the l2cap_conn object if they intend
1680 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1681 * any time if they don't.
1682 */
1683
l2cap_register_user(struct l2cap_conn * conn,struct l2cap_user * user)1684 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1685 {
1686 struct hci_dev *hdev = conn->hcon->hdev;
1687 int ret;
1688
1689 /* We need to check whether l2cap_conn is registered. If it is not, we
1690 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1691 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1692 * relies on the parent hci_conn object to be locked. This itself relies
1693 * on the hci_dev object to be locked. So we must lock the hci device
1694 * here, too. */
1695
1696 hci_dev_lock(hdev);
1697
1698 if (!list_empty(&user->list)) {
1699 ret = -EINVAL;
1700 goto out_unlock;
1701 }
1702
1703 /* conn->hchan is NULL after l2cap_conn_del() was called */
1704 if (!conn->hchan) {
1705 ret = -ENODEV;
1706 goto out_unlock;
1707 }
1708
1709 ret = user->probe(conn, user);
1710 if (ret)
1711 goto out_unlock;
1712
1713 list_add(&user->list, &conn->users);
1714 ret = 0;
1715
1716 out_unlock:
1717 hci_dev_unlock(hdev);
1718 return ret;
1719 }
1720 EXPORT_SYMBOL(l2cap_register_user);
1721
l2cap_unregister_user(struct l2cap_conn * conn,struct l2cap_user * user)1722 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1723 {
1724 struct hci_dev *hdev = conn->hcon->hdev;
1725
1726 hci_dev_lock(hdev);
1727
1728 if (list_empty(&user->list))
1729 goto out_unlock;
1730
1731 list_del_init(&user->list);
1732 user->remove(conn, user);
1733
1734 out_unlock:
1735 hci_dev_unlock(hdev);
1736 }
1737 EXPORT_SYMBOL(l2cap_unregister_user);
1738
l2cap_unregister_all_users(struct l2cap_conn * conn)1739 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1740 {
1741 struct l2cap_user *user;
1742
1743 while (!list_empty(&conn->users)) {
1744 user = list_first_entry(&conn->users, struct l2cap_user, list);
1745 list_del_init(&user->list);
1746 user->remove(conn, user);
1747 }
1748 }
1749
l2cap_conn_del(struct hci_conn * hcon,int err)1750 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1751 {
1752 struct l2cap_conn *conn = hcon->l2cap_data;
1753 struct l2cap_chan *chan, *l;
1754
1755 if (!conn)
1756 return;
1757
1758 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1759
1760 kfree_skb(conn->rx_skb);
1761
1762 skb_queue_purge(&conn->pending_rx);
1763
1764 /* We can not call flush_work(&conn->pending_rx_work) here since we
1765 * might block if we are running on a worker from the same workqueue
1766 * pending_rx_work is waiting on.
1767 */
1768 if (work_pending(&conn->pending_rx_work))
1769 cancel_work_sync(&conn->pending_rx_work);
1770
1771 cancel_delayed_work_sync(&conn->id_addr_timer);
1772
1773 l2cap_unregister_all_users(conn);
1774
1775 /* Force the connection to be immediately dropped */
1776 hcon->disc_timeout = 0;
1777
1778 mutex_lock(&conn->chan_lock);
1779
1780 /* Kill channels */
1781 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1782 l2cap_chan_hold(chan);
1783 l2cap_chan_lock(chan);
1784
1785 l2cap_chan_del(chan, err);
1786
1787 chan->ops->close(chan);
1788
1789 l2cap_chan_unlock(chan);
1790 l2cap_chan_put(chan);
1791 }
1792
1793 mutex_unlock(&conn->chan_lock);
1794
1795 hci_chan_del(conn->hchan);
1796
1797 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1798 cancel_delayed_work_sync(&conn->info_timer);
1799
1800 hcon->l2cap_data = NULL;
1801 conn->hchan = NULL;
1802 l2cap_conn_put(conn);
1803 }
1804
l2cap_conn_free(struct kref * ref)1805 static void l2cap_conn_free(struct kref *ref)
1806 {
1807 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1808
1809 hci_conn_put(conn->hcon);
1810 kfree(conn);
1811 }
1812
l2cap_conn_get(struct l2cap_conn * conn)1813 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1814 {
1815 kref_get(&conn->ref);
1816 return conn;
1817 }
1818 EXPORT_SYMBOL(l2cap_conn_get);
1819
l2cap_conn_put(struct l2cap_conn * conn)1820 void l2cap_conn_put(struct l2cap_conn *conn)
1821 {
1822 kref_put(&conn->ref, l2cap_conn_free);
1823 }
1824 EXPORT_SYMBOL(l2cap_conn_put);
1825
1826 /* ---- Socket interface ---- */
1827
1828 /* Find socket with psm and source / destination bdaddr.
1829 * Returns closest match.
1830 */
l2cap_global_chan_by_psm(int state,__le16 psm,bdaddr_t * src,bdaddr_t * dst,u8 link_type)1831 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1832 bdaddr_t *src,
1833 bdaddr_t *dst,
1834 u8 link_type)
1835 {
1836 struct l2cap_chan *c, *tmp, *c1 = NULL;
1837
1838 read_lock(&chan_list_lock);
1839
1840 list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1841 if (state && c->state != state)
1842 continue;
1843
1844 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1845 continue;
1846
1847 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1848 continue;
1849
1850 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
1851 int src_match, dst_match;
1852 int src_any, dst_any;
1853
1854 /* Exact match. */
1855 src_match = !bacmp(&c->src, src);
1856 dst_match = !bacmp(&c->dst, dst);
1857 if (src_match && dst_match) {
1858 if (!l2cap_chan_hold_unless_zero(c))
1859 continue;
1860
1861 read_unlock(&chan_list_lock);
1862 return c;
1863 }
1864
1865 /* Closest match */
1866 src_any = !bacmp(&c->src, BDADDR_ANY);
1867 dst_any = !bacmp(&c->dst, BDADDR_ANY);
1868 if ((src_match && dst_any) || (src_any && dst_match) ||
1869 (src_any && dst_any))
1870 c1 = c;
1871 }
1872 }
1873
1874 if (c1)
1875 c1 = l2cap_chan_hold_unless_zero(c1);
1876
1877 read_unlock(&chan_list_lock);
1878
1879 return c1;
1880 }
1881
l2cap_monitor_timeout(struct work_struct * work)1882 static void l2cap_monitor_timeout(struct work_struct *work)
1883 {
1884 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1885 monitor_timer.work);
1886
1887 BT_DBG("chan %p", chan);
1888
1889 l2cap_chan_lock(chan);
1890
1891 if (!chan->conn) {
1892 l2cap_chan_unlock(chan);
1893 l2cap_chan_put(chan);
1894 return;
1895 }
1896
1897 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1898
1899 l2cap_chan_unlock(chan);
1900 l2cap_chan_put(chan);
1901 }
1902
l2cap_retrans_timeout(struct work_struct * work)1903 static void l2cap_retrans_timeout(struct work_struct *work)
1904 {
1905 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1906 retrans_timer.work);
1907
1908 BT_DBG("chan %p", chan);
1909
1910 l2cap_chan_lock(chan);
1911
1912 if (!chan->conn) {
1913 l2cap_chan_unlock(chan);
1914 l2cap_chan_put(chan);
1915 return;
1916 }
1917
1918 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1919 l2cap_chan_unlock(chan);
1920 l2cap_chan_put(chan);
1921 }
1922
l2cap_streaming_send(struct l2cap_chan * chan,struct sk_buff_head * skbs)1923 static void l2cap_streaming_send(struct l2cap_chan *chan,
1924 struct sk_buff_head *skbs)
1925 {
1926 struct sk_buff *skb;
1927 struct l2cap_ctrl *control;
1928
1929 BT_DBG("chan %p, skbs %p", chan, skbs);
1930
1931 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1932
1933 while (!skb_queue_empty(&chan->tx_q)) {
1934
1935 skb = skb_dequeue(&chan->tx_q);
1936
1937 bt_cb(skb)->l2cap.retries = 1;
1938 control = &bt_cb(skb)->l2cap;
1939
1940 control->reqseq = 0;
1941 control->txseq = chan->next_tx_seq;
1942
1943 __pack_control(chan, control, skb);
1944
1945 if (chan->fcs == L2CAP_FCS_CRC16) {
1946 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1947 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1948 }
1949
1950 l2cap_do_send(chan, skb);
1951
1952 BT_DBG("Sent txseq %u", control->txseq);
1953
1954 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1955 chan->frames_sent++;
1956 }
1957 }
1958
l2cap_ertm_send(struct l2cap_chan * chan)1959 static int l2cap_ertm_send(struct l2cap_chan *chan)
1960 {
1961 struct sk_buff *skb, *tx_skb;
1962 struct l2cap_ctrl *control;
1963 int sent = 0;
1964
1965 BT_DBG("chan %p", chan);
1966
1967 if (chan->state != BT_CONNECTED)
1968 return -ENOTCONN;
1969
1970 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1971 return 0;
1972
1973 while (chan->tx_send_head &&
1974 chan->unacked_frames < chan->remote_tx_win &&
1975 chan->tx_state == L2CAP_TX_STATE_XMIT) {
1976
1977 skb = chan->tx_send_head;
1978
1979 bt_cb(skb)->l2cap.retries = 1;
1980 control = &bt_cb(skb)->l2cap;
1981
1982 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1983 control->final = 1;
1984
1985 control->reqseq = chan->buffer_seq;
1986 chan->last_acked_seq = chan->buffer_seq;
1987 control->txseq = chan->next_tx_seq;
1988
1989 __pack_control(chan, control, skb);
1990
1991 if (chan->fcs == L2CAP_FCS_CRC16) {
1992 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1993 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1994 }
1995
1996 /* Clone after data has been modified. Data is assumed to be
1997 read-only (for locking purposes) on cloned sk_buffs.
1998 */
1999 tx_skb = skb_clone(skb, GFP_KERNEL);
2000
2001 if (!tx_skb)
2002 break;
2003
2004 __set_retrans_timer(chan);
2005
2006 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2007 chan->unacked_frames++;
2008 chan->frames_sent++;
2009 sent++;
2010
2011 if (skb_queue_is_last(&chan->tx_q, skb))
2012 chan->tx_send_head = NULL;
2013 else
2014 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2015
2016 l2cap_do_send(chan, tx_skb);
2017 BT_DBG("Sent txseq %u", control->txseq);
2018 }
2019
2020 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2021 chan->unacked_frames, skb_queue_len(&chan->tx_q));
2022
2023 return sent;
2024 }
2025
l2cap_ertm_resend(struct l2cap_chan * chan)2026 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2027 {
2028 struct l2cap_ctrl control;
2029 struct sk_buff *skb;
2030 struct sk_buff *tx_skb;
2031 u16 seq;
2032
2033 BT_DBG("chan %p", chan);
2034
2035 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2036 return;
2037
2038 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2039 seq = l2cap_seq_list_pop(&chan->retrans_list);
2040
2041 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2042 if (!skb) {
2043 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2044 seq);
2045 continue;
2046 }
2047
2048 bt_cb(skb)->l2cap.retries++;
2049 control = bt_cb(skb)->l2cap;
2050
2051 if (chan->max_tx != 0 &&
2052 bt_cb(skb)->l2cap.retries > chan->max_tx) {
2053 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2054 l2cap_send_disconn_req(chan, ECONNRESET);
2055 l2cap_seq_list_clear(&chan->retrans_list);
2056 break;
2057 }
2058
2059 control.reqseq = chan->buffer_seq;
2060 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2061 control.final = 1;
2062 else
2063 control.final = 0;
2064
2065 if (skb_cloned(skb)) {
2066 /* Cloned sk_buffs are read-only, so we need a
2067 * writeable copy
2068 */
2069 tx_skb = skb_copy(skb, GFP_KERNEL);
2070 } else {
2071 tx_skb = skb_clone(skb, GFP_KERNEL);
2072 }
2073
2074 if (!tx_skb) {
2075 l2cap_seq_list_clear(&chan->retrans_list);
2076 break;
2077 }
2078
2079 /* Update skb contents */
2080 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2081 put_unaligned_le32(__pack_extended_control(&control),
2082 tx_skb->data + L2CAP_HDR_SIZE);
2083 } else {
2084 put_unaligned_le16(__pack_enhanced_control(&control),
2085 tx_skb->data + L2CAP_HDR_SIZE);
2086 }
2087
2088 /* Update FCS */
2089 if (chan->fcs == L2CAP_FCS_CRC16) {
2090 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2091 tx_skb->len - L2CAP_FCS_SIZE);
2092 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2093 L2CAP_FCS_SIZE);
2094 }
2095
2096 l2cap_do_send(chan, tx_skb);
2097
2098 BT_DBG("Resent txseq %d", control.txseq);
2099
2100 chan->last_acked_seq = chan->buffer_seq;
2101 }
2102 }
2103
l2cap_retransmit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2104 static void l2cap_retransmit(struct l2cap_chan *chan,
2105 struct l2cap_ctrl *control)
2106 {
2107 BT_DBG("chan %p, control %p", chan, control);
2108
2109 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2110 l2cap_ertm_resend(chan);
2111 }
2112
l2cap_retransmit_all(struct l2cap_chan * chan,struct l2cap_ctrl * control)2113 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2114 struct l2cap_ctrl *control)
2115 {
2116 struct sk_buff *skb;
2117
2118 BT_DBG("chan %p, control %p", chan, control);
2119
2120 if (control->poll)
2121 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2122
2123 l2cap_seq_list_clear(&chan->retrans_list);
2124
2125 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2126 return;
2127
2128 if (chan->unacked_frames) {
2129 skb_queue_walk(&chan->tx_q, skb) {
2130 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2131 skb == chan->tx_send_head)
2132 break;
2133 }
2134
2135 skb_queue_walk_from(&chan->tx_q, skb) {
2136 if (skb == chan->tx_send_head)
2137 break;
2138
2139 l2cap_seq_list_append(&chan->retrans_list,
2140 bt_cb(skb)->l2cap.txseq);
2141 }
2142
2143 l2cap_ertm_resend(chan);
2144 }
2145 }
2146
l2cap_send_ack(struct l2cap_chan * chan)2147 static void l2cap_send_ack(struct l2cap_chan *chan)
2148 {
2149 struct l2cap_ctrl control;
2150 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2151 chan->last_acked_seq);
2152 int threshold;
2153
2154 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2155 chan, chan->last_acked_seq, chan->buffer_seq);
2156
2157 memset(&control, 0, sizeof(control));
2158 control.sframe = 1;
2159
2160 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2161 chan->rx_state == L2CAP_RX_STATE_RECV) {
2162 __clear_ack_timer(chan);
2163 control.super = L2CAP_SUPER_RNR;
2164 control.reqseq = chan->buffer_seq;
2165 l2cap_send_sframe(chan, &control);
2166 } else {
2167 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2168 l2cap_ertm_send(chan);
2169 /* If any i-frames were sent, they included an ack */
2170 if (chan->buffer_seq == chan->last_acked_seq)
2171 frames_to_ack = 0;
2172 }
2173
2174 /* Ack now if the window is 3/4ths full.
2175 * Calculate without mul or div
2176 */
2177 threshold = chan->ack_win;
2178 threshold += threshold << 1;
2179 threshold >>= 2;
2180
2181 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2182 threshold);
2183
2184 if (frames_to_ack >= threshold) {
2185 __clear_ack_timer(chan);
2186 control.super = L2CAP_SUPER_RR;
2187 control.reqseq = chan->buffer_seq;
2188 l2cap_send_sframe(chan, &control);
2189 frames_to_ack = 0;
2190 }
2191
2192 if (frames_to_ack)
2193 __set_ack_timer(chan);
2194 }
2195 }
2196
l2cap_skbuff_fromiovec(struct l2cap_chan * chan,struct msghdr * msg,int len,int count,struct sk_buff * skb)2197 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2198 struct msghdr *msg, int len,
2199 int count, struct sk_buff *skb)
2200 {
2201 struct l2cap_conn *conn = chan->conn;
2202 struct sk_buff **frag;
2203 int sent = 0;
2204
2205 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2206 return -EFAULT;
2207
2208 sent += count;
2209 len -= count;
2210
2211 /* Continuation fragments (no L2CAP header) */
2212 frag = &skb_shinfo(skb)->frag_list;
2213 while (len) {
2214 struct sk_buff *tmp;
2215
2216 count = min_t(unsigned int, conn->mtu, len);
2217
2218 tmp = chan->ops->alloc_skb(chan, 0, count,
2219 msg->msg_flags & MSG_DONTWAIT);
2220 if (IS_ERR(tmp))
2221 return PTR_ERR(tmp);
2222
2223 *frag = tmp;
2224
2225 if (!copy_from_iter_full(skb_put(*frag, count), count,
2226 &msg->msg_iter))
2227 return -EFAULT;
2228
2229 sent += count;
2230 len -= count;
2231
2232 skb->len += (*frag)->len;
2233 skb->data_len += (*frag)->len;
2234
2235 frag = &(*frag)->next;
2236 }
2237
2238 return sent;
2239 }
2240
l2cap_create_connless_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2241 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2242 struct msghdr *msg, size_t len)
2243 {
2244 struct l2cap_conn *conn = chan->conn;
2245 struct sk_buff *skb;
2246 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2247 struct l2cap_hdr *lh;
2248
2249 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2250 __le16_to_cpu(chan->psm), len);
2251
2252 count = min_t(unsigned int, (conn->mtu - hlen), len);
2253
2254 skb = chan->ops->alloc_skb(chan, hlen, count,
2255 msg->msg_flags & MSG_DONTWAIT);
2256 if (IS_ERR(skb))
2257 return skb;
2258
2259 /* Create L2CAP header */
2260 lh = skb_put(skb, L2CAP_HDR_SIZE);
2261 lh->cid = cpu_to_le16(chan->dcid);
2262 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2263 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2264
2265 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2266 if (unlikely(err < 0)) {
2267 kfree_skb(skb);
2268 return ERR_PTR(err);
2269 }
2270 return skb;
2271 }
2272
l2cap_create_basic_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2273 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2274 struct msghdr *msg, size_t len)
2275 {
2276 struct l2cap_conn *conn = chan->conn;
2277 struct sk_buff *skb;
2278 int err, count;
2279 struct l2cap_hdr *lh;
2280
2281 BT_DBG("chan %p len %zu", chan, len);
2282
2283 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2284
2285 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2286 msg->msg_flags & MSG_DONTWAIT);
2287 if (IS_ERR(skb))
2288 return skb;
2289
2290 /* Create L2CAP header */
2291 lh = skb_put(skb, L2CAP_HDR_SIZE);
2292 lh->cid = cpu_to_le16(chan->dcid);
2293 lh->len = cpu_to_le16(len);
2294
2295 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2296 if (unlikely(err < 0)) {
2297 kfree_skb(skb);
2298 return ERR_PTR(err);
2299 }
2300 return skb;
2301 }
2302
l2cap_create_iframe_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2303 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2304 struct msghdr *msg, size_t len,
2305 u16 sdulen)
2306 {
2307 struct l2cap_conn *conn = chan->conn;
2308 struct sk_buff *skb;
2309 int err, count, hlen;
2310 struct l2cap_hdr *lh;
2311
2312 BT_DBG("chan %p len %zu", chan, len);
2313
2314 if (!conn)
2315 return ERR_PTR(-ENOTCONN);
2316
2317 hlen = __ertm_hdr_size(chan);
2318
2319 if (sdulen)
2320 hlen += L2CAP_SDULEN_SIZE;
2321
2322 if (chan->fcs == L2CAP_FCS_CRC16)
2323 hlen += L2CAP_FCS_SIZE;
2324
2325 count = min_t(unsigned int, (conn->mtu - hlen), len);
2326
2327 skb = chan->ops->alloc_skb(chan, hlen, count,
2328 msg->msg_flags & MSG_DONTWAIT);
2329 if (IS_ERR(skb))
2330 return skb;
2331
2332 /* Create L2CAP header */
2333 lh = skb_put(skb, L2CAP_HDR_SIZE);
2334 lh->cid = cpu_to_le16(chan->dcid);
2335 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2336
2337 /* Control header is populated later */
2338 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2339 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2340 else
2341 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2342
2343 if (sdulen)
2344 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2345
2346 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2347 if (unlikely(err < 0)) {
2348 kfree_skb(skb);
2349 return ERR_PTR(err);
2350 }
2351
2352 bt_cb(skb)->l2cap.fcs = chan->fcs;
2353 bt_cb(skb)->l2cap.retries = 0;
2354 return skb;
2355 }
2356
l2cap_segment_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2357 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2358 struct sk_buff_head *seg_queue,
2359 struct msghdr *msg, size_t len)
2360 {
2361 struct sk_buff *skb;
2362 u16 sdu_len;
2363 size_t pdu_len;
2364 u8 sar;
2365
2366 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2367
2368 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2369 * so fragmented skbs are not used. The HCI layer's handling
2370 * of fragmented skbs is not compatible with ERTM's queueing.
2371 */
2372
2373 /* PDU size is derived from the HCI MTU */
2374 pdu_len = chan->conn->mtu;
2375
2376 /* Constrain PDU size for BR/EDR connections */
2377 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2378
2379 /* Adjust for largest possible L2CAP overhead. */
2380 if (chan->fcs)
2381 pdu_len -= L2CAP_FCS_SIZE;
2382
2383 pdu_len -= __ertm_hdr_size(chan);
2384
2385 /* Remote device may have requested smaller PDUs */
2386 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2387
2388 if (len <= pdu_len) {
2389 sar = L2CAP_SAR_UNSEGMENTED;
2390 sdu_len = 0;
2391 pdu_len = len;
2392 } else {
2393 sar = L2CAP_SAR_START;
2394 sdu_len = len;
2395 }
2396
2397 while (len > 0) {
2398 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2399
2400 if (IS_ERR(skb)) {
2401 __skb_queue_purge(seg_queue);
2402 return PTR_ERR(skb);
2403 }
2404
2405 bt_cb(skb)->l2cap.sar = sar;
2406 __skb_queue_tail(seg_queue, skb);
2407
2408 len -= pdu_len;
2409 if (sdu_len)
2410 sdu_len = 0;
2411
2412 if (len <= pdu_len) {
2413 sar = L2CAP_SAR_END;
2414 pdu_len = len;
2415 } else {
2416 sar = L2CAP_SAR_CONTINUE;
2417 }
2418 }
2419
2420 return 0;
2421 }
2422
l2cap_create_le_flowctl_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2423 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2424 struct msghdr *msg,
2425 size_t len, u16 sdulen)
2426 {
2427 struct l2cap_conn *conn = chan->conn;
2428 struct sk_buff *skb;
2429 int err, count, hlen;
2430 struct l2cap_hdr *lh;
2431
2432 BT_DBG("chan %p len %zu", chan, len);
2433
2434 if (!conn)
2435 return ERR_PTR(-ENOTCONN);
2436
2437 hlen = L2CAP_HDR_SIZE;
2438
2439 if (sdulen)
2440 hlen += L2CAP_SDULEN_SIZE;
2441
2442 count = min_t(unsigned int, (conn->mtu - hlen), len);
2443
2444 skb = chan->ops->alloc_skb(chan, hlen, count,
2445 msg->msg_flags & MSG_DONTWAIT);
2446 if (IS_ERR(skb))
2447 return skb;
2448
2449 /* Create L2CAP header */
2450 lh = skb_put(skb, L2CAP_HDR_SIZE);
2451 lh->cid = cpu_to_le16(chan->dcid);
2452 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2453
2454 if (sdulen)
2455 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2456
2457 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2458 if (unlikely(err < 0)) {
2459 kfree_skb(skb);
2460 return ERR_PTR(err);
2461 }
2462
2463 return skb;
2464 }
2465
l2cap_segment_le_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2466 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2467 struct sk_buff_head *seg_queue,
2468 struct msghdr *msg, size_t len)
2469 {
2470 struct sk_buff *skb;
2471 size_t pdu_len;
2472 u16 sdu_len;
2473
2474 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2475
2476 sdu_len = len;
2477 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2478
2479 while (len > 0) {
2480 if (len <= pdu_len)
2481 pdu_len = len;
2482
2483 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2484 if (IS_ERR(skb)) {
2485 __skb_queue_purge(seg_queue);
2486 return PTR_ERR(skb);
2487 }
2488
2489 __skb_queue_tail(seg_queue, skb);
2490
2491 len -= pdu_len;
2492
2493 if (sdu_len) {
2494 sdu_len = 0;
2495 pdu_len += L2CAP_SDULEN_SIZE;
2496 }
2497 }
2498
2499 return 0;
2500 }
2501
l2cap_le_flowctl_send(struct l2cap_chan * chan)2502 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2503 {
2504 int sent = 0;
2505
2506 BT_DBG("chan %p", chan);
2507
2508 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2509 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2510 chan->tx_credits--;
2511 sent++;
2512 }
2513
2514 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2515 skb_queue_len(&chan->tx_q));
2516 }
2517
l2cap_chan_send(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2518 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2519 {
2520 struct sk_buff *skb;
2521 int err;
2522 struct sk_buff_head seg_queue;
2523
2524 if (!chan->conn)
2525 return -ENOTCONN;
2526
2527 /* Connectionless channel */
2528 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2529 skb = l2cap_create_connless_pdu(chan, msg, len);
2530 if (IS_ERR(skb))
2531 return PTR_ERR(skb);
2532
2533 l2cap_do_send(chan, skb);
2534 return len;
2535 }
2536
2537 switch (chan->mode) {
2538 case L2CAP_MODE_LE_FLOWCTL:
2539 case L2CAP_MODE_EXT_FLOWCTL:
2540 /* Check outgoing MTU */
2541 if (len > chan->omtu)
2542 return -EMSGSIZE;
2543
2544 __skb_queue_head_init(&seg_queue);
2545
2546 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2547
2548 if (chan->state != BT_CONNECTED) {
2549 __skb_queue_purge(&seg_queue);
2550 err = -ENOTCONN;
2551 }
2552
2553 if (err)
2554 return err;
2555
2556 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2557
2558 l2cap_le_flowctl_send(chan);
2559
2560 if (!chan->tx_credits)
2561 chan->ops->suspend(chan);
2562
2563 err = len;
2564
2565 break;
2566
2567 case L2CAP_MODE_BASIC:
2568 /* Check outgoing MTU */
2569 if (len > chan->omtu)
2570 return -EMSGSIZE;
2571
2572 /* Create a basic PDU */
2573 skb = l2cap_create_basic_pdu(chan, msg, len);
2574 if (IS_ERR(skb))
2575 return PTR_ERR(skb);
2576
2577 l2cap_do_send(chan, skb);
2578 err = len;
2579 break;
2580
2581 case L2CAP_MODE_ERTM:
2582 case L2CAP_MODE_STREAMING:
2583 /* Check outgoing MTU */
2584 if (len > chan->omtu) {
2585 err = -EMSGSIZE;
2586 break;
2587 }
2588
2589 __skb_queue_head_init(&seg_queue);
2590
2591 /* Do segmentation before calling in to the state machine,
2592 * since it's possible to block while waiting for memory
2593 * allocation.
2594 */
2595 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2596
2597 if (err)
2598 break;
2599
2600 if (chan->mode == L2CAP_MODE_ERTM)
2601 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2602 else
2603 l2cap_streaming_send(chan, &seg_queue);
2604
2605 err = len;
2606
2607 /* If the skbs were not queued for sending, they'll still be in
2608 * seg_queue and need to be purged.
2609 */
2610 __skb_queue_purge(&seg_queue);
2611 break;
2612
2613 default:
2614 BT_DBG("bad state %1.1x", chan->mode);
2615 err = -EBADFD;
2616 }
2617
2618 return err;
2619 }
2620 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2621
l2cap_send_srej(struct l2cap_chan * chan,u16 txseq)2622 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2623 {
2624 struct l2cap_ctrl control;
2625 u16 seq;
2626
2627 BT_DBG("chan %p, txseq %u", chan, txseq);
2628
2629 memset(&control, 0, sizeof(control));
2630 control.sframe = 1;
2631 control.super = L2CAP_SUPER_SREJ;
2632
2633 for (seq = chan->expected_tx_seq; seq != txseq;
2634 seq = __next_seq(chan, seq)) {
2635 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2636 control.reqseq = seq;
2637 l2cap_send_sframe(chan, &control);
2638 l2cap_seq_list_append(&chan->srej_list, seq);
2639 }
2640 }
2641
2642 chan->expected_tx_seq = __next_seq(chan, txseq);
2643 }
2644
l2cap_send_srej_tail(struct l2cap_chan * chan)2645 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2646 {
2647 struct l2cap_ctrl control;
2648
2649 BT_DBG("chan %p", chan);
2650
2651 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2652 return;
2653
2654 memset(&control, 0, sizeof(control));
2655 control.sframe = 1;
2656 control.super = L2CAP_SUPER_SREJ;
2657 control.reqseq = chan->srej_list.tail;
2658 l2cap_send_sframe(chan, &control);
2659 }
2660
l2cap_send_srej_list(struct l2cap_chan * chan,u16 txseq)2661 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2662 {
2663 struct l2cap_ctrl control;
2664 u16 initial_head;
2665 u16 seq;
2666
2667 BT_DBG("chan %p, txseq %u", chan, txseq);
2668
2669 memset(&control, 0, sizeof(control));
2670 control.sframe = 1;
2671 control.super = L2CAP_SUPER_SREJ;
2672
2673 /* Capture initial list head to allow only one pass through the list. */
2674 initial_head = chan->srej_list.head;
2675
2676 do {
2677 seq = l2cap_seq_list_pop(&chan->srej_list);
2678 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2679 break;
2680
2681 control.reqseq = seq;
2682 l2cap_send_sframe(chan, &control);
2683 l2cap_seq_list_append(&chan->srej_list, seq);
2684 } while (chan->srej_list.head != initial_head);
2685 }
2686
l2cap_process_reqseq(struct l2cap_chan * chan,u16 reqseq)2687 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2688 {
2689 struct sk_buff *acked_skb;
2690 u16 ackseq;
2691
2692 BT_DBG("chan %p, reqseq %u", chan, reqseq);
2693
2694 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2695 return;
2696
2697 BT_DBG("expected_ack_seq %u, unacked_frames %u",
2698 chan->expected_ack_seq, chan->unacked_frames);
2699
2700 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2701 ackseq = __next_seq(chan, ackseq)) {
2702
2703 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2704 if (acked_skb) {
2705 skb_unlink(acked_skb, &chan->tx_q);
2706 kfree_skb(acked_skb);
2707 chan->unacked_frames--;
2708 }
2709 }
2710
2711 chan->expected_ack_seq = reqseq;
2712
2713 if (chan->unacked_frames == 0)
2714 __clear_retrans_timer(chan);
2715
2716 BT_DBG("unacked_frames %u", chan->unacked_frames);
2717 }
2718
l2cap_abort_rx_srej_sent(struct l2cap_chan * chan)2719 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2720 {
2721 BT_DBG("chan %p", chan);
2722
2723 chan->expected_tx_seq = chan->buffer_seq;
2724 l2cap_seq_list_clear(&chan->srej_list);
2725 skb_queue_purge(&chan->srej_q);
2726 chan->rx_state = L2CAP_RX_STATE_RECV;
2727 }
2728
l2cap_tx_state_xmit(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2729 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2730 struct l2cap_ctrl *control,
2731 struct sk_buff_head *skbs, u8 event)
2732 {
2733 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2734 event);
2735
2736 switch (event) {
2737 case L2CAP_EV_DATA_REQUEST:
2738 if (chan->tx_send_head == NULL)
2739 chan->tx_send_head = skb_peek(skbs);
2740
2741 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2742 l2cap_ertm_send(chan);
2743 break;
2744 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2745 BT_DBG("Enter LOCAL_BUSY");
2746 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2747
2748 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2749 /* The SREJ_SENT state must be aborted if we are to
2750 * enter the LOCAL_BUSY state.
2751 */
2752 l2cap_abort_rx_srej_sent(chan);
2753 }
2754
2755 l2cap_send_ack(chan);
2756
2757 break;
2758 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2759 BT_DBG("Exit LOCAL_BUSY");
2760 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2761
2762 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2763 struct l2cap_ctrl local_control;
2764
2765 memset(&local_control, 0, sizeof(local_control));
2766 local_control.sframe = 1;
2767 local_control.super = L2CAP_SUPER_RR;
2768 local_control.poll = 1;
2769 local_control.reqseq = chan->buffer_seq;
2770 l2cap_send_sframe(chan, &local_control);
2771
2772 chan->retry_count = 1;
2773 __set_monitor_timer(chan);
2774 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2775 }
2776 break;
2777 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2778 l2cap_process_reqseq(chan, control->reqseq);
2779 break;
2780 case L2CAP_EV_EXPLICIT_POLL:
2781 l2cap_send_rr_or_rnr(chan, 1);
2782 chan->retry_count = 1;
2783 __set_monitor_timer(chan);
2784 __clear_ack_timer(chan);
2785 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2786 break;
2787 case L2CAP_EV_RETRANS_TO:
2788 l2cap_send_rr_or_rnr(chan, 1);
2789 chan->retry_count = 1;
2790 __set_monitor_timer(chan);
2791 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2792 break;
2793 case L2CAP_EV_RECV_FBIT:
2794 /* Nothing to process */
2795 break;
2796 default:
2797 break;
2798 }
2799 }
2800
l2cap_tx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2801 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2802 struct l2cap_ctrl *control,
2803 struct sk_buff_head *skbs, u8 event)
2804 {
2805 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2806 event);
2807
2808 switch (event) {
2809 case L2CAP_EV_DATA_REQUEST:
2810 if (chan->tx_send_head == NULL)
2811 chan->tx_send_head = skb_peek(skbs);
2812 /* Queue data, but don't send. */
2813 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2814 break;
2815 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2816 BT_DBG("Enter LOCAL_BUSY");
2817 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2818
2819 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2820 /* The SREJ_SENT state must be aborted if we are to
2821 * enter the LOCAL_BUSY state.
2822 */
2823 l2cap_abort_rx_srej_sent(chan);
2824 }
2825
2826 l2cap_send_ack(chan);
2827
2828 break;
2829 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2830 BT_DBG("Exit LOCAL_BUSY");
2831 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2832
2833 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2834 struct l2cap_ctrl local_control;
2835 memset(&local_control, 0, sizeof(local_control));
2836 local_control.sframe = 1;
2837 local_control.super = L2CAP_SUPER_RR;
2838 local_control.poll = 1;
2839 local_control.reqseq = chan->buffer_seq;
2840 l2cap_send_sframe(chan, &local_control);
2841
2842 chan->retry_count = 1;
2843 __set_monitor_timer(chan);
2844 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2845 }
2846 break;
2847 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2848 l2cap_process_reqseq(chan, control->reqseq);
2849 fallthrough;
2850
2851 case L2CAP_EV_RECV_FBIT:
2852 if (control && control->final) {
2853 __clear_monitor_timer(chan);
2854 if (chan->unacked_frames > 0)
2855 __set_retrans_timer(chan);
2856 chan->retry_count = 0;
2857 chan->tx_state = L2CAP_TX_STATE_XMIT;
2858 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2859 }
2860 break;
2861 case L2CAP_EV_EXPLICIT_POLL:
2862 /* Ignore */
2863 break;
2864 case L2CAP_EV_MONITOR_TO:
2865 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2866 l2cap_send_rr_or_rnr(chan, 1);
2867 __set_monitor_timer(chan);
2868 chan->retry_count++;
2869 } else {
2870 l2cap_send_disconn_req(chan, ECONNABORTED);
2871 }
2872 break;
2873 default:
2874 break;
2875 }
2876 }
2877
l2cap_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2878 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2879 struct sk_buff_head *skbs, u8 event)
2880 {
2881 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2882 chan, control, skbs, event, chan->tx_state);
2883
2884 switch (chan->tx_state) {
2885 case L2CAP_TX_STATE_XMIT:
2886 l2cap_tx_state_xmit(chan, control, skbs, event);
2887 break;
2888 case L2CAP_TX_STATE_WAIT_F:
2889 l2cap_tx_state_wait_f(chan, control, skbs, event);
2890 break;
2891 default:
2892 /* Ignore event */
2893 break;
2894 }
2895 }
2896
l2cap_pass_to_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control)2897 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2898 struct l2cap_ctrl *control)
2899 {
2900 BT_DBG("chan %p, control %p", chan, control);
2901 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2902 }
2903
l2cap_pass_to_tx_fbit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2904 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2905 struct l2cap_ctrl *control)
2906 {
2907 BT_DBG("chan %p, control %p", chan, control);
2908 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2909 }
2910
2911 /* Copy frame to all raw sockets on that connection */
l2cap_raw_recv(struct l2cap_conn * conn,struct sk_buff * skb)2912 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2913 {
2914 struct sk_buff *nskb;
2915 struct l2cap_chan *chan;
2916
2917 BT_DBG("conn %p", conn);
2918
2919 mutex_lock(&conn->chan_lock);
2920
2921 list_for_each_entry(chan, &conn->chan_l, list) {
2922 if (chan->chan_type != L2CAP_CHAN_RAW)
2923 continue;
2924
2925 /* Don't send frame to the channel it came from */
2926 if (bt_cb(skb)->l2cap.chan == chan)
2927 continue;
2928
2929 nskb = skb_clone(skb, GFP_KERNEL);
2930 if (!nskb)
2931 continue;
2932 if (chan->ops->recv(chan, nskb))
2933 kfree_skb(nskb);
2934 }
2935
2936 mutex_unlock(&conn->chan_lock);
2937 }
2938
2939 /* ---- L2CAP signalling commands ---- */
l2cap_build_cmd(struct l2cap_conn * conn,u8 code,u8 ident,u16 dlen,void * data)2940 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2941 u8 ident, u16 dlen, void *data)
2942 {
2943 struct sk_buff *skb, **frag;
2944 struct l2cap_cmd_hdr *cmd;
2945 struct l2cap_hdr *lh;
2946 int len, count;
2947
2948 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2949 conn, code, ident, dlen);
2950
2951 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2952 return NULL;
2953
2954 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2955 count = min_t(unsigned int, conn->mtu, len);
2956
2957 skb = bt_skb_alloc(count, GFP_KERNEL);
2958 if (!skb)
2959 return NULL;
2960
2961 lh = skb_put(skb, L2CAP_HDR_SIZE);
2962 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2963
2964 if (conn->hcon->type == LE_LINK)
2965 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2966 else
2967 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2968
2969 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
2970 cmd->code = code;
2971 cmd->ident = ident;
2972 cmd->len = cpu_to_le16(dlen);
2973
2974 if (dlen) {
2975 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2976 skb_put_data(skb, data, count);
2977 data += count;
2978 }
2979
2980 len -= skb->len;
2981
2982 /* Continuation fragments (no L2CAP header) */
2983 frag = &skb_shinfo(skb)->frag_list;
2984 while (len) {
2985 count = min_t(unsigned int, conn->mtu, len);
2986
2987 *frag = bt_skb_alloc(count, GFP_KERNEL);
2988 if (!*frag)
2989 goto fail;
2990
2991 skb_put_data(*frag, data, count);
2992
2993 len -= count;
2994 data += count;
2995
2996 frag = &(*frag)->next;
2997 }
2998
2999 return skb;
3000
3001 fail:
3002 kfree_skb(skb);
3003 return NULL;
3004 }
3005
l2cap_get_conf_opt(void ** ptr,int * type,int * olen,unsigned long * val)3006 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3007 unsigned long *val)
3008 {
3009 struct l2cap_conf_opt *opt = *ptr;
3010 int len;
3011
3012 len = L2CAP_CONF_OPT_SIZE + opt->len;
3013 *ptr += len;
3014
3015 *type = opt->type;
3016 *olen = opt->len;
3017
3018 switch (opt->len) {
3019 case 1:
3020 *val = *((u8 *) opt->val);
3021 break;
3022
3023 case 2:
3024 *val = get_unaligned_le16(opt->val);
3025 break;
3026
3027 case 4:
3028 *val = get_unaligned_le32(opt->val);
3029 break;
3030
3031 default:
3032 *val = (unsigned long) opt->val;
3033 break;
3034 }
3035
3036 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3037 return len;
3038 }
3039
l2cap_add_conf_opt(void ** ptr,u8 type,u8 len,unsigned long val,size_t size)3040 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3041 {
3042 struct l2cap_conf_opt *opt = *ptr;
3043
3044 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3045
3046 if (size < L2CAP_CONF_OPT_SIZE + len)
3047 return;
3048
3049 opt->type = type;
3050 opt->len = len;
3051
3052 switch (len) {
3053 case 1:
3054 *((u8 *) opt->val) = val;
3055 break;
3056
3057 case 2:
3058 put_unaligned_le16(val, opt->val);
3059 break;
3060
3061 case 4:
3062 put_unaligned_le32(val, opt->val);
3063 break;
3064
3065 default:
3066 memcpy(opt->val, (void *) val, len);
3067 break;
3068 }
3069
3070 *ptr += L2CAP_CONF_OPT_SIZE + len;
3071 }
3072
l2cap_add_opt_efs(void ** ptr,struct l2cap_chan * chan,size_t size)3073 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3074 {
3075 struct l2cap_conf_efs efs;
3076
3077 switch (chan->mode) {
3078 case L2CAP_MODE_ERTM:
3079 efs.id = chan->local_id;
3080 efs.stype = chan->local_stype;
3081 efs.msdu = cpu_to_le16(chan->local_msdu);
3082 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3083 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3084 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3085 break;
3086
3087 case L2CAP_MODE_STREAMING:
3088 efs.id = 1;
3089 efs.stype = L2CAP_SERV_BESTEFFORT;
3090 efs.msdu = cpu_to_le16(chan->local_msdu);
3091 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3092 efs.acc_lat = 0;
3093 efs.flush_to = 0;
3094 break;
3095
3096 default:
3097 return;
3098 }
3099
3100 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3101 (unsigned long) &efs, size);
3102 }
3103
l2cap_ack_timeout(struct work_struct * work)3104 static void l2cap_ack_timeout(struct work_struct *work)
3105 {
3106 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3107 ack_timer.work);
3108 u16 frames_to_ack;
3109
3110 BT_DBG("chan %p", chan);
3111
3112 l2cap_chan_lock(chan);
3113
3114 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3115 chan->last_acked_seq);
3116
3117 if (frames_to_ack)
3118 l2cap_send_rr_or_rnr(chan, 0);
3119
3120 l2cap_chan_unlock(chan);
3121 l2cap_chan_put(chan);
3122 }
3123
l2cap_ertm_init(struct l2cap_chan * chan)3124 int l2cap_ertm_init(struct l2cap_chan *chan)
3125 {
3126 int err;
3127
3128 chan->next_tx_seq = 0;
3129 chan->expected_tx_seq = 0;
3130 chan->expected_ack_seq = 0;
3131 chan->unacked_frames = 0;
3132 chan->buffer_seq = 0;
3133 chan->frames_sent = 0;
3134 chan->last_acked_seq = 0;
3135 chan->sdu = NULL;
3136 chan->sdu_last_frag = NULL;
3137 chan->sdu_len = 0;
3138
3139 skb_queue_head_init(&chan->tx_q);
3140
3141 if (chan->mode != L2CAP_MODE_ERTM)
3142 return 0;
3143
3144 chan->rx_state = L2CAP_RX_STATE_RECV;
3145 chan->tx_state = L2CAP_TX_STATE_XMIT;
3146
3147 skb_queue_head_init(&chan->srej_q);
3148
3149 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3150 if (err < 0)
3151 return err;
3152
3153 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3154 if (err < 0)
3155 l2cap_seq_list_free(&chan->srej_list);
3156
3157 return err;
3158 }
3159
l2cap_select_mode(__u8 mode,__u16 remote_feat_mask)3160 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3161 {
3162 switch (mode) {
3163 case L2CAP_MODE_STREAMING:
3164 case L2CAP_MODE_ERTM:
3165 if (l2cap_mode_supported(mode, remote_feat_mask))
3166 return mode;
3167 fallthrough;
3168 default:
3169 return L2CAP_MODE_BASIC;
3170 }
3171 }
3172
__l2cap_ews_supported(struct l2cap_conn * conn)3173 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3174 {
3175 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
3176 }
3177
__l2cap_efs_supported(struct l2cap_conn * conn)3178 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3179 {
3180 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
3181 }
3182
__l2cap_set_ertm_timeouts(struct l2cap_chan * chan,struct l2cap_conf_rfc * rfc)3183 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3184 struct l2cap_conf_rfc *rfc)
3185 {
3186 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3187 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3188 }
3189
l2cap_txwin_setup(struct l2cap_chan * chan)3190 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3191 {
3192 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3193 __l2cap_ews_supported(chan->conn)) {
3194 /* use extended control field */
3195 set_bit(FLAG_EXT_CTRL, &chan->flags);
3196 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3197 } else {
3198 chan->tx_win = min_t(u16, chan->tx_win,
3199 L2CAP_DEFAULT_TX_WINDOW);
3200 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3201 }
3202 chan->ack_win = chan->tx_win;
3203 }
3204
l2cap_mtu_auto(struct l2cap_chan * chan)3205 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3206 {
3207 struct hci_conn *conn = chan->conn->hcon;
3208
3209 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3210
3211 /* The 2-DH1 packet has between 2 and 56 information bytes
3212 * (including the 2-byte payload header)
3213 */
3214 if (!(conn->pkt_type & HCI_2DH1))
3215 chan->imtu = 54;
3216
3217 /* The 3-DH1 packet has between 2 and 85 information bytes
3218 * (including the 2-byte payload header)
3219 */
3220 if (!(conn->pkt_type & HCI_3DH1))
3221 chan->imtu = 83;
3222
3223 /* The 2-DH3 packet has between 2 and 369 information bytes
3224 * (including the 2-byte payload header)
3225 */
3226 if (!(conn->pkt_type & HCI_2DH3))
3227 chan->imtu = 367;
3228
3229 /* The 3-DH3 packet has between 2 and 554 information bytes
3230 * (including the 2-byte payload header)
3231 */
3232 if (!(conn->pkt_type & HCI_3DH3))
3233 chan->imtu = 552;
3234
3235 /* The 2-DH5 packet has between 2 and 681 information bytes
3236 * (including the 2-byte payload header)
3237 */
3238 if (!(conn->pkt_type & HCI_2DH5))
3239 chan->imtu = 679;
3240
3241 /* The 3-DH5 packet has between 2 and 1023 information bytes
3242 * (including the 2-byte payload header)
3243 */
3244 if (!(conn->pkt_type & HCI_3DH5))
3245 chan->imtu = 1021;
3246 }
3247
l2cap_build_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3248 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3249 {
3250 struct l2cap_conf_req *req = data;
3251 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3252 void *ptr = req->data;
3253 void *endptr = data + data_size;
3254 u16 size;
3255
3256 BT_DBG("chan %p", chan);
3257
3258 if (chan->num_conf_req || chan->num_conf_rsp)
3259 goto done;
3260
3261 switch (chan->mode) {
3262 case L2CAP_MODE_STREAMING:
3263 case L2CAP_MODE_ERTM:
3264 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3265 break;
3266
3267 if (__l2cap_efs_supported(chan->conn))
3268 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3269
3270 fallthrough;
3271 default:
3272 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3273 break;
3274 }
3275
3276 done:
3277 if (chan->imtu != L2CAP_DEFAULT_MTU) {
3278 if (!chan->imtu)
3279 l2cap_mtu_auto(chan);
3280 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3281 endptr - ptr);
3282 }
3283
3284 switch (chan->mode) {
3285 case L2CAP_MODE_BASIC:
3286 if (disable_ertm)
3287 break;
3288
3289 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3290 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3291 break;
3292
3293 rfc.mode = L2CAP_MODE_BASIC;
3294 rfc.txwin_size = 0;
3295 rfc.max_transmit = 0;
3296 rfc.retrans_timeout = 0;
3297 rfc.monitor_timeout = 0;
3298 rfc.max_pdu_size = 0;
3299
3300 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3301 (unsigned long) &rfc, endptr - ptr);
3302 break;
3303
3304 case L2CAP_MODE_ERTM:
3305 rfc.mode = L2CAP_MODE_ERTM;
3306 rfc.max_transmit = chan->max_tx;
3307
3308 __l2cap_set_ertm_timeouts(chan, &rfc);
3309
3310 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3311 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3312 L2CAP_FCS_SIZE);
3313 rfc.max_pdu_size = cpu_to_le16(size);
3314
3315 l2cap_txwin_setup(chan);
3316
3317 rfc.txwin_size = min_t(u16, chan->tx_win,
3318 L2CAP_DEFAULT_TX_WINDOW);
3319
3320 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3321 (unsigned long) &rfc, endptr - ptr);
3322
3323 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3324 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3325
3326 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3327 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3328 chan->tx_win, endptr - ptr);
3329
3330 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3331 if (chan->fcs == L2CAP_FCS_NONE ||
3332 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3333 chan->fcs = L2CAP_FCS_NONE;
3334 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3335 chan->fcs, endptr - ptr);
3336 }
3337 break;
3338
3339 case L2CAP_MODE_STREAMING:
3340 l2cap_txwin_setup(chan);
3341 rfc.mode = L2CAP_MODE_STREAMING;
3342 rfc.txwin_size = 0;
3343 rfc.max_transmit = 0;
3344 rfc.retrans_timeout = 0;
3345 rfc.monitor_timeout = 0;
3346
3347 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3348 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3349 L2CAP_FCS_SIZE);
3350 rfc.max_pdu_size = cpu_to_le16(size);
3351
3352 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3353 (unsigned long) &rfc, endptr - ptr);
3354
3355 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3356 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3357
3358 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3359 if (chan->fcs == L2CAP_FCS_NONE ||
3360 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3361 chan->fcs = L2CAP_FCS_NONE;
3362 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3363 chan->fcs, endptr - ptr);
3364 }
3365 break;
3366 }
3367
3368 req->dcid = cpu_to_le16(chan->dcid);
3369 req->flags = cpu_to_le16(0);
3370
3371 return ptr - data;
3372 }
3373
l2cap_parse_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3374 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3375 {
3376 struct l2cap_conf_rsp *rsp = data;
3377 void *ptr = rsp->data;
3378 void *endptr = data + data_size;
3379 void *req = chan->conf_req;
3380 int len = chan->conf_len;
3381 int type, hint, olen;
3382 unsigned long val;
3383 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3384 struct l2cap_conf_efs efs;
3385 u8 remote_efs = 0;
3386 u16 mtu = L2CAP_DEFAULT_MTU;
3387 u16 result = L2CAP_CONF_SUCCESS;
3388 u16 size;
3389
3390 BT_DBG("chan %p", chan);
3391
3392 while (len >= L2CAP_CONF_OPT_SIZE) {
3393 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3394 if (len < 0)
3395 break;
3396
3397 hint = type & L2CAP_CONF_HINT;
3398 type &= L2CAP_CONF_MASK;
3399
3400 switch (type) {
3401 case L2CAP_CONF_MTU:
3402 if (olen != 2)
3403 break;
3404 mtu = val;
3405 break;
3406
3407 case L2CAP_CONF_FLUSH_TO:
3408 if (olen != 2)
3409 break;
3410 chan->flush_to = val;
3411 break;
3412
3413 case L2CAP_CONF_QOS:
3414 break;
3415
3416 case L2CAP_CONF_RFC:
3417 if (olen != sizeof(rfc))
3418 break;
3419 memcpy(&rfc, (void *) val, olen);
3420 break;
3421
3422 case L2CAP_CONF_FCS:
3423 if (olen != 1)
3424 break;
3425 if (val == L2CAP_FCS_NONE)
3426 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3427 break;
3428
3429 case L2CAP_CONF_EFS:
3430 if (olen != sizeof(efs))
3431 break;
3432 remote_efs = 1;
3433 memcpy(&efs, (void *) val, olen);
3434 break;
3435
3436 case L2CAP_CONF_EWS:
3437 if (olen != 2)
3438 break;
3439 return -ECONNREFUSED;
3440
3441 default:
3442 if (hint)
3443 break;
3444 result = L2CAP_CONF_UNKNOWN;
3445 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3446 break;
3447 }
3448 }
3449
3450 if (chan->num_conf_rsp || chan->num_conf_req > 1)
3451 goto done;
3452
3453 switch (chan->mode) {
3454 case L2CAP_MODE_STREAMING:
3455 case L2CAP_MODE_ERTM:
3456 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3457 chan->mode = l2cap_select_mode(rfc.mode,
3458 chan->conn->feat_mask);
3459 break;
3460 }
3461
3462 if (remote_efs) {
3463 if (__l2cap_efs_supported(chan->conn))
3464 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3465 else
3466 return -ECONNREFUSED;
3467 }
3468
3469 if (chan->mode != rfc.mode)
3470 return -ECONNREFUSED;
3471
3472 break;
3473 }
3474
3475 done:
3476 if (chan->mode != rfc.mode) {
3477 result = L2CAP_CONF_UNACCEPT;
3478 rfc.mode = chan->mode;
3479
3480 if (chan->num_conf_rsp == 1)
3481 return -ECONNREFUSED;
3482
3483 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3484 (unsigned long) &rfc, endptr - ptr);
3485 }
3486
3487 if (result == L2CAP_CONF_SUCCESS) {
3488 /* Configure output options and let the other side know
3489 * which ones we don't like. */
3490
3491 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3492 result = L2CAP_CONF_UNACCEPT;
3493 else {
3494 chan->omtu = mtu;
3495 set_bit(CONF_MTU_DONE, &chan->conf_state);
3496 }
3497 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3498
3499 if (remote_efs) {
3500 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3501 efs.stype != L2CAP_SERV_NOTRAFIC &&
3502 efs.stype != chan->local_stype) {
3503
3504 result = L2CAP_CONF_UNACCEPT;
3505
3506 if (chan->num_conf_req >= 1)
3507 return -ECONNREFUSED;
3508
3509 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3510 sizeof(efs),
3511 (unsigned long) &efs, endptr - ptr);
3512 } else {
3513 /* Send PENDING Conf Rsp */
3514 result = L2CAP_CONF_PENDING;
3515 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3516 }
3517 }
3518
3519 switch (rfc.mode) {
3520 case L2CAP_MODE_BASIC:
3521 chan->fcs = L2CAP_FCS_NONE;
3522 set_bit(CONF_MODE_DONE, &chan->conf_state);
3523 break;
3524
3525 case L2CAP_MODE_ERTM:
3526 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3527 chan->remote_tx_win = rfc.txwin_size;
3528 else
3529 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3530
3531 chan->remote_max_tx = rfc.max_transmit;
3532
3533 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3534 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3535 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3536 rfc.max_pdu_size = cpu_to_le16(size);
3537 chan->remote_mps = size;
3538
3539 __l2cap_set_ertm_timeouts(chan, &rfc);
3540
3541 set_bit(CONF_MODE_DONE, &chan->conf_state);
3542
3543 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3544 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3545
3546 if (remote_efs &&
3547 test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3548 chan->remote_id = efs.id;
3549 chan->remote_stype = efs.stype;
3550 chan->remote_msdu = le16_to_cpu(efs.msdu);
3551 chan->remote_flush_to =
3552 le32_to_cpu(efs.flush_to);
3553 chan->remote_acc_lat =
3554 le32_to_cpu(efs.acc_lat);
3555 chan->remote_sdu_itime =
3556 le32_to_cpu(efs.sdu_itime);
3557 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3558 sizeof(efs),
3559 (unsigned long) &efs, endptr - ptr);
3560 }
3561 break;
3562
3563 case L2CAP_MODE_STREAMING:
3564 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3565 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3566 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3567 rfc.max_pdu_size = cpu_to_le16(size);
3568 chan->remote_mps = size;
3569
3570 set_bit(CONF_MODE_DONE, &chan->conf_state);
3571
3572 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3573 (unsigned long) &rfc, endptr - ptr);
3574
3575 break;
3576
3577 default:
3578 result = L2CAP_CONF_UNACCEPT;
3579
3580 memset(&rfc, 0, sizeof(rfc));
3581 rfc.mode = chan->mode;
3582 }
3583
3584 if (result == L2CAP_CONF_SUCCESS)
3585 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3586 }
3587 rsp->scid = cpu_to_le16(chan->dcid);
3588 rsp->result = cpu_to_le16(result);
3589 rsp->flags = cpu_to_le16(0);
3590
3591 return ptr - data;
3592 }
3593
l2cap_parse_conf_rsp(struct l2cap_chan * chan,void * rsp,int len,void * data,size_t size,u16 * result)3594 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3595 void *data, size_t size, u16 *result)
3596 {
3597 struct l2cap_conf_req *req = data;
3598 void *ptr = req->data;
3599 void *endptr = data + size;
3600 int type, olen;
3601 unsigned long val;
3602 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3603 struct l2cap_conf_efs efs;
3604
3605 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3606
3607 while (len >= L2CAP_CONF_OPT_SIZE) {
3608 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3609 if (len < 0)
3610 break;
3611
3612 switch (type) {
3613 case L2CAP_CONF_MTU:
3614 if (olen != 2)
3615 break;
3616 if (val < L2CAP_DEFAULT_MIN_MTU) {
3617 *result = L2CAP_CONF_UNACCEPT;
3618 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3619 } else
3620 chan->imtu = val;
3621 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3622 endptr - ptr);
3623 break;
3624
3625 case L2CAP_CONF_FLUSH_TO:
3626 if (olen != 2)
3627 break;
3628 chan->flush_to = val;
3629 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3630 chan->flush_to, endptr - ptr);
3631 break;
3632
3633 case L2CAP_CONF_RFC:
3634 if (olen != sizeof(rfc))
3635 break;
3636 memcpy(&rfc, (void *)val, olen);
3637 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3638 rfc.mode != chan->mode)
3639 return -ECONNREFUSED;
3640 chan->fcs = 0;
3641 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3642 (unsigned long) &rfc, endptr - ptr);
3643 break;
3644
3645 case L2CAP_CONF_EWS:
3646 if (olen != 2)
3647 break;
3648 chan->ack_win = min_t(u16, val, chan->ack_win);
3649 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3650 chan->tx_win, endptr - ptr);
3651 break;
3652
3653 case L2CAP_CONF_EFS:
3654 if (olen != sizeof(efs))
3655 break;
3656 memcpy(&efs, (void *)val, olen);
3657 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3658 efs.stype != L2CAP_SERV_NOTRAFIC &&
3659 efs.stype != chan->local_stype)
3660 return -ECONNREFUSED;
3661 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3662 (unsigned long) &efs, endptr - ptr);
3663 break;
3664
3665 case L2CAP_CONF_FCS:
3666 if (olen != 1)
3667 break;
3668 if (*result == L2CAP_CONF_PENDING)
3669 if (val == L2CAP_FCS_NONE)
3670 set_bit(CONF_RECV_NO_FCS,
3671 &chan->conf_state);
3672 break;
3673 }
3674 }
3675
3676 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3677 return -ECONNREFUSED;
3678
3679 chan->mode = rfc.mode;
3680
3681 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3682 switch (rfc.mode) {
3683 case L2CAP_MODE_ERTM:
3684 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3685 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3686 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3687 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3688 chan->ack_win = min_t(u16, chan->ack_win,
3689 rfc.txwin_size);
3690
3691 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3692 chan->local_msdu = le16_to_cpu(efs.msdu);
3693 chan->local_sdu_itime =
3694 le32_to_cpu(efs.sdu_itime);
3695 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3696 chan->local_flush_to =
3697 le32_to_cpu(efs.flush_to);
3698 }
3699 break;
3700
3701 case L2CAP_MODE_STREAMING:
3702 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3703 }
3704 }
3705
3706 req->dcid = cpu_to_le16(chan->dcid);
3707 req->flags = cpu_to_le16(0);
3708
3709 return ptr - data;
3710 }
3711
l2cap_build_conf_rsp(struct l2cap_chan * chan,void * data,u16 result,u16 flags)3712 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3713 u16 result, u16 flags)
3714 {
3715 struct l2cap_conf_rsp *rsp = data;
3716 void *ptr = rsp->data;
3717
3718 BT_DBG("chan %p", chan);
3719
3720 rsp->scid = cpu_to_le16(chan->dcid);
3721 rsp->result = cpu_to_le16(result);
3722 rsp->flags = cpu_to_le16(flags);
3723
3724 return ptr - data;
3725 }
3726
__l2cap_le_connect_rsp_defer(struct l2cap_chan * chan)3727 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3728 {
3729 struct l2cap_le_conn_rsp rsp;
3730 struct l2cap_conn *conn = chan->conn;
3731
3732 BT_DBG("chan %p", chan);
3733
3734 rsp.dcid = cpu_to_le16(chan->scid);
3735 rsp.mtu = cpu_to_le16(chan->imtu);
3736 rsp.mps = cpu_to_le16(chan->mps);
3737 rsp.credits = cpu_to_le16(chan->rx_credits);
3738 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3739
3740 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3741 &rsp);
3742 }
3743
l2cap_ecred_list_defer(struct l2cap_chan * chan,void * data)3744 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
3745 {
3746 int *result = data;
3747
3748 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3749 return;
3750
3751 switch (chan->state) {
3752 case BT_CONNECT2:
3753 /* If channel still pending accept add to result */
3754 (*result)++;
3755 return;
3756 case BT_CONNECTED:
3757 return;
3758 default:
3759 /* If not connected or pending accept it has been refused */
3760 *result = -ECONNREFUSED;
3761 return;
3762 }
3763 }
3764
3765 struct l2cap_ecred_rsp_data {
3766 struct {
3767 struct l2cap_ecred_conn_rsp rsp;
3768 __le16 scid[L2CAP_ECRED_MAX_CID];
3769 } __packed pdu;
3770 int count;
3771 };
3772
l2cap_ecred_rsp_defer(struct l2cap_chan * chan,void * data)3773 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
3774 {
3775 struct l2cap_ecred_rsp_data *rsp = data;
3776
3777 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3778 return;
3779
3780 /* Reset ident so only one response is sent */
3781 chan->ident = 0;
3782
3783 /* Include all channels pending with the same ident */
3784 if (!rsp->pdu.rsp.result)
3785 rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
3786 else
3787 l2cap_chan_del(chan, ECONNRESET);
3788 }
3789
__l2cap_ecred_conn_rsp_defer(struct l2cap_chan * chan)3790 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3791 {
3792 struct l2cap_conn *conn = chan->conn;
3793 struct l2cap_ecred_rsp_data data;
3794 u16 id = chan->ident;
3795 int result = 0;
3796
3797 if (!id)
3798 return;
3799
3800 BT_DBG("chan %p id %d", chan, id);
3801
3802 memset(&data, 0, sizeof(data));
3803
3804 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu);
3805 data.pdu.rsp.mps = cpu_to_le16(chan->mps);
3806 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3807 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3808
3809 /* Verify that all channels are ready */
3810 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
3811
3812 if (result > 0)
3813 return;
3814
3815 if (result < 0)
3816 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
3817
3818 /* Build response */
3819 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
3820
3821 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
3822 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
3823 &data.pdu);
3824 }
3825
__l2cap_connect_rsp_defer(struct l2cap_chan * chan)3826 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3827 {
3828 struct l2cap_conn_rsp rsp;
3829 struct l2cap_conn *conn = chan->conn;
3830 u8 buf[128];
3831 u8 rsp_code;
3832
3833 rsp.scid = cpu_to_le16(chan->dcid);
3834 rsp.dcid = cpu_to_le16(chan->scid);
3835 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3836 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3837 rsp_code = L2CAP_CONN_RSP;
3838
3839 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3840
3841 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3842
3843 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3844 return;
3845
3846 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3847 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
3848 chan->num_conf_req++;
3849 }
3850
l2cap_conf_rfc_get(struct l2cap_chan * chan,void * rsp,int len)3851 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3852 {
3853 int type, olen;
3854 unsigned long val;
3855 /* Use sane default values in case a misbehaving remote device
3856 * did not send an RFC or extended window size option.
3857 */
3858 u16 txwin_ext = chan->ack_win;
3859 struct l2cap_conf_rfc rfc = {
3860 .mode = chan->mode,
3861 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3862 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3863 .max_pdu_size = cpu_to_le16(chan->imtu),
3864 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3865 };
3866
3867 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3868
3869 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3870 return;
3871
3872 while (len >= L2CAP_CONF_OPT_SIZE) {
3873 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3874 if (len < 0)
3875 break;
3876
3877 switch (type) {
3878 case L2CAP_CONF_RFC:
3879 if (olen != sizeof(rfc))
3880 break;
3881 memcpy(&rfc, (void *)val, olen);
3882 break;
3883 case L2CAP_CONF_EWS:
3884 if (olen != 2)
3885 break;
3886 txwin_ext = val;
3887 break;
3888 }
3889 }
3890
3891 switch (rfc.mode) {
3892 case L2CAP_MODE_ERTM:
3893 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3894 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3895 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3896 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3897 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3898 else
3899 chan->ack_win = min_t(u16, chan->ack_win,
3900 rfc.txwin_size);
3901 break;
3902 case L2CAP_MODE_STREAMING:
3903 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3904 }
3905 }
3906
l2cap_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)3907 static inline int l2cap_command_rej(struct l2cap_conn *conn,
3908 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3909 u8 *data)
3910 {
3911 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3912
3913 if (cmd_len < sizeof(*rej))
3914 return -EPROTO;
3915
3916 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3917 return 0;
3918
3919 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3920 cmd->ident == conn->info_ident) {
3921 cancel_delayed_work(&conn->info_timer);
3922
3923 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3924 conn->info_ident = 0;
3925
3926 l2cap_conn_start(conn);
3927 }
3928
3929 return 0;
3930 }
3931
l2cap_connect(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u8 * data,u8 rsp_code)3932 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
3933 u8 *data, u8 rsp_code)
3934 {
3935 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3936 struct l2cap_conn_rsp rsp;
3937 struct l2cap_chan *chan = NULL, *pchan = NULL;
3938 int result, status = L2CAP_CS_NO_INFO;
3939
3940 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3941 __le16 psm = req->psm;
3942
3943 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3944
3945 /* Check if we have socket listening on psm */
3946 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
3947 &conn->hcon->dst, ACL_LINK);
3948 if (!pchan) {
3949 result = L2CAP_CR_BAD_PSM;
3950 goto response;
3951 }
3952
3953 mutex_lock(&conn->chan_lock);
3954 l2cap_chan_lock(pchan);
3955
3956 /* Check if the ACL is secure enough (if not SDP) */
3957 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3958 !hci_conn_check_link_mode(conn->hcon)) {
3959 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3960 result = L2CAP_CR_SEC_BLOCK;
3961 goto response;
3962 }
3963
3964 result = L2CAP_CR_NO_MEM;
3965
3966 /* Check for valid dynamic CID range (as per Erratum 3253) */
3967 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
3968 result = L2CAP_CR_INVALID_SCID;
3969 goto response;
3970 }
3971
3972 /* Check if we already have channel with that dcid */
3973 if (__l2cap_get_chan_by_dcid(conn, scid)) {
3974 result = L2CAP_CR_SCID_IN_USE;
3975 goto response;
3976 }
3977
3978 chan = pchan->ops->new_connection(pchan);
3979 if (!chan)
3980 goto response;
3981
3982 /* For certain devices (ex: HID mouse), support for authentication,
3983 * pairing and bonding is optional. For such devices, inorder to avoid
3984 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3985 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3986 */
3987 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3988
3989 bacpy(&chan->src, &conn->hcon->src);
3990 bacpy(&chan->dst, &conn->hcon->dst);
3991 chan->src_type = bdaddr_src_type(conn->hcon);
3992 chan->dst_type = bdaddr_dst_type(conn->hcon);
3993 chan->psm = psm;
3994 chan->dcid = scid;
3995
3996 __l2cap_chan_add(conn, chan);
3997
3998 dcid = chan->scid;
3999
4000 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4001
4002 chan->ident = cmd->ident;
4003
4004 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4005 if (l2cap_chan_check_security(chan, false)) {
4006 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4007 l2cap_state_change(chan, BT_CONNECT2);
4008 result = L2CAP_CR_PEND;
4009 status = L2CAP_CS_AUTHOR_PEND;
4010 chan->ops->defer(chan);
4011 } else {
4012 l2cap_state_change(chan, BT_CONFIG);
4013 result = L2CAP_CR_SUCCESS;
4014 status = L2CAP_CS_NO_INFO;
4015 }
4016 } else {
4017 l2cap_state_change(chan, BT_CONNECT2);
4018 result = L2CAP_CR_PEND;
4019 status = L2CAP_CS_AUTHEN_PEND;
4020 }
4021 } else {
4022 l2cap_state_change(chan, BT_CONNECT2);
4023 result = L2CAP_CR_PEND;
4024 status = L2CAP_CS_NO_INFO;
4025 }
4026
4027 response:
4028 rsp.scid = cpu_to_le16(scid);
4029 rsp.dcid = cpu_to_le16(dcid);
4030 rsp.result = cpu_to_le16(result);
4031 rsp.status = cpu_to_le16(status);
4032 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4033
4034 if (!pchan)
4035 return;
4036
4037 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4038 struct l2cap_info_req info;
4039 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4040
4041 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4042 conn->info_ident = l2cap_get_ident(conn);
4043
4044 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4045
4046 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4047 sizeof(info), &info);
4048 }
4049
4050 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4051 result == L2CAP_CR_SUCCESS) {
4052 u8 buf[128];
4053 set_bit(CONF_REQ_SENT, &chan->conf_state);
4054 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4055 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4056 chan->num_conf_req++;
4057 }
4058
4059 l2cap_chan_unlock(pchan);
4060 mutex_unlock(&conn->chan_lock);
4061 l2cap_chan_put(pchan);
4062 }
4063
l2cap_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4064 static int l2cap_connect_req(struct l2cap_conn *conn,
4065 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4066 {
4067 if (cmd_len < sizeof(struct l2cap_conn_req))
4068 return -EPROTO;
4069
4070 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
4071 return 0;
4072 }
4073
l2cap_connect_create_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4074 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4075 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4076 u8 *data)
4077 {
4078 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4079 u16 scid, dcid, result, status;
4080 struct l2cap_chan *chan;
4081 u8 req[128];
4082 int err;
4083
4084 if (cmd_len < sizeof(*rsp))
4085 return -EPROTO;
4086
4087 scid = __le16_to_cpu(rsp->scid);
4088 dcid = __le16_to_cpu(rsp->dcid);
4089 result = __le16_to_cpu(rsp->result);
4090 status = __le16_to_cpu(rsp->status);
4091
4092 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
4093 dcid > L2CAP_CID_DYN_END))
4094 return -EPROTO;
4095
4096 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4097 dcid, scid, result, status);
4098
4099 mutex_lock(&conn->chan_lock);
4100
4101 if (scid) {
4102 chan = __l2cap_get_chan_by_scid(conn, scid);
4103 if (!chan) {
4104 err = -EBADSLT;
4105 goto unlock;
4106 }
4107 } else {
4108 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4109 if (!chan) {
4110 err = -EBADSLT;
4111 goto unlock;
4112 }
4113 }
4114
4115 chan = l2cap_chan_hold_unless_zero(chan);
4116 if (!chan) {
4117 err = -EBADSLT;
4118 goto unlock;
4119 }
4120
4121 err = 0;
4122
4123 l2cap_chan_lock(chan);
4124
4125 switch (result) {
4126 case L2CAP_CR_SUCCESS:
4127 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4128 err = -EBADSLT;
4129 break;
4130 }
4131
4132 l2cap_state_change(chan, BT_CONFIG);
4133 chan->ident = 0;
4134 chan->dcid = dcid;
4135 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4136
4137 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4138 break;
4139
4140 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4141 l2cap_build_conf_req(chan, req, sizeof(req)), req);
4142 chan->num_conf_req++;
4143 break;
4144
4145 case L2CAP_CR_PEND:
4146 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4147 break;
4148
4149 default:
4150 l2cap_chan_del(chan, ECONNREFUSED);
4151 break;
4152 }
4153
4154 l2cap_chan_unlock(chan);
4155 l2cap_chan_put(chan);
4156
4157 unlock:
4158 mutex_unlock(&conn->chan_lock);
4159
4160 return err;
4161 }
4162
set_default_fcs(struct l2cap_chan * chan)4163 static inline void set_default_fcs(struct l2cap_chan *chan)
4164 {
4165 /* FCS is enabled only in ERTM or streaming mode, if one or both
4166 * sides request it.
4167 */
4168 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4169 chan->fcs = L2CAP_FCS_NONE;
4170 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4171 chan->fcs = L2CAP_FCS_CRC16;
4172 }
4173
l2cap_send_efs_conf_rsp(struct l2cap_chan * chan,void * data,u8 ident,u16 flags)4174 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4175 u8 ident, u16 flags)
4176 {
4177 struct l2cap_conn *conn = chan->conn;
4178
4179 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4180 flags);
4181
4182 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4183 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4184
4185 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4186 l2cap_build_conf_rsp(chan, data,
4187 L2CAP_CONF_SUCCESS, flags), data);
4188 }
4189
cmd_reject_invalid_cid(struct l2cap_conn * conn,u8 ident,u16 scid,u16 dcid)4190 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4191 u16 scid, u16 dcid)
4192 {
4193 struct l2cap_cmd_rej_cid rej;
4194
4195 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4196 rej.scid = __cpu_to_le16(scid);
4197 rej.dcid = __cpu_to_le16(dcid);
4198
4199 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4200 }
4201
l2cap_config_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4202 static inline int l2cap_config_req(struct l2cap_conn *conn,
4203 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4204 u8 *data)
4205 {
4206 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4207 u16 dcid, flags;
4208 u8 rsp[64];
4209 struct l2cap_chan *chan;
4210 int len, err = 0;
4211
4212 if (cmd_len < sizeof(*req))
4213 return -EPROTO;
4214
4215 dcid = __le16_to_cpu(req->dcid);
4216 flags = __le16_to_cpu(req->flags);
4217
4218 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4219
4220 chan = l2cap_get_chan_by_scid(conn, dcid);
4221 if (!chan) {
4222 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4223 return 0;
4224 }
4225
4226 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4227 chan->state != BT_CONNECTED) {
4228 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4229 chan->dcid);
4230 goto unlock;
4231 }
4232
4233 /* Reject if config buffer is too small. */
4234 len = cmd_len - sizeof(*req);
4235 if (chan->conf_len + len > sizeof(chan->conf_req)) {
4236 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4237 l2cap_build_conf_rsp(chan, rsp,
4238 L2CAP_CONF_REJECT, flags), rsp);
4239 goto unlock;
4240 }
4241
4242 /* Store config. */
4243 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4244 chan->conf_len += len;
4245
4246 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4247 /* Incomplete config. Send empty response. */
4248 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4249 l2cap_build_conf_rsp(chan, rsp,
4250 L2CAP_CONF_SUCCESS, flags), rsp);
4251 goto unlock;
4252 }
4253
4254 /* Complete config. */
4255 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4256 if (len < 0) {
4257 l2cap_send_disconn_req(chan, ECONNRESET);
4258 goto unlock;
4259 }
4260
4261 chan->ident = cmd->ident;
4262 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4263 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4264 chan->num_conf_rsp++;
4265
4266 /* Reset config buffer. */
4267 chan->conf_len = 0;
4268
4269 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4270 goto unlock;
4271
4272 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4273 set_default_fcs(chan);
4274
4275 if (chan->mode == L2CAP_MODE_ERTM ||
4276 chan->mode == L2CAP_MODE_STREAMING)
4277 err = l2cap_ertm_init(chan);
4278
4279 if (err < 0)
4280 l2cap_send_disconn_req(chan, -err);
4281 else
4282 l2cap_chan_ready(chan);
4283
4284 goto unlock;
4285 }
4286
4287 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4288 u8 buf[64];
4289 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4290 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4291 chan->num_conf_req++;
4292 }
4293
4294 /* Got Conf Rsp PENDING from remote side and assume we sent
4295 Conf Rsp PENDING in the code above */
4296 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4297 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4298
4299 /* check compatibility */
4300
4301 /* Send rsp for BR/EDR channel */
4302 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4303 }
4304
4305 unlock:
4306 l2cap_chan_unlock(chan);
4307 l2cap_chan_put(chan);
4308 return err;
4309 }
4310
l2cap_config_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4311 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4312 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4313 u8 *data)
4314 {
4315 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4316 u16 scid, flags, result;
4317 struct l2cap_chan *chan;
4318 int len = cmd_len - sizeof(*rsp);
4319 int err = 0;
4320
4321 if (cmd_len < sizeof(*rsp))
4322 return -EPROTO;
4323
4324 scid = __le16_to_cpu(rsp->scid);
4325 flags = __le16_to_cpu(rsp->flags);
4326 result = __le16_to_cpu(rsp->result);
4327
4328 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4329 result, len);
4330
4331 chan = l2cap_get_chan_by_scid(conn, scid);
4332 if (!chan)
4333 return 0;
4334
4335 switch (result) {
4336 case L2CAP_CONF_SUCCESS:
4337 l2cap_conf_rfc_get(chan, rsp->data, len);
4338 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4339 break;
4340
4341 case L2CAP_CONF_PENDING:
4342 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4343
4344 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4345 char buf[64];
4346
4347 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4348 buf, sizeof(buf), &result);
4349 if (len < 0) {
4350 l2cap_send_disconn_req(chan, ECONNRESET);
4351 goto done;
4352 }
4353
4354 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
4355 }
4356 goto done;
4357
4358 case L2CAP_CONF_UNKNOWN:
4359 case L2CAP_CONF_UNACCEPT:
4360 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4361 char req[64];
4362
4363 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4364 l2cap_send_disconn_req(chan, ECONNRESET);
4365 goto done;
4366 }
4367
4368 /* throw out any old stored conf requests */
4369 result = L2CAP_CONF_SUCCESS;
4370 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4371 req, sizeof(req), &result);
4372 if (len < 0) {
4373 l2cap_send_disconn_req(chan, ECONNRESET);
4374 goto done;
4375 }
4376
4377 l2cap_send_cmd(conn, l2cap_get_ident(conn),
4378 L2CAP_CONF_REQ, len, req);
4379 chan->num_conf_req++;
4380 if (result != L2CAP_CONF_SUCCESS)
4381 goto done;
4382 break;
4383 }
4384 fallthrough;
4385
4386 default:
4387 l2cap_chan_set_err(chan, ECONNRESET);
4388
4389 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4390 l2cap_send_disconn_req(chan, ECONNRESET);
4391 goto done;
4392 }
4393
4394 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4395 goto done;
4396
4397 set_bit(CONF_INPUT_DONE, &chan->conf_state);
4398
4399 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4400 set_default_fcs(chan);
4401
4402 if (chan->mode == L2CAP_MODE_ERTM ||
4403 chan->mode == L2CAP_MODE_STREAMING)
4404 err = l2cap_ertm_init(chan);
4405
4406 if (err < 0)
4407 l2cap_send_disconn_req(chan, -err);
4408 else
4409 l2cap_chan_ready(chan);
4410 }
4411
4412 done:
4413 l2cap_chan_unlock(chan);
4414 l2cap_chan_put(chan);
4415 return err;
4416 }
4417
l2cap_disconnect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4418 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4419 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4420 u8 *data)
4421 {
4422 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4423 struct l2cap_disconn_rsp rsp;
4424 u16 dcid, scid;
4425 struct l2cap_chan *chan;
4426
4427 if (cmd_len != sizeof(*req))
4428 return -EPROTO;
4429
4430 scid = __le16_to_cpu(req->scid);
4431 dcid = __le16_to_cpu(req->dcid);
4432
4433 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4434
4435 chan = l2cap_get_chan_by_scid(conn, dcid);
4436 if (!chan) {
4437 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4438 return 0;
4439 }
4440
4441 rsp.dcid = cpu_to_le16(chan->scid);
4442 rsp.scid = cpu_to_le16(chan->dcid);
4443 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4444
4445 chan->ops->set_shutdown(chan);
4446
4447 l2cap_chan_unlock(chan);
4448 mutex_lock(&conn->chan_lock);
4449 l2cap_chan_lock(chan);
4450 l2cap_chan_del(chan, ECONNRESET);
4451 mutex_unlock(&conn->chan_lock);
4452
4453 chan->ops->close(chan);
4454
4455 l2cap_chan_unlock(chan);
4456 l2cap_chan_put(chan);
4457
4458 return 0;
4459 }
4460
l2cap_disconnect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4461 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4462 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4463 u8 *data)
4464 {
4465 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4466 u16 dcid, scid;
4467 struct l2cap_chan *chan;
4468
4469 if (cmd_len != sizeof(*rsp))
4470 return -EPROTO;
4471
4472 scid = __le16_to_cpu(rsp->scid);
4473 dcid = __le16_to_cpu(rsp->dcid);
4474
4475 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4476
4477 chan = l2cap_get_chan_by_scid(conn, scid);
4478 if (!chan) {
4479 return 0;
4480 }
4481
4482 if (chan->state != BT_DISCONN) {
4483 l2cap_chan_unlock(chan);
4484 l2cap_chan_put(chan);
4485 return 0;
4486 }
4487
4488 l2cap_chan_unlock(chan);
4489 mutex_lock(&conn->chan_lock);
4490 l2cap_chan_lock(chan);
4491 l2cap_chan_del(chan, 0);
4492 mutex_unlock(&conn->chan_lock);
4493
4494 chan->ops->close(chan);
4495
4496 l2cap_chan_unlock(chan);
4497 l2cap_chan_put(chan);
4498
4499 return 0;
4500 }
4501
l2cap_information_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4502 static inline int l2cap_information_req(struct l2cap_conn *conn,
4503 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4504 u8 *data)
4505 {
4506 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4507 u16 type;
4508
4509 if (cmd_len != sizeof(*req))
4510 return -EPROTO;
4511
4512 type = __le16_to_cpu(req->type);
4513
4514 BT_DBG("type 0x%4.4x", type);
4515
4516 if (type == L2CAP_IT_FEAT_MASK) {
4517 u8 buf[8];
4518 u32 feat_mask = l2cap_feat_mask;
4519 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4520 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4521 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4522 if (!disable_ertm)
4523 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4524 | L2CAP_FEAT_FCS;
4525
4526 put_unaligned_le32(feat_mask, rsp->data);
4527 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4528 buf);
4529 } else if (type == L2CAP_IT_FIXED_CHAN) {
4530 u8 buf[12];
4531 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4532
4533 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4534 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4535 rsp->data[0] = conn->local_fixed_chan;
4536 memset(rsp->data + 1, 0, 7);
4537 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4538 buf);
4539 } else {
4540 struct l2cap_info_rsp rsp;
4541 rsp.type = cpu_to_le16(type);
4542 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4543 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4544 &rsp);
4545 }
4546
4547 return 0;
4548 }
4549
l2cap_information_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4550 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4551 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4552 u8 *data)
4553 {
4554 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4555 u16 type, result;
4556
4557 if (cmd_len < sizeof(*rsp))
4558 return -EPROTO;
4559
4560 type = __le16_to_cpu(rsp->type);
4561 result = __le16_to_cpu(rsp->result);
4562
4563 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4564
4565 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4566 if (cmd->ident != conn->info_ident ||
4567 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4568 return 0;
4569
4570 cancel_delayed_work(&conn->info_timer);
4571
4572 if (result != L2CAP_IR_SUCCESS) {
4573 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4574 conn->info_ident = 0;
4575
4576 l2cap_conn_start(conn);
4577
4578 return 0;
4579 }
4580
4581 switch (type) {
4582 case L2CAP_IT_FEAT_MASK:
4583 conn->feat_mask = get_unaligned_le32(rsp->data);
4584
4585 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4586 struct l2cap_info_req req;
4587 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4588
4589 conn->info_ident = l2cap_get_ident(conn);
4590
4591 l2cap_send_cmd(conn, conn->info_ident,
4592 L2CAP_INFO_REQ, sizeof(req), &req);
4593 } else {
4594 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4595 conn->info_ident = 0;
4596
4597 l2cap_conn_start(conn);
4598 }
4599 break;
4600
4601 case L2CAP_IT_FIXED_CHAN:
4602 conn->remote_fixed_chan = rsp->data[0];
4603 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4604 conn->info_ident = 0;
4605
4606 l2cap_conn_start(conn);
4607 break;
4608 }
4609
4610 return 0;
4611 }
4612
l2cap_conn_param_update_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4613 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4614 struct l2cap_cmd_hdr *cmd,
4615 u16 cmd_len, u8 *data)
4616 {
4617 struct hci_conn *hcon = conn->hcon;
4618 struct l2cap_conn_param_update_req *req;
4619 struct l2cap_conn_param_update_rsp rsp;
4620 u16 min, max, latency, to_multiplier;
4621 int err;
4622
4623 if (hcon->role != HCI_ROLE_MASTER)
4624 return -EINVAL;
4625
4626 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4627 return -EPROTO;
4628
4629 req = (struct l2cap_conn_param_update_req *) data;
4630 min = __le16_to_cpu(req->min);
4631 max = __le16_to_cpu(req->max);
4632 latency = __le16_to_cpu(req->latency);
4633 to_multiplier = __le16_to_cpu(req->to_multiplier);
4634
4635 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4636 min, max, latency, to_multiplier);
4637
4638 memset(&rsp, 0, sizeof(rsp));
4639
4640 err = hci_check_conn_params(min, max, latency, to_multiplier);
4641 if (err)
4642 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4643 else
4644 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4645
4646 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4647 sizeof(rsp), &rsp);
4648
4649 if (!err) {
4650 u8 store_hint;
4651
4652 store_hint = hci_le_conn_update(hcon, min, max, latency,
4653 to_multiplier);
4654 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
4655 store_hint, min, max, latency,
4656 to_multiplier);
4657
4658 }
4659
4660 return 0;
4661 }
4662
l2cap_le_connect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4663 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
4664 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4665 u8 *data)
4666 {
4667 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
4668 struct hci_conn *hcon = conn->hcon;
4669 u16 dcid, mtu, mps, credits, result;
4670 struct l2cap_chan *chan;
4671 int err, sec_level;
4672
4673 if (cmd_len < sizeof(*rsp))
4674 return -EPROTO;
4675
4676 dcid = __le16_to_cpu(rsp->dcid);
4677 mtu = __le16_to_cpu(rsp->mtu);
4678 mps = __le16_to_cpu(rsp->mps);
4679 credits = __le16_to_cpu(rsp->credits);
4680 result = __le16_to_cpu(rsp->result);
4681
4682 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
4683 dcid < L2CAP_CID_DYN_START ||
4684 dcid > L2CAP_CID_LE_DYN_END))
4685 return -EPROTO;
4686
4687 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4688 dcid, mtu, mps, credits, result);
4689
4690 mutex_lock(&conn->chan_lock);
4691
4692 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4693 if (!chan) {
4694 err = -EBADSLT;
4695 goto unlock;
4696 }
4697
4698 err = 0;
4699
4700 l2cap_chan_lock(chan);
4701
4702 switch (result) {
4703 case L2CAP_CR_LE_SUCCESS:
4704 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4705 err = -EBADSLT;
4706 break;
4707 }
4708
4709 chan->ident = 0;
4710 chan->dcid = dcid;
4711 chan->omtu = mtu;
4712 chan->remote_mps = mps;
4713 chan->tx_credits = credits;
4714 l2cap_chan_ready(chan);
4715 break;
4716
4717 case L2CAP_CR_LE_AUTHENTICATION:
4718 case L2CAP_CR_LE_ENCRYPTION:
4719 /* If we already have MITM protection we can't do
4720 * anything.
4721 */
4722 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
4723 l2cap_chan_del(chan, ECONNREFUSED);
4724 break;
4725 }
4726
4727 sec_level = hcon->sec_level + 1;
4728 if (chan->sec_level < sec_level)
4729 chan->sec_level = sec_level;
4730
4731 /* We'll need to send a new Connect Request */
4732 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
4733
4734 smp_conn_security(hcon, chan->sec_level);
4735 break;
4736
4737 default:
4738 l2cap_chan_del(chan, ECONNREFUSED);
4739 break;
4740 }
4741
4742 l2cap_chan_unlock(chan);
4743
4744 unlock:
4745 mutex_unlock(&conn->chan_lock);
4746
4747 return err;
4748 }
4749
l2cap_bredr_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4750 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4751 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4752 u8 *data)
4753 {
4754 int err = 0;
4755
4756 switch (cmd->code) {
4757 case L2CAP_COMMAND_REJ:
4758 l2cap_command_rej(conn, cmd, cmd_len, data);
4759 break;
4760
4761 case L2CAP_CONN_REQ:
4762 err = l2cap_connect_req(conn, cmd, cmd_len, data);
4763 break;
4764
4765 case L2CAP_CONN_RSP:
4766 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
4767 break;
4768
4769 case L2CAP_CONF_REQ:
4770 err = l2cap_config_req(conn, cmd, cmd_len, data);
4771 break;
4772
4773 case L2CAP_CONF_RSP:
4774 l2cap_config_rsp(conn, cmd, cmd_len, data);
4775 break;
4776
4777 case L2CAP_DISCONN_REQ:
4778 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
4779 break;
4780
4781 case L2CAP_DISCONN_RSP:
4782 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
4783 break;
4784
4785 case L2CAP_ECHO_REQ:
4786 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4787 break;
4788
4789 case L2CAP_ECHO_RSP:
4790 break;
4791
4792 case L2CAP_INFO_REQ:
4793 err = l2cap_information_req(conn, cmd, cmd_len, data);
4794 break;
4795
4796 case L2CAP_INFO_RSP:
4797 l2cap_information_rsp(conn, cmd, cmd_len, data);
4798 break;
4799
4800 default:
4801 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4802 err = -EINVAL;
4803 break;
4804 }
4805
4806 return err;
4807 }
4808
l2cap_le_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4809 static int l2cap_le_connect_req(struct l2cap_conn *conn,
4810 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4811 u8 *data)
4812 {
4813 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
4814 struct l2cap_le_conn_rsp rsp;
4815 struct l2cap_chan *chan, *pchan;
4816 u16 dcid, scid, credits, mtu, mps;
4817 __le16 psm;
4818 u8 result;
4819
4820 if (cmd_len != sizeof(*req))
4821 return -EPROTO;
4822
4823 scid = __le16_to_cpu(req->scid);
4824 mtu = __le16_to_cpu(req->mtu);
4825 mps = __le16_to_cpu(req->mps);
4826 psm = req->psm;
4827 dcid = 0;
4828 credits = 0;
4829
4830 if (mtu < 23 || mps < 23)
4831 return -EPROTO;
4832
4833 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
4834 scid, mtu, mps);
4835
4836 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
4837 * page 1059:
4838 *
4839 * Valid range: 0x0001-0x00ff
4840 *
4841 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
4842 */
4843 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
4844 result = L2CAP_CR_LE_BAD_PSM;
4845 chan = NULL;
4846 goto response;
4847 }
4848
4849 /* Check if we have socket listening on psm */
4850 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4851 &conn->hcon->dst, LE_LINK);
4852 if (!pchan) {
4853 result = L2CAP_CR_LE_BAD_PSM;
4854 chan = NULL;
4855 goto response;
4856 }
4857
4858 mutex_lock(&conn->chan_lock);
4859 l2cap_chan_lock(pchan);
4860
4861 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
4862 SMP_ALLOW_STK)) {
4863 result = L2CAP_CR_LE_AUTHENTICATION;
4864 chan = NULL;
4865 goto response_unlock;
4866 }
4867
4868 /* Check for valid dynamic CID range */
4869 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
4870 result = L2CAP_CR_LE_INVALID_SCID;
4871 chan = NULL;
4872 goto response_unlock;
4873 }
4874
4875 /* Check if we already have channel with that dcid */
4876 if (__l2cap_get_chan_by_dcid(conn, scid)) {
4877 result = L2CAP_CR_LE_SCID_IN_USE;
4878 chan = NULL;
4879 goto response_unlock;
4880 }
4881
4882 chan = pchan->ops->new_connection(pchan);
4883 if (!chan) {
4884 result = L2CAP_CR_LE_NO_MEM;
4885 goto response_unlock;
4886 }
4887
4888 bacpy(&chan->src, &conn->hcon->src);
4889 bacpy(&chan->dst, &conn->hcon->dst);
4890 chan->src_type = bdaddr_src_type(conn->hcon);
4891 chan->dst_type = bdaddr_dst_type(conn->hcon);
4892 chan->psm = psm;
4893 chan->dcid = scid;
4894 chan->omtu = mtu;
4895 chan->remote_mps = mps;
4896
4897 __l2cap_chan_add(conn, chan);
4898
4899 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
4900
4901 dcid = chan->scid;
4902 credits = chan->rx_credits;
4903
4904 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4905
4906 chan->ident = cmd->ident;
4907
4908 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4909 l2cap_state_change(chan, BT_CONNECT2);
4910 /* The following result value is actually not defined
4911 * for LE CoC but we use it to let the function know
4912 * that it should bail out after doing its cleanup
4913 * instead of sending a response.
4914 */
4915 result = L2CAP_CR_PEND;
4916 chan->ops->defer(chan);
4917 } else {
4918 l2cap_chan_ready(chan);
4919 result = L2CAP_CR_LE_SUCCESS;
4920 }
4921
4922 response_unlock:
4923 l2cap_chan_unlock(pchan);
4924 mutex_unlock(&conn->chan_lock);
4925 l2cap_chan_put(pchan);
4926
4927 if (result == L2CAP_CR_PEND)
4928 return 0;
4929
4930 response:
4931 if (chan) {
4932 rsp.mtu = cpu_to_le16(chan->imtu);
4933 rsp.mps = cpu_to_le16(chan->mps);
4934 } else {
4935 rsp.mtu = 0;
4936 rsp.mps = 0;
4937 }
4938
4939 rsp.dcid = cpu_to_le16(dcid);
4940 rsp.credits = cpu_to_le16(credits);
4941 rsp.result = cpu_to_le16(result);
4942
4943 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
4944
4945 return 0;
4946 }
4947
l2cap_le_credits(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4948 static inline int l2cap_le_credits(struct l2cap_conn *conn,
4949 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4950 u8 *data)
4951 {
4952 struct l2cap_le_credits *pkt;
4953 struct l2cap_chan *chan;
4954 u16 cid, credits, max_credits;
4955
4956 if (cmd_len != sizeof(*pkt))
4957 return -EPROTO;
4958
4959 pkt = (struct l2cap_le_credits *) data;
4960 cid = __le16_to_cpu(pkt->cid);
4961 credits = __le16_to_cpu(pkt->credits);
4962
4963 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
4964
4965 chan = l2cap_get_chan_by_dcid(conn, cid);
4966 if (!chan)
4967 return -EBADSLT;
4968
4969 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
4970 if (credits > max_credits) {
4971 BT_ERR("LE credits overflow");
4972 l2cap_send_disconn_req(chan, ECONNRESET);
4973
4974 /* Return 0 so that we don't trigger an unnecessary
4975 * command reject packet.
4976 */
4977 goto unlock;
4978 }
4979
4980 chan->tx_credits += credits;
4981
4982 /* Resume sending */
4983 l2cap_le_flowctl_send(chan);
4984
4985 if (chan->tx_credits)
4986 chan->ops->resume(chan);
4987
4988 unlock:
4989 l2cap_chan_unlock(chan);
4990 l2cap_chan_put(chan);
4991
4992 return 0;
4993 }
4994
l2cap_ecred_conn_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4995 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
4996 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4997 u8 *data)
4998 {
4999 struct l2cap_ecred_conn_req *req = (void *) data;
5000 struct {
5001 struct l2cap_ecred_conn_rsp rsp;
5002 __le16 dcid[L2CAP_ECRED_MAX_CID];
5003 } __packed pdu;
5004 struct l2cap_chan *chan, *pchan;
5005 u16 mtu, mps;
5006 __le16 psm;
5007 u8 result, len = 0;
5008 int i, num_scid;
5009 bool defer = false;
5010
5011 if (!enable_ecred)
5012 return -EINVAL;
5013
5014 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5015 result = L2CAP_CR_LE_INVALID_PARAMS;
5016 goto response;
5017 }
5018
5019 cmd_len -= sizeof(*req);
5020 num_scid = cmd_len / sizeof(u16);
5021
5022 if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5023 result = L2CAP_CR_LE_INVALID_PARAMS;
5024 goto response;
5025 }
5026
5027 mtu = __le16_to_cpu(req->mtu);
5028 mps = __le16_to_cpu(req->mps);
5029
5030 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5031 result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5032 goto response;
5033 }
5034
5035 psm = req->psm;
5036
5037 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
5038 * page 1059:
5039 *
5040 * Valid range: 0x0001-0x00ff
5041 *
5042 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
5043 */
5044 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
5045 result = L2CAP_CR_LE_BAD_PSM;
5046 goto response;
5047 }
5048
5049 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5050
5051 memset(&pdu, 0, sizeof(pdu));
5052
5053 /* Check if we have socket listening on psm */
5054 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5055 &conn->hcon->dst, LE_LINK);
5056 if (!pchan) {
5057 result = L2CAP_CR_LE_BAD_PSM;
5058 goto response;
5059 }
5060
5061 mutex_lock(&conn->chan_lock);
5062 l2cap_chan_lock(pchan);
5063
5064 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5065 SMP_ALLOW_STK)) {
5066 result = L2CAP_CR_LE_AUTHENTICATION;
5067 goto unlock;
5068 }
5069
5070 result = L2CAP_CR_LE_SUCCESS;
5071
5072 for (i = 0; i < num_scid; i++) {
5073 u16 scid = __le16_to_cpu(req->scid[i]);
5074
5075 BT_DBG("scid[%d] 0x%4.4x", i, scid);
5076
5077 pdu.dcid[i] = 0x0000;
5078 len += sizeof(*pdu.dcid);
5079
5080 /* Check for valid dynamic CID range */
5081 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5082 result = L2CAP_CR_LE_INVALID_SCID;
5083 continue;
5084 }
5085
5086 /* Check if we already have channel with that dcid */
5087 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5088 result = L2CAP_CR_LE_SCID_IN_USE;
5089 continue;
5090 }
5091
5092 chan = pchan->ops->new_connection(pchan);
5093 if (!chan) {
5094 result = L2CAP_CR_LE_NO_MEM;
5095 continue;
5096 }
5097
5098 bacpy(&chan->src, &conn->hcon->src);
5099 bacpy(&chan->dst, &conn->hcon->dst);
5100 chan->src_type = bdaddr_src_type(conn->hcon);
5101 chan->dst_type = bdaddr_dst_type(conn->hcon);
5102 chan->psm = psm;
5103 chan->dcid = scid;
5104 chan->omtu = mtu;
5105 chan->remote_mps = mps;
5106
5107 __l2cap_chan_add(conn, chan);
5108
5109 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
5110
5111 /* Init response */
5112 if (!pdu.rsp.credits) {
5113 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
5114 pdu.rsp.mps = cpu_to_le16(chan->mps);
5115 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
5116 }
5117
5118 pdu.dcid[i] = cpu_to_le16(chan->scid);
5119
5120 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5121
5122 chan->ident = cmd->ident;
5123 chan->mode = L2CAP_MODE_EXT_FLOWCTL;
5124
5125 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5126 l2cap_state_change(chan, BT_CONNECT2);
5127 defer = true;
5128 chan->ops->defer(chan);
5129 } else {
5130 l2cap_chan_ready(chan);
5131 }
5132 }
5133
5134 unlock:
5135 l2cap_chan_unlock(pchan);
5136 mutex_unlock(&conn->chan_lock);
5137 l2cap_chan_put(pchan);
5138
5139 response:
5140 pdu.rsp.result = cpu_to_le16(result);
5141
5142 if (defer)
5143 return 0;
5144
5145 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
5146 sizeof(pdu.rsp) + len, &pdu);
5147
5148 return 0;
5149 }
5150
l2cap_ecred_conn_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5151 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
5152 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5153 u8 *data)
5154 {
5155 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5156 struct hci_conn *hcon = conn->hcon;
5157 u16 mtu, mps, credits, result;
5158 struct l2cap_chan *chan, *tmp;
5159 int err = 0, sec_level;
5160 int i = 0;
5161
5162 if (cmd_len < sizeof(*rsp))
5163 return -EPROTO;
5164
5165 mtu = __le16_to_cpu(rsp->mtu);
5166 mps = __le16_to_cpu(rsp->mps);
5167 credits = __le16_to_cpu(rsp->credits);
5168 result = __le16_to_cpu(rsp->result);
5169
5170 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5171 result);
5172
5173 mutex_lock(&conn->chan_lock);
5174
5175 cmd_len -= sizeof(*rsp);
5176
5177 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5178 u16 dcid;
5179
5180 if (chan->ident != cmd->ident ||
5181 chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
5182 chan->state == BT_CONNECTED)
5183 continue;
5184
5185 l2cap_chan_lock(chan);
5186
5187 /* Check that there is a dcid for each pending channel */
5188 if (cmd_len < sizeof(dcid)) {
5189 l2cap_chan_del(chan, ECONNREFUSED);
5190 l2cap_chan_unlock(chan);
5191 continue;
5192 }
5193
5194 dcid = __le16_to_cpu(rsp->dcid[i++]);
5195 cmd_len -= sizeof(u16);
5196
5197 BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
5198
5199 /* Check if dcid is already in use */
5200 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
5201 /* If a device receives a
5202 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
5203 * already-assigned Destination CID, then both the
5204 * original channel and the new channel shall be
5205 * immediately discarded and not used.
5206 */
5207 l2cap_chan_del(chan, ECONNREFUSED);
5208 l2cap_chan_unlock(chan);
5209 chan = __l2cap_get_chan_by_dcid(conn, dcid);
5210 l2cap_chan_lock(chan);
5211 l2cap_chan_del(chan, ECONNRESET);
5212 l2cap_chan_unlock(chan);
5213 continue;
5214 }
5215
5216 switch (result) {
5217 case L2CAP_CR_LE_AUTHENTICATION:
5218 case L2CAP_CR_LE_ENCRYPTION:
5219 /* If we already have MITM protection we can't do
5220 * anything.
5221 */
5222 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5223 l2cap_chan_del(chan, ECONNREFUSED);
5224 break;
5225 }
5226
5227 sec_level = hcon->sec_level + 1;
5228 if (chan->sec_level < sec_level)
5229 chan->sec_level = sec_level;
5230
5231 /* We'll need to send a new Connect Request */
5232 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
5233
5234 smp_conn_security(hcon, chan->sec_level);
5235 break;
5236
5237 case L2CAP_CR_LE_BAD_PSM:
5238 l2cap_chan_del(chan, ECONNREFUSED);
5239 break;
5240
5241 default:
5242 /* If dcid was not set it means channels was refused */
5243 if (!dcid) {
5244 l2cap_chan_del(chan, ECONNREFUSED);
5245 break;
5246 }
5247
5248 chan->ident = 0;
5249 chan->dcid = dcid;
5250 chan->omtu = mtu;
5251 chan->remote_mps = mps;
5252 chan->tx_credits = credits;
5253 l2cap_chan_ready(chan);
5254 break;
5255 }
5256
5257 l2cap_chan_unlock(chan);
5258 }
5259
5260 mutex_unlock(&conn->chan_lock);
5261
5262 return err;
5263 }
5264
l2cap_ecred_reconf_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5265 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
5266 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5267 u8 *data)
5268 {
5269 struct l2cap_ecred_reconf_req *req = (void *) data;
5270 struct l2cap_ecred_reconf_rsp rsp;
5271 u16 mtu, mps, result;
5272 struct l2cap_chan *chan;
5273 int i, num_scid;
5274
5275 if (!enable_ecred)
5276 return -EINVAL;
5277
5278 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
5279 result = L2CAP_CR_LE_INVALID_PARAMS;
5280 goto respond;
5281 }
5282
5283 mtu = __le16_to_cpu(req->mtu);
5284 mps = __le16_to_cpu(req->mps);
5285
5286 BT_DBG("mtu %u mps %u", mtu, mps);
5287
5288 if (mtu < L2CAP_ECRED_MIN_MTU) {
5289 result = L2CAP_RECONF_INVALID_MTU;
5290 goto respond;
5291 }
5292
5293 if (mps < L2CAP_ECRED_MIN_MPS) {
5294 result = L2CAP_RECONF_INVALID_MPS;
5295 goto respond;
5296 }
5297
5298 cmd_len -= sizeof(*req);
5299 num_scid = cmd_len / sizeof(u16);
5300 result = L2CAP_RECONF_SUCCESS;
5301
5302 for (i = 0; i < num_scid; i++) {
5303 u16 scid;
5304
5305 scid = __le16_to_cpu(req->scid[i]);
5306 if (!scid)
5307 return -EPROTO;
5308
5309 chan = __l2cap_get_chan_by_dcid(conn, scid);
5310 if (!chan)
5311 continue;
5312
5313 /* If the MTU value is decreased for any of the included
5314 * channels, then the receiver shall disconnect all
5315 * included channels.
5316 */
5317 if (chan->omtu > mtu) {
5318 BT_ERR("chan %p decreased MTU %u -> %u", chan,
5319 chan->omtu, mtu);
5320 result = L2CAP_RECONF_INVALID_MTU;
5321 }
5322
5323 chan->omtu = mtu;
5324 chan->remote_mps = mps;
5325 }
5326
5327 respond:
5328 rsp.result = cpu_to_le16(result);
5329
5330 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
5331 &rsp);
5332
5333 return 0;
5334 }
5335
l2cap_ecred_reconf_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5336 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
5337 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5338 u8 *data)
5339 {
5340 struct l2cap_chan *chan, *tmp;
5341 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5342 u16 result;
5343
5344 if (cmd_len < sizeof(*rsp))
5345 return -EPROTO;
5346
5347 result = __le16_to_cpu(rsp->result);
5348
5349 BT_DBG("result 0x%4.4x", rsp->result);
5350
5351 if (!result)
5352 return 0;
5353
5354 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5355 if (chan->ident != cmd->ident)
5356 continue;
5357
5358 l2cap_chan_del(chan, ECONNRESET);
5359 }
5360
5361 return 0;
5362 }
5363
l2cap_le_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5364 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5365 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5366 u8 *data)
5367 {
5368 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5369 struct l2cap_chan *chan;
5370
5371 if (cmd_len < sizeof(*rej))
5372 return -EPROTO;
5373
5374 mutex_lock(&conn->chan_lock);
5375
5376 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5377 if (!chan)
5378 goto done;
5379
5380 chan = l2cap_chan_hold_unless_zero(chan);
5381 if (!chan)
5382 goto done;
5383
5384 l2cap_chan_lock(chan);
5385 l2cap_chan_del(chan, ECONNREFUSED);
5386 l2cap_chan_unlock(chan);
5387 l2cap_chan_put(chan);
5388
5389 done:
5390 mutex_unlock(&conn->chan_lock);
5391 return 0;
5392 }
5393
l2cap_le_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5394 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5395 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5396 u8 *data)
5397 {
5398 int err = 0;
5399
5400 switch (cmd->code) {
5401 case L2CAP_COMMAND_REJ:
5402 l2cap_le_command_rej(conn, cmd, cmd_len, data);
5403 break;
5404
5405 case L2CAP_CONN_PARAM_UPDATE_REQ:
5406 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5407 break;
5408
5409 case L2CAP_CONN_PARAM_UPDATE_RSP:
5410 break;
5411
5412 case L2CAP_LE_CONN_RSP:
5413 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5414 break;
5415
5416 case L2CAP_LE_CONN_REQ:
5417 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5418 break;
5419
5420 case L2CAP_LE_CREDITS:
5421 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5422 break;
5423
5424 case L2CAP_ECRED_CONN_REQ:
5425 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
5426 break;
5427
5428 case L2CAP_ECRED_CONN_RSP:
5429 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
5430 break;
5431
5432 case L2CAP_ECRED_RECONF_REQ:
5433 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
5434 break;
5435
5436 case L2CAP_ECRED_RECONF_RSP:
5437 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
5438 break;
5439
5440 case L2CAP_DISCONN_REQ:
5441 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5442 break;
5443
5444 case L2CAP_DISCONN_RSP:
5445 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5446 break;
5447
5448 default:
5449 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5450 err = -EINVAL;
5451 break;
5452 }
5453
5454 return err;
5455 }
5456
l2cap_le_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5457 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5458 struct sk_buff *skb)
5459 {
5460 struct hci_conn *hcon = conn->hcon;
5461 struct l2cap_cmd_hdr *cmd;
5462 u16 len;
5463 int err;
5464
5465 if (hcon->type != LE_LINK)
5466 goto drop;
5467
5468 if (skb->len < L2CAP_CMD_HDR_SIZE)
5469 goto drop;
5470
5471 cmd = (void *) skb->data;
5472 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5473
5474 len = le16_to_cpu(cmd->len);
5475
5476 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5477
5478 if (len != skb->len || !cmd->ident) {
5479 BT_DBG("corrupted command");
5480 goto drop;
5481 }
5482
5483 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5484 if (err) {
5485 struct l2cap_cmd_rej_unk rej;
5486
5487 BT_ERR("Wrong link type (%d)", err);
5488
5489 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5490 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5491 sizeof(rej), &rej);
5492 }
5493
5494 drop:
5495 kfree_skb(skb);
5496 }
5497
l2cap_sig_send_rej(struct l2cap_conn * conn,u16 ident)5498 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
5499 {
5500 struct l2cap_cmd_rej_unk rej;
5501
5502 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5503 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5504 }
5505
l2cap_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5506 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5507 struct sk_buff *skb)
5508 {
5509 struct hci_conn *hcon = conn->hcon;
5510 struct l2cap_cmd_hdr *cmd;
5511 int err;
5512
5513 l2cap_raw_recv(conn, skb);
5514
5515 if (hcon->type != ACL_LINK)
5516 goto drop;
5517
5518 while (skb->len >= L2CAP_CMD_HDR_SIZE) {
5519 u16 len;
5520
5521 cmd = (void *) skb->data;
5522 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5523
5524 len = le16_to_cpu(cmd->len);
5525
5526 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
5527 cmd->ident);
5528
5529 if (len > skb->len || !cmd->ident) {
5530 BT_DBG("corrupted command");
5531 l2cap_sig_send_rej(conn, cmd->ident);
5532 skb_pull(skb, len > skb->len ? skb->len : len);
5533 continue;
5534 }
5535
5536 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
5537 if (err) {
5538 BT_ERR("Wrong link type (%d)", err);
5539 l2cap_sig_send_rej(conn, cmd->ident);
5540 }
5541
5542 skb_pull(skb, len);
5543 }
5544
5545 if (skb->len > 0) {
5546 BT_DBG("corrupted command");
5547 l2cap_sig_send_rej(conn, 0);
5548 }
5549
5550 drop:
5551 kfree_skb(skb);
5552 }
5553
l2cap_check_fcs(struct l2cap_chan * chan,struct sk_buff * skb)5554 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
5555 {
5556 u16 our_fcs, rcv_fcs;
5557 int hdr_size;
5558
5559 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5560 hdr_size = L2CAP_EXT_HDR_SIZE;
5561 else
5562 hdr_size = L2CAP_ENH_HDR_SIZE;
5563
5564 if (chan->fcs == L2CAP_FCS_CRC16) {
5565 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5566 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5567 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5568
5569 if (our_fcs != rcv_fcs)
5570 return -EBADMSG;
5571 }
5572 return 0;
5573 }
5574
l2cap_send_i_or_rr_or_rnr(struct l2cap_chan * chan)5575 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5576 {
5577 struct l2cap_ctrl control;
5578
5579 BT_DBG("chan %p", chan);
5580
5581 memset(&control, 0, sizeof(control));
5582 control.sframe = 1;
5583 control.final = 1;
5584 control.reqseq = chan->buffer_seq;
5585 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5586
5587 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5588 control.super = L2CAP_SUPER_RNR;
5589 l2cap_send_sframe(chan, &control);
5590 }
5591
5592 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5593 chan->unacked_frames > 0)
5594 __set_retrans_timer(chan);
5595
5596 /* Send pending iframes */
5597 l2cap_ertm_send(chan);
5598
5599 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5600 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5601 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5602 * send it now.
5603 */
5604 control.super = L2CAP_SUPER_RR;
5605 l2cap_send_sframe(chan, &control);
5606 }
5607 }
5608
append_skb_frag(struct sk_buff * skb,struct sk_buff * new_frag,struct sk_buff ** last_frag)5609 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5610 struct sk_buff **last_frag)
5611 {
5612 /* skb->len reflects data in skb as well as all fragments
5613 * skb->data_len reflects only data in fragments
5614 */
5615 if (!skb_has_frag_list(skb))
5616 skb_shinfo(skb)->frag_list = new_frag;
5617
5618 new_frag->next = NULL;
5619
5620 (*last_frag)->next = new_frag;
5621 *last_frag = new_frag;
5622
5623 skb->len += new_frag->len;
5624 skb->data_len += new_frag->len;
5625 skb->truesize += new_frag->truesize;
5626 }
5627
l2cap_reassemble_sdu(struct l2cap_chan * chan,struct sk_buff * skb,struct l2cap_ctrl * control)5628 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5629 struct l2cap_ctrl *control)
5630 {
5631 int err = -EINVAL;
5632
5633 switch (control->sar) {
5634 case L2CAP_SAR_UNSEGMENTED:
5635 if (chan->sdu)
5636 break;
5637
5638 err = chan->ops->recv(chan, skb);
5639 break;
5640
5641 case L2CAP_SAR_START:
5642 if (chan->sdu)
5643 break;
5644
5645 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5646 break;
5647
5648 chan->sdu_len = get_unaligned_le16(skb->data);
5649 skb_pull(skb, L2CAP_SDULEN_SIZE);
5650
5651 if (chan->sdu_len > chan->imtu) {
5652 err = -EMSGSIZE;
5653 break;
5654 }
5655
5656 if (skb->len >= chan->sdu_len)
5657 break;
5658
5659 chan->sdu = skb;
5660 chan->sdu_last_frag = skb;
5661
5662 skb = NULL;
5663 err = 0;
5664 break;
5665
5666 case L2CAP_SAR_CONTINUE:
5667 if (!chan->sdu)
5668 break;
5669
5670 append_skb_frag(chan->sdu, skb,
5671 &chan->sdu_last_frag);
5672 skb = NULL;
5673
5674 if (chan->sdu->len >= chan->sdu_len)
5675 break;
5676
5677 err = 0;
5678 break;
5679
5680 case L2CAP_SAR_END:
5681 if (!chan->sdu)
5682 break;
5683
5684 append_skb_frag(chan->sdu, skb,
5685 &chan->sdu_last_frag);
5686 skb = NULL;
5687
5688 if (chan->sdu->len != chan->sdu_len)
5689 break;
5690
5691 err = chan->ops->recv(chan, chan->sdu);
5692
5693 if (!err) {
5694 /* Reassembly complete */
5695 chan->sdu = NULL;
5696 chan->sdu_last_frag = NULL;
5697 chan->sdu_len = 0;
5698 }
5699 break;
5700 }
5701
5702 if (err) {
5703 kfree_skb(skb);
5704 kfree_skb(chan->sdu);
5705 chan->sdu = NULL;
5706 chan->sdu_last_frag = NULL;
5707 chan->sdu_len = 0;
5708 }
5709
5710 return err;
5711 }
5712
l2cap_resegment(struct l2cap_chan * chan)5713 static int l2cap_resegment(struct l2cap_chan *chan)
5714 {
5715 /* Placeholder */
5716 return 0;
5717 }
5718
l2cap_chan_busy(struct l2cap_chan * chan,int busy)5719 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5720 {
5721 u8 event;
5722
5723 if (chan->mode != L2CAP_MODE_ERTM)
5724 return;
5725
5726 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5727 l2cap_tx(chan, NULL, NULL, event);
5728 }
5729
l2cap_rx_queued_iframes(struct l2cap_chan * chan)5730 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5731 {
5732 int err = 0;
5733 /* Pass sequential frames to l2cap_reassemble_sdu()
5734 * until a gap is encountered.
5735 */
5736
5737 BT_DBG("chan %p", chan);
5738
5739 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5740 struct sk_buff *skb;
5741 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5742 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5743
5744 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5745
5746 if (!skb)
5747 break;
5748
5749 skb_unlink(skb, &chan->srej_q);
5750 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5751 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
5752 if (err)
5753 break;
5754 }
5755
5756 if (skb_queue_empty(&chan->srej_q)) {
5757 chan->rx_state = L2CAP_RX_STATE_RECV;
5758 l2cap_send_ack(chan);
5759 }
5760
5761 return err;
5762 }
5763
l2cap_handle_srej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5764 static void l2cap_handle_srej(struct l2cap_chan *chan,
5765 struct l2cap_ctrl *control)
5766 {
5767 struct sk_buff *skb;
5768
5769 BT_DBG("chan %p, control %p", chan, control);
5770
5771 if (control->reqseq == chan->next_tx_seq) {
5772 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5773 l2cap_send_disconn_req(chan, ECONNRESET);
5774 return;
5775 }
5776
5777 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5778
5779 if (skb == NULL) {
5780 BT_DBG("Seq %d not available for retransmission",
5781 control->reqseq);
5782 return;
5783 }
5784
5785 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5786 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5787 l2cap_send_disconn_req(chan, ECONNRESET);
5788 return;
5789 }
5790
5791 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5792
5793 if (control->poll) {
5794 l2cap_pass_to_tx(chan, control);
5795
5796 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5797 l2cap_retransmit(chan, control);
5798 l2cap_ertm_send(chan);
5799
5800 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5801 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5802 chan->srej_save_reqseq = control->reqseq;
5803 }
5804 } else {
5805 l2cap_pass_to_tx_fbit(chan, control);
5806
5807 if (control->final) {
5808 if (chan->srej_save_reqseq != control->reqseq ||
5809 !test_and_clear_bit(CONN_SREJ_ACT,
5810 &chan->conn_state))
5811 l2cap_retransmit(chan, control);
5812 } else {
5813 l2cap_retransmit(chan, control);
5814 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5815 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5816 chan->srej_save_reqseq = control->reqseq;
5817 }
5818 }
5819 }
5820 }
5821
l2cap_handle_rej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5822 static void l2cap_handle_rej(struct l2cap_chan *chan,
5823 struct l2cap_ctrl *control)
5824 {
5825 struct sk_buff *skb;
5826
5827 BT_DBG("chan %p, control %p", chan, control);
5828
5829 if (control->reqseq == chan->next_tx_seq) {
5830 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5831 l2cap_send_disconn_req(chan, ECONNRESET);
5832 return;
5833 }
5834
5835 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5836
5837 if (chan->max_tx && skb &&
5838 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5839 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5840 l2cap_send_disconn_req(chan, ECONNRESET);
5841 return;
5842 }
5843
5844 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5845
5846 l2cap_pass_to_tx(chan, control);
5847
5848 if (control->final) {
5849 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5850 l2cap_retransmit_all(chan, control);
5851 } else {
5852 l2cap_retransmit_all(chan, control);
5853 l2cap_ertm_send(chan);
5854 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5855 set_bit(CONN_REJ_ACT, &chan->conn_state);
5856 }
5857 }
5858
l2cap_classify_txseq(struct l2cap_chan * chan,u16 txseq)5859 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5860 {
5861 BT_DBG("chan %p, txseq %d", chan, txseq);
5862
5863 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5864 chan->expected_tx_seq);
5865
5866 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5867 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5868 chan->tx_win) {
5869 /* See notes below regarding "double poll" and
5870 * invalid packets.
5871 */
5872 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5873 BT_DBG("Invalid/Ignore - after SREJ");
5874 return L2CAP_TXSEQ_INVALID_IGNORE;
5875 } else {
5876 BT_DBG("Invalid - in window after SREJ sent");
5877 return L2CAP_TXSEQ_INVALID;
5878 }
5879 }
5880
5881 if (chan->srej_list.head == txseq) {
5882 BT_DBG("Expected SREJ");
5883 return L2CAP_TXSEQ_EXPECTED_SREJ;
5884 }
5885
5886 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5887 BT_DBG("Duplicate SREJ - txseq already stored");
5888 return L2CAP_TXSEQ_DUPLICATE_SREJ;
5889 }
5890
5891 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5892 BT_DBG("Unexpected SREJ - not requested");
5893 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5894 }
5895 }
5896
5897 if (chan->expected_tx_seq == txseq) {
5898 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5899 chan->tx_win) {
5900 BT_DBG("Invalid - txseq outside tx window");
5901 return L2CAP_TXSEQ_INVALID;
5902 } else {
5903 BT_DBG("Expected");
5904 return L2CAP_TXSEQ_EXPECTED;
5905 }
5906 }
5907
5908 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
5909 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
5910 BT_DBG("Duplicate - expected_tx_seq later than txseq");
5911 return L2CAP_TXSEQ_DUPLICATE;
5912 }
5913
5914 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5915 /* A source of invalid packets is a "double poll" condition,
5916 * where delays cause us to send multiple poll packets. If
5917 * the remote stack receives and processes both polls,
5918 * sequence numbers can wrap around in such a way that a
5919 * resent frame has a sequence number that looks like new data
5920 * with a sequence gap. This would trigger an erroneous SREJ
5921 * request.
5922 *
5923 * Fortunately, this is impossible with a tx window that's
5924 * less than half of the maximum sequence number, which allows
5925 * invalid frames to be safely ignored.
5926 *
5927 * With tx window sizes greater than half of the tx window
5928 * maximum, the frame is invalid and cannot be ignored. This
5929 * causes a disconnect.
5930 */
5931
5932 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5933 BT_DBG("Invalid/Ignore - txseq outside tx window");
5934 return L2CAP_TXSEQ_INVALID_IGNORE;
5935 } else {
5936 BT_DBG("Invalid - txseq outside tx window");
5937 return L2CAP_TXSEQ_INVALID;
5938 }
5939 } else {
5940 BT_DBG("Unexpected - txseq indicates missing frames");
5941 return L2CAP_TXSEQ_UNEXPECTED;
5942 }
5943 }
5944
l2cap_rx_state_recv(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)5945 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5946 struct l2cap_ctrl *control,
5947 struct sk_buff *skb, u8 event)
5948 {
5949 struct l2cap_ctrl local_control;
5950 int err = 0;
5951 bool skb_in_use = false;
5952
5953 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5954 event);
5955
5956 switch (event) {
5957 case L2CAP_EV_RECV_IFRAME:
5958 switch (l2cap_classify_txseq(chan, control->txseq)) {
5959 case L2CAP_TXSEQ_EXPECTED:
5960 l2cap_pass_to_tx(chan, control);
5961
5962 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5963 BT_DBG("Busy, discarding expected seq %d",
5964 control->txseq);
5965 break;
5966 }
5967
5968 chan->expected_tx_seq = __next_seq(chan,
5969 control->txseq);
5970
5971 chan->buffer_seq = chan->expected_tx_seq;
5972 skb_in_use = true;
5973
5974 /* l2cap_reassemble_sdu may free skb, hence invalidate
5975 * control, so make a copy in advance to use it after
5976 * l2cap_reassemble_sdu returns and to avoid the race
5977 * condition, for example:
5978 *
5979 * The current thread calls:
5980 * l2cap_reassemble_sdu
5981 * chan->ops->recv == l2cap_sock_recv_cb
5982 * __sock_queue_rcv_skb
5983 * Another thread calls:
5984 * bt_sock_recvmsg
5985 * skb_recv_datagram
5986 * skb_free_datagram
5987 * Then the current thread tries to access control, but
5988 * it was freed by skb_free_datagram.
5989 */
5990 local_control = *control;
5991 err = l2cap_reassemble_sdu(chan, skb, control);
5992 if (err)
5993 break;
5994
5995 if (local_control.final) {
5996 if (!test_and_clear_bit(CONN_REJ_ACT,
5997 &chan->conn_state)) {
5998 local_control.final = 0;
5999 l2cap_retransmit_all(chan, &local_control);
6000 l2cap_ertm_send(chan);
6001 }
6002 }
6003
6004 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6005 l2cap_send_ack(chan);
6006 break;
6007 case L2CAP_TXSEQ_UNEXPECTED:
6008 l2cap_pass_to_tx(chan, control);
6009
6010 /* Can't issue SREJ frames in the local busy state.
6011 * Drop this frame, it will be seen as missing
6012 * when local busy is exited.
6013 */
6014 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6015 BT_DBG("Busy, discarding unexpected seq %d",
6016 control->txseq);
6017 break;
6018 }
6019
6020 /* There was a gap in the sequence, so an SREJ
6021 * must be sent for each missing frame. The
6022 * current frame is stored for later use.
6023 */
6024 skb_queue_tail(&chan->srej_q, skb);
6025 skb_in_use = true;
6026 BT_DBG("Queued %p (queue len %d)", skb,
6027 skb_queue_len(&chan->srej_q));
6028
6029 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6030 l2cap_seq_list_clear(&chan->srej_list);
6031 l2cap_send_srej(chan, control->txseq);
6032
6033 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6034 break;
6035 case L2CAP_TXSEQ_DUPLICATE:
6036 l2cap_pass_to_tx(chan, control);
6037 break;
6038 case L2CAP_TXSEQ_INVALID_IGNORE:
6039 break;
6040 case L2CAP_TXSEQ_INVALID:
6041 default:
6042 l2cap_send_disconn_req(chan, ECONNRESET);
6043 break;
6044 }
6045 break;
6046 case L2CAP_EV_RECV_RR:
6047 l2cap_pass_to_tx(chan, control);
6048 if (control->final) {
6049 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6050
6051 if (!test_and_clear_bit(CONN_REJ_ACT,
6052 &chan->conn_state)) {
6053 control->final = 0;
6054 l2cap_retransmit_all(chan, control);
6055 }
6056
6057 l2cap_ertm_send(chan);
6058 } else if (control->poll) {
6059 l2cap_send_i_or_rr_or_rnr(chan);
6060 } else {
6061 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6062 &chan->conn_state) &&
6063 chan->unacked_frames)
6064 __set_retrans_timer(chan);
6065
6066 l2cap_ertm_send(chan);
6067 }
6068 break;
6069 case L2CAP_EV_RECV_RNR:
6070 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6071 l2cap_pass_to_tx(chan, control);
6072 if (control && control->poll) {
6073 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6074 l2cap_send_rr_or_rnr(chan, 0);
6075 }
6076 __clear_retrans_timer(chan);
6077 l2cap_seq_list_clear(&chan->retrans_list);
6078 break;
6079 case L2CAP_EV_RECV_REJ:
6080 l2cap_handle_rej(chan, control);
6081 break;
6082 case L2CAP_EV_RECV_SREJ:
6083 l2cap_handle_srej(chan, control);
6084 break;
6085 default:
6086 break;
6087 }
6088
6089 if (skb && !skb_in_use) {
6090 BT_DBG("Freeing %p", skb);
6091 kfree_skb(skb);
6092 }
6093
6094 return err;
6095 }
6096
l2cap_rx_state_srej_sent(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6097 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6098 struct l2cap_ctrl *control,
6099 struct sk_buff *skb, u8 event)
6100 {
6101 int err = 0;
6102 u16 txseq = control->txseq;
6103 bool skb_in_use = false;
6104
6105 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6106 event);
6107
6108 switch (event) {
6109 case L2CAP_EV_RECV_IFRAME:
6110 switch (l2cap_classify_txseq(chan, txseq)) {
6111 case L2CAP_TXSEQ_EXPECTED:
6112 /* Keep frame for reassembly later */
6113 l2cap_pass_to_tx(chan, control);
6114 skb_queue_tail(&chan->srej_q, skb);
6115 skb_in_use = true;
6116 BT_DBG("Queued %p (queue len %d)", skb,
6117 skb_queue_len(&chan->srej_q));
6118
6119 chan->expected_tx_seq = __next_seq(chan, txseq);
6120 break;
6121 case L2CAP_TXSEQ_EXPECTED_SREJ:
6122 l2cap_seq_list_pop(&chan->srej_list);
6123
6124 l2cap_pass_to_tx(chan, control);
6125 skb_queue_tail(&chan->srej_q, skb);
6126 skb_in_use = true;
6127 BT_DBG("Queued %p (queue len %d)", skb,
6128 skb_queue_len(&chan->srej_q));
6129
6130 err = l2cap_rx_queued_iframes(chan);
6131 if (err)
6132 break;
6133
6134 break;
6135 case L2CAP_TXSEQ_UNEXPECTED:
6136 /* Got a frame that can't be reassembled yet.
6137 * Save it for later, and send SREJs to cover
6138 * the missing frames.
6139 */
6140 skb_queue_tail(&chan->srej_q, skb);
6141 skb_in_use = true;
6142 BT_DBG("Queued %p (queue len %d)", skb,
6143 skb_queue_len(&chan->srej_q));
6144
6145 l2cap_pass_to_tx(chan, control);
6146 l2cap_send_srej(chan, control->txseq);
6147 break;
6148 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6149 /* This frame was requested with an SREJ, but
6150 * some expected retransmitted frames are
6151 * missing. Request retransmission of missing
6152 * SREJ'd frames.
6153 */
6154 skb_queue_tail(&chan->srej_q, skb);
6155 skb_in_use = true;
6156 BT_DBG("Queued %p (queue len %d)", skb,
6157 skb_queue_len(&chan->srej_q));
6158
6159 l2cap_pass_to_tx(chan, control);
6160 l2cap_send_srej_list(chan, control->txseq);
6161 break;
6162 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6163 /* We've already queued this frame. Drop this copy. */
6164 l2cap_pass_to_tx(chan, control);
6165 break;
6166 case L2CAP_TXSEQ_DUPLICATE:
6167 /* Expecting a later sequence number, so this frame
6168 * was already received. Ignore it completely.
6169 */
6170 break;
6171 case L2CAP_TXSEQ_INVALID_IGNORE:
6172 break;
6173 case L2CAP_TXSEQ_INVALID:
6174 default:
6175 l2cap_send_disconn_req(chan, ECONNRESET);
6176 break;
6177 }
6178 break;
6179 case L2CAP_EV_RECV_RR:
6180 l2cap_pass_to_tx(chan, control);
6181 if (control->final) {
6182 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6183
6184 if (!test_and_clear_bit(CONN_REJ_ACT,
6185 &chan->conn_state)) {
6186 control->final = 0;
6187 l2cap_retransmit_all(chan, control);
6188 }
6189
6190 l2cap_ertm_send(chan);
6191 } else if (control->poll) {
6192 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6193 &chan->conn_state) &&
6194 chan->unacked_frames) {
6195 __set_retrans_timer(chan);
6196 }
6197
6198 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6199 l2cap_send_srej_tail(chan);
6200 } else {
6201 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6202 &chan->conn_state) &&
6203 chan->unacked_frames)
6204 __set_retrans_timer(chan);
6205
6206 l2cap_send_ack(chan);
6207 }
6208 break;
6209 case L2CAP_EV_RECV_RNR:
6210 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6211 l2cap_pass_to_tx(chan, control);
6212 if (control->poll) {
6213 l2cap_send_srej_tail(chan);
6214 } else {
6215 struct l2cap_ctrl rr_control;
6216 memset(&rr_control, 0, sizeof(rr_control));
6217 rr_control.sframe = 1;
6218 rr_control.super = L2CAP_SUPER_RR;
6219 rr_control.reqseq = chan->buffer_seq;
6220 l2cap_send_sframe(chan, &rr_control);
6221 }
6222
6223 break;
6224 case L2CAP_EV_RECV_REJ:
6225 l2cap_handle_rej(chan, control);
6226 break;
6227 case L2CAP_EV_RECV_SREJ:
6228 l2cap_handle_srej(chan, control);
6229 break;
6230 }
6231
6232 if (skb && !skb_in_use) {
6233 BT_DBG("Freeing %p", skb);
6234 kfree_skb(skb);
6235 }
6236
6237 return err;
6238 }
6239
l2cap_finish_move(struct l2cap_chan * chan)6240 static int l2cap_finish_move(struct l2cap_chan *chan)
6241 {
6242 BT_DBG("chan %p", chan);
6243
6244 chan->rx_state = L2CAP_RX_STATE_RECV;
6245 chan->conn->mtu = chan->conn->hcon->mtu;
6246
6247 return l2cap_resegment(chan);
6248 }
6249
l2cap_rx_state_wait_p(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6250 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6251 struct l2cap_ctrl *control,
6252 struct sk_buff *skb, u8 event)
6253 {
6254 int err;
6255
6256 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6257 event);
6258
6259 if (!control->poll)
6260 return -EPROTO;
6261
6262 l2cap_process_reqseq(chan, control->reqseq);
6263
6264 if (!skb_queue_empty(&chan->tx_q))
6265 chan->tx_send_head = skb_peek(&chan->tx_q);
6266 else
6267 chan->tx_send_head = NULL;
6268
6269 /* Rewind next_tx_seq to the point expected
6270 * by the receiver.
6271 */
6272 chan->next_tx_seq = control->reqseq;
6273 chan->unacked_frames = 0;
6274
6275 err = l2cap_finish_move(chan);
6276 if (err)
6277 return err;
6278
6279 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6280 l2cap_send_i_or_rr_or_rnr(chan);
6281
6282 if (event == L2CAP_EV_RECV_IFRAME)
6283 return -EPROTO;
6284
6285 return l2cap_rx_state_recv(chan, control, NULL, event);
6286 }
6287
l2cap_rx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6288 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6289 struct l2cap_ctrl *control,
6290 struct sk_buff *skb, u8 event)
6291 {
6292 int err;
6293
6294 if (!control->final)
6295 return -EPROTO;
6296
6297 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6298
6299 chan->rx_state = L2CAP_RX_STATE_RECV;
6300 l2cap_process_reqseq(chan, control->reqseq);
6301
6302 if (!skb_queue_empty(&chan->tx_q))
6303 chan->tx_send_head = skb_peek(&chan->tx_q);
6304 else
6305 chan->tx_send_head = NULL;
6306
6307 /* Rewind next_tx_seq to the point expected
6308 * by the receiver.
6309 */
6310 chan->next_tx_seq = control->reqseq;
6311 chan->unacked_frames = 0;
6312 chan->conn->mtu = chan->conn->hcon->mtu;
6313
6314 err = l2cap_resegment(chan);
6315
6316 if (!err)
6317 err = l2cap_rx_state_recv(chan, control, skb, event);
6318
6319 return err;
6320 }
6321
__valid_reqseq(struct l2cap_chan * chan,u16 reqseq)6322 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6323 {
6324 /* Make sure reqseq is for a packet that has been sent but not acked */
6325 u16 unacked;
6326
6327 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6328 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6329 }
6330
l2cap_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6331 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6332 struct sk_buff *skb, u8 event)
6333 {
6334 int err = 0;
6335
6336 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6337 control, skb, event, chan->rx_state);
6338
6339 if (__valid_reqseq(chan, control->reqseq)) {
6340 switch (chan->rx_state) {
6341 case L2CAP_RX_STATE_RECV:
6342 err = l2cap_rx_state_recv(chan, control, skb, event);
6343 break;
6344 case L2CAP_RX_STATE_SREJ_SENT:
6345 err = l2cap_rx_state_srej_sent(chan, control, skb,
6346 event);
6347 break;
6348 case L2CAP_RX_STATE_WAIT_P:
6349 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6350 break;
6351 case L2CAP_RX_STATE_WAIT_F:
6352 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6353 break;
6354 default:
6355 /* shut it down */
6356 break;
6357 }
6358 } else {
6359 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6360 control->reqseq, chan->next_tx_seq,
6361 chan->expected_ack_seq);
6362 l2cap_send_disconn_req(chan, ECONNRESET);
6363 }
6364
6365 return err;
6366 }
6367
l2cap_stream_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)6368 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6369 struct sk_buff *skb)
6370 {
6371 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6372 * the txseq field in advance to use it after l2cap_reassemble_sdu
6373 * returns and to avoid the race condition, for example:
6374 *
6375 * The current thread calls:
6376 * l2cap_reassemble_sdu
6377 * chan->ops->recv == l2cap_sock_recv_cb
6378 * __sock_queue_rcv_skb
6379 * Another thread calls:
6380 * bt_sock_recvmsg
6381 * skb_recv_datagram
6382 * skb_free_datagram
6383 * Then the current thread tries to access control, but it was freed by
6384 * skb_free_datagram.
6385 */
6386 u16 txseq = control->txseq;
6387
6388 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6389 chan->rx_state);
6390
6391 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
6392 l2cap_pass_to_tx(chan, control);
6393
6394 BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
6395 __next_seq(chan, chan->buffer_seq));
6396
6397 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6398
6399 l2cap_reassemble_sdu(chan, skb, control);
6400 } else {
6401 if (chan->sdu) {
6402 kfree_skb(chan->sdu);
6403 chan->sdu = NULL;
6404 }
6405 chan->sdu_last_frag = NULL;
6406 chan->sdu_len = 0;
6407
6408 if (skb) {
6409 BT_DBG("Freeing %p", skb);
6410 kfree_skb(skb);
6411 }
6412 }
6413
6414 chan->last_acked_seq = txseq;
6415 chan->expected_tx_seq = __next_seq(chan, txseq);
6416
6417 return 0;
6418 }
6419
l2cap_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6420 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6421 {
6422 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6423 u16 len;
6424 u8 event;
6425
6426 __unpack_control(chan, skb);
6427
6428 len = skb->len;
6429
6430 /*
6431 * We can just drop the corrupted I-frame here.
6432 * Receiver will miss it and start proper recovery
6433 * procedures and ask for retransmission.
6434 */
6435 if (l2cap_check_fcs(chan, skb))
6436 goto drop;
6437
6438 if (!control->sframe && control->sar == L2CAP_SAR_START)
6439 len -= L2CAP_SDULEN_SIZE;
6440
6441 if (chan->fcs == L2CAP_FCS_CRC16)
6442 len -= L2CAP_FCS_SIZE;
6443
6444 if (len > chan->mps) {
6445 l2cap_send_disconn_req(chan, ECONNRESET);
6446 goto drop;
6447 }
6448
6449 if (chan->ops->filter) {
6450 if (chan->ops->filter(chan, skb))
6451 goto drop;
6452 }
6453
6454 if (!control->sframe) {
6455 int err;
6456
6457 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6458 control->sar, control->reqseq, control->final,
6459 control->txseq);
6460
6461 /* Validate F-bit - F=0 always valid, F=1 only
6462 * valid in TX WAIT_F
6463 */
6464 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6465 goto drop;
6466
6467 if (chan->mode != L2CAP_MODE_STREAMING) {
6468 event = L2CAP_EV_RECV_IFRAME;
6469 err = l2cap_rx(chan, control, skb, event);
6470 } else {
6471 err = l2cap_stream_rx(chan, control, skb);
6472 }
6473
6474 if (err)
6475 l2cap_send_disconn_req(chan, ECONNRESET);
6476 } else {
6477 const u8 rx_func_to_event[4] = {
6478 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6479 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6480 };
6481
6482 /* Only I-frames are expected in streaming mode */
6483 if (chan->mode == L2CAP_MODE_STREAMING)
6484 goto drop;
6485
6486 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6487 control->reqseq, control->final, control->poll,
6488 control->super);
6489
6490 if (len != 0) {
6491 BT_ERR("Trailing bytes: %d in sframe", len);
6492 l2cap_send_disconn_req(chan, ECONNRESET);
6493 goto drop;
6494 }
6495
6496 /* Validate F and P bits */
6497 if (control->final && (control->poll ||
6498 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6499 goto drop;
6500
6501 event = rx_func_to_event[control->super];
6502 if (l2cap_rx(chan, control, skb, event))
6503 l2cap_send_disconn_req(chan, ECONNRESET);
6504 }
6505
6506 return 0;
6507
6508 drop:
6509 kfree_skb(skb);
6510 return 0;
6511 }
6512
l2cap_chan_le_send_credits(struct l2cap_chan * chan)6513 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6514 {
6515 struct l2cap_conn *conn = chan->conn;
6516 struct l2cap_le_credits pkt;
6517 u16 return_credits = l2cap_le_rx_credits(chan);
6518
6519 if (chan->rx_credits >= return_credits)
6520 return;
6521
6522 return_credits -= chan->rx_credits;
6523
6524 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6525
6526 chan->rx_credits += return_credits;
6527
6528 pkt.cid = cpu_to_le16(chan->scid);
6529 pkt.credits = cpu_to_le16(return_credits);
6530
6531 chan->ident = l2cap_get_ident(conn);
6532
6533 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6534 }
6535
l2cap_chan_rx_avail(struct l2cap_chan * chan,ssize_t rx_avail)6536 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
6537 {
6538 if (chan->rx_avail == rx_avail)
6539 return;
6540
6541 BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail);
6542
6543 chan->rx_avail = rx_avail;
6544
6545 if (chan->state == BT_CONNECTED)
6546 l2cap_chan_le_send_credits(chan);
6547 }
6548
l2cap_ecred_recv(struct l2cap_chan * chan,struct sk_buff * skb)6549 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
6550 {
6551 int err;
6552
6553 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
6554
6555 /* Wait recv to confirm reception before updating the credits */
6556 err = chan->ops->recv(chan, skb);
6557
6558 if (err < 0 && chan->rx_avail != -1) {
6559 BT_ERR("Queueing received LE L2CAP data failed");
6560 l2cap_send_disconn_req(chan, ECONNRESET);
6561 return err;
6562 }
6563
6564 /* Update credits whenever an SDU is received */
6565 l2cap_chan_le_send_credits(chan);
6566
6567 return err;
6568 }
6569
l2cap_ecred_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6570 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6571 {
6572 int err;
6573
6574 if (!chan->rx_credits) {
6575 BT_ERR("No credits to receive LE L2CAP data");
6576 l2cap_send_disconn_req(chan, ECONNRESET);
6577 return -ENOBUFS;
6578 }
6579
6580 if (chan->imtu < skb->len) {
6581 BT_ERR("Too big LE L2CAP PDU");
6582 return -ENOBUFS;
6583 }
6584
6585 chan->rx_credits--;
6586 BT_DBG("chan %p: rx_credits %u -> %u",
6587 chan, chan->rx_credits + 1, chan->rx_credits);
6588
6589 /* Update if remote had run out of credits, this should only happens
6590 * if the remote is not using the entire MPS.
6591 */
6592 if (!chan->rx_credits)
6593 l2cap_chan_le_send_credits(chan);
6594
6595 err = 0;
6596
6597 if (!chan->sdu) {
6598 u16 sdu_len;
6599
6600 sdu_len = get_unaligned_le16(skb->data);
6601 skb_pull(skb, L2CAP_SDULEN_SIZE);
6602
6603 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6604 sdu_len, skb->len, chan->imtu);
6605
6606 if (sdu_len > chan->imtu) {
6607 BT_ERR("Too big LE L2CAP SDU length received");
6608 err = -EMSGSIZE;
6609 goto failed;
6610 }
6611
6612 if (skb->len > sdu_len) {
6613 BT_ERR("Too much LE L2CAP data received");
6614 err = -EINVAL;
6615 goto failed;
6616 }
6617
6618 if (skb->len == sdu_len)
6619 return l2cap_ecred_recv(chan, skb);
6620
6621 chan->sdu = skb;
6622 chan->sdu_len = sdu_len;
6623 chan->sdu_last_frag = skb;
6624
6625 /* Detect if remote is not able to use the selected MPS */
6626 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
6627 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
6628
6629 /* Adjust the number of credits */
6630 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
6631 chan->mps = mps_len;
6632 l2cap_chan_le_send_credits(chan);
6633 }
6634
6635 return 0;
6636 }
6637
6638 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6639 chan->sdu->len, skb->len, chan->sdu_len);
6640
6641 if (chan->sdu->len + skb->len > chan->sdu_len) {
6642 BT_ERR("Too much LE L2CAP data received");
6643 err = -EINVAL;
6644 goto failed;
6645 }
6646
6647 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6648 skb = NULL;
6649
6650 if (chan->sdu->len == chan->sdu_len) {
6651 err = l2cap_ecred_recv(chan, chan->sdu);
6652 if (!err) {
6653 chan->sdu = NULL;
6654 chan->sdu_last_frag = NULL;
6655 chan->sdu_len = 0;
6656 }
6657 }
6658
6659 failed:
6660 if (err) {
6661 kfree_skb(skb);
6662 kfree_skb(chan->sdu);
6663 chan->sdu = NULL;
6664 chan->sdu_last_frag = NULL;
6665 chan->sdu_len = 0;
6666 }
6667
6668 /* We can't return an error here since we took care of the skb
6669 * freeing internally. An error return would cause the caller to
6670 * do a double-free of the skb.
6671 */
6672 return 0;
6673 }
6674
l2cap_data_channel(struct l2cap_conn * conn,u16 cid,struct sk_buff * skb)6675 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6676 struct sk_buff *skb)
6677 {
6678 struct l2cap_chan *chan;
6679
6680 chan = l2cap_get_chan_by_scid(conn, cid);
6681 if (!chan) {
6682 BT_DBG("unknown cid 0x%4.4x", cid);
6683 /* Drop packet and return */
6684 kfree_skb(skb);
6685 return;
6686 }
6687
6688 BT_DBG("chan %p, len %d", chan, skb->len);
6689
6690 /* If we receive data on a fixed channel before the info req/rsp
6691 * procedure is done simply assume that the channel is supported
6692 * and mark it as ready.
6693 */
6694 if (chan->chan_type == L2CAP_CHAN_FIXED)
6695 l2cap_chan_ready(chan);
6696
6697 if (chan->state != BT_CONNECTED)
6698 goto drop;
6699
6700 switch (chan->mode) {
6701 case L2CAP_MODE_LE_FLOWCTL:
6702 case L2CAP_MODE_EXT_FLOWCTL:
6703 if (l2cap_ecred_data_rcv(chan, skb) < 0)
6704 goto drop;
6705
6706 goto done;
6707
6708 case L2CAP_MODE_BASIC:
6709 /* If socket recv buffers overflows we drop data here
6710 * which is *bad* because L2CAP has to be reliable.
6711 * But we don't have any other choice. L2CAP doesn't
6712 * provide flow control mechanism. */
6713
6714 if (chan->imtu < skb->len) {
6715 BT_ERR("Dropping L2CAP data: receive buffer overflow");
6716 goto drop;
6717 }
6718
6719 if (!chan->ops->recv(chan, skb))
6720 goto done;
6721 break;
6722
6723 case L2CAP_MODE_ERTM:
6724 case L2CAP_MODE_STREAMING:
6725 l2cap_data_rcv(chan, skb);
6726 goto done;
6727
6728 default:
6729 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6730 break;
6731 }
6732
6733 drop:
6734 kfree_skb(skb);
6735
6736 done:
6737 l2cap_chan_unlock(chan);
6738 l2cap_chan_put(chan);
6739 }
6740
l2cap_conless_channel(struct l2cap_conn * conn,__le16 psm,struct sk_buff * skb)6741 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6742 struct sk_buff *skb)
6743 {
6744 struct hci_conn *hcon = conn->hcon;
6745 struct l2cap_chan *chan;
6746
6747 if (hcon->type != ACL_LINK)
6748 goto free_skb;
6749
6750 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6751 ACL_LINK);
6752 if (!chan)
6753 goto free_skb;
6754
6755 BT_DBG("chan %p, len %d", chan, skb->len);
6756
6757 l2cap_chan_lock(chan);
6758
6759 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6760 goto drop;
6761
6762 if (chan->imtu < skb->len)
6763 goto drop;
6764
6765 /* Store remote BD_ADDR and PSM for msg_name */
6766 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6767 bt_cb(skb)->l2cap.psm = psm;
6768
6769 if (!chan->ops->recv(chan, skb)) {
6770 l2cap_chan_unlock(chan);
6771 l2cap_chan_put(chan);
6772 return;
6773 }
6774
6775 drop:
6776 l2cap_chan_unlock(chan);
6777 l2cap_chan_put(chan);
6778 free_skb:
6779 kfree_skb(skb);
6780 }
6781
l2cap_recv_frame(struct l2cap_conn * conn,struct sk_buff * skb)6782 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6783 {
6784 struct l2cap_hdr *lh = (void *) skb->data;
6785 struct hci_conn *hcon = conn->hcon;
6786 u16 cid, len;
6787 __le16 psm;
6788
6789 if (hcon->state != BT_CONNECTED) {
6790 BT_DBG("queueing pending rx skb");
6791 skb_queue_tail(&conn->pending_rx, skb);
6792 return;
6793 }
6794
6795 skb_pull(skb, L2CAP_HDR_SIZE);
6796 cid = __le16_to_cpu(lh->cid);
6797 len = __le16_to_cpu(lh->len);
6798
6799 if (len != skb->len) {
6800 kfree_skb(skb);
6801 return;
6802 }
6803
6804 /* Since we can't actively block incoming LE connections we must
6805 * at least ensure that we ignore incoming data from them.
6806 */
6807 if (hcon->type == LE_LINK &&
6808 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
6809 bdaddr_dst_type(hcon))) {
6810 kfree_skb(skb);
6811 return;
6812 }
6813
6814 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6815
6816 switch (cid) {
6817 case L2CAP_CID_SIGNALING:
6818 l2cap_sig_channel(conn, skb);
6819 break;
6820
6821 case L2CAP_CID_CONN_LESS:
6822 psm = get_unaligned((__le16 *) skb->data);
6823 skb_pull(skb, L2CAP_PSMLEN_SIZE);
6824 l2cap_conless_channel(conn, psm, skb);
6825 break;
6826
6827 case L2CAP_CID_LE_SIGNALING:
6828 l2cap_le_sig_channel(conn, skb);
6829 break;
6830
6831 default:
6832 l2cap_data_channel(conn, cid, skb);
6833 break;
6834 }
6835 }
6836
process_pending_rx(struct work_struct * work)6837 static void process_pending_rx(struct work_struct *work)
6838 {
6839 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6840 pending_rx_work);
6841 struct sk_buff *skb;
6842
6843 BT_DBG("");
6844
6845 while ((skb = skb_dequeue(&conn->pending_rx)))
6846 l2cap_recv_frame(conn, skb);
6847 }
6848
l2cap_conn_add(struct hci_conn * hcon)6849 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6850 {
6851 struct l2cap_conn *conn = hcon->l2cap_data;
6852 struct hci_chan *hchan;
6853
6854 if (conn)
6855 return conn;
6856
6857 hchan = hci_chan_create(hcon);
6858 if (!hchan)
6859 return NULL;
6860
6861 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
6862 if (!conn) {
6863 hci_chan_del(hchan);
6864 return NULL;
6865 }
6866
6867 kref_init(&conn->ref);
6868 hcon->l2cap_data = conn;
6869 conn->hcon = hci_conn_get(hcon);
6870 conn->hchan = hchan;
6871
6872 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6873
6874 conn->mtu = hcon->mtu;
6875 conn->feat_mask = 0;
6876
6877 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
6878
6879 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
6880 (bredr_sc_enabled(hcon->hdev) ||
6881 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
6882 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
6883
6884 mutex_init(&conn->ident_lock);
6885 mutex_init(&conn->chan_lock);
6886
6887 INIT_LIST_HEAD(&conn->chan_l);
6888 INIT_LIST_HEAD(&conn->users);
6889
6890 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
6891
6892 skb_queue_head_init(&conn->pending_rx);
6893 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
6894 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
6895
6896 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
6897
6898 return conn;
6899 }
6900
is_valid_psm(u16 psm,u8 dst_type)6901 static bool is_valid_psm(u16 psm, u8 dst_type)
6902 {
6903 if (!psm)
6904 return false;
6905
6906 if (bdaddr_type_is_le(dst_type))
6907 return (psm <= 0x00ff);
6908
6909 /* PSM must be odd and lsb of upper byte must be 0 */
6910 return ((psm & 0x0101) == 0x0001);
6911 }
6912
6913 struct l2cap_chan_data {
6914 struct l2cap_chan *chan;
6915 struct pid *pid;
6916 int count;
6917 };
6918
l2cap_chan_by_pid(struct l2cap_chan * chan,void * data)6919 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
6920 {
6921 struct l2cap_chan_data *d = data;
6922 struct pid *pid;
6923
6924 if (chan == d->chan)
6925 return;
6926
6927 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
6928 return;
6929
6930 pid = chan->ops->get_peer_pid(chan);
6931
6932 /* Only count deferred channels with the same PID/PSM */
6933 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
6934 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
6935 return;
6936
6937 d->count++;
6938 }
6939
l2cap_chan_connect(struct l2cap_chan * chan,__le16 psm,u16 cid,bdaddr_t * dst,u8 dst_type)6940 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
6941 bdaddr_t *dst, u8 dst_type)
6942 {
6943 struct l2cap_conn *conn;
6944 struct hci_conn *hcon;
6945 struct hci_dev *hdev;
6946 int err;
6947
6948 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
6949 dst, dst_type, __le16_to_cpu(psm), chan->mode);
6950
6951 hdev = hci_get_route(dst, &chan->src, chan->src_type);
6952 if (!hdev)
6953 return -EHOSTUNREACH;
6954
6955 hci_dev_lock(hdev);
6956
6957 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
6958 chan->chan_type != L2CAP_CHAN_RAW) {
6959 err = -EINVAL;
6960 goto done;
6961 }
6962
6963 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
6964 err = -EINVAL;
6965 goto done;
6966 }
6967
6968 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
6969 err = -EINVAL;
6970 goto done;
6971 }
6972
6973 switch (chan->mode) {
6974 case L2CAP_MODE_BASIC:
6975 break;
6976 case L2CAP_MODE_LE_FLOWCTL:
6977 break;
6978 case L2CAP_MODE_EXT_FLOWCTL:
6979 if (!enable_ecred) {
6980 err = -EOPNOTSUPP;
6981 goto done;
6982 }
6983 break;
6984 case L2CAP_MODE_ERTM:
6985 case L2CAP_MODE_STREAMING:
6986 if (!disable_ertm)
6987 break;
6988 fallthrough;
6989 default:
6990 err = -EOPNOTSUPP;
6991 goto done;
6992 }
6993
6994 switch (chan->state) {
6995 case BT_CONNECT:
6996 case BT_CONNECT2:
6997 case BT_CONFIG:
6998 /* Already connecting */
6999 err = 0;
7000 goto done;
7001
7002 case BT_CONNECTED:
7003 /* Already connected */
7004 err = -EISCONN;
7005 goto done;
7006
7007 case BT_OPEN:
7008 case BT_BOUND:
7009 /* Can connect */
7010 break;
7011
7012 default:
7013 err = -EBADFD;
7014 goto done;
7015 }
7016
7017 /* Set destination address and psm */
7018 bacpy(&chan->dst, dst);
7019 chan->dst_type = dst_type;
7020
7021 chan->psm = psm;
7022 chan->dcid = cid;
7023
7024 if (bdaddr_type_is_le(dst_type)) {
7025 /* Convert from L2CAP channel address type to HCI address type
7026 */
7027 if (dst_type == BDADDR_LE_PUBLIC)
7028 dst_type = ADDR_LE_DEV_PUBLIC;
7029 else
7030 dst_type = ADDR_LE_DEV_RANDOM;
7031
7032 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7033 hcon = hci_connect_le(hdev, dst, dst_type, false,
7034 chan->sec_level,
7035 HCI_LE_CONN_TIMEOUT,
7036 HCI_ROLE_SLAVE);
7037 else
7038 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7039 chan->sec_level,
7040 HCI_LE_CONN_TIMEOUT,
7041 CONN_REASON_L2CAP_CHAN);
7042
7043 } else {
7044 u8 auth_type = l2cap_get_auth_type(chan);
7045 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7046 CONN_REASON_L2CAP_CHAN);
7047 }
7048
7049 if (IS_ERR(hcon)) {
7050 err = PTR_ERR(hcon);
7051 goto done;
7052 }
7053
7054 conn = l2cap_conn_add(hcon);
7055 if (!conn) {
7056 hci_conn_drop(hcon);
7057 err = -ENOMEM;
7058 goto done;
7059 }
7060
7061 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7062 struct l2cap_chan_data data;
7063
7064 data.chan = chan;
7065 data.pid = chan->ops->get_peer_pid(chan);
7066 data.count = 1;
7067
7068 l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7069
7070 /* Check if there isn't too many channels being connected */
7071 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7072 hci_conn_drop(hcon);
7073 err = -EPROTO;
7074 goto done;
7075 }
7076 }
7077
7078 mutex_lock(&conn->chan_lock);
7079 l2cap_chan_lock(chan);
7080
7081 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7082 hci_conn_drop(hcon);
7083 err = -EBUSY;
7084 goto chan_unlock;
7085 }
7086
7087 /* Update source addr of the socket */
7088 bacpy(&chan->src, &hcon->src);
7089 chan->src_type = bdaddr_src_type(hcon);
7090
7091 __l2cap_chan_add(conn, chan);
7092
7093 /* l2cap_chan_add takes its own ref so we can drop this one */
7094 hci_conn_drop(hcon);
7095
7096 l2cap_state_change(chan, BT_CONNECT);
7097 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7098
7099 /* Release chan->sport so that it can be reused by other
7100 * sockets (as it's only used for listening sockets).
7101 */
7102 write_lock(&chan_list_lock);
7103 chan->sport = 0;
7104 write_unlock(&chan_list_lock);
7105
7106 if (hcon->state == BT_CONNECTED) {
7107 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7108 __clear_chan_timer(chan);
7109 if (l2cap_chan_check_security(chan, true))
7110 l2cap_state_change(chan, BT_CONNECTED);
7111 } else
7112 l2cap_do_start(chan);
7113 }
7114
7115 err = 0;
7116
7117 chan_unlock:
7118 l2cap_chan_unlock(chan);
7119 mutex_unlock(&conn->chan_lock);
7120 done:
7121 hci_dev_unlock(hdev);
7122 hci_dev_put(hdev);
7123 return err;
7124 }
7125 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7126
l2cap_ecred_reconfigure(struct l2cap_chan * chan)7127 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
7128 {
7129 struct l2cap_conn *conn = chan->conn;
7130 struct {
7131 struct l2cap_ecred_reconf_req req;
7132 __le16 scid;
7133 } pdu;
7134
7135 pdu.req.mtu = cpu_to_le16(chan->imtu);
7136 pdu.req.mps = cpu_to_le16(chan->mps);
7137 pdu.scid = cpu_to_le16(chan->scid);
7138
7139 chan->ident = l2cap_get_ident(conn);
7140
7141 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
7142 sizeof(pdu), &pdu);
7143 }
7144
l2cap_chan_reconfigure(struct l2cap_chan * chan,__u16 mtu)7145 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
7146 {
7147 if (chan->imtu > mtu)
7148 return -EINVAL;
7149
7150 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
7151
7152 chan->imtu = mtu;
7153
7154 l2cap_ecred_reconfigure(chan);
7155
7156 return 0;
7157 }
7158
7159 /* ---- L2CAP interface with lower layer (HCI) ---- */
7160
l2cap_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr)7161 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7162 {
7163 int exact = 0, lm1 = 0, lm2 = 0;
7164 struct l2cap_chan *c;
7165
7166 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7167
7168 /* Find listening sockets and check their link_mode */
7169 read_lock(&chan_list_lock);
7170 list_for_each_entry(c, &chan_list, global_l) {
7171 if (c->state != BT_LISTEN)
7172 continue;
7173
7174 if (!bacmp(&c->src, &hdev->bdaddr)) {
7175 lm1 |= HCI_LM_ACCEPT;
7176 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7177 lm1 |= HCI_LM_MASTER;
7178 exact++;
7179 } else if (!bacmp(&c->src, BDADDR_ANY)) {
7180 lm2 |= HCI_LM_ACCEPT;
7181 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7182 lm2 |= HCI_LM_MASTER;
7183 }
7184 }
7185 read_unlock(&chan_list_lock);
7186
7187 return exact ? lm1 : lm2;
7188 }
7189
7190 /* Find the next fixed channel in BT_LISTEN state, continue iteration
7191 * from an existing channel in the list or from the beginning of the
7192 * global list (by passing NULL as first parameter).
7193 */
l2cap_global_fixed_chan(struct l2cap_chan * c,struct hci_conn * hcon)7194 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7195 struct hci_conn *hcon)
7196 {
7197 u8 src_type = bdaddr_src_type(hcon);
7198
7199 read_lock(&chan_list_lock);
7200
7201 if (c)
7202 c = list_next_entry(c, global_l);
7203 else
7204 c = list_entry(chan_list.next, typeof(*c), global_l);
7205
7206 list_for_each_entry_from(c, &chan_list, global_l) {
7207 if (c->chan_type != L2CAP_CHAN_FIXED)
7208 continue;
7209 if (c->state != BT_LISTEN)
7210 continue;
7211 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7212 continue;
7213 if (src_type != c->src_type)
7214 continue;
7215
7216 c = l2cap_chan_hold_unless_zero(c);
7217 read_unlock(&chan_list_lock);
7218 return c;
7219 }
7220
7221 read_unlock(&chan_list_lock);
7222
7223 return NULL;
7224 }
7225
l2cap_connect_cfm(struct hci_conn * hcon,u8 status)7226 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7227 {
7228 struct hci_dev *hdev = hcon->hdev;
7229 struct l2cap_conn *conn;
7230 struct l2cap_chan *pchan;
7231 u8 dst_type;
7232
7233 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7234 return;
7235
7236 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7237
7238 if (status) {
7239 l2cap_conn_del(hcon, bt_to_errno(status));
7240 return;
7241 }
7242
7243 conn = l2cap_conn_add(hcon);
7244 if (!conn)
7245 return;
7246
7247 dst_type = bdaddr_dst_type(hcon);
7248
7249 /* If device is blocked, do not create channels for it */
7250 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
7251 return;
7252
7253 /* Find fixed channels and notify them of the new connection. We
7254 * use multiple individual lookups, continuing each time where
7255 * we left off, because the list lock would prevent calling the
7256 * potentially sleeping l2cap_chan_lock() function.
7257 */
7258 pchan = l2cap_global_fixed_chan(NULL, hcon);
7259 while (pchan) {
7260 struct l2cap_chan *chan, *next;
7261
7262 /* Client fixed channels should override server ones */
7263 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7264 goto next;
7265
7266 l2cap_chan_lock(pchan);
7267 chan = pchan->ops->new_connection(pchan);
7268 if (chan) {
7269 bacpy(&chan->src, &hcon->src);
7270 bacpy(&chan->dst, &hcon->dst);
7271 chan->src_type = bdaddr_src_type(hcon);
7272 chan->dst_type = dst_type;
7273
7274 __l2cap_chan_add(conn, chan);
7275 }
7276
7277 l2cap_chan_unlock(pchan);
7278 next:
7279 next = l2cap_global_fixed_chan(pchan, hcon);
7280 l2cap_chan_put(pchan);
7281 pchan = next;
7282 }
7283
7284 l2cap_conn_ready(conn);
7285 }
7286
l2cap_disconn_ind(struct hci_conn * hcon)7287 int l2cap_disconn_ind(struct hci_conn *hcon)
7288 {
7289 struct l2cap_conn *conn = hcon->l2cap_data;
7290
7291 BT_DBG("hcon %p", hcon);
7292
7293 if (!conn)
7294 return HCI_ERROR_REMOTE_USER_TERM;
7295 return conn->disc_reason;
7296 }
7297
l2cap_disconn_cfm(struct hci_conn * hcon,u8 reason)7298 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7299 {
7300 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7301 return;
7302
7303 BT_DBG("hcon %p reason %d", hcon, reason);
7304
7305 l2cap_conn_del(hcon, bt_to_errno(reason));
7306 }
7307
l2cap_check_encryption(struct l2cap_chan * chan,u8 encrypt)7308 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7309 {
7310 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7311 return;
7312
7313 if (encrypt == 0x00) {
7314 if (chan->sec_level == BT_SECURITY_MEDIUM) {
7315 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7316 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7317 chan->sec_level == BT_SECURITY_FIPS)
7318 l2cap_chan_close(chan, ECONNREFUSED);
7319 } else {
7320 if (chan->sec_level == BT_SECURITY_MEDIUM)
7321 __clear_chan_timer(chan);
7322 }
7323 }
7324
l2cap_security_cfm(struct hci_conn * hcon,u8 status,u8 encrypt)7325 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7326 {
7327 struct l2cap_conn *conn = hcon->l2cap_data;
7328 struct l2cap_chan *chan;
7329
7330 if (!conn)
7331 return;
7332
7333 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7334
7335 mutex_lock(&conn->chan_lock);
7336
7337 list_for_each_entry(chan, &conn->chan_l, list) {
7338 l2cap_chan_lock(chan);
7339
7340 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7341 state_to_string(chan->state));
7342
7343 if (!status && encrypt)
7344 chan->sec_level = hcon->sec_level;
7345
7346 if (!__l2cap_no_conn_pending(chan)) {
7347 l2cap_chan_unlock(chan);
7348 continue;
7349 }
7350
7351 if (!status && (chan->state == BT_CONNECTED ||
7352 chan->state == BT_CONFIG)) {
7353 chan->ops->resume(chan);
7354 l2cap_check_encryption(chan, encrypt);
7355 l2cap_chan_unlock(chan);
7356 continue;
7357 }
7358
7359 if (chan->state == BT_CONNECT) {
7360 if (!status && l2cap_check_enc_key_size(hcon))
7361 l2cap_start_connection(chan);
7362 else
7363 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7364 } else if (chan->state == BT_CONNECT2 &&
7365 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
7366 chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
7367 struct l2cap_conn_rsp rsp;
7368 __u16 res, stat;
7369
7370 if (!status && l2cap_check_enc_key_size(hcon)) {
7371 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
7372 res = L2CAP_CR_PEND;
7373 stat = L2CAP_CS_AUTHOR_PEND;
7374 chan->ops->defer(chan);
7375 } else {
7376 l2cap_state_change(chan, BT_CONFIG);
7377 res = L2CAP_CR_SUCCESS;
7378 stat = L2CAP_CS_NO_INFO;
7379 }
7380 } else {
7381 l2cap_state_change(chan, BT_DISCONN);
7382 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7383 res = L2CAP_CR_SEC_BLOCK;
7384 stat = L2CAP_CS_NO_INFO;
7385 }
7386
7387 rsp.scid = cpu_to_le16(chan->dcid);
7388 rsp.dcid = cpu_to_le16(chan->scid);
7389 rsp.result = cpu_to_le16(res);
7390 rsp.status = cpu_to_le16(stat);
7391 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7392 sizeof(rsp), &rsp);
7393
7394 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7395 res == L2CAP_CR_SUCCESS) {
7396 char buf[128];
7397 set_bit(CONF_REQ_SENT, &chan->conf_state);
7398 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7399 L2CAP_CONF_REQ,
7400 l2cap_build_conf_req(chan, buf, sizeof(buf)),
7401 buf);
7402 chan->num_conf_req++;
7403 }
7404 }
7405
7406 l2cap_chan_unlock(chan);
7407 }
7408
7409 mutex_unlock(&conn->chan_lock);
7410 }
7411
7412 /* Append fragment into frame respecting the maximum len of rx_skb */
l2cap_recv_frag(struct l2cap_conn * conn,struct sk_buff * skb,u16 len)7413 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
7414 u16 len)
7415 {
7416 if (!conn->rx_skb) {
7417 /* Allocate skb for the complete frame (with header) */
7418 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7419 if (!conn->rx_skb)
7420 return -ENOMEM;
7421 /* Init rx_len */
7422 conn->rx_len = len;
7423 }
7424
7425 /* Copy as much as the rx_skb can hold */
7426 len = min_t(u16, len, skb->len);
7427 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
7428 skb_pull(skb, len);
7429 conn->rx_len -= len;
7430
7431 return len;
7432 }
7433
l2cap_recv_len(struct l2cap_conn * conn,struct sk_buff * skb)7434 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
7435 {
7436 struct sk_buff *rx_skb;
7437 int len;
7438
7439 /* Append just enough to complete the header */
7440 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
7441
7442 /* If header could not be read just continue */
7443 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
7444 return len;
7445
7446 rx_skb = conn->rx_skb;
7447 len = get_unaligned_le16(rx_skb->data);
7448
7449 /* Check if rx_skb has enough space to received all fragments */
7450 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
7451 /* Update expected len */
7452 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
7453 return L2CAP_LEN_SIZE;
7454 }
7455
7456 /* Reset conn->rx_skb since it will need to be reallocated in order to
7457 * fit all fragments.
7458 */
7459 conn->rx_skb = NULL;
7460
7461 /* Reallocates rx_skb using the exact expected length */
7462 len = l2cap_recv_frag(conn, rx_skb,
7463 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
7464 kfree_skb(rx_skb);
7465
7466 return len;
7467 }
7468
l2cap_recv_reset(struct l2cap_conn * conn)7469 static void l2cap_recv_reset(struct l2cap_conn *conn)
7470 {
7471 kfree_skb(conn->rx_skb);
7472 conn->rx_skb = NULL;
7473 conn->rx_len = 0;
7474 }
7475
l2cap_recv_acldata(struct hci_conn * hcon,struct sk_buff * skb,u16 flags)7476 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
7477 {
7478 struct l2cap_conn *conn = hcon->l2cap_data;
7479 int len;
7480
7481 if (!conn)
7482 conn = l2cap_conn_add(hcon);
7483
7484 if (!conn)
7485 goto drop;
7486
7487 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
7488
7489 switch (flags) {
7490 case ACL_START:
7491 case ACL_START_NO_FLUSH:
7492 case ACL_COMPLETE:
7493 if (conn->rx_skb) {
7494 BT_ERR("Unexpected start frame (len %d)", skb->len);
7495 l2cap_recv_reset(conn);
7496 l2cap_conn_unreliable(conn, ECOMM);
7497 }
7498
7499 /* Start fragment may not contain the L2CAP length so just
7500 * copy the initial byte when that happens and use conn->mtu as
7501 * expected length.
7502 */
7503 if (skb->len < L2CAP_LEN_SIZE) {
7504 l2cap_recv_frag(conn, skb, conn->mtu);
7505 break;
7506 }
7507
7508 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
7509
7510 if (len == skb->len) {
7511 /* Complete frame received */
7512 l2cap_recv_frame(conn, skb);
7513 return;
7514 }
7515
7516 BT_DBG("Start: total len %d, frag len %u", len, skb->len);
7517
7518 if (skb->len > len) {
7519 BT_ERR("Frame is too long (len %u, expected len %d)",
7520 skb->len, len);
7521 l2cap_conn_unreliable(conn, ECOMM);
7522 goto drop;
7523 }
7524
7525 /* Append fragment into frame (with header) */
7526 if (l2cap_recv_frag(conn, skb, len) < 0)
7527 goto drop;
7528
7529 break;
7530
7531 case ACL_CONT:
7532 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
7533
7534 if (!conn->rx_skb) {
7535 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7536 l2cap_conn_unreliable(conn, ECOMM);
7537 goto drop;
7538 }
7539
7540 /* Complete the L2CAP length if it has not been read */
7541 if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
7542 if (l2cap_recv_len(conn, skb) < 0) {
7543 l2cap_conn_unreliable(conn, ECOMM);
7544 goto drop;
7545 }
7546
7547 /* Header still could not be read just continue */
7548 if (conn->rx_skb->len < L2CAP_LEN_SIZE)
7549 break;
7550 }
7551
7552 if (skb->len > conn->rx_len) {
7553 BT_ERR("Fragment is too long (len %u, expected %u)",
7554 skb->len, conn->rx_len);
7555 l2cap_recv_reset(conn);
7556 l2cap_conn_unreliable(conn, ECOMM);
7557 goto drop;
7558 }
7559
7560 /* Append fragment into frame (with header) */
7561 l2cap_recv_frag(conn, skb, skb->len);
7562
7563 if (!conn->rx_len) {
7564 /* Complete frame received. l2cap_recv_frame
7565 * takes ownership of the skb so set the global
7566 * rx_skb pointer to NULL first.
7567 */
7568 struct sk_buff *rx_skb = conn->rx_skb;
7569 conn->rx_skb = NULL;
7570 l2cap_recv_frame(conn, rx_skb);
7571 }
7572 break;
7573 }
7574
7575 drop:
7576 kfree_skb(skb);
7577 }
7578
7579 static struct hci_cb l2cap_cb = {
7580 .name = "L2CAP",
7581 .connect_cfm = l2cap_connect_cfm,
7582 .disconn_cfm = l2cap_disconn_cfm,
7583 .security_cfm = l2cap_security_cfm,
7584 };
7585
l2cap_debugfs_show(struct seq_file * f,void * p)7586 static int l2cap_debugfs_show(struct seq_file *f, void *p)
7587 {
7588 struct l2cap_chan *c;
7589
7590 read_lock(&chan_list_lock);
7591
7592 list_for_each_entry(c, &chan_list, global_l) {
7593 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7594 &c->src, c->src_type, &c->dst, c->dst_type,
7595 c->state, __le16_to_cpu(c->psm),
7596 c->scid, c->dcid, c->imtu, c->omtu,
7597 c->sec_level, c->mode);
7598 }
7599
7600 read_unlock(&chan_list_lock);
7601
7602 return 0;
7603 }
7604
7605 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
7606
7607 static struct dentry *l2cap_debugfs;
7608
l2cap_init(void)7609 int __init l2cap_init(void)
7610 {
7611 int err;
7612
7613 err = l2cap_init_sockets();
7614 if (err < 0)
7615 return err;
7616
7617 hci_register_cb(&l2cap_cb);
7618
7619 if (IS_ERR_OR_NULL(bt_debugfs))
7620 return 0;
7621
7622 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7623 NULL, &l2cap_debugfs_fops);
7624
7625 return 0;
7626 }
7627
l2cap_exit(void)7628 void l2cap_exit(void)
7629 {
7630 debugfs_remove(l2cap_debugfs);
7631 hci_unregister_cb(&l2cap_cb);
7632 l2cap_cleanup_sockets();
7633 }
7634
7635 module_param(disable_ertm, bool, 0644);
7636 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
7637
7638 module_param(enable_ecred, bool, 0644);
7639 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
7640