xref: /openbmc/linux/net/bluetooth/l2cap_core.c (revision b9090769)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5    Copyright (C) 2010 Google Inc.
6    Copyright (C) 2011 ProFUSION Embedded Systems
7    Copyright (c) 2012 Code Aurora Forum.  All rights reserved.
8 
9    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 
11    This program is free software; you can redistribute it and/or modify
12    it under the terms of the GNU General Public License version 2 as
13    published by the Free Software Foundation;
14 
15    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 
24    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26    SOFTWARE IS DISCLAIMED.
27 */
28 
29 /* Bluetooth L2CAP core. */
30 
31 #include <linux/module.h>
32 
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
35 #include <linux/filter.h>
36 
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
40 
41 #include "smp.h"
42 
43 #define LE_FLOWCTL_MAX_CREDITS 65535
44 
45 bool disable_ertm;
46 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED);
47 
48 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
49 
50 static LIST_HEAD(chan_list);
51 static DEFINE_RWLOCK(chan_list_lock);
52 
53 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
54 				       u8 code, u8 ident, u16 dlen, void *data);
55 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
56 			   void *data);
57 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
58 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
59 
60 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
61 		     struct sk_buff_head *skbs, u8 event);
62 static void l2cap_retrans_timeout(struct work_struct *work);
63 static void l2cap_monitor_timeout(struct work_struct *work);
64 static void l2cap_ack_timeout(struct work_struct *work);
65 
bdaddr_type(u8 link_type,u8 bdaddr_type)66 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
67 {
68 	if (link_type == LE_LINK) {
69 		if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
70 			return BDADDR_LE_PUBLIC;
71 		else
72 			return BDADDR_LE_RANDOM;
73 	}
74 
75 	return BDADDR_BREDR;
76 }
77 
bdaddr_src_type(struct hci_conn * hcon)78 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
79 {
80 	return bdaddr_type(hcon->type, hcon->src_type);
81 }
82 
bdaddr_dst_type(struct hci_conn * hcon)83 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
84 {
85 	return bdaddr_type(hcon->type, hcon->dst_type);
86 }
87 
88 /* ---- L2CAP channels ---- */
89 
__l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)90 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
91 						   u16 cid)
92 {
93 	struct l2cap_chan *c;
94 
95 	list_for_each_entry(c, &conn->chan_l, list) {
96 		if (c->dcid == cid)
97 			return c;
98 	}
99 	return NULL;
100 }
101 
__l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)102 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
103 						   u16 cid)
104 {
105 	struct l2cap_chan *c;
106 
107 	list_for_each_entry(c, &conn->chan_l, list) {
108 		if (c->scid == cid)
109 			return c;
110 	}
111 	return NULL;
112 }
113 
114 /* Find channel with given SCID.
115  * Returns a reference locked channel.
116  */
l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)117 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
118 						 u16 cid)
119 {
120 	struct l2cap_chan *c;
121 
122 	mutex_lock(&conn->chan_lock);
123 	c = __l2cap_get_chan_by_scid(conn, cid);
124 	if (c) {
125 		/* Only lock if chan reference is not 0 */
126 		c = l2cap_chan_hold_unless_zero(c);
127 		if (c)
128 			l2cap_chan_lock(c);
129 	}
130 	mutex_unlock(&conn->chan_lock);
131 
132 	return c;
133 }
134 
135 /* Find channel with given DCID.
136  * Returns a reference locked channel.
137  */
l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)138 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
139 						 u16 cid)
140 {
141 	struct l2cap_chan *c;
142 
143 	mutex_lock(&conn->chan_lock);
144 	c = __l2cap_get_chan_by_dcid(conn, cid);
145 	if (c) {
146 		/* Only lock if chan reference is not 0 */
147 		c = l2cap_chan_hold_unless_zero(c);
148 		if (c)
149 			l2cap_chan_lock(c);
150 	}
151 	mutex_unlock(&conn->chan_lock);
152 
153 	return c;
154 }
155 
__l2cap_get_chan_by_ident(struct l2cap_conn * conn,u8 ident)156 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
157 						    u8 ident)
158 {
159 	struct l2cap_chan *c;
160 
161 	list_for_each_entry(c, &conn->chan_l, list) {
162 		if (c->ident == ident)
163 			return c;
164 	}
165 	return NULL;
166 }
167 
__l2cap_global_chan_by_addr(__le16 psm,bdaddr_t * src,u8 src_type)168 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
169 						      u8 src_type)
170 {
171 	struct l2cap_chan *c;
172 
173 	list_for_each_entry(c, &chan_list, global_l) {
174 		if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
175 			continue;
176 
177 		if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
178 			continue;
179 
180 		if (c->sport == psm && !bacmp(&c->src, src))
181 			return c;
182 	}
183 	return NULL;
184 }
185 
l2cap_add_psm(struct l2cap_chan * chan,bdaddr_t * src,__le16 psm)186 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
187 {
188 	int err;
189 
190 	write_lock(&chan_list_lock);
191 
192 	if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
193 		err = -EADDRINUSE;
194 		goto done;
195 	}
196 
197 	if (psm) {
198 		chan->psm = psm;
199 		chan->sport = psm;
200 		err = 0;
201 	} else {
202 		u16 p, start, end, incr;
203 
204 		if (chan->src_type == BDADDR_BREDR) {
205 			start = L2CAP_PSM_DYN_START;
206 			end = L2CAP_PSM_AUTO_END;
207 			incr = 2;
208 		} else {
209 			start = L2CAP_PSM_LE_DYN_START;
210 			end = L2CAP_PSM_LE_DYN_END;
211 			incr = 1;
212 		}
213 
214 		err = -EINVAL;
215 		for (p = start; p <= end; p += incr)
216 			if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
217 							 chan->src_type)) {
218 				chan->psm   = cpu_to_le16(p);
219 				chan->sport = cpu_to_le16(p);
220 				err = 0;
221 				break;
222 			}
223 	}
224 
225 done:
226 	write_unlock(&chan_list_lock);
227 	return err;
228 }
229 EXPORT_SYMBOL_GPL(l2cap_add_psm);
230 
l2cap_add_scid(struct l2cap_chan * chan,__u16 scid)231 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
232 {
233 	write_lock(&chan_list_lock);
234 
235 	/* Override the defaults (which are for conn-oriented) */
236 	chan->omtu = L2CAP_DEFAULT_MTU;
237 	chan->chan_type = L2CAP_CHAN_FIXED;
238 
239 	chan->scid = scid;
240 
241 	write_unlock(&chan_list_lock);
242 
243 	return 0;
244 }
245 
l2cap_alloc_cid(struct l2cap_conn * conn)246 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
247 {
248 	u16 cid, dyn_end;
249 
250 	if (conn->hcon->type == LE_LINK)
251 		dyn_end = L2CAP_CID_LE_DYN_END;
252 	else
253 		dyn_end = L2CAP_CID_DYN_END;
254 
255 	for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
256 		if (!__l2cap_get_chan_by_scid(conn, cid))
257 			return cid;
258 	}
259 
260 	return 0;
261 }
262 
l2cap_state_change(struct l2cap_chan * chan,int state)263 static void l2cap_state_change(struct l2cap_chan *chan, int state)
264 {
265 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
266 	       state_to_string(state));
267 
268 	chan->state = state;
269 	chan->ops->state_change(chan, state, 0);
270 }
271 
l2cap_state_change_and_error(struct l2cap_chan * chan,int state,int err)272 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
273 						int state, int err)
274 {
275 	chan->state = state;
276 	chan->ops->state_change(chan, chan->state, err);
277 }
278 
l2cap_chan_set_err(struct l2cap_chan * chan,int err)279 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
280 {
281 	chan->ops->state_change(chan, chan->state, err);
282 }
283 
__set_retrans_timer(struct l2cap_chan * chan)284 static void __set_retrans_timer(struct l2cap_chan *chan)
285 {
286 	if (!delayed_work_pending(&chan->monitor_timer) &&
287 	    chan->retrans_timeout) {
288 		l2cap_set_timer(chan, &chan->retrans_timer,
289 				msecs_to_jiffies(chan->retrans_timeout));
290 	}
291 }
292 
__set_monitor_timer(struct l2cap_chan * chan)293 static void __set_monitor_timer(struct l2cap_chan *chan)
294 {
295 	__clear_retrans_timer(chan);
296 	if (chan->monitor_timeout) {
297 		l2cap_set_timer(chan, &chan->monitor_timer,
298 				msecs_to_jiffies(chan->monitor_timeout));
299 	}
300 }
301 
l2cap_ertm_seq_in_queue(struct sk_buff_head * head,u16 seq)302 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
303 					       u16 seq)
304 {
305 	struct sk_buff *skb;
306 
307 	skb_queue_walk(head, skb) {
308 		if (bt_cb(skb)->l2cap.txseq == seq)
309 			return skb;
310 	}
311 
312 	return NULL;
313 }
314 
315 /* ---- L2CAP sequence number lists ---- */
316 
317 /* For ERTM, ordered lists of sequence numbers must be tracked for
318  * SREJ requests that are received and for frames that are to be
319  * retransmitted. These seq_list functions implement a singly-linked
320  * list in an array, where membership in the list can also be checked
321  * in constant time. Items can also be added to the tail of the list
322  * and removed from the head in constant time, without further memory
323  * allocs or frees.
324  */
325 
l2cap_seq_list_init(struct l2cap_seq_list * seq_list,u16 size)326 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
327 {
328 	size_t alloc_size, i;
329 
330 	/* Allocated size is a power of 2 to map sequence numbers
331 	 * (which may be up to 14 bits) in to a smaller array that is
332 	 * sized for the negotiated ERTM transmit windows.
333 	 */
334 	alloc_size = roundup_pow_of_two(size);
335 
336 	seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
337 	if (!seq_list->list)
338 		return -ENOMEM;
339 
340 	seq_list->mask = alloc_size - 1;
341 	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
342 	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
343 	for (i = 0; i < alloc_size; i++)
344 		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
345 
346 	return 0;
347 }
348 
l2cap_seq_list_free(struct l2cap_seq_list * seq_list)349 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
350 {
351 	kfree(seq_list->list);
352 }
353 
l2cap_seq_list_contains(struct l2cap_seq_list * seq_list,u16 seq)354 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
355 					   u16 seq)
356 {
357 	/* Constant-time check for list membership */
358 	return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
359 }
360 
l2cap_seq_list_pop(struct l2cap_seq_list * seq_list)361 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
362 {
363 	u16 seq = seq_list->head;
364 	u16 mask = seq_list->mask;
365 
366 	seq_list->head = seq_list->list[seq & mask];
367 	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
368 
369 	if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
370 		seq_list->head = L2CAP_SEQ_LIST_CLEAR;
371 		seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
372 	}
373 
374 	return seq;
375 }
376 
l2cap_seq_list_clear(struct l2cap_seq_list * seq_list)377 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
378 {
379 	u16 i;
380 
381 	if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
382 		return;
383 
384 	for (i = 0; i <= seq_list->mask; i++)
385 		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
386 
387 	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
388 	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
389 }
390 
l2cap_seq_list_append(struct l2cap_seq_list * seq_list,u16 seq)391 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
392 {
393 	u16 mask = seq_list->mask;
394 
395 	/* All appends happen in constant time */
396 
397 	if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
398 		return;
399 
400 	if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
401 		seq_list->head = seq;
402 	else
403 		seq_list->list[seq_list->tail & mask] = seq;
404 
405 	seq_list->tail = seq;
406 	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
407 }
408 
l2cap_chan_timeout(struct work_struct * work)409 static void l2cap_chan_timeout(struct work_struct *work)
410 {
411 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
412 					       chan_timer.work);
413 	struct l2cap_conn *conn = chan->conn;
414 	int reason;
415 
416 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
417 
418 	if (!conn)
419 		return;
420 
421 	mutex_lock(&conn->chan_lock);
422 	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
423 	 * this work. No need to call l2cap_chan_hold(chan) here again.
424 	 */
425 	l2cap_chan_lock(chan);
426 
427 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
428 		reason = ECONNREFUSED;
429 	else if (chan->state == BT_CONNECT &&
430 		 chan->sec_level != BT_SECURITY_SDP)
431 		reason = ECONNREFUSED;
432 	else
433 		reason = ETIMEDOUT;
434 
435 	l2cap_chan_close(chan, reason);
436 
437 	chan->ops->close(chan);
438 
439 	l2cap_chan_unlock(chan);
440 	l2cap_chan_put(chan);
441 
442 	mutex_unlock(&conn->chan_lock);
443 }
444 
l2cap_chan_create(void)445 struct l2cap_chan *l2cap_chan_create(void)
446 {
447 	struct l2cap_chan *chan;
448 
449 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
450 	if (!chan)
451 		return NULL;
452 
453 	skb_queue_head_init(&chan->tx_q);
454 	skb_queue_head_init(&chan->srej_q);
455 	mutex_init(&chan->lock);
456 
457 	/* Set default lock nesting level */
458 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
459 
460 	/* Available receive buffer space is initially unknown */
461 	chan->rx_avail = -1;
462 
463 	write_lock(&chan_list_lock);
464 	list_add(&chan->global_l, &chan_list);
465 	write_unlock(&chan_list_lock);
466 
467 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
468 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
469 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
470 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
471 
472 	chan->state = BT_OPEN;
473 
474 	kref_init(&chan->kref);
475 
476 	/* This flag is cleared in l2cap_chan_ready() */
477 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
478 
479 	BT_DBG("chan %p", chan);
480 
481 	return chan;
482 }
483 EXPORT_SYMBOL_GPL(l2cap_chan_create);
484 
l2cap_chan_destroy(struct kref * kref)485 static void l2cap_chan_destroy(struct kref *kref)
486 {
487 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
488 
489 	BT_DBG("chan %p", chan);
490 
491 	write_lock(&chan_list_lock);
492 	list_del(&chan->global_l);
493 	write_unlock(&chan_list_lock);
494 
495 	kfree(chan);
496 }
497 
l2cap_chan_hold(struct l2cap_chan * c)498 void l2cap_chan_hold(struct l2cap_chan *c)
499 {
500 	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
501 
502 	kref_get(&c->kref);
503 }
504 
l2cap_chan_hold_unless_zero(struct l2cap_chan * c)505 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
506 {
507 	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
508 
509 	if (!kref_get_unless_zero(&c->kref))
510 		return NULL;
511 
512 	return c;
513 }
514 
l2cap_chan_put(struct l2cap_chan * c)515 void l2cap_chan_put(struct l2cap_chan *c)
516 {
517 	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
518 
519 	kref_put(&c->kref, l2cap_chan_destroy);
520 }
521 EXPORT_SYMBOL_GPL(l2cap_chan_put);
522 
l2cap_chan_set_defaults(struct l2cap_chan * chan)523 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
524 {
525 	chan->fcs  = L2CAP_FCS_CRC16;
526 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;
527 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
528 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
529 	chan->remote_max_tx = chan->max_tx;
530 	chan->remote_tx_win = chan->tx_win;
531 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
532 	chan->sec_level = BT_SECURITY_LOW;
533 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
534 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
535 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
536 
537 	chan->conf_state = 0;
538 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
539 
540 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
541 }
542 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
543 
l2cap_le_rx_credits(struct l2cap_chan * chan)544 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan)
545 {
546 	size_t sdu_len = chan->sdu ? chan->sdu->len : 0;
547 
548 	if (chan->mps == 0)
549 		return 0;
550 
551 	/* If we don't know the available space in the receiver buffer, give
552 	 * enough credits for a full packet.
553 	 */
554 	if (chan->rx_avail == -1)
555 		return (chan->imtu / chan->mps) + 1;
556 
557 	/* If we know how much space is available in the receive buffer, give
558 	 * out as many credits as would fill the buffer.
559 	 */
560 	if (chan->rx_avail <= sdu_len)
561 		return 0;
562 
563 	return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps);
564 }
565 
l2cap_le_flowctl_init(struct l2cap_chan * chan,u16 tx_credits)566 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
567 {
568 	chan->sdu = NULL;
569 	chan->sdu_last_frag = NULL;
570 	chan->sdu_len = 0;
571 	chan->tx_credits = tx_credits;
572 	/* Derive MPS from connection MTU to stop HCI fragmentation */
573 	chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
574 	chan->rx_credits = l2cap_le_rx_credits(chan);
575 
576 	skb_queue_head_init(&chan->tx_q);
577 }
578 
l2cap_ecred_init(struct l2cap_chan * chan,u16 tx_credits)579 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
580 {
581 	l2cap_le_flowctl_init(chan, tx_credits);
582 
583 	/* L2CAP implementations shall support a minimum MPS of 64 octets */
584 	if (chan->mps < L2CAP_ECRED_MIN_MPS) {
585 		chan->mps = L2CAP_ECRED_MIN_MPS;
586 		chan->rx_credits = l2cap_le_rx_credits(chan);
587 	}
588 }
589 
__l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)590 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
591 {
592 	BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
593 	       __le16_to_cpu(chan->psm), chan->dcid);
594 
595 	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
596 
597 	chan->conn = conn;
598 
599 	switch (chan->chan_type) {
600 	case L2CAP_CHAN_CONN_ORIENTED:
601 		/* Alloc CID for connection-oriented socket */
602 		chan->scid = l2cap_alloc_cid(conn);
603 		if (conn->hcon->type == ACL_LINK)
604 			chan->omtu = L2CAP_DEFAULT_MTU;
605 		break;
606 
607 	case L2CAP_CHAN_CONN_LESS:
608 		/* Connectionless socket */
609 		chan->scid = L2CAP_CID_CONN_LESS;
610 		chan->dcid = L2CAP_CID_CONN_LESS;
611 		chan->omtu = L2CAP_DEFAULT_MTU;
612 		break;
613 
614 	case L2CAP_CHAN_FIXED:
615 		/* Caller will set CID and CID specific MTU values */
616 		break;
617 
618 	default:
619 		/* Raw socket can send/recv signalling messages only */
620 		chan->scid = L2CAP_CID_SIGNALING;
621 		chan->dcid = L2CAP_CID_SIGNALING;
622 		chan->omtu = L2CAP_DEFAULT_MTU;
623 	}
624 
625 	chan->local_id		= L2CAP_BESTEFFORT_ID;
626 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;
627 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;
628 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;
629 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;
630 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;
631 
632 	l2cap_chan_hold(chan);
633 
634 	/* Only keep a reference for fixed channels if they requested it */
635 	if (chan->chan_type != L2CAP_CHAN_FIXED ||
636 	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
637 		hci_conn_hold(conn->hcon);
638 
639 	list_add(&chan->list, &conn->chan_l);
640 }
641 
l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)642 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643 {
644 	mutex_lock(&conn->chan_lock);
645 	__l2cap_chan_add(conn, chan);
646 	mutex_unlock(&conn->chan_lock);
647 }
648 
l2cap_chan_del(struct l2cap_chan * chan,int err)649 void l2cap_chan_del(struct l2cap_chan *chan, int err)
650 {
651 	struct l2cap_conn *conn = chan->conn;
652 
653 	__clear_chan_timer(chan);
654 
655 	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
656 	       state_to_string(chan->state));
657 
658 	chan->ops->teardown(chan, err);
659 
660 	if (conn) {
661 		/* Delete from channel list */
662 		list_del(&chan->list);
663 
664 		l2cap_chan_put(chan);
665 
666 		chan->conn = NULL;
667 
668 		/* Reference was only held for non-fixed channels or
669 		 * fixed channels that explicitly requested it using the
670 		 * FLAG_HOLD_HCI_CONN flag.
671 		 */
672 		if (chan->chan_type != L2CAP_CHAN_FIXED ||
673 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
674 			hci_conn_drop(conn->hcon);
675 	}
676 
677 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
678 		return;
679 
680 	switch (chan->mode) {
681 	case L2CAP_MODE_BASIC:
682 		break;
683 
684 	case L2CAP_MODE_LE_FLOWCTL:
685 	case L2CAP_MODE_EXT_FLOWCTL:
686 		skb_queue_purge(&chan->tx_q);
687 		break;
688 
689 	case L2CAP_MODE_ERTM:
690 		__clear_retrans_timer(chan);
691 		__clear_monitor_timer(chan);
692 		__clear_ack_timer(chan);
693 
694 		skb_queue_purge(&chan->srej_q);
695 
696 		l2cap_seq_list_free(&chan->srej_list);
697 		l2cap_seq_list_free(&chan->retrans_list);
698 		fallthrough;
699 
700 	case L2CAP_MODE_STREAMING:
701 		skb_queue_purge(&chan->tx_q);
702 		break;
703 	}
704 }
705 EXPORT_SYMBOL_GPL(l2cap_chan_del);
706 
__l2cap_chan_list_id(struct l2cap_conn * conn,u16 id,l2cap_chan_func_t func,void * data)707 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
708 				 l2cap_chan_func_t func, void *data)
709 {
710 	struct l2cap_chan *chan, *l;
711 
712 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
713 		if (chan->ident == id)
714 			func(chan, data);
715 	}
716 }
717 
__l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)718 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
719 			      void *data)
720 {
721 	struct l2cap_chan *chan;
722 
723 	list_for_each_entry(chan, &conn->chan_l, list) {
724 		func(chan, data);
725 	}
726 }
727 
l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)728 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
729 		     void *data)
730 {
731 	if (!conn)
732 		return;
733 
734 	mutex_lock(&conn->chan_lock);
735 	__l2cap_chan_list(conn, func, data);
736 	mutex_unlock(&conn->chan_lock);
737 }
738 
739 EXPORT_SYMBOL_GPL(l2cap_chan_list);
740 
l2cap_conn_update_id_addr(struct work_struct * work)741 static void l2cap_conn_update_id_addr(struct work_struct *work)
742 {
743 	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
744 					       id_addr_timer.work);
745 	struct hci_conn *hcon = conn->hcon;
746 	struct l2cap_chan *chan;
747 
748 	mutex_lock(&conn->chan_lock);
749 
750 	list_for_each_entry(chan, &conn->chan_l, list) {
751 		l2cap_chan_lock(chan);
752 		bacpy(&chan->dst, &hcon->dst);
753 		chan->dst_type = bdaddr_dst_type(hcon);
754 		l2cap_chan_unlock(chan);
755 	}
756 
757 	mutex_unlock(&conn->chan_lock);
758 }
759 
l2cap_chan_le_connect_reject(struct l2cap_chan * chan)760 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
761 {
762 	struct l2cap_conn *conn = chan->conn;
763 	struct l2cap_le_conn_rsp rsp;
764 	u16 result;
765 
766 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
767 		result = L2CAP_CR_LE_AUTHORIZATION;
768 	else
769 		result = L2CAP_CR_LE_BAD_PSM;
770 
771 	l2cap_state_change(chan, BT_DISCONN);
772 
773 	rsp.dcid    = cpu_to_le16(chan->scid);
774 	rsp.mtu     = cpu_to_le16(chan->imtu);
775 	rsp.mps     = cpu_to_le16(chan->mps);
776 	rsp.credits = cpu_to_le16(chan->rx_credits);
777 	rsp.result  = cpu_to_le16(result);
778 
779 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
780 		       &rsp);
781 }
782 
l2cap_chan_ecred_connect_reject(struct l2cap_chan * chan)783 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
784 {
785 	l2cap_state_change(chan, BT_DISCONN);
786 
787 	__l2cap_ecred_conn_rsp_defer(chan);
788 }
789 
l2cap_chan_connect_reject(struct l2cap_chan * chan)790 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
791 {
792 	struct l2cap_conn *conn = chan->conn;
793 	struct l2cap_conn_rsp rsp;
794 	u16 result;
795 
796 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
797 		result = L2CAP_CR_SEC_BLOCK;
798 	else
799 		result = L2CAP_CR_BAD_PSM;
800 
801 	l2cap_state_change(chan, BT_DISCONN);
802 
803 	rsp.scid   = cpu_to_le16(chan->dcid);
804 	rsp.dcid   = cpu_to_le16(chan->scid);
805 	rsp.result = cpu_to_le16(result);
806 	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
807 
808 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
809 }
810 
l2cap_chan_close(struct l2cap_chan * chan,int reason)811 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
812 {
813 	struct l2cap_conn *conn = chan->conn;
814 
815 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
816 
817 	switch (chan->state) {
818 	case BT_LISTEN:
819 		chan->ops->teardown(chan, 0);
820 		break;
821 
822 	case BT_CONNECTED:
823 	case BT_CONFIG:
824 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
825 			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
826 			l2cap_send_disconn_req(chan, reason);
827 		} else
828 			l2cap_chan_del(chan, reason);
829 		break;
830 
831 	case BT_CONNECT2:
832 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
833 			if (conn->hcon->type == ACL_LINK)
834 				l2cap_chan_connect_reject(chan);
835 			else if (conn->hcon->type == LE_LINK) {
836 				switch (chan->mode) {
837 				case L2CAP_MODE_LE_FLOWCTL:
838 					l2cap_chan_le_connect_reject(chan);
839 					break;
840 				case L2CAP_MODE_EXT_FLOWCTL:
841 					l2cap_chan_ecred_connect_reject(chan);
842 					return;
843 				}
844 			}
845 		}
846 
847 		l2cap_chan_del(chan, reason);
848 		break;
849 
850 	case BT_CONNECT:
851 	case BT_DISCONN:
852 		l2cap_chan_del(chan, reason);
853 		break;
854 
855 	default:
856 		chan->ops->teardown(chan, 0);
857 		break;
858 	}
859 }
860 EXPORT_SYMBOL(l2cap_chan_close);
861 
l2cap_get_auth_type(struct l2cap_chan * chan)862 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
863 {
864 	switch (chan->chan_type) {
865 	case L2CAP_CHAN_RAW:
866 		switch (chan->sec_level) {
867 		case BT_SECURITY_HIGH:
868 		case BT_SECURITY_FIPS:
869 			return HCI_AT_DEDICATED_BONDING_MITM;
870 		case BT_SECURITY_MEDIUM:
871 			return HCI_AT_DEDICATED_BONDING;
872 		default:
873 			return HCI_AT_NO_BONDING;
874 		}
875 		break;
876 	case L2CAP_CHAN_CONN_LESS:
877 		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
878 			if (chan->sec_level == BT_SECURITY_LOW)
879 				chan->sec_level = BT_SECURITY_SDP;
880 		}
881 		if (chan->sec_level == BT_SECURITY_HIGH ||
882 		    chan->sec_level == BT_SECURITY_FIPS)
883 			return HCI_AT_NO_BONDING_MITM;
884 		else
885 			return HCI_AT_NO_BONDING;
886 		break;
887 	case L2CAP_CHAN_CONN_ORIENTED:
888 		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
889 			if (chan->sec_level == BT_SECURITY_LOW)
890 				chan->sec_level = BT_SECURITY_SDP;
891 
892 			if (chan->sec_level == BT_SECURITY_HIGH ||
893 			    chan->sec_level == BT_SECURITY_FIPS)
894 				return HCI_AT_NO_BONDING_MITM;
895 			else
896 				return HCI_AT_NO_BONDING;
897 		}
898 		fallthrough;
899 
900 	default:
901 		switch (chan->sec_level) {
902 		case BT_SECURITY_HIGH:
903 		case BT_SECURITY_FIPS:
904 			return HCI_AT_GENERAL_BONDING_MITM;
905 		case BT_SECURITY_MEDIUM:
906 			return HCI_AT_GENERAL_BONDING;
907 		default:
908 			return HCI_AT_NO_BONDING;
909 		}
910 		break;
911 	}
912 }
913 
914 /* Service level security */
l2cap_chan_check_security(struct l2cap_chan * chan,bool initiator)915 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
916 {
917 	struct l2cap_conn *conn = chan->conn;
918 	__u8 auth_type;
919 
920 	if (conn->hcon->type == LE_LINK)
921 		return smp_conn_security(conn->hcon, chan->sec_level);
922 
923 	auth_type = l2cap_get_auth_type(chan);
924 
925 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
926 				 initiator);
927 }
928 
l2cap_get_ident(struct l2cap_conn * conn)929 static u8 l2cap_get_ident(struct l2cap_conn *conn)
930 {
931 	u8 id;
932 
933 	/* Get next available identificator.
934 	 *    1 - 128 are used by kernel.
935 	 *  129 - 199 are reserved.
936 	 *  200 - 254 are used by utilities like l2ping, etc.
937 	 */
938 
939 	mutex_lock(&conn->ident_lock);
940 
941 	if (++conn->tx_ident > 128)
942 		conn->tx_ident = 1;
943 
944 	id = conn->tx_ident;
945 
946 	mutex_unlock(&conn->ident_lock);
947 
948 	return id;
949 }
950 
l2cap_send_cmd(struct l2cap_conn * conn,u8 ident,u8 code,u16 len,void * data)951 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
952 			   void *data)
953 {
954 	struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
955 	u8 flags;
956 
957 	BT_DBG("code 0x%2.2x", code);
958 
959 	if (!skb)
960 		return;
961 
962 	/* Use NO_FLUSH if supported or we have an LE link (which does
963 	 * not support auto-flushing packets) */
964 	if (lmp_no_flush_capable(conn->hcon->hdev) ||
965 	    conn->hcon->type == LE_LINK)
966 		flags = ACL_START_NO_FLUSH;
967 	else
968 		flags = ACL_START;
969 
970 	bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
971 	skb->priority = HCI_PRIO_MAX;
972 
973 	hci_send_acl(conn->hchan, skb, flags);
974 }
975 
l2cap_do_send(struct l2cap_chan * chan,struct sk_buff * skb)976 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
977 {
978 	struct hci_conn *hcon = chan->conn->hcon;
979 	u16 flags;
980 
981 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
982 	       skb->priority);
983 
984 	/* Use NO_FLUSH for LE links (where this is the only option) or
985 	 * if the BR/EDR link supports it and flushing has not been
986 	 * explicitly requested (through FLAG_FLUSHABLE).
987 	 */
988 	if (hcon->type == LE_LINK ||
989 	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
990 	     lmp_no_flush_capable(hcon->hdev)))
991 		flags = ACL_START_NO_FLUSH;
992 	else
993 		flags = ACL_START;
994 
995 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
996 	hci_send_acl(chan->conn->hchan, skb, flags);
997 }
998 
__unpack_enhanced_control(u16 enh,struct l2cap_ctrl * control)999 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
1000 {
1001 	control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
1002 	control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
1003 
1004 	if (enh & L2CAP_CTRL_FRAME_TYPE) {
1005 		/* S-Frame */
1006 		control->sframe = 1;
1007 		control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1008 		control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1009 
1010 		control->sar = 0;
1011 		control->txseq = 0;
1012 	} else {
1013 		/* I-Frame */
1014 		control->sframe = 0;
1015 		control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1016 		control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1017 
1018 		control->poll = 0;
1019 		control->super = 0;
1020 	}
1021 }
1022 
__unpack_extended_control(u32 ext,struct l2cap_ctrl * control)1023 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1024 {
1025 	control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1026 	control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1027 
1028 	if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1029 		/* S-Frame */
1030 		control->sframe = 1;
1031 		control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1032 		control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1033 
1034 		control->sar = 0;
1035 		control->txseq = 0;
1036 	} else {
1037 		/* I-Frame */
1038 		control->sframe = 0;
1039 		control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1040 		control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1041 
1042 		control->poll = 0;
1043 		control->super = 0;
1044 	}
1045 }
1046 
__unpack_control(struct l2cap_chan * chan,struct sk_buff * skb)1047 static inline void __unpack_control(struct l2cap_chan *chan,
1048 				    struct sk_buff *skb)
1049 {
1050 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1051 		__unpack_extended_control(get_unaligned_le32(skb->data),
1052 					  &bt_cb(skb)->l2cap);
1053 		skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1054 	} else {
1055 		__unpack_enhanced_control(get_unaligned_le16(skb->data),
1056 					  &bt_cb(skb)->l2cap);
1057 		skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1058 	}
1059 }
1060 
__pack_extended_control(struct l2cap_ctrl * control)1061 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1062 {
1063 	u32 packed;
1064 
1065 	packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1066 	packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1067 
1068 	if (control->sframe) {
1069 		packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1070 		packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1071 		packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1072 	} else {
1073 		packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1074 		packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1075 	}
1076 
1077 	return packed;
1078 }
1079 
__pack_enhanced_control(struct l2cap_ctrl * control)1080 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1081 {
1082 	u16 packed;
1083 
1084 	packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1085 	packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1086 
1087 	if (control->sframe) {
1088 		packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1089 		packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1090 		packed |= L2CAP_CTRL_FRAME_TYPE;
1091 	} else {
1092 		packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1093 		packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1094 	}
1095 
1096 	return packed;
1097 }
1098 
__pack_control(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)1099 static inline void __pack_control(struct l2cap_chan *chan,
1100 				  struct l2cap_ctrl *control,
1101 				  struct sk_buff *skb)
1102 {
1103 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1104 		put_unaligned_le32(__pack_extended_control(control),
1105 				   skb->data + L2CAP_HDR_SIZE);
1106 	} else {
1107 		put_unaligned_le16(__pack_enhanced_control(control),
1108 				   skb->data + L2CAP_HDR_SIZE);
1109 	}
1110 }
1111 
__ertm_hdr_size(struct l2cap_chan * chan)1112 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1113 {
1114 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1115 		return L2CAP_EXT_HDR_SIZE;
1116 	else
1117 		return L2CAP_ENH_HDR_SIZE;
1118 }
1119 
l2cap_create_sframe_pdu(struct l2cap_chan * chan,u32 control)1120 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1121 					       u32 control)
1122 {
1123 	struct sk_buff *skb;
1124 	struct l2cap_hdr *lh;
1125 	int hlen = __ertm_hdr_size(chan);
1126 
1127 	if (chan->fcs == L2CAP_FCS_CRC16)
1128 		hlen += L2CAP_FCS_SIZE;
1129 
1130 	skb = bt_skb_alloc(hlen, GFP_KERNEL);
1131 
1132 	if (!skb)
1133 		return ERR_PTR(-ENOMEM);
1134 
1135 	lh = skb_put(skb, L2CAP_HDR_SIZE);
1136 	lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1137 	lh->cid = cpu_to_le16(chan->dcid);
1138 
1139 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1140 		put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1141 	else
1142 		put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1143 
1144 	if (chan->fcs == L2CAP_FCS_CRC16) {
1145 		u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1146 		put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1147 	}
1148 
1149 	skb->priority = HCI_PRIO_MAX;
1150 	return skb;
1151 }
1152 
l2cap_send_sframe(struct l2cap_chan * chan,struct l2cap_ctrl * control)1153 static void l2cap_send_sframe(struct l2cap_chan *chan,
1154 			      struct l2cap_ctrl *control)
1155 {
1156 	struct sk_buff *skb;
1157 	u32 control_field;
1158 
1159 	BT_DBG("chan %p, control %p", chan, control);
1160 
1161 	if (!control->sframe)
1162 		return;
1163 
1164 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1165 	    !control->poll)
1166 		control->final = 1;
1167 
1168 	if (control->super == L2CAP_SUPER_RR)
1169 		clear_bit(CONN_RNR_SENT, &chan->conn_state);
1170 	else if (control->super == L2CAP_SUPER_RNR)
1171 		set_bit(CONN_RNR_SENT, &chan->conn_state);
1172 
1173 	if (control->super != L2CAP_SUPER_SREJ) {
1174 		chan->last_acked_seq = control->reqseq;
1175 		__clear_ack_timer(chan);
1176 	}
1177 
1178 	BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1179 	       control->final, control->poll, control->super);
1180 
1181 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1182 		control_field = __pack_extended_control(control);
1183 	else
1184 		control_field = __pack_enhanced_control(control);
1185 
1186 	skb = l2cap_create_sframe_pdu(chan, control_field);
1187 	if (!IS_ERR(skb))
1188 		l2cap_do_send(chan, skb);
1189 }
1190 
l2cap_send_rr_or_rnr(struct l2cap_chan * chan,bool poll)1191 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1192 {
1193 	struct l2cap_ctrl control;
1194 
1195 	BT_DBG("chan %p, poll %d", chan, poll);
1196 
1197 	memset(&control, 0, sizeof(control));
1198 	control.sframe = 1;
1199 	control.poll = poll;
1200 
1201 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1202 		control.super = L2CAP_SUPER_RNR;
1203 	else
1204 		control.super = L2CAP_SUPER_RR;
1205 
1206 	control.reqseq = chan->buffer_seq;
1207 	l2cap_send_sframe(chan, &control);
1208 }
1209 
__l2cap_no_conn_pending(struct l2cap_chan * chan)1210 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1211 {
1212 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1213 		return true;
1214 
1215 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1216 }
1217 
l2cap_send_conn_req(struct l2cap_chan * chan)1218 void l2cap_send_conn_req(struct l2cap_chan *chan)
1219 {
1220 	struct l2cap_conn *conn = chan->conn;
1221 	struct l2cap_conn_req req;
1222 
1223 	req.scid = cpu_to_le16(chan->scid);
1224 	req.psm  = chan->psm;
1225 
1226 	chan->ident = l2cap_get_ident(conn);
1227 
1228 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1229 
1230 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1231 }
1232 
l2cap_chan_ready(struct l2cap_chan * chan)1233 static void l2cap_chan_ready(struct l2cap_chan *chan)
1234 {
1235 	/* The channel may have already been flagged as connected in
1236 	 * case of receiving data before the L2CAP info req/rsp
1237 	 * procedure is complete.
1238 	 */
1239 	if (chan->state == BT_CONNECTED)
1240 		return;
1241 
1242 	/* This clears all conf flags, including CONF_NOT_COMPLETE */
1243 	chan->conf_state = 0;
1244 	__clear_chan_timer(chan);
1245 
1246 	switch (chan->mode) {
1247 	case L2CAP_MODE_LE_FLOWCTL:
1248 	case L2CAP_MODE_EXT_FLOWCTL:
1249 		if (!chan->tx_credits)
1250 			chan->ops->suspend(chan);
1251 		break;
1252 	}
1253 
1254 	chan->state = BT_CONNECTED;
1255 
1256 	chan->ops->ready(chan);
1257 }
1258 
l2cap_le_connect(struct l2cap_chan * chan)1259 static void l2cap_le_connect(struct l2cap_chan *chan)
1260 {
1261 	struct l2cap_conn *conn = chan->conn;
1262 	struct l2cap_le_conn_req req;
1263 
1264 	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1265 		return;
1266 
1267 	if (!chan->imtu)
1268 		chan->imtu = chan->conn->mtu;
1269 
1270 	l2cap_le_flowctl_init(chan, 0);
1271 
1272 	memset(&req, 0, sizeof(req));
1273 	req.psm     = chan->psm;
1274 	req.scid    = cpu_to_le16(chan->scid);
1275 	req.mtu     = cpu_to_le16(chan->imtu);
1276 	req.mps     = cpu_to_le16(chan->mps);
1277 	req.credits = cpu_to_le16(chan->rx_credits);
1278 
1279 	chan->ident = l2cap_get_ident(conn);
1280 
1281 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1282 		       sizeof(req), &req);
1283 }
1284 
1285 struct l2cap_ecred_conn_data {
1286 	struct {
1287 		struct l2cap_ecred_conn_req req;
1288 		__le16 scid[5];
1289 	} __packed pdu;
1290 	struct l2cap_chan *chan;
1291 	struct pid *pid;
1292 	int count;
1293 };
1294 
l2cap_ecred_defer_connect(struct l2cap_chan * chan,void * data)1295 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1296 {
1297 	struct l2cap_ecred_conn_data *conn = data;
1298 	struct pid *pid;
1299 
1300 	if (chan == conn->chan)
1301 		return;
1302 
1303 	if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1304 		return;
1305 
1306 	pid = chan->ops->get_peer_pid(chan);
1307 
1308 	/* Only add deferred channels with the same PID/PSM */
1309 	if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1310 	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1311 		return;
1312 
1313 	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1314 		return;
1315 
1316 	l2cap_ecred_init(chan, 0);
1317 
1318 	/* Set the same ident so we can match on the rsp */
1319 	chan->ident = conn->chan->ident;
1320 
1321 	/* Include all channels deferred */
1322 	conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1323 
1324 	conn->count++;
1325 }
1326 
l2cap_ecred_connect(struct l2cap_chan * chan)1327 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1328 {
1329 	struct l2cap_conn *conn = chan->conn;
1330 	struct l2cap_ecred_conn_data data;
1331 
1332 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1333 		return;
1334 
1335 	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1336 		return;
1337 
1338 	l2cap_ecred_init(chan, 0);
1339 
1340 	memset(&data, 0, sizeof(data));
1341 	data.pdu.req.psm     = chan->psm;
1342 	data.pdu.req.mtu     = cpu_to_le16(chan->imtu);
1343 	data.pdu.req.mps     = cpu_to_le16(chan->mps);
1344 	data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1345 	data.pdu.scid[0]     = cpu_to_le16(chan->scid);
1346 
1347 	chan->ident = l2cap_get_ident(conn);
1348 
1349 	data.count = 1;
1350 	data.chan = chan;
1351 	data.pid = chan->ops->get_peer_pid(chan);
1352 
1353 	__l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1354 
1355 	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1356 		       sizeof(data.pdu.req) + data.count * sizeof(__le16),
1357 		       &data.pdu);
1358 }
1359 
l2cap_le_start(struct l2cap_chan * chan)1360 static void l2cap_le_start(struct l2cap_chan *chan)
1361 {
1362 	struct l2cap_conn *conn = chan->conn;
1363 
1364 	if (!smp_conn_security(conn->hcon, chan->sec_level))
1365 		return;
1366 
1367 	if (!chan->psm) {
1368 		l2cap_chan_ready(chan);
1369 		return;
1370 	}
1371 
1372 	if (chan->state == BT_CONNECT) {
1373 		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1374 			l2cap_ecred_connect(chan);
1375 		else
1376 			l2cap_le_connect(chan);
1377 	}
1378 }
1379 
l2cap_start_connection(struct l2cap_chan * chan)1380 static void l2cap_start_connection(struct l2cap_chan *chan)
1381 {
1382 	if (chan->conn->hcon->type == LE_LINK) {
1383 		l2cap_le_start(chan);
1384 	} else {
1385 		l2cap_send_conn_req(chan);
1386 	}
1387 }
1388 
l2cap_request_info(struct l2cap_conn * conn)1389 static void l2cap_request_info(struct l2cap_conn *conn)
1390 {
1391 	struct l2cap_info_req req;
1392 
1393 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1394 		return;
1395 
1396 	req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1397 
1398 	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1399 	conn->info_ident = l2cap_get_ident(conn);
1400 
1401 	schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1402 
1403 	l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1404 		       sizeof(req), &req);
1405 }
1406 
l2cap_check_enc_key_size(struct hci_conn * hcon)1407 static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1408 {
1409 	/* The minimum encryption key size needs to be enforced by the
1410 	 * host stack before establishing any L2CAP connections. The
1411 	 * specification in theory allows a minimum of 1, but to align
1412 	 * BR/EDR and LE transports, a minimum of 7 is chosen.
1413 	 *
1414 	 * This check might also be called for unencrypted connections
1415 	 * that have no key size requirements. Ensure that the link is
1416 	 * actually encrypted before enforcing a key size.
1417 	 */
1418 	int min_key_size = hcon->hdev->min_enc_key_size;
1419 
1420 	/* On FIPS security level, key size must be 16 bytes */
1421 	if (hcon->sec_level == BT_SECURITY_FIPS)
1422 		min_key_size = 16;
1423 
1424 	return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1425 		hcon->enc_key_size >= min_key_size);
1426 }
1427 
l2cap_do_start(struct l2cap_chan * chan)1428 static void l2cap_do_start(struct l2cap_chan *chan)
1429 {
1430 	struct l2cap_conn *conn = chan->conn;
1431 
1432 	if (conn->hcon->type == LE_LINK) {
1433 		l2cap_le_start(chan);
1434 		return;
1435 	}
1436 
1437 	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1438 		l2cap_request_info(conn);
1439 		return;
1440 	}
1441 
1442 	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1443 		return;
1444 
1445 	if (!l2cap_chan_check_security(chan, true) ||
1446 	    !__l2cap_no_conn_pending(chan))
1447 		return;
1448 
1449 	if (l2cap_check_enc_key_size(conn->hcon))
1450 		l2cap_start_connection(chan);
1451 	else
1452 		__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1453 }
1454 
l2cap_mode_supported(__u8 mode,__u32 feat_mask)1455 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1456 {
1457 	u32 local_feat_mask = l2cap_feat_mask;
1458 	if (!disable_ertm)
1459 		local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1460 
1461 	switch (mode) {
1462 	case L2CAP_MODE_ERTM:
1463 		return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1464 	case L2CAP_MODE_STREAMING:
1465 		return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1466 	default:
1467 		return 0x00;
1468 	}
1469 }
1470 
l2cap_send_disconn_req(struct l2cap_chan * chan,int err)1471 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1472 {
1473 	struct l2cap_conn *conn = chan->conn;
1474 	struct l2cap_disconn_req req;
1475 
1476 	if (!conn)
1477 		return;
1478 
1479 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1480 		__clear_retrans_timer(chan);
1481 		__clear_monitor_timer(chan);
1482 		__clear_ack_timer(chan);
1483 	}
1484 
1485 	req.dcid = cpu_to_le16(chan->dcid);
1486 	req.scid = cpu_to_le16(chan->scid);
1487 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1488 		       sizeof(req), &req);
1489 
1490 	l2cap_state_change_and_error(chan, BT_DISCONN, err);
1491 }
1492 
1493 /* ---- L2CAP connections ---- */
l2cap_conn_start(struct l2cap_conn * conn)1494 static void l2cap_conn_start(struct l2cap_conn *conn)
1495 {
1496 	struct l2cap_chan *chan, *tmp;
1497 
1498 	BT_DBG("conn %p", conn);
1499 
1500 	mutex_lock(&conn->chan_lock);
1501 
1502 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1503 		l2cap_chan_lock(chan);
1504 
1505 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1506 			l2cap_chan_ready(chan);
1507 			l2cap_chan_unlock(chan);
1508 			continue;
1509 		}
1510 
1511 		if (chan->state == BT_CONNECT) {
1512 			if (!l2cap_chan_check_security(chan, true) ||
1513 			    !__l2cap_no_conn_pending(chan)) {
1514 				l2cap_chan_unlock(chan);
1515 				continue;
1516 			}
1517 
1518 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1519 			    && test_bit(CONF_STATE2_DEVICE,
1520 					&chan->conf_state)) {
1521 				l2cap_chan_close(chan, ECONNRESET);
1522 				l2cap_chan_unlock(chan);
1523 				continue;
1524 			}
1525 
1526 			if (l2cap_check_enc_key_size(conn->hcon))
1527 				l2cap_start_connection(chan);
1528 			else
1529 				l2cap_chan_close(chan, ECONNREFUSED);
1530 
1531 		} else if (chan->state == BT_CONNECT2) {
1532 			struct l2cap_conn_rsp rsp;
1533 			char buf[128];
1534 			rsp.scid = cpu_to_le16(chan->dcid);
1535 			rsp.dcid = cpu_to_le16(chan->scid);
1536 
1537 			if (l2cap_chan_check_security(chan, false)) {
1538 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1539 					rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1540 					rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1541 					chan->ops->defer(chan);
1542 
1543 				} else {
1544 					l2cap_state_change(chan, BT_CONFIG);
1545 					rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1546 					rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1547 				}
1548 			} else {
1549 				rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1550 				rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1551 			}
1552 
1553 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1554 				       sizeof(rsp), &rsp);
1555 
1556 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1557 			    rsp.result != L2CAP_CR_SUCCESS) {
1558 				l2cap_chan_unlock(chan);
1559 				continue;
1560 			}
1561 
1562 			set_bit(CONF_REQ_SENT, &chan->conf_state);
1563 			l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1564 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1565 			chan->num_conf_req++;
1566 		}
1567 
1568 		l2cap_chan_unlock(chan);
1569 	}
1570 
1571 	mutex_unlock(&conn->chan_lock);
1572 }
1573 
l2cap_le_conn_ready(struct l2cap_conn * conn)1574 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1575 {
1576 	struct hci_conn *hcon = conn->hcon;
1577 	struct hci_dev *hdev = hcon->hdev;
1578 
1579 	BT_DBG("%s conn %p", hdev->name, conn);
1580 
1581 	/* For outgoing pairing which doesn't necessarily have an
1582 	 * associated socket (e.g. mgmt_pair_device).
1583 	 */
1584 	if (hcon->out)
1585 		smp_conn_security(hcon, hcon->pending_sec_level);
1586 
1587 	/* For LE peripheral connections, make sure the connection interval
1588 	 * is in the range of the minimum and maximum interval that has
1589 	 * been configured for this connection. If not, then trigger
1590 	 * the connection update procedure.
1591 	 */
1592 	if (hcon->role == HCI_ROLE_SLAVE &&
1593 	    (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1594 	     hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1595 		struct l2cap_conn_param_update_req req;
1596 
1597 		req.min = cpu_to_le16(hcon->le_conn_min_interval);
1598 		req.max = cpu_to_le16(hcon->le_conn_max_interval);
1599 		req.latency = cpu_to_le16(hcon->le_conn_latency);
1600 		req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1601 
1602 		l2cap_send_cmd(conn, l2cap_get_ident(conn),
1603 			       L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1604 	}
1605 }
1606 
l2cap_conn_ready(struct l2cap_conn * conn)1607 static void l2cap_conn_ready(struct l2cap_conn *conn)
1608 {
1609 	struct l2cap_chan *chan;
1610 	struct hci_conn *hcon = conn->hcon;
1611 
1612 	BT_DBG("conn %p", conn);
1613 
1614 	if (hcon->type == ACL_LINK)
1615 		l2cap_request_info(conn);
1616 
1617 	mutex_lock(&conn->chan_lock);
1618 
1619 	list_for_each_entry(chan, &conn->chan_l, list) {
1620 
1621 		l2cap_chan_lock(chan);
1622 
1623 		if (hcon->type == LE_LINK) {
1624 			l2cap_le_start(chan);
1625 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1626 			if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1627 				l2cap_chan_ready(chan);
1628 		} else if (chan->state == BT_CONNECT) {
1629 			l2cap_do_start(chan);
1630 		}
1631 
1632 		l2cap_chan_unlock(chan);
1633 	}
1634 
1635 	mutex_unlock(&conn->chan_lock);
1636 
1637 	if (hcon->type == LE_LINK)
1638 		l2cap_le_conn_ready(conn);
1639 
1640 	queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1641 }
1642 
1643 /* Notify sockets that we cannot guaranty reliability anymore */
l2cap_conn_unreliable(struct l2cap_conn * conn,int err)1644 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1645 {
1646 	struct l2cap_chan *chan;
1647 
1648 	BT_DBG("conn %p", conn);
1649 
1650 	mutex_lock(&conn->chan_lock);
1651 
1652 	list_for_each_entry(chan, &conn->chan_l, list) {
1653 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1654 			l2cap_chan_set_err(chan, err);
1655 	}
1656 
1657 	mutex_unlock(&conn->chan_lock);
1658 }
1659 
l2cap_info_timeout(struct work_struct * work)1660 static void l2cap_info_timeout(struct work_struct *work)
1661 {
1662 	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1663 					       info_timer.work);
1664 
1665 	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1666 	conn->info_ident = 0;
1667 
1668 	l2cap_conn_start(conn);
1669 }
1670 
1671 /*
1672  * l2cap_user
1673  * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1674  * callback is called during registration. The ->remove callback is called
1675  * during unregistration.
1676  * An l2cap_user object can either be explicitly unregistered or when the
1677  * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1678  * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1679  * External modules must own a reference to the l2cap_conn object if they intend
1680  * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1681  * any time if they don't.
1682  */
1683 
l2cap_register_user(struct l2cap_conn * conn,struct l2cap_user * user)1684 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1685 {
1686 	struct hci_dev *hdev = conn->hcon->hdev;
1687 	int ret;
1688 
1689 	/* We need to check whether l2cap_conn is registered. If it is not, we
1690 	 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1691 	 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1692 	 * relies on the parent hci_conn object to be locked. This itself relies
1693 	 * on the hci_dev object to be locked. So we must lock the hci device
1694 	 * here, too. */
1695 
1696 	hci_dev_lock(hdev);
1697 
1698 	if (!list_empty(&user->list)) {
1699 		ret = -EINVAL;
1700 		goto out_unlock;
1701 	}
1702 
1703 	/* conn->hchan is NULL after l2cap_conn_del() was called */
1704 	if (!conn->hchan) {
1705 		ret = -ENODEV;
1706 		goto out_unlock;
1707 	}
1708 
1709 	ret = user->probe(conn, user);
1710 	if (ret)
1711 		goto out_unlock;
1712 
1713 	list_add(&user->list, &conn->users);
1714 	ret = 0;
1715 
1716 out_unlock:
1717 	hci_dev_unlock(hdev);
1718 	return ret;
1719 }
1720 EXPORT_SYMBOL(l2cap_register_user);
1721 
l2cap_unregister_user(struct l2cap_conn * conn,struct l2cap_user * user)1722 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1723 {
1724 	struct hci_dev *hdev = conn->hcon->hdev;
1725 
1726 	hci_dev_lock(hdev);
1727 
1728 	if (list_empty(&user->list))
1729 		goto out_unlock;
1730 
1731 	list_del_init(&user->list);
1732 	user->remove(conn, user);
1733 
1734 out_unlock:
1735 	hci_dev_unlock(hdev);
1736 }
1737 EXPORT_SYMBOL(l2cap_unregister_user);
1738 
l2cap_unregister_all_users(struct l2cap_conn * conn)1739 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1740 {
1741 	struct l2cap_user *user;
1742 
1743 	while (!list_empty(&conn->users)) {
1744 		user = list_first_entry(&conn->users, struct l2cap_user, list);
1745 		list_del_init(&user->list);
1746 		user->remove(conn, user);
1747 	}
1748 }
1749 
l2cap_conn_del(struct hci_conn * hcon,int err)1750 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1751 {
1752 	struct l2cap_conn *conn = hcon->l2cap_data;
1753 	struct l2cap_chan *chan, *l;
1754 
1755 	if (!conn)
1756 		return;
1757 
1758 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1759 
1760 	kfree_skb(conn->rx_skb);
1761 
1762 	skb_queue_purge(&conn->pending_rx);
1763 
1764 	/* We can not call flush_work(&conn->pending_rx_work) here since we
1765 	 * might block if we are running on a worker from the same workqueue
1766 	 * pending_rx_work is waiting on.
1767 	 */
1768 	if (work_pending(&conn->pending_rx_work))
1769 		cancel_work_sync(&conn->pending_rx_work);
1770 
1771 	cancel_delayed_work_sync(&conn->id_addr_timer);
1772 
1773 	l2cap_unregister_all_users(conn);
1774 
1775 	/* Force the connection to be immediately dropped */
1776 	hcon->disc_timeout = 0;
1777 
1778 	mutex_lock(&conn->chan_lock);
1779 
1780 	/* Kill channels */
1781 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1782 		l2cap_chan_hold(chan);
1783 		l2cap_chan_lock(chan);
1784 
1785 		l2cap_chan_del(chan, err);
1786 
1787 		chan->ops->close(chan);
1788 
1789 		l2cap_chan_unlock(chan);
1790 		l2cap_chan_put(chan);
1791 	}
1792 
1793 	mutex_unlock(&conn->chan_lock);
1794 
1795 	hci_chan_del(conn->hchan);
1796 
1797 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1798 		cancel_delayed_work_sync(&conn->info_timer);
1799 
1800 	hcon->l2cap_data = NULL;
1801 	conn->hchan = NULL;
1802 	l2cap_conn_put(conn);
1803 }
1804 
l2cap_conn_free(struct kref * ref)1805 static void l2cap_conn_free(struct kref *ref)
1806 {
1807 	struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1808 
1809 	hci_conn_put(conn->hcon);
1810 	kfree(conn);
1811 }
1812 
l2cap_conn_get(struct l2cap_conn * conn)1813 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1814 {
1815 	kref_get(&conn->ref);
1816 	return conn;
1817 }
1818 EXPORT_SYMBOL(l2cap_conn_get);
1819 
l2cap_conn_put(struct l2cap_conn * conn)1820 void l2cap_conn_put(struct l2cap_conn *conn)
1821 {
1822 	kref_put(&conn->ref, l2cap_conn_free);
1823 }
1824 EXPORT_SYMBOL(l2cap_conn_put);
1825 
1826 /* ---- Socket interface ---- */
1827 
1828 /* Find socket with psm and source / destination bdaddr.
1829  * Returns closest match.
1830  */
l2cap_global_chan_by_psm(int state,__le16 psm,bdaddr_t * src,bdaddr_t * dst,u8 link_type)1831 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1832 						   bdaddr_t *src,
1833 						   bdaddr_t *dst,
1834 						   u8 link_type)
1835 {
1836 	struct l2cap_chan *c, *tmp, *c1 = NULL;
1837 
1838 	read_lock(&chan_list_lock);
1839 
1840 	list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1841 		if (state && c->state != state)
1842 			continue;
1843 
1844 		if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1845 			continue;
1846 
1847 		if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1848 			continue;
1849 
1850 		if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
1851 			int src_match, dst_match;
1852 			int src_any, dst_any;
1853 
1854 			/* Exact match. */
1855 			src_match = !bacmp(&c->src, src);
1856 			dst_match = !bacmp(&c->dst, dst);
1857 			if (src_match && dst_match) {
1858 				if (!l2cap_chan_hold_unless_zero(c))
1859 					continue;
1860 
1861 				read_unlock(&chan_list_lock);
1862 				return c;
1863 			}
1864 
1865 			/* Closest match */
1866 			src_any = !bacmp(&c->src, BDADDR_ANY);
1867 			dst_any = !bacmp(&c->dst, BDADDR_ANY);
1868 			if ((src_match && dst_any) || (src_any && dst_match) ||
1869 			    (src_any && dst_any))
1870 				c1 = c;
1871 		}
1872 	}
1873 
1874 	if (c1)
1875 		c1 = l2cap_chan_hold_unless_zero(c1);
1876 
1877 	read_unlock(&chan_list_lock);
1878 
1879 	return c1;
1880 }
1881 
l2cap_monitor_timeout(struct work_struct * work)1882 static void l2cap_monitor_timeout(struct work_struct *work)
1883 {
1884 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1885 					       monitor_timer.work);
1886 
1887 	BT_DBG("chan %p", chan);
1888 
1889 	l2cap_chan_lock(chan);
1890 
1891 	if (!chan->conn) {
1892 		l2cap_chan_unlock(chan);
1893 		l2cap_chan_put(chan);
1894 		return;
1895 	}
1896 
1897 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1898 
1899 	l2cap_chan_unlock(chan);
1900 	l2cap_chan_put(chan);
1901 }
1902 
l2cap_retrans_timeout(struct work_struct * work)1903 static void l2cap_retrans_timeout(struct work_struct *work)
1904 {
1905 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1906 					       retrans_timer.work);
1907 
1908 	BT_DBG("chan %p", chan);
1909 
1910 	l2cap_chan_lock(chan);
1911 
1912 	if (!chan->conn) {
1913 		l2cap_chan_unlock(chan);
1914 		l2cap_chan_put(chan);
1915 		return;
1916 	}
1917 
1918 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1919 	l2cap_chan_unlock(chan);
1920 	l2cap_chan_put(chan);
1921 }
1922 
l2cap_streaming_send(struct l2cap_chan * chan,struct sk_buff_head * skbs)1923 static void l2cap_streaming_send(struct l2cap_chan *chan,
1924 				 struct sk_buff_head *skbs)
1925 {
1926 	struct sk_buff *skb;
1927 	struct l2cap_ctrl *control;
1928 
1929 	BT_DBG("chan %p, skbs %p", chan, skbs);
1930 
1931 	skb_queue_splice_tail_init(skbs, &chan->tx_q);
1932 
1933 	while (!skb_queue_empty(&chan->tx_q)) {
1934 
1935 		skb = skb_dequeue(&chan->tx_q);
1936 
1937 		bt_cb(skb)->l2cap.retries = 1;
1938 		control = &bt_cb(skb)->l2cap;
1939 
1940 		control->reqseq = 0;
1941 		control->txseq = chan->next_tx_seq;
1942 
1943 		__pack_control(chan, control, skb);
1944 
1945 		if (chan->fcs == L2CAP_FCS_CRC16) {
1946 			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1947 			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1948 		}
1949 
1950 		l2cap_do_send(chan, skb);
1951 
1952 		BT_DBG("Sent txseq %u", control->txseq);
1953 
1954 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1955 		chan->frames_sent++;
1956 	}
1957 }
1958 
l2cap_ertm_send(struct l2cap_chan * chan)1959 static int l2cap_ertm_send(struct l2cap_chan *chan)
1960 {
1961 	struct sk_buff *skb, *tx_skb;
1962 	struct l2cap_ctrl *control;
1963 	int sent = 0;
1964 
1965 	BT_DBG("chan %p", chan);
1966 
1967 	if (chan->state != BT_CONNECTED)
1968 		return -ENOTCONN;
1969 
1970 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1971 		return 0;
1972 
1973 	while (chan->tx_send_head &&
1974 	       chan->unacked_frames < chan->remote_tx_win &&
1975 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {
1976 
1977 		skb = chan->tx_send_head;
1978 
1979 		bt_cb(skb)->l2cap.retries = 1;
1980 		control = &bt_cb(skb)->l2cap;
1981 
1982 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1983 			control->final = 1;
1984 
1985 		control->reqseq = chan->buffer_seq;
1986 		chan->last_acked_seq = chan->buffer_seq;
1987 		control->txseq = chan->next_tx_seq;
1988 
1989 		__pack_control(chan, control, skb);
1990 
1991 		if (chan->fcs == L2CAP_FCS_CRC16) {
1992 			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1993 			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1994 		}
1995 
1996 		/* Clone after data has been modified. Data is assumed to be
1997 		   read-only (for locking purposes) on cloned sk_buffs.
1998 		 */
1999 		tx_skb = skb_clone(skb, GFP_KERNEL);
2000 
2001 		if (!tx_skb)
2002 			break;
2003 
2004 		__set_retrans_timer(chan);
2005 
2006 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2007 		chan->unacked_frames++;
2008 		chan->frames_sent++;
2009 		sent++;
2010 
2011 		if (skb_queue_is_last(&chan->tx_q, skb))
2012 			chan->tx_send_head = NULL;
2013 		else
2014 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2015 
2016 		l2cap_do_send(chan, tx_skb);
2017 		BT_DBG("Sent txseq %u", control->txseq);
2018 	}
2019 
2020 	BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2021 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));
2022 
2023 	return sent;
2024 }
2025 
l2cap_ertm_resend(struct l2cap_chan * chan)2026 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2027 {
2028 	struct l2cap_ctrl control;
2029 	struct sk_buff *skb;
2030 	struct sk_buff *tx_skb;
2031 	u16 seq;
2032 
2033 	BT_DBG("chan %p", chan);
2034 
2035 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2036 		return;
2037 
2038 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2039 		seq = l2cap_seq_list_pop(&chan->retrans_list);
2040 
2041 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2042 		if (!skb) {
2043 			BT_DBG("Error: Can't retransmit seq %d, frame missing",
2044 			       seq);
2045 			continue;
2046 		}
2047 
2048 		bt_cb(skb)->l2cap.retries++;
2049 		control = bt_cb(skb)->l2cap;
2050 
2051 		if (chan->max_tx != 0 &&
2052 		    bt_cb(skb)->l2cap.retries > chan->max_tx) {
2053 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2054 			l2cap_send_disconn_req(chan, ECONNRESET);
2055 			l2cap_seq_list_clear(&chan->retrans_list);
2056 			break;
2057 		}
2058 
2059 		control.reqseq = chan->buffer_seq;
2060 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2061 			control.final = 1;
2062 		else
2063 			control.final = 0;
2064 
2065 		if (skb_cloned(skb)) {
2066 			/* Cloned sk_buffs are read-only, so we need a
2067 			 * writeable copy
2068 			 */
2069 			tx_skb = skb_copy(skb, GFP_KERNEL);
2070 		} else {
2071 			tx_skb = skb_clone(skb, GFP_KERNEL);
2072 		}
2073 
2074 		if (!tx_skb) {
2075 			l2cap_seq_list_clear(&chan->retrans_list);
2076 			break;
2077 		}
2078 
2079 		/* Update skb contents */
2080 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2081 			put_unaligned_le32(__pack_extended_control(&control),
2082 					   tx_skb->data + L2CAP_HDR_SIZE);
2083 		} else {
2084 			put_unaligned_le16(__pack_enhanced_control(&control),
2085 					   tx_skb->data + L2CAP_HDR_SIZE);
2086 		}
2087 
2088 		/* Update FCS */
2089 		if (chan->fcs == L2CAP_FCS_CRC16) {
2090 			u16 fcs = crc16(0, (u8 *) tx_skb->data,
2091 					tx_skb->len - L2CAP_FCS_SIZE);
2092 			put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2093 						L2CAP_FCS_SIZE);
2094 		}
2095 
2096 		l2cap_do_send(chan, tx_skb);
2097 
2098 		BT_DBG("Resent txseq %d", control.txseq);
2099 
2100 		chan->last_acked_seq = chan->buffer_seq;
2101 	}
2102 }
2103 
l2cap_retransmit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2104 static void l2cap_retransmit(struct l2cap_chan *chan,
2105 			     struct l2cap_ctrl *control)
2106 {
2107 	BT_DBG("chan %p, control %p", chan, control);
2108 
2109 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2110 	l2cap_ertm_resend(chan);
2111 }
2112 
l2cap_retransmit_all(struct l2cap_chan * chan,struct l2cap_ctrl * control)2113 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2114 				 struct l2cap_ctrl *control)
2115 {
2116 	struct sk_buff *skb;
2117 
2118 	BT_DBG("chan %p, control %p", chan, control);
2119 
2120 	if (control->poll)
2121 		set_bit(CONN_SEND_FBIT, &chan->conn_state);
2122 
2123 	l2cap_seq_list_clear(&chan->retrans_list);
2124 
2125 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2126 		return;
2127 
2128 	if (chan->unacked_frames) {
2129 		skb_queue_walk(&chan->tx_q, skb) {
2130 			if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2131 			    skb == chan->tx_send_head)
2132 				break;
2133 		}
2134 
2135 		skb_queue_walk_from(&chan->tx_q, skb) {
2136 			if (skb == chan->tx_send_head)
2137 				break;
2138 
2139 			l2cap_seq_list_append(&chan->retrans_list,
2140 					      bt_cb(skb)->l2cap.txseq);
2141 		}
2142 
2143 		l2cap_ertm_resend(chan);
2144 	}
2145 }
2146 
l2cap_send_ack(struct l2cap_chan * chan)2147 static void l2cap_send_ack(struct l2cap_chan *chan)
2148 {
2149 	struct l2cap_ctrl control;
2150 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2151 					 chan->last_acked_seq);
2152 	int threshold;
2153 
2154 	BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2155 	       chan, chan->last_acked_seq, chan->buffer_seq);
2156 
2157 	memset(&control, 0, sizeof(control));
2158 	control.sframe = 1;
2159 
2160 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2161 	    chan->rx_state == L2CAP_RX_STATE_RECV) {
2162 		__clear_ack_timer(chan);
2163 		control.super = L2CAP_SUPER_RNR;
2164 		control.reqseq = chan->buffer_seq;
2165 		l2cap_send_sframe(chan, &control);
2166 	} else {
2167 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2168 			l2cap_ertm_send(chan);
2169 			/* If any i-frames were sent, they included an ack */
2170 			if (chan->buffer_seq == chan->last_acked_seq)
2171 				frames_to_ack = 0;
2172 		}
2173 
2174 		/* Ack now if the window is 3/4ths full.
2175 		 * Calculate without mul or div
2176 		 */
2177 		threshold = chan->ack_win;
2178 		threshold += threshold << 1;
2179 		threshold >>= 2;
2180 
2181 		BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2182 		       threshold);
2183 
2184 		if (frames_to_ack >= threshold) {
2185 			__clear_ack_timer(chan);
2186 			control.super = L2CAP_SUPER_RR;
2187 			control.reqseq = chan->buffer_seq;
2188 			l2cap_send_sframe(chan, &control);
2189 			frames_to_ack = 0;
2190 		}
2191 
2192 		if (frames_to_ack)
2193 			__set_ack_timer(chan);
2194 	}
2195 }
2196 
l2cap_skbuff_fromiovec(struct l2cap_chan * chan,struct msghdr * msg,int len,int count,struct sk_buff * skb)2197 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2198 					 struct msghdr *msg, int len,
2199 					 int count, struct sk_buff *skb)
2200 {
2201 	struct l2cap_conn *conn = chan->conn;
2202 	struct sk_buff **frag;
2203 	int sent = 0;
2204 
2205 	if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2206 		return -EFAULT;
2207 
2208 	sent += count;
2209 	len  -= count;
2210 
2211 	/* Continuation fragments (no L2CAP header) */
2212 	frag = &skb_shinfo(skb)->frag_list;
2213 	while (len) {
2214 		struct sk_buff *tmp;
2215 
2216 		count = min_t(unsigned int, conn->mtu, len);
2217 
2218 		tmp = chan->ops->alloc_skb(chan, 0, count,
2219 					   msg->msg_flags & MSG_DONTWAIT);
2220 		if (IS_ERR(tmp))
2221 			return PTR_ERR(tmp);
2222 
2223 		*frag = tmp;
2224 
2225 		if (!copy_from_iter_full(skb_put(*frag, count), count,
2226 				   &msg->msg_iter))
2227 			return -EFAULT;
2228 
2229 		sent += count;
2230 		len  -= count;
2231 
2232 		skb->len += (*frag)->len;
2233 		skb->data_len += (*frag)->len;
2234 
2235 		frag = &(*frag)->next;
2236 	}
2237 
2238 	return sent;
2239 }
2240 
l2cap_create_connless_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2241 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2242 						 struct msghdr *msg, size_t len)
2243 {
2244 	struct l2cap_conn *conn = chan->conn;
2245 	struct sk_buff *skb;
2246 	int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2247 	struct l2cap_hdr *lh;
2248 
2249 	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2250 	       __le16_to_cpu(chan->psm), len);
2251 
2252 	count = min_t(unsigned int, (conn->mtu - hlen), len);
2253 
2254 	skb = chan->ops->alloc_skb(chan, hlen, count,
2255 				   msg->msg_flags & MSG_DONTWAIT);
2256 	if (IS_ERR(skb))
2257 		return skb;
2258 
2259 	/* Create L2CAP header */
2260 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2261 	lh->cid = cpu_to_le16(chan->dcid);
2262 	lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2263 	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2264 
2265 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2266 	if (unlikely(err < 0)) {
2267 		kfree_skb(skb);
2268 		return ERR_PTR(err);
2269 	}
2270 	return skb;
2271 }
2272 
l2cap_create_basic_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2273 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2274 					      struct msghdr *msg, size_t len)
2275 {
2276 	struct l2cap_conn *conn = chan->conn;
2277 	struct sk_buff *skb;
2278 	int err, count;
2279 	struct l2cap_hdr *lh;
2280 
2281 	BT_DBG("chan %p len %zu", chan, len);
2282 
2283 	count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2284 
2285 	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2286 				   msg->msg_flags & MSG_DONTWAIT);
2287 	if (IS_ERR(skb))
2288 		return skb;
2289 
2290 	/* Create L2CAP header */
2291 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2292 	lh->cid = cpu_to_le16(chan->dcid);
2293 	lh->len = cpu_to_le16(len);
2294 
2295 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2296 	if (unlikely(err < 0)) {
2297 		kfree_skb(skb);
2298 		return ERR_PTR(err);
2299 	}
2300 	return skb;
2301 }
2302 
l2cap_create_iframe_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2303 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2304 					       struct msghdr *msg, size_t len,
2305 					       u16 sdulen)
2306 {
2307 	struct l2cap_conn *conn = chan->conn;
2308 	struct sk_buff *skb;
2309 	int err, count, hlen;
2310 	struct l2cap_hdr *lh;
2311 
2312 	BT_DBG("chan %p len %zu", chan, len);
2313 
2314 	if (!conn)
2315 		return ERR_PTR(-ENOTCONN);
2316 
2317 	hlen = __ertm_hdr_size(chan);
2318 
2319 	if (sdulen)
2320 		hlen += L2CAP_SDULEN_SIZE;
2321 
2322 	if (chan->fcs == L2CAP_FCS_CRC16)
2323 		hlen += L2CAP_FCS_SIZE;
2324 
2325 	count = min_t(unsigned int, (conn->mtu - hlen), len);
2326 
2327 	skb = chan->ops->alloc_skb(chan, hlen, count,
2328 				   msg->msg_flags & MSG_DONTWAIT);
2329 	if (IS_ERR(skb))
2330 		return skb;
2331 
2332 	/* Create L2CAP header */
2333 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2334 	lh->cid = cpu_to_le16(chan->dcid);
2335 	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2336 
2337 	/* Control header is populated later */
2338 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2339 		put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2340 	else
2341 		put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2342 
2343 	if (sdulen)
2344 		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2345 
2346 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2347 	if (unlikely(err < 0)) {
2348 		kfree_skb(skb);
2349 		return ERR_PTR(err);
2350 	}
2351 
2352 	bt_cb(skb)->l2cap.fcs = chan->fcs;
2353 	bt_cb(skb)->l2cap.retries = 0;
2354 	return skb;
2355 }
2356 
l2cap_segment_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2357 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2358 			     struct sk_buff_head *seg_queue,
2359 			     struct msghdr *msg, size_t len)
2360 {
2361 	struct sk_buff *skb;
2362 	u16 sdu_len;
2363 	size_t pdu_len;
2364 	u8 sar;
2365 
2366 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2367 
2368 	/* It is critical that ERTM PDUs fit in a single HCI fragment,
2369 	 * so fragmented skbs are not used.  The HCI layer's handling
2370 	 * of fragmented skbs is not compatible with ERTM's queueing.
2371 	 */
2372 
2373 	/* PDU size is derived from the HCI MTU */
2374 	pdu_len = chan->conn->mtu;
2375 
2376 	/* Constrain PDU size for BR/EDR connections */
2377 	pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2378 
2379 	/* Adjust for largest possible L2CAP overhead. */
2380 	if (chan->fcs)
2381 		pdu_len -= L2CAP_FCS_SIZE;
2382 
2383 	pdu_len -= __ertm_hdr_size(chan);
2384 
2385 	/* Remote device may have requested smaller PDUs */
2386 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2387 
2388 	if (len <= pdu_len) {
2389 		sar = L2CAP_SAR_UNSEGMENTED;
2390 		sdu_len = 0;
2391 		pdu_len = len;
2392 	} else {
2393 		sar = L2CAP_SAR_START;
2394 		sdu_len = len;
2395 	}
2396 
2397 	while (len > 0) {
2398 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2399 
2400 		if (IS_ERR(skb)) {
2401 			__skb_queue_purge(seg_queue);
2402 			return PTR_ERR(skb);
2403 		}
2404 
2405 		bt_cb(skb)->l2cap.sar = sar;
2406 		__skb_queue_tail(seg_queue, skb);
2407 
2408 		len -= pdu_len;
2409 		if (sdu_len)
2410 			sdu_len = 0;
2411 
2412 		if (len <= pdu_len) {
2413 			sar = L2CAP_SAR_END;
2414 			pdu_len = len;
2415 		} else {
2416 			sar = L2CAP_SAR_CONTINUE;
2417 		}
2418 	}
2419 
2420 	return 0;
2421 }
2422 
l2cap_create_le_flowctl_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2423 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2424 						   struct msghdr *msg,
2425 						   size_t len, u16 sdulen)
2426 {
2427 	struct l2cap_conn *conn = chan->conn;
2428 	struct sk_buff *skb;
2429 	int err, count, hlen;
2430 	struct l2cap_hdr *lh;
2431 
2432 	BT_DBG("chan %p len %zu", chan, len);
2433 
2434 	if (!conn)
2435 		return ERR_PTR(-ENOTCONN);
2436 
2437 	hlen = L2CAP_HDR_SIZE;
2438 
2439 	if (sdulen)
2440 		hlen += L2CAP_SDULEN_SIZE;
2441 
2442 	count = min_t(unsigned int, (conn->mtu - hlen), len);
2443 
2444 	skb = chan->ops->alloc_skb(chan, hlen, count,
2445 				   msg->msg_flags & MSG_DONTWAIT);
2446 	if (IS_ERR(skb))
2447 		return skb;
2448 
2449 	/* Create L2CAP header */
2450 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2451 	lh->cid = cpu_to_le16(chan->dcid);
2452 	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2453 
2454 	if (sdulen)
2455 		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2456 
2457 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2458 	if (unlikely(err < 0)) {
2459 		kfree_skb(skb);
2460 		return ERR_PTR(err);
2461 	}
2462 
2463 	return skb;
2464 }
2465 
l2cap_segment_le_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2466 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2467 				struct sk_buff_head *seg_queue,
2468 				struct msghdr *msg, size_t len)
2469 {
2470 	struct sk_buff *skb;
2471 	size_t pdu_len;
2472 	u16 sdu_len;
2473 
2474 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2475 
2476 	sdu_len = len;
2477 	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2478 
2479 	while (len > 0) {
2480 		if (len <= pdu_len)
2481 			pdu_len = len;
2482 
2483 		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2484 		if (IS_ERR(skb)) {
2485 			__skb_queue_purge(seg_queue);
2486 			return PTR_ERR(skb);
2487 		}
2488 
2489 		__skb_queue_tail(seg_queue, skb);
2490 
2491 		len -= pdu_len;
2492 
2493 		if (sdu_len) {
2494 			sdu_len = 0;
2495 			pdu_len += L2CAP_SDULEN_SIZE;
2496 		}
2497 	}
2498 
2499 	return 0;
2500 }
2501 
l2cap_le_flowctl_send(struct l2cap_chan * chan)2502 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2503 {
2504 	int sent = 0;
2505 
2506 	BT_DBG("chan %p", chan);
2507 
2508 	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2509 		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2510 		chan->tx_credits--;
2511 		sent++;
2512 	}
2513 
2514 	BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2515 	       skb_queue_len(&chan->tx_q));
2516 }
2517 
l2cap_chan_send(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2518 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2519 {
2520 	struct sk_buff *skb;
2521 	int err;
2522 	struct sk_buff_head seg_queue;
2523 
2524 	if (!chan->conn)
2525 		return -ENOTCONN;
2526 
2527 	/* Connectionless channel */
2528 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2529 		skb = l2cap_create_connless_pdu(chan, msg, len);
2530 		if (IS_ERR(skb))
2531 			return PTR_ERR(skb);
2532 
2533 		l2cap_do_send(chan, skb);
2534 		return len;
2535 	}
2536 
2537 	switch (chan->mode) {
2538 	case L2CAP_MODE_LE_FLOWCTL:
2539 	case L2CAP_MODE_EXT_FLOWCTL:
2540 		/* Check outgoing MTU */
2541 		if (len > chan->omtu)
2542 			return -EMSGSIZE;
2543 
2544 		__skb_queue_head_init(&seg_queue);
2545 
2546 		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2547 
2548 		if (chan->state != BT_CONNECTED) {
2549 			__skb_queue_purge(&seg_queue);
2550 			err = -ENOTCONN;
2551 		}
2552 
2553 		if (err)
2554 			return err;
2555 
2556 		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2557 
2558 		l2cap_le_flowctl_send(chan);
2559 
2560 		if (!chan->tx_credits)
2561 			chan->ops->suspend(chan);
2562 
2563 		err = len;
2564 
2565 		break;
2566 
2567 	case L2CAP_MODE_BASIC:
2568 		/* Check outgoing MTU */
2569 		if (len > chan->omtu)
2570 			return -EMSGSIZE;
2571 
2572 		/* Create a basic PDU */
2573 		skb = l2cap_create_basic_pdu(chan, msg, len);
2574 		if (IS_ERR(skb))
2575 			return PTR_ERR(skb);
2576 
2577 		l2cap_do_send(chan, skb);
2578 		err = len;
2579 		break;
2580 
2581 	case L2CAP_MODE_ERTM:
2582 	case L2CAP_MODE_STREAMING:
2583 		/* Check outgoing MTU */
2584 		if (len > chan->omtu) {
2585 			err = -EMSGSIZE;
2586 			break;
2587 		}
2588 
2589 		__skb_queue_head_init(&seg_queue);
2590 
2591 		/* Do segmentation before calling in to the state machine,
2592 		 * since it's possible to block while waiting for memory
2593 		 * allocation.
2594 		 */
2595 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2596 
2597 		if (err)
2598 			break;
2599 
2600 		if (chan->mode == L2CAP_MODE_ERTM)
2601 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2602 		else
2603 			l2cap_streaming_send(chan, &seg_queue);
2604 
2605 		err = len;
2606 
2607 		/* If the skbs were not queued for sending, they'll still be in
2608 		 * seg_queue and need to be purged.
2609 		 */
2610 		__skb_queue_purge(&seg_queue);
2611 		break;
2612 
2613 	default:
2614 		BT_DBG("bad state %1.1x", chan->mode);
2615 		err = -EBADFD;
2616 	}
2617 
2618 	return err;
2619 }
2620 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2621 
l2cap_send_srej(struct l2cap_chan * chan,u16 txseq)2622 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2623 {
2624 	struct l2cap_ctrl control;
2625 	u16 seq;
2626 
2627 	BT_DBG("chan %p, txseq %u", chan, txseq);
2628 
2629 	memset(&control, 0, sizeof(control));
2630 	control.sframe = 1;
2631 	control.super = L2CAP_SUPER_SREJ;
2632 
2633 	for (seq = chan->expected_tx_seq; seq != txseq;
2634 	     seq = __next_seq(chan, seq)) {
2635 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2636 			control.reqseq = seq;
2637 			l2cap_send_sframe(chan, &control);
2638 			l2cap_seq_list_append(&chan->srej_list, seq);
2639 		}
2640 	}
2641 
2642 	chan->expected_tx_seq = __next_seq(chan, txseq);
2643 }
2644 
l2cap_send_srej_tail(struct l2cap_chan * chan)2645 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2646 {
2647 	struct l2cap_ctrl control;
2648 
2649 	BT_DBG("chan %p", chan);
2650 
2651 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2652 		return;
2653 
2654 	memset(&control, 0, sizeof(control));
2655 	control.sframe = 1;
2656 	control.super = L2CAP_SUPER_SREJ;
2657 	control.reqseq = chan->srej_list.tail;
2658 	l2cap_send_sframe(chan, &control);
2659 }
2660 
l2cap_send_srej_list(struct l2cap_chan * chan,u16 txseq)2661 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2662 {
2663 	struct l2cap_ctrl control;
2664 	u16 initial_head;
2665 	u16 seq;
2666 
2667 	BT_DBG("chan %p, txseq %u", chan, txseq);
2668 
2669 	memset(&control, 0, sizeof(control));
2670 	control.sframe = 1;
2671 	control.super = L2CAP_SUPER_SREJ;
2672 
2673 	/* Capture initial list head to allow only one pass through the list. */
2674 	initial_head = chan->srej_list.head;
2675 
2676 	do {
2677 		seq = l2cap_seq_list_pop(&chan->srej_list);
2678 		if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2679 			break;
2680 
2681 		control.reqseq = seq;
2682 		l2cap_send_sframe(chan, &control);
2683 		l2cap_seq_list_append(&chan->srej_list, seq);
2684 	} while (chan->srej_list.head != initial_head);
2685 }
2686 
l2cap_process_reqseq(struct l2cap_chan * chan,u16 reqseq)2687 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2688 {
2689 	struct sk_buff *acked_skb;
2690 	u16 ackseq;
2691 
2692 	BT_DBG("chan %p, reqseq %u", chan, reqseq);
2693 
2694 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2695 		return;
2696 
2697 	BT_DBG("expected_ack_seq %u, unacked_frames %u",
2698 	       chan->expected_ack_seq, chan->unacked_frames);
2699 
2700 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2701 	     ackseq = __next_seq(chan, ackseq)) {
2702 
2703 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2704 		if (acked_skb) {
2705 			skb_unlink(acked_skb, &chan->tx_q);
2706 			kfree_skb(acked_skb);
2707 			chan->unacked_frames--;
2708 		}
2709 	}
2710 
2711 	chan->expected_ack_seq = reqseq;
2712 
2713 	if (chan->unacked_frames == 0)
2714 		__clear_retrans_timer(chan);
2715 
2716 	BT_DBG("unacked_frames %u", chan->unacked_frames);
2717 }
2718 
l2cap_abort_rx_srej_sent(struct l2cap_chan * chan)2719 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2720 {
2721 	BT_DBG("chan %p", chan);
2722 
2723 	chan->expected_tx_seq = chan->buffer_seq;
2724 	l2cap_seq_list_clear(&chan->srej_list);
2725 	skb_queue_purge(&chan->srej_q);
2726 	chan->rx_state = L2CAP_RX_STATE_RECV;
2727 }
2728 
l2cap_tx_state_xmit(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2729 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2730 				struct l2cap_ctrl *control,
2731 				struct sk_buff_head *skbs, u8 event)
2732 {
2733 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2734 	       event);
2735 
2736 	switch (event) {
2737 	case L2CAP_EV_DATA_REQUEST:
2738 		if (chan->tx_send_head == NULL)
2739 			chan->tx_send_head = skb_peek(skbs);
2740 
2741 		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2742 		l2cap_ertm_send(chan);
2743 		break;
2744 	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2745 		BT_DBG("Enter LOCAL_BUSY");
2746 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2747 
2748 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2749 			/* The SREJ_SENT state must be aborted if we are to
2750 			 * enter the LOCAL_BUSY state.
2751 			 */
2752 			l2cap_abort_rx_srej_sent(chan);
2753 		}
2754 
2755 		l2cap_send_ack(chan);
2756 
2757 		break;
2758 	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2759 		BT_DBG("Exit LOCAL_BUSY");
2760 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2761 
2762 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2763 			struct l2cap_ctrl local_control;
2764 
2765 			memset(&local_control, 0, sizeof(local_control));
2766 			local_control.sframe = 1;
2767 			local_control.super = L2CAP_SUPER_RR;
2768 			local_control.poll = 1;
2769 			local_control.reqseq = chan->buffer_seq;
2770 			l2cap_send_sframe(chan, &local_control);
2771 
2772 			chan->retry_count = 1;
2773 			__set_monitor_timer(chan);
2774 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2775 		}
2776 		break;
2777 	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2778 		l2cap_process_reqseq(chan, control->reqseq);
2779 		break;
2780 	case L2CAP_EV_EXPLICIT_POLL:
2781 		l2cap_send_rr_or_rnr(chan, 1);
2782 		chan->retry_count = 1;
2783 		__set_monitor_timer(chan);
2784 		__clear_ack_timer(chan);
2785 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2786 		break;
2787 	case L2CAP_EV_RETRANS_TO:
2788 		l2cap_send_rr_or_rnr(chan, 1);
2789 		chan->retry_count = 1;
2790 		__set_monitor_timer(chan);
2791 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2792 		break;
2793 	case L2CAP_EV_RECV_FBIT:
2794 		/* Nothing to process */
2795 		break;
2796 	default:
2797 		break;
2798 	}
2799 }
2800 
l2cap_tx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2801 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2802 				  struct l2cap_ctrl *control,
2803 				  struct sk_buff_head *skbs, u8 event)
2804 {
2805 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2806 	       event);
2807 
2808 	switch (event) {
2809 	case L2CAP_EV_DATA_REQUEST:
2810 		if (chan->tx_send_head == NULL)
2811 			chan->tx_send_head = skb_peek(skbs);
2812 		/* Queue data, but don't send. */
2813 		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2814 		break;
2815 	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2816 		BT_DBG("Enter LOCAL_BUSY");
2817 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2818 
2819 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2820 			/* The SREJ_SENT state must be aborted if we are to
2821 			 * enter the LOCAL_BUSY state.
2822 			 */
2823 			l2cap_abort_rx_srej_sent(chan);
2824 		}
2825 
2826 		l2cap_send_ack(chan);
2827 
2828 		break;
2829 	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2830 		BT_DBG("Exit LOCAL_BUSY");
2831 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2832 
2833 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2834 			struct l2cap_ctrl local_control;
2835 			memset(&local_control, 0, sizeof(local_control));
2836 			local_control.sframe = 1;
2837 			local_control.super = L2CAP_SUPER_RR;
2838 			local_control.poll = 1;
2839 			local_control.reqseq = chan->buffer_seq;
2840 			l2cap_send_sframe(chan, &local_control);
2841 
2842 			chan->retry_count = 1;
2843 			__set_monitor_timer(chan);
2844 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2845 		}
2846 		break;
2847 	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2848 		l2cap_process_reqseq(chan, control->reqseq);
2849 		fallthrough;
2850 
2851 	case L2CAP_EV_RECV_FBIT:
2852 		if (control && control->final) {
2853 			__clear_monitor_timer(chan);
2854 			if (chan->unacked_frames > 0)
2855 				__set_retrans_timer(chan);
2856 			chan->retry_count = 0;
2857 			chan->tx_state = L2CAP_TX_STATE_XMIT;
2858 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2859 		}
2860 		break;
2861 	case L2CAP_EV_EXPLICIT_POLL:
2862 		/* Ignore */
2863 		break;
2864 	case L2CAP_EV_MONITOR_TO:
2865 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2866 			l2cap_send_rr_or_rnr(chan, 1);
2867 			__set_monitor_timer(chan);
2868 			chan->retry_count++;
2869 		} else {
2870 			l2cap_send_disconn_req(chan, ECONNABORTED);
2871 		}
2872 		break;
2873 	default:
2874 		break;
2875 	}
2876 }
2877 
l2cap_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2878 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2879 		     struct sk_buff_head *skbs, u8 event)
2880 {
2881 	BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2882 	       chan, control, skbs, event, chan->tx_state);
2883 
2884 	switch (chan->tx_state) {
2885 	case L2CAP_TX_STATE_XMIT:
2886 		l2cap_tx_state_xmit(chan, control, skbs, event);
2887 		break;
2888 	case L2CAP_TX_STATE_WAIT_F:
2889 		l2cap_tx_state_wait_f(chan, control, skbs, event);
2890 		break;
2891 	default:
2892 		/* Ignore event */
2893 		break;
2894 	}
2895 }
2896 
l2cap_pass_to_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control)2897 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2898 			     struct l2cap_ctrl *control)
2899 {
2900 	BT_DBG("chan %p, control %p", chan, control);
2901 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2902 }
2903 
l2cap_pass_to_tx_fbit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2904 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2905 				  struct l2cap_ctrl *control)
2906 {
2907 	BT_DBG("chan %p, control %p", chan, control);
2908 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2909 }
2910 
2911 /* Copy frame to all raw sockets on that connection */
l2cap_raw_recv(struct l2cap_conn * conn,struct sk_buff * skb)2912 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2913 {
2914 	struct sk_buff *nskb;
2915 	struct l2cap_chan *chan;
2916 
2917 	BT_DBG("conn %p", conn);
2918 
2919 	mutex_lock(&conn->chan_lock);
2920 
2921 	list_for_each_entry(chan, &conn->chan_l, list) {
2922 		if (chan->chan_type != L2CAP_CHAN_RAW)
2923 			continue;
2924 
2925 		/* Don't send frame to the channel it came from */
2926 		if (bt_cb(skb)->l2cap.chan == chan)
2927 			continue;
2928 
2929 		nskb = skb_clone(skb, GFP_KERNEL);
2930 		if (!nskb)
2931 			continue;
2932 		if (chan->ops->recv(chan, nskb))
2933 			kfree_skb(nskb);
2934 	}
2935 
2936 	mutex_unlock(&conn->chan_lock);
2937 }
2938 
2939 /* ---- L2CAP signalling commands ---- */
l2cap_build_cmd(struct l2cap_conn * conn,u8 code,u8 ident,u16 dlen,void * data)2940 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2941 				       u8 ident, u16 dlen, void *data)
2942 {
2943 	struct sk_buff *skb, **frag;
2944 	struct l2cap_cmd_hdr *cmd;
2945 	struct l2cap_hdr *lh;
2946 	int len, count;
2947 
2948 	BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2949 	       conn, code, ident, dlen);
2950 
2951 	if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2952 		return NULL;
2953 
2954 	len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2955 	count = min_t(unsigned int, conn->mtu, len);
2956 
2957 	skb = bt_skb_alloc(count, GFP_KERNEL);
2958 	if (!skb)
2959 		return NULL;
2960 
2961 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2962 	lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2963 
2964 	if (conn->hcon->type == LE_LINK)
2965 		lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2966 	else
2967 		lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2968 
2969 	cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
2970 	cmd->code  = code;
2971 	cmd->ident = ident;
2972 	cmd->len   = cpu_to_le16(dlen);
2973 
2974 	if (dlen) {
2975 		count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2976 		skb_put_data(skb, data, count);
2977 		data += count;
2978 	}
2979 
2980 	len -= skb->len;
2981 
2982 	/* Continuation fragments (no L2CAP header) */
2983 	frag = &skb_shinfo(skb)->frag_list;
2984 	while (len) {
2985 		count = min_t(unsigned int, conn->mtu, len);
2986 
2987 		*frag = bt_skb_alloc(count, GFP_KERNEL);
2988 		if (!*frag)
2989 			goto fail;
2990 
2991 		skb_put_data(*frag, data, count);
2992 
2993 		len  -= count;
2994 		data += count;
2995 
2996 		frag = &(*frag)->next;
2997 	}
2998 
2999 	return skb;
3000 
3001 fail:
3002 	kfree_skb(skb);
3003 	return NULL;
3004 }
3005 
l2cap_get_conf_opt(void ** ptr,int * type,int * olen,unsigned long * val)3006 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3007 				     unsigned long *val)
3008 {
3009 	struct l2cap_conf_opt *opt = *ptr;
3010 	int len;
3011 
3012 	len = L2CAP_CONF_OPT_SIZE + opt->len;
3013 	*ptr += len;
3014 
3015 	*type = opt->type;
3016 	*olen = opt->len;
3017 
3018 	switch (opt->len) {
3019 	case 1:
3020 		*val = *((u8 *) opt->val);
3021 		break;
3022 
3023 	case 2:
3024 		*val = get_unaligned_le16(opt->val);
3025 		break;
3026 
3027 	case 4:
3028 		*val = get_unaligned_le32(opt->val);
3029 		break;
3030 
3031 	default:
3032 		*val = (unsigned long) opt->val;
3033 		break;
3034 	}
3035 
3036 	BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3037 	return len;
3038 }
3039 
l2cap_add_conf_opt(void ** ptr,u8 type,u8 len,unsigned long val,size_t size)3040 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3041 {
3042 	struct l2cap_conf_opt *opt = *ptr;
3043 
3044 	BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3045 
3046 	if (size < L2CAP_CONF_OPT_SIZE + len)
3047 		return;
3048 
3049 	opt->type = type;
3050 	opt->len  = len;
3051 
3052 	switch (len) {
3053 	case 1:
3054 		*((u8 *) opt->val)  = val;
3055 		break;
3056 
3057 	case 2:
3058 		put_unaligned_le16(val, opt->val);
3059 		break;
3060 
3061 	case 4:
3062 		put_unaligned_le32(val, opt->val);
3063 		break;
3064 
3065 	default:
3066 		memcpy(opt->val, (void *) val, len);
3067 		break;
3068 	}
3069 
3070 	*ptr += L2CAP_CONF_OPT_SIZE + len;
3071 }
3072 
l2cap_add_opt_efs(void ** ptr,struct l2cap_chan * chan,size_t size)3073 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3074 {
3075 	struct l2cap_conf_efs efs;
3076 
3077 	switch (chan->mode) {
3078 	case L2CAP_MODE_ERTM:
3079 		efs.id		= chan->local_id;
3080 		efs.stype	= chan->local_stype;
3081 		efs.msdu	= cpu_to_le16(chan->local_msdu);
3082 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3083 		efs.acc_lat	= cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3084 		efs.flush_to	= cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3085 		break;
3086 
3087 	case L2CAP_MODE_STREAMING:
3088 		efs.id		= 1;
3089 		efs.stype	= L2CAP_SERV_BESTEFFORT;
3090 		efs.msdu	= cpu_to_le16(chan->local_msdu);
3091 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3092 		efs.acc_lat	= 0;
3093 		efs.flush_to	= 0;
3094 		break;
3095 
3096 	default:
3097 		return;
3098 	}
3099 
3100 	l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3101 			   (unsigned long) &efs, size);
3102 }
3103 
l2cap_ack_timeout(struct work_struct * work)3104 static void l2cap_ack_timeout(struct work_struct *work)
3105 {
3106 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3107 					       ack_timer.work);
3108 	u16 frames_to_ack;
3109 
3110 	BT_DBG("chan %p", chan);
3111 
3112 	l2cap_chan_lock(chan);
3113 
3114 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3115 				     chan->last_acked_seq);
3116 
3117 	if (frames_to_ack)
3118 		l2cap_send_rr_or_rnr(chan, 0);
3119 
3120 	l2cap_chan_unlock(chan);
3121 	l2cap_chan_put(chan);
3122 }
3123 
l2cap_ertm_init(struct l2cap_chan * chan)3124 int l2cap_ertm_init(struct l2cap_chan *chan)
3125 {
3126 	int err;
3127 
3128 	chan->next_tx_seq = 0;
3129 	chan->expected_tx_seq = 0;
3130 	chan->expected_ack_seq = 0;
3131 	chan->unacked_frames = 0;
3132 	chan->buffer_seq = 0;
3133 	chan->frames_sent = 0;
3134 	chan->last_acked_seq = 0;
3135 	chan->sdu = NULL;
3136 	chan->sdu_last_frag = NULL;
3137 	chan->sdu_len = 0;
3138 
3139 	skb_queue_head_init(&chan->tx_q);
3140 
3141 	if (chan->mode != L2CAP_MODE_ERTM)
3142 		return 0;
3143 
3144 	chan->rx_state = L2CAP_RX_STATE_RECV;
3145 	chan->tx_state = L2CAP_TX_STATE_XMIT;
3146 
3147 	skb_queue_head_init(&chan->srej_q);
3148 
3149 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3150 	if (err < 0)
3151 		return err;
3152 
3153 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3154 	if (err < 0)
3155 		l2cap_seq_list_free(&chan->srej_list);
3156 
3157 	return err;
3158 }
3159 
l2cap_select_mode(__u8 mode,__u16 remote_feat_mask)3160 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3161 {
3162 	switch (mode) {
3163 	case L2CAP_MODE_STREAMING:
3164 	case L2CAP_MODE_ERTM:
3165 		if (l2cap_mode_supported(mode, remote_feat_mask))
3166 			return mode;
3167 		fallthrough;
3168 	default:
3169 		return L2CAP_MODE_BASIC;
3170 	}
3171 }
3172 
__l2cap_ews_supported(struct l2cap_conn * conn)3173 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3174 {
3175 	return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
3176 }
3177 
__l2cap_efs_supported(struct l2cap_conn * conn)3178 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3179 {
3180 	return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
3181 }
3182 
__l2cap_set_ertm_timeouts(struct l2cap_chan * chan,struct l2cap_conf_rfc * rfc)3183 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3184 				      struct l2cap_conf_rfc *rfc)
3185 {
3186 	rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3187 	rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3188 }
3189 
l2cap_txwin_setup(struct l2cap_chan * chan)3190 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3191 {
3192 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3193 	    __l2cap_ews_supported(chan->conn)) {
3194 		/* use extended control field */
3195 		set_bit(FLAG_EXT_CTRL, &chan->flags);
3196 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3197 	} else {
3198 		chan->tx_win = min_t(u16, chan->tx_win,
3199 				     L2CAP_DEFAULT_TX_WINDOW);
3200 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3201 	}
3202 	chan->ack_win = chan->tx_win;
3203 }
3204 
l2cap_mtu_auto(struct l2cap_chan * chan)3205 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3206 {
3207 	struct hci_conn *conn = chan->conn->hcon;
3208 
3209 	chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3210 
3211 	/* The 2-DH1 packet has between 2 and 56 information bytes
3212 	 * (including the 2-byte payload header)
3213 	 */
3214 	if (!(conn->pkt_type & HCI_2DH1))
3215 		chan->imtu = 54;
3216 
3217 	/* The 3-DH1 packet has between 2 and 85 information bytes
3218 	 * (including the 2-byte payload header)
3219 	 */
3220 	if (!(conn->pkt_type & HCI_3DH1))
3221 		chan->imtu = 83;
3222 
3223 	/* The 2-DH3 packet has between 2 and 369 information bytes
3224 	 * (including the 2-byte payload header)
3225 	 */
3226 	if (!(conn->pkt_type & HCI_2DH3))
3227 		chan->imtu = 367;
3228 
3229 	/* The 3-DH3 packet has between 2 and 554 information bytes
3230 	 * (including the 2-byte payload header)
3231 	 */
3232 	if (!(conn->pkt_type & HCI_3DH3))
3233 		chan->imtu = 552;
3234 
3235 	/* The 2-DH5 packet has between 2 and 681 information bytes
3236 	 * (including the 2-byte payload header)
3237 	 */
3238 	if (!(conn->pkt_type & HCI_2DH5))
3239 		chan->imtu = 679;
3240 
3241 	/* The 3-DH5 packet has between 2 and 1023 information bytes
3242 	 * (including the 2-byte payload header)
3243 	 */
3244 	if (!(conn->pkt_type & HCI_3DH5))
3245 		chan->imtu = 1021;
3246 }
3247 
l2cap_build_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3248 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3249 {
3250 	struct l2cap_conf_req *req = data;
3251 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3252 	void *ptr = req->data;
3253 	void *endptr = data + data_size;
3254 	u16 size;
3255 
3256 	BT_DBG("chan %p", chan);
3257 
3258 	if (chan->num_conf_req || chan->num_conf_rsp)
3259 		goto done;
3260 
3261 	switch (chan->mode) {
3262 	case L2CAP_MODE_STREAMING:
3263 	case L2CAP_MODE_ERTM:
3264 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3265 			break;
3266 
3267 		if (__l2cap_efs_supported(chan->conn))
3268 			set_bit(FLAG_EFS_ENABLE, &chan->flags);
3269 
3270 		fallthrough;
3271 	default:
3272 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3273 		break;
3274 	}
3275 
3276 done:
3277 	if (chan->imtu != L2CAP_DEFAULT_MTU) {
3278 		if (!chan->imtu)
3279 			l2cap_mtu_auto(chan);
3280 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3281 				   endptr - ptr);
3282 	}
3283 
3284 	switch (chan->mode) {
3285 	case L2CAP_MODE_BASIC:
3286 		if (disable_ertm)
3287 			break;
3288 
3289 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3290 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3291 			break;
3292 
3293 		rfc.mode            = L2CAP_MODE_BASIC;
3294 		rfc.txwin_size      = 0;
3295 		rfc.max_transmit    = 0;
3296 		rfc.retrans_timeout = 0;
3297 		rfc.monitor_timeout = 0;
3298 		rfc.max_pdu_size    = 0;
3299 
3300 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3301 				   (unsigned long) &rfc, endptr - ptr);
3302 		break;
3303 
3304 	case L2CAP_MODE_ERTM:
3305 		rfc.mode            = L2CAP_MODE_ERTM;
3306 		rfc.max_transmit    = chan->max_tx;
3307 
3308 		__l2cap_set_ertm_timeouts(chan, &rfc);
3309 
3310 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3311 			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3312 			     L2CAP_FCS_SIZE);
3313 		rfc.max_pdu_size = cpu_to_le16(size);
3314 
3315 		l2cap_txwin_setup(chan);
3316 
3317 		rfc.txwin_size = min_t(u16, chan->tx_win,
3318 				       L2CAP_DEFAULT_TX_WINDOW);
3319 
3320 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3321 				   (unsigned long) &rfc, endptr - ptr);
3322 
3323 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3324 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3325 
3326 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3327 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3328 					   chan->tx_win, endptr - ptr);
3329 
3330 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3331 			if (chan->fcs == L2CAP_FCS_NONE ||
3332 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3333 				chan->fcs = L2CAP_FCS_NONE;
3334 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3335 						   chan->fcs, endptr - ptr);
3336 			}
3337 		break;
3338 
3339 	case L2CAP_MODE_STREAMING:
3340 		l2cap_txwin_setup(chan);
3341 		rfc.mode            = L2CAP_MODE_STREAMING;
3342 		rfc.txwin_size      = 0;
3343 		rfc.max_transmit    = 0;
3344 		rfc.retrans_timeout = 0;
3345 		rfc.monitor_timeout = 0;
3346 
3347 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3348 			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3349 			     L2CAP_FCS_SIZE);
3350 		rfc.max_pdu_size = cpu_to_le16(size);
3351 
3352 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3353 				   (unsigned long) &rfc, endptr - ptr);
3354 
3355 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3356 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3357 
3358 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3359 			if (chan->fcs == L2CAP_FCS_NONE ||
3360 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3361 				chan->fcs = L2CAP_FCS_NONE;
3362 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3363 						   chan->fcs, endptr - ptr);
3364 			}
3365 		break;
3366 	}
3367 
3368 	req->dcid  = cpu_to_le16(chan->dcid);
3369 	req->flags = cpu_to_le16(0);
3370 
3371 	return ptr - data;
3372 }
3373 
l2cap_parse_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3374 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3375 {
3376 	struct l2cap_conf_rsp *rsp = data;
3377 	void *ptr = rsp->data;
3378 	void *endptr = data + data_size;
3379 	void *req = chan->conf_req;
3380 	int len = chan->conf_len;
3381 	int type, hint, olen;
3382 	unsigned long val;
3383 	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3384 	struct l2cap_conf_efs efs;
3385 	u8 remote_efs = 0;
3386 	u16 mtu = L2CAP_DEFAULT_MTU;
3387 	u16 result = L2CAP_CONF_SUCCESS;
3388 	u16 size;
3389 
3390 	BT_DBG("chan %p", chan);
3391 
3392 	while (len >= L2CAP_CONF_OPT_SIZE) {
3393 		len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3394 		if (len < 0)
3395 			break;
3396 
3397 		hint  = type & L2CAP_CONF_HINT;
3398 		type &= L2CAP_CONF_MASK;
3399 
3400 		switch (type) {
3401 		case L2CAP_CONF_MTU:
3402 			if (olen != 2)
3403 				break;
3404 			mtu = val;
3405 			break;
3406 
3407 		case L2CAP_CONF_FLUSH_TO:
3408 			if (olen != 2)
3409 				break;
3410 			chan->flush_to = val;
3411 			break;
3412 
3413 		case L2CAP_CONF_QOS:
3414 			break;
3415 
3416 		case L2CAP_CONF_RFC:
3417 			if (olen != sizeof(rfc))
3418 				break;
3419 			memcpy(&rfc, (void *) val, olen);
3420 			break;
3421 
3422 		case L2CAP_CONF_FCS:
3423 			if (olen != 1)
3424 				break;
3425 			if (val == L2CAP_FCS_NONE)
3426 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3427 			break;
3428 
3429 		case L2CAP_CONF_EFS:
3430 			if (olen != sizeof(efs))
3431 				break;
3432 			remote_efs = 1;
3433 			memcpy(&efs, (void *) val, olen);
3434 			break;
3435 
3436 		case L2CAP_CONF_EWS:
3437 			if (olen != 2)
3438 				break;
3439 			return -ECONNREFUSED;
3440 
3441 		default:
3442 			if (hint)
3443 				break;
3444 			result = L2CAP_CONF_UNKNOWN;
3445 			l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3446 			break;
3447 		}
3448 	}
3449 
3450 	if (chan->num_conf_rsp || chan->num_conf_req > 1)
3451 		goto done;
3452 
3453 	switch (chan->mode) {
3454 	case L2CAP_MODE_STREAMING:
3455 	case L2CAP_MODE_ERTM:
3456 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3457 			chan->mode = l2cap_select_mode(rfc.mode,
3458 						       chan->conn->feat_mask);
3459 			break;
3460 		}
3461 
3462 		if (remote_efs) {
3463 			if (__l2cap_efs_supported(chan->conn))
3464 				set_bit(FLAG_EFS_ENABLE, &chan->flags);
3465 			else
3466 				return -ECONNREFUSED;
3467 		}
3468 
3469 		if (chan->mode != rfc.mode)
3470 			return -ECONNREFUSED;
3471 
3472 		break;
3473 	}
3474 
3475 done:
3476 	if (chan->mode != rfc.mode) {
3477 		result = L2CAP_CONF_UNACCEPT;
3478 		rfc.mode = chan->mode;
3479 
3480 		if (chan->num_conf_rsp == 1)
3481 			return -ECONNREFUSED;
3482 
3483 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3484 				   (unsigned long) &rfc, endptr - ptr);
3485 	}
3486 
3487 	if (result == L2CAP_CONF_SUCCESS) {
3488 		/* Configure output options and let the other side know
3489 		 * which ones we don't like. */
3490 
3491 		if (mtu < L2CAP_DEFAULT_MIN_MTU)
3492 			result = L2CAP_CONF_UNACCEPT;
3493 		else {
3494 			chan->omtu = mtu;
3495 			set_bit(CONF_MTU_DONE, &chan->conf_state);
3496 		}
3497 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3498 
3499 		if (remote_efs) {
3500 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3501 			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3502 			    efs.stype != chan->local_stype) {
3503 
3504 				result = L2CAP_CONF_UNACCEPT;
3505 
3506 				if (chan->num_conf_req >= 1)
3507 					return -ECONNREFUSED;
3508 
3509 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3510 						   sizeof(efs),
3511 						   (unsigned long) &efs, endptr - ptr);
3512 			} else {
3513 				/* Send PENDING Conf Rsp */
3514 				result = L2CAP_CONF_PENDING;
3515 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3516 			}
3517 		}
3518 
3519 		switch (rfc.mode) {
3520 		case L2CAP_MODE_BASIC:
3521 			chan->fcs = L2CAP_FCS_NONE;
3522 			set_bit(CONF_MODE_DONE, &chan->conf_state);
3523 			break;
3524 
3525 		case L2CAP_MODE_ERTM:
3526 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3527 				chan->remote_tx_win = rfc.txwin_size;
3528 			else
3529 				rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3530 
3531 			chan->remote_max_tx = rfc.max_transmit;
3532 
3533 			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3534 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3535 				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3536 			rfc.max_pdu_size = cpu_to_le16(size);
3537 			chan->remote_mps = size;
3538 
3539 			__l2cap_set_ertm_timeouts(chan, &rfc);
3540 
3541 			set_bit(CONF_MODE_DONE, &chan->conf_state);
3542 
3543 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3544 					   sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3545 
3546 			if (remote_efs &&
3547 			    test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3548 				chan->remote_id = efs.id;
3549 				chan->remote_stype = efs.stype;
3550 				chan->remote_msdu = le16_to_cpu(efs.msdu);
3551 				chan->remote_flush_to =
3552 					le32_to_cpu(efs.flush_to);
3553 				chan->remote_acc_lat =
3554 					le32_to_cpu(efs.acc_lat);
3555 				chan->remote_sdu_itime =
3556 					le32_to_cpu(efs.sdu_itime);
3557 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3558 						   sizeof(efs),
3559 						   (unsigned long) &efs, endptr - ptr);
3560 			}
3561 			break;
3562 
3563 		case L2CAP_MODE_STREAMING:
3564 			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3565 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3566 				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3567 			rfc.max_pdu_size = cpu_to_le16(size);
3568 			chan->remote_mps = size;
3569 
3570 			set_bit(CONF_MODE_DONE, &chan->conf_state);
3571 
3572 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3573 					   (unsigned long) &rfc, endptr - ptr);
3574 
3575 			break;
3576 
3577 		default:
3578 			result = L2CAP_CONF_UNACCEPT;
3579 
3580 			memset(&rfc, 0, sizeof(rfc));
3581 			rfc.mode = chan->mode;
3582 		}
3583 
3584 		if (result == L2CAP_CONF_SUCCESS)
3585 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3586 	}
3587 	rsp->scid   = cpu_to_le16(chan->dcid);
3588 	rsp->result = cpu_to_le16(result);
3589 	rsp->flags  = cpu_to_le16(0);
3590 
3591 	return ptr - data;
3592 }
3593 
l2cap_parse_conf_rsp(struct l2cap_chan * chan,void * rsp,int len,void * data,size_t size,u16 * result)3594 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3595 				void *data, size_t size, u16 *result)
3596 {
3597 	struct l2cap_conf_req *req = data;
3598 	void *ptr = req->data;
3599 	void *endptr = data + size;
3600 	int type, olen;
3601 	unsigned long val;
3602 	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3603 	struct l2cap_conf_efs efs;
3604 
3605 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3606 
3607 	while (len >= L2CAP_CONF_OPT_SIZE) {
3608 		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3609 		if (len < 0)
3610 			break;
3611 
3612 		switch (type) {
3613 		case L2CAP_CONF_MTU:
3614 			if (olen != 2)
3615 				break;
3616 			if (val < L2CAP_DEFAULT_MIN_MTU) {
3617 				*result = L2CAP_CONF_UNACCEPT;
3618 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3619 			} else
3620 				chan->imtu = val;
3621 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3622 					   endptr - ptr);
3623 			break;
3624 
3625 		case L2CAP_CONF_FLUSH_TO:
3626 			if (olen != 2)
3627 				break;
3628 			chan->flush_to = val;
3629 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3630 					   chan->flush_to, endptr - ptr);
3631 			break;
3632 
3633 		case L2CAP_CONF_RFC:
3634 			if (olen != sizeof(rfc))
3635 				break;
3636 			memcpy(&rfc, (void *)val, olen);
3637 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3638 			    rfc.mode != chan->mode)
3639 				return -ECONNREFUSED;
3640 			chan->fcs = 0;
3641 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3642 					   (unsigned long) &rfc, endptr - ptr);
3643 			break;
3644 
3645 		case L2CAP_CONF_EWS:
3646 			if (olen != 2)
3647 				break;
3648 			chan->ack_win = min_t(u16, val, chan->ack_win);
3649 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3650 					   chan->tx_win, endptr - ptr);
3651 			break;
3652 
3653 		case L2CAP_CONF_EFS:
3654 			if (olen != sizeof(efs))
3655 				break;
3656 			memcpy(&efs, (void *)val, olen);
3657 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3658 			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3659 			    efs.stype != chan->local_stype)
3660 				return -ECONNREFUSED;
3661 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3662 					   (unsigned long) &efs, endptr - ptr);
3663 			break;
3664 
3665 		case L2CAP_CONF_FCS:
3666 			if (olen != 1)
3667 				break;
3668 			if (*result == L2CAP_CONF_PENDING)
3669 				if (val == L2CAP_FCS_NONE)
3670 					set_bit(CONF_RECV_NO_FCS,
3671 						&chan->conf_state);
3672 			break;
3673 		}
3674 	}
3675 
3676 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3677 		return -ECONNREFUSED;
3678 
3679 	chan->mode = rfc.mode;
3680 
3681 	if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3682 		switch (rfc.mode) {
3683 		case L2CAP_MODE_ERTM:
3684 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3685 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3686 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3687 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3688 				chan->ack_win = min_t(u16, chan->ack_win,
3689 						      rfc.txwin_size);
3690 
3691 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3692 				chan->local_msdu = le16_to_cpu(efs.msdu);
3693 				chan->local_sdu_itime =
3694 					le32_to_cpu(efs.sdu_itime);
3695 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3696 				chan->local_flush_to =
3697 					le32_to_cpu(efs.flush_to);
3698 			}
3699 			break;
3700 
3701 		case L2CAP_MODE_STREAMING:
3702 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3703 		}
3704 	}
3705 
3706 	req->dcid   = cpu_to_le16(chan->dcid);
3707 	req->flags  = cpu_to_le16(0);
3708 
3709 	return ptr - data;
3710 }
3711 
l2cap_build_conf_rsp(struct l2cap_chan * chan,void * data,u16 result,u16 flags)3712 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3713 				u16 result, u16 flags)
3714 {
3715 	struct l2cap_conf_rsp *rsp = data;
3716 	void *ptr = rsp->data;
3717 
3718 	BT_DBG("chan %p", chan);
3719 
3720 	rsp->scid   = cpu_to_le16(chan->dcid);
3721 	rsp->result = cpu_to_le16(result);
3722 	rsp->flags  = cpu_to_le16(flags);
3723 
3724 	return ptr - data;
3725 }
3726 
__l2cap_le_connect_rsp_defer(struct l2cap_chan * chan)3727 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3728 {
3729 	struct l2cap_le_conn_rsp rsp;
3730 	struct l2cap_conn *conn = chan->conn;
3731 
3732 	BT_DBG("chan %p", chan);
3733 
3734 	rsp.dcid    = cpu_to_le16(chan->scid);
3735 	rsp.mtu     = cpu_to_le16(chan->imtu);
3736 	rsp.mps     = cpu_to_le16(chan->mps);
3737 	rsp.credits = cpu_to_le16(chan->rx_credits);
3738 	rsp.result  = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3739 
3740 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3741 		       &rsp);
3742 }
3743 
l2cap_ecred_list_defer(struct l2cap_chan * chan,void * data)3744 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
3745 {
3746 	int *result = data;
3747 
3748 	if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3749 		return;
3750 
3751 	switch (chan->state) {
3752 	case BT_CONNECT2:
3753 		/* If channel still pending accept add to result */
3754 		(*result)++;
3755 		return;
3756 	case BT_CONNECTED:
3757 		return;
3758 	default:
3759 		/* If not connected or pending accept it has been refused */
3760 		*result = -ECONNREFUSED;
3761 		return;
3762 	}
3763 }
3764 
3765 struct l2cap_ecred_rsp_data {
3766 	struct {
3767 		struct l2cap_ecred_conn_rsp rsp;
3768 		__le16 scid[L2CAP_ECRED_MAX_CID];
3769 	} __packed pdu;
3770 	int count;
3771 };
3772 
l2cap_ecred_rsp_defer(struct l2cap_chan * chan,void * data)3773 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
3774 {
3775 	struct l2cap_ecred_rsp_data *rsp = data;
3776 
3777 	if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3778 		return;
3779 
3780 	/* Reset ident so only one response is sent */
3781 	chan->ident = 0;
3782 
3783 	/* Include all channels pending with the same ident */
3784 	if (!rsp->pdu.rsp.result)
3785 		rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
3786 	else
3787 		l2cap_chan_del(chan, ECONNRESET);
3788 }
3789 
__l2cap_ecred_conn_rsp_defer(struct l2cap_chan * chan)3790 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3791 {
3792 	struct l2cap_conn *conn = chan->conn;
3793 	struct l2cap_ecred_rsp_data data;
3794 	u16 id = chan->ident;
3795 	int result = 0;
3796 
3797 	if (!id)
3798 		return;
3799 
3800 	BT_DBG("chan %p id %d", chan, id);
3801 
3802 	memset(&data, 0, sizeof(data));
3803 
3804 	data.pdu.rsp.mtu     = cpu_to_le16(chan->imtu);
3805 	data.pdu.rsp.mps     = cpu_to_le16(chan->mps);
3806 	data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3807 	data.pdu.rsp.result  = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3808 
3809 	/* Verify that all channels are ready */
3810 	__l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
3811 
3812 	if (result > 0)
3813 		return;
3814 
3815 	if (result < 0)
3816 		data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
3817 
3818 	/* Build response */
3819 	__l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
3820 
3821 	l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
3822 		       sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
3823 		       &data.pdu);
3824 }
3825 
__l2cap_connect_rsp_defer(struct l2cap_chan * chan)3826 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3827 {
3828 	struct l2cap_conn_rsp rsp;
3829 	struct l2cap_conn *conn = chan->conn;
3830 	u8 buf[128];
3831 	u8 rsp_code;
3832 
3833 	rsp.scid   = cpu_to_le16(chan->dcid);
3834 	rsp.dcid   = cpu_to_le16(chan->scid);
3835 	rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3836 	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3837 	rsp_code = L2CAP_CONN_RSP;
3838 
3839 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3840 
3841 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3842 
3843 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3844 		return;
3845 
3846 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3847 		       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
3848 	chan->num_conf_req++;
3849 }
3850 
l2cap_conf_rfc_get(struct l2cap_chan * chan,void * rsp,int len)3851 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3852 {
3853 	int type, olen;
3854 	unsigned long val;
3855 	/* Use sane default values in case a misbehaving remote device
3856 	 * did not send an RFC or extended window size option.
3857 	 */
3858 	u16 txwin_ext = chan->ack_win;
3859 	struct l2cap_conf_rfc rfc = {
3860 		.mode = chan->mode,
3861 		.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3862 		.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3863 		.max_pdu_size = cpu_to_le16(chan->imtu),
3864 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3865 	};
3866 
3867 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3868 
3869 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3870 		return;
3871 
3872 	while (len >= L2CAP_CONF_OPT_SIZE) {
3873 		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3874 		if (len < 0)
3875 			break;
3876 
3877 		switch (type) {
3878 		case L2CAP_CONF_RFC:
3879 			if (olen != sizeof(rfc))
3880 				break;
3881 			memcpy(&rfc, (void *)val, olen);
3882 			break;
3883 		case L2CAP_CONF_EWS:
3884 			if (olen != 2)
3885 				break;
3886 			txwin_ext = val;
3887 			break;
3888 		}
3889 	}
3890 
3891 	switch (rfc.mode) {
3892 	case L2CAP_MODE_ERTM:
3893 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3894 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3895 		chan->mps = le16_to_cpu(rfc.max_pdu_size);
3896 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3897 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3898 		else
3899 			chan->ack_win = min_t(u16, chan->ack_win,
3900 					      rfc.txwin_size);
3901 		break;
3902 	case L2CAP_MODE_STREAMING:
3903 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3904 	}
3905 }
3906 
l2cap_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)3907 static inline int l2cap_command_rej(struct l2cap_conn *conn,
3908 				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3909 				    u8 *data)
3910 {
3911 	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3912 
3913 	if (cmd_len < sizeof(*rej))
3914 		return -EPROTO;
3915 
3916 	if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3917 		return 0;
3918 
3919 	if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3920 	    cmd->ident == conn->info_ident) {
3921 		cancel_delayed_work(&conn->info_timer);
3922 
3923 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3924 		conn->info_ident = 0;
3925 
3926 		l2cap_conn_start(conn);
3927 	}
3928 
3929 	return 0;
3930 }
3931 
l2cap_connect(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u8 * data,u8 rsp_code)3932 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
3933 			  u8 *data, u8 rsp_code)
3934 {
3935 	struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3936 	struct l2cap_conn_rsp rsp;
3937 	struct l2cap_chan *chan = NULL, *pchan = NULL;
3938 	int result, status = L2CAP_CS_NO_INFO;
3939 
3940 	u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3941 	__le16 psm = req->psm;
3942 
3943 	BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3944 
3945 	/* Check if we have socket listening on psm */
3946 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
3947 					 &conn->hcon->dst, ACL_LINK);
3948 	if (!pchan) {
3949 		result = L2CAP_CR_BAD_PSM;
3950 		goto response;
3951 	}
3952 
3953 	mutex_lock(&conn->chan_lock);
3954 	l2cap_chan_lock(pchan);
3955 
3956 	/* Check if the ACL is secure enough (if not SDP) */
3957 	if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3958 	    !hci_conn_check_link_mode(conn->hcon)) {
3959 		conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3960 		result = L2CAP_CR_SEC_BLOCK;
3961 		goto response;
3962 	}
3963 
3964 	result = L2CAP_CR_NO_MEM;
3965 
3966 	/* Check for valid dynamic CID range (as per Erratum 3253) */
3967 	if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
3968 		result = L2CAP_CR_INVALID_SCID;
3969 		goto response;
3970 	}
3971 
3972 	/* Check if we already have channel with that dcid */
3973 	if (__l2cap_get_chan_by_dcid(conn, scid)) {
3974 		result = L2CAP_CR_SCID_IN_USE;
3975 		goto response;
3976 	}
3977 
3978 	chan = pchan->ops->new_connection(pchan);
3979 	if (!chan)
3980 		goto response;
3981 
3982 	/* For certain devices (ex: HID mouse), support for authentication,
3983 	 * pairing and bonding is optional. For such devices, inorder to avoid
3984 	 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3985 	 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3986 	 */
3987 	conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3988 
3989 	bacpy(&chan->src, &conn->hcon->src);
3990 	bacpy(&chan->dst, &conn->hcon->dst);
3991 	chan->src_type = bdaddr_src_type(conn->hcon);
3992 	chan->dst_type = bdaddr_dst_type(conn->hcon);
3993 	chan->psm  = psm;
3994 	chan->dcid = scid;
3995 
3996 	__l2cap_chan_add(conn, chan);
3997 
3998 	dcid = chan->scid;
3999 
4000 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4001 
4002 	chan->ident = cmd->ident;
4003 
4004 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4005 		if (l2cap_chan_check_security(chan, false)) {
4006 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4007 				l2cap_state_change(chan, BT_CONNECT2);
4008 				result = L2CAP_CR_PEND;
4009 				status = L2CAP_CS_AUTHOR_PEND;
4010 				chan->ops->defer(chan);
4011 			} else {
4012 				l2cap_state_change(chan, BT_CONFIG);
4013 				result = L2CAP_CR_SUCCESS;
4014 				status = L2CAP_CS_NO_INFO;
4015 			}
4016 		} else {
4017 			l2cap_state_change(chan, BT_CONNECT2);
4018 			result = L2CAP_CR_PEND;
4019 			status = L2CAP_CS_AUTHEN_PEND;
4020 		}
4021 	} else {
4022 		l2cap_state_change(chan, BT_CONNECT2);
4023 		result = L2CAP_CR_PEND;
4024 		status = L2CAP_CS_NO_INFO;
4025 	}
4026 
4027 response:
4028 	rsp.scid   = cpu_to_le16(scid);
4029 	rsp.dcid   = cpu_to_le16(dcid);
4030 	rsp.result = cpu_to_le16(result);
4031 	rsp.status = cpu_to_le16(status);
4032 	l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4033 
4034 	if (!pchan)
4035 		return;
4036 
4037 	if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4038 		struct l2cap_info_req info;
4039 		info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4040 
4041 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4042 		conn->info_ident = l2cap_get_ident(conn);
4043 
4044 		schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4045 
4046 		l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4047 			       sizeof(info), &info);
4048 	}
4049 
4050 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4051 	    result == L2CAP_CR_SUCCESS) {
4052 		u8 buf[128];
4053 		set_bit(CONF_REQ_SENT, &chan->conf_state);
4054 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4055 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4056 		chan->num_conf_req++;
4057 	}
4058 
4059 	l2cap_chan_unlock(pchan);
4060 	mutex_unlock(&conn->chan_lock);
4061 	l2cap_chan_put(pchan);
4062 }
4063 
l2cap_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4064 static int l2cap_connect_req(struct l2cap_conn *conn,
4065 			     struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4066 {
4067 	if (cmd_len < sizeof(struct l2cap_conn_req))
4068 		return -EPROTO;
4069 
4070 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
4071 	return 0;
4072 }
4073 
l2cap_connect_create_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4074 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4075 				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4076 				    u8 *data)
4077 {
4078 	struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4079 	u16 scid, dcid, result, status;
4080 	struct l2cap_chan *chan;
4081 	u8 req[128];
4082 	int err;
4083 
4084 	if (cmd_len < sizeof(*rsp))
4085 		return -EPROTO;
4086 
4087 	scid   = __le16_to_cpu(rsp->scid);
4088 	dcid   = __le16_to_cpu(rsp->dcid);
4089 	result = __le16_to_cpu(rsp->result);
4090 	status = __le16_to_cpu(rsp->status);
4091 
4092 	if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
4093 					   dcid > L2CAP_CID_DYN_END))
4094 		return -EPROTO;
4095 
4096 	BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4097 	       dcid, scid, result, status);
4098 
4099 	mutex_lock(&conn->chan_lock);
4100 
4101 	if (scid) {
4102 		chan = __l2cap_get_chan_by_scid(conn, scid);
4103 		if (!chan) {
4104 			err = -EBADSLT;
4105 			goto unlock;
4106 		}
4107 	} else {
4108 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4109 		if (!chan) {
4110 			err = -EBADSLT;
4111 			goto unlock;
4112 		}
4113 	}
4114 
4115 	chan = l2cap_chan_hold_unless_zero(chan);
4116 	if (!chan) {
4117 		err = -EBADSLT;
4118 		goto unlock;
4119 	}
4120 
4121 	err = 0;
4122 
4123 	l2cap_chan_lock(chan);
4124 
4125 	switch (result) {
4126 	case L2CAP_CR_SUCCESS:
4127 		if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4128 			err = -EBADSLT;
4129 			break;
4130 		}
4131 
4132 		l2cap_state_change(chan, BT_CONFIG);
4133 		chan->ident = 0;
4134 		chan->dcid = dcid;
4135 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4136 
4137 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4138 			break;
4139 
4140 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4141 			       l2cap_build_conf_req(chan, req, sizeof(req)), req);
4142 		chan->num_conf_req++;
4143 		break;
4144 
4145 	case L2CAP_CR_PEND:
4146 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4147 		break;
4148 
4149 	default:
4150 		l2cap_chan_del(chan, ECONNREFUSED);
4151 		break;
4152 	}
4153 
4154 	l2cap_chan_unlock(chan);
4155 	l2cap_chan_put(chan);
4156 
4157 unlock:
4158 	mutex_unlock(&conn->chan_lock);
4159 
4160 	return err;
4161 }
4162 
set_default_fcs(struct l2cap_chan * chan)4163 static inline void set_default_fcs(struct l2cap_chan *chan)
4164 {
4165 	/* FCS is enabled only in ERTM or streaming mode, if one or both
4166 	 * sides request it.
4167 	 */
4168 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4169 		chan->fcs = L2CAP_FCS_NONE;
4170 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4171 		chan->fcs = L2CAP_FCS_CRC16;
4172 }
4173 
l2cap_send_efs_conf_rsp(struct l2cap_chan * chan,void * data,u8 ident,u16 flags)4174 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4175 				    u8 ident, u16 flags)
4176 {
4177 	struct l2cap_conn *conn = chan->conn;
4178 
4179 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4180 	       flags);
4181 
4182 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4183 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4184 
4185 	l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4186 		       l2cap_build_conf_rsp(chan, data,
4187 					    L2CAP_CONF_SUCCESS, flags), data);
4188 }
4189 
cmd_reject_invalid_cid(struct l2cap_conn * conn,u8 ident,u16 scid,u16 dcid)4190 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4191 				   u16 scid, u16 dcid)
4192 {
4193 	struct l2cap_cmd_rej_cid rej;
4194 
4195 	rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4196 	rej.scid = __cpu_to_le16(scid);
4197 	rej.dcid = __cpu_to_le16(dcid);
4198 
4199 	l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4200 }
4201 
l2cap_config_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4202 static inline int l2cap_config_req(struct l2cap_conn *conn,
4203 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4204 				   u8 *data)
4205 {
4206 	struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4207 	u16 dcid, flags;
4208 	u8 rsp[64];
4209 	struct l2cap_chan *chan;
4210 	int len, err = 0;
4211 
4212 	if (cmd_len < sizeof(*req))
4213 		return -EPROTO;
4214 
4215 	dcid  = __le16_to_cpu(req->dcid);
4216 	flags = __le16_to_cpu(req->flags);
4217 
4218 	BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4219 
4220 	chan = l2cap_get_chan_by_scid(conn, dcid);
4221 	if (!chan) {
4222 		cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4223 		return 0;
4224 	}
4225 
4226 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4227 	    chan->state != BT_CONNECTED) {
4228 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4229 				       chan->dcid);
4230 		goto unlock;
4231 	}
4232 
4233 	/* Reject if config buffer is too small. */
4234 	len = cmd_len - sizeof(*req);
4235 	if (chan->conf_len + len > sizeof(chan->conf_req)) {
4236 		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4237 			       l2cap_build_conf_rsp(chan, rsp,
4238 			       L2CAP_CONF_REJECT, flags), rsp);
4239 		goto unlock;
4240 	}
4241 
4242 	/* Store config. */
4243 	memcpy(chan->conf_req + chan->conf_len, req->data, len);
4244 	chan->conf_len += len;
4245 
4246 	if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4247 		/* Incomplete config. Send empty response. */
4248 		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4249 			       l2cap_build_conf_rsp(chan, rsp,
4250 			       L2CAP_CONF_SUCCESS, flags), rsp);
4251 		goto unlock;
4252 	}
4253 
4254 	/* Complete config. */
4255 	len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4256 	if (len < 0) {
4257 		l2cap_send_disconn_req(chan, ECONNRESET);
4258 		goto unlock;
4259 	}
4260 
4261 	chan->ident = cmd->ident;
4262 	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4263 	if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4264 		chan->num_conf_rsp++;
4265 
4266 	/* Reset config buffer. */
4267 	chan->conf_len = 0;
4268 
4269 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4270 		goto unlock;
4271 
4272 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4273 		set_default_fcs(chan);
4274 
4275 		if (chan->mode == L2CAP_MODE_ERTM ||
4276 		    chan->mode == L2CAP_MODE_STREAMING)
4277 			err = l2cap_ertm_init(chan);
4278 
4279 		if (err < 0)
4280 			l2cap_send_disconn_req(chan, -err);
4281 		else
4282 			l2cap_chan_ready(chan);
4283 
4284 		goto unlock;
4285 	}
4286 
4287 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4288 		u8 buf[64];
4289 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4290 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4291 		chan->num_conf_req++;
4292 	}
4293 
4294 	/* Got Conf Rsp PENDING from remote side and assume we sent
4295 	   Conf Rsp PENDING in the code above */
4296 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4297 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4298 
4299 		/* check compatibility */
4300 
4301 		/* Send rsp for BR/EDR channel */
4302 		l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4303 	}
4304 
4305 unlock:
4306 	l2cap_chan_unlock(chan);
4307 	l2cap_chan_put(chan);
4308 	return err;
4309 }
4310 
l2cap_config_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4311 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4312 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4313 				   u8 *data)
4314 {
4315 	struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4316 	u16 scid, flags, result;
4317 	struct l2cap_chan *chan;
4318 	int len = cmd_len - sizeof(*rsp);
4319 	int err = 0;
4320 
4321 	if (cmd_len < sizeof(*rsp))
4322 		return -EPROTO;
4323 
4324 	scid   = __le16_to_cpu(rsp->scid);
4325 	flags  = __le16_to_cpu(rsp->flags);
4326 	result = __le16_to_cpu(rsp->result);
4327 
4328 	BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4329 	       result, len);
4330 
4331 	chan = l2cap_get_chan_by_scid(conn, scid);
4332 	if (!chan)
4333 		return 0;
4334 
4335 	switch (result) {
4336 	case L2CAP_CONF_SUCCESS:
4337 		l2cap_conf_rfc_get(chan, rsp->data, len);
4338 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4339 		break;
4340 
4341 	case L2CAP_CONF_PENDING:
4342 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4343 
4344 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4345 			char buf[64];
4346 
4347 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4348 						   buf, sizeof(buf), &result);
4349 			if (len < 0) {
4350 				l2cap_send_disconn_req(chan, ECONNRESET);
4351 				goto done;
4352 			}
4353 
4354 			l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
4355 		}
4356 		goto done;
4357 
4358 	case L2CAP_CONF_UNKNOWN:
4359 	case L2CAP_CONF_UNACCEPT:
4360 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4361 			char req[64];
4362 
4363 			if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4364 				l2cap_send_disconn_req(chan, ECONNRESET);
4365 				goto done;
4366 			}
4367 
4368 			/* throw out any old stored conf requests */
4369 			result = L2CAP_CONF_SUCCESS;
4370 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4371 						   req, sizeof(req), &result);
4372 			if (len < 0) {
4373 				l2cap_send_disconn_req(chan, ECONNRESET);
4374 				goto done;
4375 			}
4376 
4377 			l2cap_send_cmd(conn, l2cap_get_ident(conn),
4378 				       L2CAP_CONF_REQ, len, req);
4379 			chan->num_conf_req++;
4380 			if (result != L2CAP_CONF_SUCCESS)
4381 				goto done;
4382 			break;
4383 		}
4384 		fallthrough;
4385 
4386 	default:
4387 		l2cap_chan_set_err(chan, ECONNRESET);
4388 
4389 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4390 		l2cap_send_disconn_req(chan, ECONNRESET);
4391 		goto done;
4392 	}
4393 
4394 	if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4395 		goto done;
4396 
4397 	set_bit(CONF_INPUT_DONE, &chan->conf_state);
4398 
4399 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4400 		set_default_fcs(chan);
4401 
4402 		if (chan->mode == L2CAP_MODE_ERTM ||
4403 		    chan->mode == L2CAP_MODE_STREAMING)
4404 			err = l2cap_ertm_init(chan);
4405 
4406 		if (err < 0)
4407 			l2cap_send_disconn_req(chan, -err);
4408 		else
4409 			l2cap_chan_ready(chan);
4410 	}
4411 
4412 done:
4413 	l2cap_chan_unlock(chan);
4414 	l2cap_chan_put(chan);
4415 	return err;
4416 }
4417 
l2cap_disconnect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4418 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4419 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4420 				       u8 *data)
4421 {
4422 	struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4423 	struct l2cap_disconn_rsp rsp;
4424 	u16 dcid, scid;
4425 	struct l2cap_chan *chan;
4426 
4427 	if (cmd_len != sizeof(*req))
4428 		return -EPROTO;
4429 
4430 	scid = __le16_to_cpu(req->scid);
4431 	dcid = __le16_to_cpu(req->dcid);
4432 
4433 	BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4434 
4435 	chan = l2cap_get_chan_by_scid(conn, dcid);
4436 	if (!chan) {
4437 		cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4438 		return 0;
4439 	}
4440 
4441 	rsp.dcid = cpu_to_le16(chan->scid);
4442 	rsp.scid = cpu_to_le16(chan->dcid);
4443 	l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4444 
4445 	chan->ops->set_shutdown(chan);
4446 
4447 	l2cap_chan_unlock(chan);
4448 	mutex_lock(&conn->chan_lock);
4449 	l2cap_chan_lock(chan);
4450 	l2cap_chan_del(chan, ECONNRESET);
4451 	mutex_unlock(&conn->chan_lock);
4452 
4453 	chan->ops->close(chan);
4454 
4455 	l2cap_chan_unlock(chan);
4456 	l2cap_chan_put(chan);
4457 
4458 	return 0;
4459 }
4460 
l2cap_disconnect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4461 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4462 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4463 				       u8 *data)
4464 {
4465 	struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4466 	u16 dcid, scid;
4467 	struct l2cap_chan *chan;
4468 
4469 	if (cmd_len != sizeof(*rsp))
4470 		return -EPROTO;
4471 
4472 	scid = __le16_to_cpu(rsp->scid);
4473 	dcid = __le16_to_cpu(rsp->dcid);
4474 
4475 	BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4476 
4477 	chan = l2cap_get_chan_by_scid(conn, scid);
4478 	if (!chan) {
4479 		return 0;
4480 	}
4481 
4482 	if (chan->state != BT_DISCONN) {
4483 		l2cap_chan_unlock(chan);
4484 		l2cap_chan_put(chan);
4485 		return 0;
4486 	}
4487 
4488 	l2cap_chan_unlock(chan);
4489 	mutex_lock(&conn->chan_lock);
4490 	l2cap_chan_lock(chan);
4491 	l2cap_chan_del(chan, 0);
4492 	mutex_unlock(&conn->chan_lock);
4493 
4494 	chan->ops->close(chan);
4495 
4496 	l2cap_chan_unlock(chan);
4497 	l2cap_chan_put(chan);
4498 
4499 	return 0;
4500 }
4501 
l2cap_information_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4502 static inline int l2cap_information_req(struct l2cap_conn *conn,
4503 					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4504 					u8 *data)
4505 {
4506 	struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4507 	u16 type;
4508 
4509 	if (cmd_len != sizeof(*req))
4510 		return -EPROTO;
4511 
4512 	type = __le16_to_cpu(req->type);
4513 
4514 	BT_DBG("type 0x%4.4x", type);
4515 
4516 	if (type == L2CAP_IT_FEAT_MASK) {
4517 		u8 buf[8];
4518 		u32 feat_mask = l2cap_feat_mask;
4519 		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4520 		rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4521 		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4522 		if (!disable_ertm)
4523 			feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4524 				| L2CAP_FEAT_FCS;
4525 
4526 		put_unaligned_le32(feat_mask, rsp->data);
4527 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4528 			       buf);
4529 	} else if (type == L2CAP_IT_FIXED_CHAN) {
4530 		u8 buf[12];
4531 		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4532 
4533 		rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4534 		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4535 		rsp->data[0] = conn->local_fixed_chan;
4536 		memset(rsp->data + 1, 0, 7);
4537 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4538 			       buf);
4539 	} else {
4540 		struct l2cap_info_rsp rsp;
4541 		rsp.type   = cpu_to_le16(type);
4542 		rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4543 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4544 			       &rsp);
4545 	}
4546 
4547 	return 0;
4548 }
4549 
l2cap_information_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4550 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4551 					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4552 					u8 *data)
4553 {
4554 	struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4555 	u16 type, result;
4556 
4557 	if (cmd_len < sizeof(*rsp))
4558 		return -EPROTO;
4559 
4560 	type   = __le16_to_cpu(rsp->type);
4561 	result = __le16_to_cpu(rsp->result);
4562 
4563 	BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4564 
4565 	/* L2CAP Info req/rsp are unbound to channels, add extra checks */
4566 	if (cmd->ident != conn->info_ident ||
4567 	    conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4568 		return 0;
4569 
4570 	cancel_delayed_work(&conn->info_timer);
4571 
4572 	if (result != L2CAP_IR_SUCCESS) {
4573 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4574 		conn->info_ident = 0;
4575 
4576 		l2cap_conn_start(conn);
4577 
4578 		return 0;
4579 	}
4580 
4581 	switch (type) {
4582 	case L2CAP_IT_FEAT_MASK:
4583 		conn->feat_mask = get_unaligned_le32(rsp->data);
4584 
4585 		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4586 			struct l2cap_info_req req;
4587 			req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4588 
4589 			conn->info_ident = l2cap_get_ident(conn);
4590 
4591 			l2cap_send_cmd(conn, conn->info_ident,
4592 				       L2CAP_INFO_REQ, sizeof(req), &req);
4593 		} else {
4594 			conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4595 			conn->info_ident = 0;
4596 
4597 			l2cap_conn_start(conn);
4598 		}
4599 		break;
4600 
4601 	case L2CAP_IT_FIXED_CHAN:
4602 		conn->remote_fixed_chan = rsp->data[0];
4603 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4604 		conn->info_ident = 0;
4605 
4606 		l2cap_conn_start(conn);
4607 		break;
4608 	}
4609 
4610 	return 0;
4611 }
4612 
l2cap_conn_param_update_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4613 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4614 					      struct l2cap_cmd_hdr *cmd,
4615 					      u16 cmd_len, u8 *data)
4616 {
4617 	struct hci_conn *hcon = conn->hcon;
4618 	struct l2cap_conn_param_update_req *req;
4619 	struct l2cap_conn_param_update_rsp rsp;
4620 	u16 min, max, latency, to_multiplier;
4621 	int err;
4622 
4623 	if (hcon->role != HCI_ROLE_MASTER)
4624 		return -EINVAL;
4625 
4626 	if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4627 		return -EPROTO;
4628 
4629 	req = (struct l2cap_conn_param_update_req *) data;
4630 	min		= __le16_to_cpu(req->min);
4631 	max		= __le16_to_cpu(req->max);
4632 	latency		= __le16_to_cpu(req->latency);
4633 	to_multiplier	= __le16_to_cpu(req->to_multiplier);
4634 
4635 	BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4636 	       min, max, latency, to_multiplier);
4637 
4638 	memset(&rsp, 0, sizeof(rsp));
4639 
4640 	err = hci_check_conn_params(min, max, latency, to_multiplier);
4641 	if (err)
4642 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4643 	else
4644 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4645 
4646 	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4647 		       sizeof(rsp), &rsp);
4648 
4649 	if (!err) {
4650 		u8 store_hint;
4651 
4652 		store_hint = hci_le_conn_update(hcon, min, max, latency,
4653 						to_multiplier);
4654 		mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
4655 				    store_hint, min, max, latency,
4656 				    to_multiplier);
4657 
4658 	}
4659 
4660 	return 0;
4661 }
4662 
l2cap_le_connect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4663 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
4664 				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4665 				u8 *data)
4666 {
4667 	struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
4668 	struct hci_conn *hcon = conn->hcon;
4669 	u16 dcid, mtu, mps, credits, result;
4670 	struct l2cap_chan *chan;
4671 	int err, sec_level;
4672 
4673 	if (cmd_len < sizeof(*rsp))
4674 		return -EPROTO;
4675 
4676 	dcid    = __le16_to_cpu(rsp->dcid);
4677 	mtu     = __le16_to_cpu(rsp->mtu);
4678 	mps     = __le16_to_cpu(rsp->mps);
4679 	credits = __le16_to_cpu(rsp->credits);
4680 	result  = __le16_to_cpu(rsp->result);
4681 
4682 	if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
4683 					   dcid < L2CAP_CID_DYN_START ||
4684 					   dcid > L2CAP_CID_LE_DYN_END))
4685 		return -EPROTO;
4686 
4687 	BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4688 	       dcid, mtu, mps, credits, result);
4689 
4690 	mutex_lock(&conn->chan_lock);
4691 
4692 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4693 	if (!chan) {
4694 		err = -EBADSLT;
4695 		goto unlock;
4696 	}
4697 
4698 	err = 0;
4699 
4700 	l2cap_chan_lock(chan);
4701 
4702 	switch (result) {
4703 	case L2CAP_CR_LE_SUCCESS:
4704 		if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4705 			err = -EBADSLT;
4706 			break;
4707 		}
4708 
4709 		chan->ident = 0;
4710 		chan->dcid = dcid;
4711 		chan->omtu = mtu;
4712 		chan->remote_mps = mps;
4713 		chan->tx_credits = credits;
4714 		l2cap_chan_ready(chan);
4715 		break;
4716 
4717 	case L2CAP_CR_LE_AUTHENTICATION:
4718 	case L2CAP_CR_LE_ENCRYPTION:
4719 		/* If we already have MITM protection we can't do
4720 		 * anything.
4721 		 */
4722 		if (hcon->sec_level > BT_SECURITY_MEDIUM) {
4723 			l2cap_chan_del(chan, ECONNREFUSED);
4724 			break;
4725 		}
4726 
4727 		sec_level = hcon->sec_level + 1;
4728 		if (chan->sec_level < sec_level)
4729 			chan->sec_level = sec_level;
4730 
4731 		/* We'll need to send a new Connect Request */
4732 		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
4733 
4734 		smp_conn_security(hcon, chan->sec_level);
4735 		break;
4736 
4737 	default:
4738 		l2cap_chan_del(chan, ECONNREFUSED);
4739 		break;
4740 	}
4741 
4742 	l2cap_chan_unlock(chan);
4743 
4744 unlock:
4745 	mutex_unlock(&conn->chan_lock);
4746 
4747 	return err;
4748 }
4749 
l2cap_bredr_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4750 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4751 				      struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4752 				      u8 *data)
4753 {
4754 	int err = 0;
4755 
4756 	switch (cmd->code) {
4757 	case L2CAP_COMMAND_REJ:
4758 		l2cap_command_rej(conn, cmd, cmd_len, data);
4759 		break;
4760 
4761 	case L2CAP_CONN_REQ:
4762 		err = l2cap_connect_req(conn, cmd, cmd_len, data);
4763 		break;
4764 
4765 	case L2CAP_CONN_RSP:
4766 		l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
4767 		break;
4768 
4769 	case L2CAP_CONF_REQ:
4770 		err = l2cap_config_req(conn, cmd, cmd_len, data);
4771 		break;
4772 
4773 	case L2CAP_CONF_RSP:
4774 		l2cap_config_rsp(conn, cmd, cmd_len, data);
4775 		break;
4776 
4777 	case L2CAP_DISCONN_REQ:
4778 		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
4779 		break;
4780 
4781 	case L2CAP_DISCONN_RSP:
4782 		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
4783 		break;
4784 
4785 	case L2CAP_ECHO_REQ:
4786 		l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4787 		break;
4788 
4789 	case L2CAP_ECHO_RSP:
4790 		break;
4791 
4792 	case L2CAP_INFO_REQ:
4793 		err = l2cap_information_req(conn, cmd, cmd_len, data);
4794 		break;
4795 
4796 	case L2CAP_INFO_RSP:
4797 		l2cap_information_rsp(conn, cmd, cmd_len, data);
4798 		break;
4799 
4800 	default:
4801 		BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4802 		err = -EINVAL;
4803 		break;
4804 	}
4805 
4806 	return err;
4807 }
4808 
l2cap_le_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4809 static int l2cap_le_connect_req(struct l2cap_conn *conn,
4810 				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4811 				u8 *data)
4812 {
4813 	struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
4814 	struct l2cap_le_conn_rsp rsp;
4815 	struct l2cap_chan *chan, *pchan;
4816 	u16 dcid, scid, credits, mtu, mps;
4817 	__le16 psm;
4818 	u8 result;
4819 
4820 	if (cmd_len != sizeof(*req))
4821 		return -EPROTO;
4822 
4823 	scid = __le16_to_cpu(req->scid);
4824 	mtu  = __le16_to_cpu(req->mtu);
4825 	mps  = __le16_to_cpu(req->mps);
4826 	psm  = req->psm;
4827 	dcid = 0;
4828 	credits = 0;
4829 
4830 	if (mtu < 23 || mps < 23)
4831 		return -EPROTO;
4832 
4833 	BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
4834 	       scid, mtu, mps);
4835 
4836 	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
4837 	 * page 1059:
4838 	 *
4839 	 * Valid range: 0x0001-0x00ff
4840 	 *
4841 	 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
4842 	 */
4843 	if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
4844 		result = L2CAP_CR_LE_BAD_PSM;
4845 		chan = NULL;
4846 		goto response;
4847 	}
4848 
4849 	/* Check if we have socket listening on psm */
4850 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4851 					 &conn->hcon->dst, LE_LINK);
4852 	if (!pchan) {
4853 		result = L2CAP_CR_LE_BAD_PSM;
4854 		chan = NULL;
4855 		goto response;
4856 	}
4857 
4858 	mutex_lock(&conn->chan_lock);
4859 	l2cap_chan_lock(pchan);
4860 
4861 	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
4862 				     SMP_ALLOW_STK)) {
4863 		result = L2CAP_CR_LE_AUTHENTICATION;
4864 		chan = NULL;
4865 		goto response_unlock;
4866 	}
4867 
4868 	/* Check for valid dynamic CID range */
4869 	if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
4870 		result = L2CAP_CR_LE_INVALID_SCID;
4871 		chan = NULL;
4872 		goto response_unlock;
4873 	}
4874 
4875 	/* Check if we already have channel with that dcid */
4876 	if (__l2cap_get_chan_by_dcid(conn, scid)) {
4877 		result = L2CAP_CR_LE_SCID_IN_USE;
4878 		chan = NULL;
4879 		goto response_unlock;
4880 	}
4881 
4882 	chan = pchan->ops->new_connection(pchan);
4883 	if (!chan) {
4884 		result = L2CAP_CR_LE_NO_MEM;
4885 		goto response_unlock;
4886 	}
4887 
4888 	bacpy(&chan->src, &conn->hcon->src);
4889 	bacpy(&chan->dst, &conn->hcon->dst);
4890 	chan->src_type = bdaddr_src_type(conn->hcon);
4891 	chan->dst_type = bdaddr_dst_type(conn->hcon);
4892 	chan->psm  = psm;
4893 	chan->dcid = scid;
4894 	chan->omtu = mtu;
4895 	chan->remote_mps = mps;
4896 
4897 	__l2cap_chan_add(conn, chan);
4898 
4899 	l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
4900 
4901 	dcid = chan->scid;
4902 	credits = chan->rx_credits;
4903 
4904 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4905 
4906 	chan->ident = cmd->ident;
4907 
4908 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4909 		l2cap_state_change(chan, BT_CONNECT2);
4910 		/* The following result value is actually not defined
4911 		 * for LE CoC but we use it to let the function know
4912 		 * that it should bail out after doing its cleanup
4913 		 * instead of sending a response.
4914 		 */
4915 		result = L2CAP_CR_PEND;
4916 		chan->ops->defer(chan);
4917 	} else {
4918 		l2cap_chan_ready(chan);
4919 		result = L2CAP_CR_LE_SUCCESS;
4920 	}
4921 
4922 response_unlock:
4923 	l2cap_chan_unlock(pchan);
4924 	mutex_unlock(&conn->chan_lock);
4925 	l2cap_chan_put(pchan);
4926 
4927 	if (result == L2CAP_CR_PEND)
4928 		return 0;
4929 
4930 response:
4931 	if (chan) {
4932 		rsp.mtu = cpu_to_le16(chan->imtu);
4933 		rsp.mps = cpu_to_le16(chan->mps);
4934 	} else {
4935 		rsp.mtu = 0;
4936 		rsp.mps = 0;
4937 	}
4938 
4939 	rsp.dcid    = cpu_to_le16(dcid);
4940 	rsp.credits = cpu_to_le16(credits);
4941 	rsp.result  = cpu_to_le16(result);
4942 
4943 	l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
4944 
4945 	return 0;
4946 }
4947 
l2cap_le_credits(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4948 static inline int l2cap_le_credits(struct l2cap_conn *conn,
4949 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4950 				   u8 *data)
4951 {
4952 	struct l2cap_le_credits *pkt;
4953 	struct l2cap_chan *chan;
4954 	u16 cid, credits, max_credits;
4955 
4956 	if (cmd_len != sizeof(*pkt))
4957 		return -EPROTO;
4958 
4959 	pkt = (struct l2cap_le_credits *) data;
4960 	cid	= __le16_to_cpu(pkt->cid);
4961 	credits	= __le16_to_cpu(pkt->credits);
4962 
4963 	BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
4964 
4965 	chan = l2cap_get_chan_by_dcid(conn, cid);
4966 	if (!chan)
4967 		return -EBADSLT;
4968 
4969 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
4970 	if (credits > max_credits) {
4971 		BT_ERR("LE credits overflow");
4972 		l2cap_send_disconn_req(chan, ECONNRESET);
4973 
4974 		/* Return 0 so that we don't trigger an unnecessary
4975 		 * command reject packet.
4976 		 */
4977 		goto unlock;
4978 	}
4979 
4980 	chan->tx_credits += credits;
4981 
4982 	/* Resume sending */
4983 	l2cap_le_flowctl_send(chan);
4984 
4985 	if (chan->tx_credits)
4986 		chan->ops->resume(chan);
4987 
4988 unlock:
4989 	l2cap_chan_unlock(chan);
4990 	l2cap_chan_put(chan);
4991 
4992 	return 0;
4993 }
4994 
l2cap_ecred_conn_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4995 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
4996 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4997 				       u8 *data)
4998 {
4999 	struct l2cap_ecred_conn_req *req = (void *) data;
5000 	struct {
5001 		struct l2cap_ecred_conn_rsp rsp;
5002 		__le16 dcid[L2CAP_ECRED_MAX_CID];
5003 	} __packed pdu;
5004 	struct l2cap_chan *chan, *pchan;
5005 	u16 mtu, mps;
5006 	__le16 psm;
5007 	u8 result, len = 0;
5008 	int i, num_scid;
5009 	bool defer = false;
5010 
5011 	if (!enable_ecred)
5012 		return -EINVAL;
5013 
5014 	if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5015 		result = L2CAP_CR_LE_INVALID_PARAMS;
5016 		goto response;
5017 	}
5018 
5019 	cmd_len -= sizeof(*req);
5020 	num_scid = cmd_len / sizeof(u16);
5021 
5022 	if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5023 		result = L2CAP_CR_LE_INVALID_PARAMS;
5024 		goto response;
5025 	}
5026 
5027 	mtu  = __le16_to_cpu(req->mtu);
5028 	mps  = __le16_to_cpu(req->mps);
5029 
5030 	if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5031 		result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5032 		goto response;
5033 	}
5034 
5035 	psm  = req->psm;
5036 
5037 	/* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
5038 	 * page 1059:
5039 	 *
5040 	 * Valid range: 0x0001-0x00ff
5041 	 *
5042 	 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
5043 	 */
5044 	if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
5045 		result = L2CAP_CR_LE_BAD_PSM;
5046 		goto response;
5047 	}
5048 
5049 	BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5050 
5051 	memset(&pdu, 0, sizeof(pdu));
5052 
5053 	/* Check if we have socket listening on psm */
5054 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5055 					 &conn->hcon->dst, LE_LINK);
5056 	if (!pchan) {
5057 		result = L2CAP_CR_LE_BAD_PSM;
5058 		goto response;
5059 	}
5060 
5061 	mutex_lock(&conn->chan_lock);
5062 	l2cap_chan_lock(pchan);
5063 
5064 	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5065 				     SMP_ALLOW_STK)) {
5066 		result = L2CAP_CR_LE_AUTHENTICATION;
5067 		goto unlock;
5068 	}
5069 
5070 	result = L2CAP_CR_LE_SUCCESS;
5071 
5072 	for (i = 0; i < num_scid; i++) {
5073 		u16 scid = __le16_to_cpu(req->scid[i]);
5074 
5075 		BT_DBG("scid[%d] 0x%4.4x", i, scid);
5076 
5077 		pdu.dcid[i] = 0x0000;
5078 		len += sizeof(*pdu.dcid);
5079 
5080 		/* Check for valid dynamic CID range */
5081 		if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5082 			result = L2CAP_CR_LE_INVALID_SCID;
5083 			continue;
5084 		}
5085 
5086 		/* Check if we already have channel with that dcid */
5087 		if (__l2cap_get_chan_by_dcid(conn, scid)) {
5088 			result = L2CAP_CR_LE_SCID_IN_USE;
5089 			continue;
5090 		}
5091 
5092 		chan = pchan->ops->new_connection(pchan);
5093 		if (!chan) {
5094 			result = L2CAP_CR_LE_NO_MEM;
5095 			continue;
5096 		}
5097 
5098 		bacpy(&chan->src, &conn->hcon->src);
5099 		bacpy(&chan->dst, &conn->hcon->dst);
5100 		chan->src_type = bdaddr_src_type(conn->hcon);
5101 		chan->dst_type = bdaddr_dst_type(conn->hcon);
5102 		chan->psm  = psm;
5103 		chan->dcid = scid;
5104 		chan->omtu = mtu;
5105 		chan->remote_mps = mps;
5106 
5107 		__l2cap_chan_add(conn, chan);
5108 
5109 		l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
5110 
5111 		/* Init response */
5112 		if (!pdu.rsp.credits) {
5113 			pdu.rsp.mtu = cpu_to_le16(chan->imtu);
5114 			pdu.rsp.mps = cpu_to_le16(chan->mps);
5115 			pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
5116 		}
5117 
5118 		pdu.dcid[i] = cpu_to_le16(chan->scid);
5119 
5120 		__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5121 
5122 		chan->ident = cmd->ident;
5123 		chan->mode = L2CAP_MODE_EXT_FLOWCTL;
5124 
5125 		if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5126 			l2cap_state_change(chan, BT_CONNECT2);
5127 			defer = true;
5128 			chan->ops->defer(chan);
5129 		} else {
5130 			l2cap_chan_ready(chan);
5131 		}
5132 	}
5133 
5134 unlock:
5135 	l2cap_chan_unlock(pchan);
5136 	mutex_unlock(&conn->chan_lock);
5137 	l2cap_chan_put(pchan);
5138 
5139 response:
5140 	pdu.rsp.result = cpu_to_le16(result);
5141 
5142 	if (defer)
5143 		return 0;
5144 
5145 	l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
5146 		       sizeof(pdu.rsp) + len, &pdu);
5147 
5148 	return 0;
5149 }
5150 
l2cap_ecred_conn_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5151 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
5152 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5153 				       u8 *data)
5154 {
5155 	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5156 	struct hci_conn *hcon = conn->hcon;
5157 	u16 mtu, mps, credits, result;
5158 	struct l2cap_chan *chan, *tmp;
5159 	int err = 0, sec_level;
5160 	int i = 0;
5161 
5162 	if (cmd_len < sizeof(*rsp))
5163 		return -EPROTO;
5164 
5165 	mtu     = __le16_to_cpu(rsp->mtu);
5166 	mps     = __le16_to_cpu(rsp->mps);
5167 	credits = __le16_to_cpu(rsp->credits);
5168 	result  = __le16_to_cpu(rsp->result);
5169 
5170 	BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5171 	       result);
5172 
5173 	mutex_lock(&conn->chan_lock);
5174 
5175 	cmd_len -= sizeof(*rsp);
5176 
5177 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5178 		u16 dcid;
5179 
5180 		if (chan->ident != cmd->ident ||
5181 		    chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
5182 		    chan->state == BT_CONNECTED)
5183 			continue;
5184 
5185 		l2cap_chan_lock(chan);
5186 
5187 		/* Check that there is a dcid for each pending channel */
5188 		if (cmd_len < sizeof(dcid)) {
5189 			l2cap_chan_del(chan, ECONNREFUSED);
5190 			l2cap_chan_unlock(chan);
5191 			continue;
5192 		}
5193 
5194 		dcid = __le16_to_cpu(rsp->dcid[i++]);
5195 		cmd_len -= sizeof(u16);
5196 
5197 		BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
5198 
5199 		/* Check if dcid is already in use */
5200 		if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
5201 			/* If a device receives a
5202 			 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
5203 			 * already-assigned Destination CID, then both the
5204 			 * original channel and the new channel shall be
5205 			 * immediately discarded and not used.
5206 			 */
5207 			l2cap_chan_del(chan, ECONNREFUSED);
5208 			l2cap_chan_unlock(chan);
5209 			chan = __l2cap_get_chan_by_dcid(conn, dcid);
5210 			l2cap_chan_lock(chan);
5211 			l2cap_chan_del(chan, ECONNRESET);
5212 			l2cap_chan_unlock(chan);
5213 			continue;
5214 		}
5215 
5216 		switch (result) {
5217 		case L2CAP_CR_LE_AUTHENTICATION:
5218 		case L2CAP_CR_LE_ENCRYPTION:
5219 			/* If we already have MITM protection we can't do
5220 			 * anything.
5221 			 */
5222 			if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5223 				l2cap_chan_del(chan, ECONNREFUSED);
5224 				break;
5225 			}
5226 
5227 			sec_level = hcon->sec_level + 1;
5228 			if (chan->sec_level < sec_level)
5229 				chan->sec_level = sec_level;
5230 
5231 			/* We'll need to send a new Connect Request */
5232 			clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
5233 
5234 			smp_conn_security(hcon, chan->sec_level);
5235 			break;
5236 
5237 		case L2CAP_CR_LE_BAD_PSM:
5238 			l2cap_chan_del(chan, ECONNREFUSED);
5239 			break;
5240 
5241 		default:
5242 			/* If dcid was not set it means channels was refused */
5243 			if (!dcid) {
5244 				l2cap_chan_del(chan, ECONNREFUSED);
5245 				break;
5246 			}
5247 
5248 			chan->ident = 0;
5249 			chan->dcid = dcid;
5250 			chan->omtu = mtu;
5251 			chan->remote_mps = mps;
5252 			chan->tx_credits = credits;
5253 			l2cap_chan_ready(chan);
5254 			break;
5255 		}
5256 
5257 		l2cap_chan_unlock(chan);
5258 	}
5259 
5260 	mutex_unlock(&conn->chan_lock);
5261 
5262 	return err;
5263 }
5264 
l2cap_ecred_reconf_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5265 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
5266 					 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5267 					 u8 *data)
5268 {
5269 	struct l2cap_ecred_reconf_req *req = (void *) data;
5270 	struct l2cap_ecred_reconf_rsp rsp;
5271 	u16 mtu, mps, result;
5272 	struct l2cap_chan *chan;
5273 	int i, num_scid;
5274 
5275 	if (!enable_ecred)
5276 		return -EINVAL;
5277 
5278 	if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
5279 		result = L2CAP_CR_LE_INVALID_PARAMS;
5280 		goto respond;
5281 	}
5282 
5283 	mtu = __le16_to_cpu(req->mtu);
5284 	mps = __le16_to_cpu(req->mps);
5285 
5286 	BT_DBG("mtu %u mps %u", mtu, mps);
5287 
5288 	if (mtu < L2CAP_ECRED_MIN_MTU) {
5289 		result = L2CAP_RECONF_INVALID_MTU;
5290 		goto respond;
5291 	}
5292 
5293 	if (mps < L2CAP_ECRED_MIN_MPS) {
5294 		result = L2CAP_RECONF_INVALID_MPS;
5295 		goto respond;
5296 	}
5297 
5298 	cmd_len -= sizeof(*req);
5299 	num_scid = cmd_len / sizeof(u16);
5300 	result = L2CAP_RECONF_SUCCESS;
5301 
5302 	for (i = 0; i < num_scid; i++) {
5303 		u16 scid;
5304 
5305 		scid = __le16_to_cpu(req->scid[i]);
5306 		if (!scid)
5307 			return -EPROTO;
5308 
5309 		chan = __l2cap_get_chan_by_dcid(conn, scid);
5310 		if (!chan)
5311 			continue;
5312 
5313 		/* If the MTU value is decreased for any of the included
5314 		 * channels, then the receiver shall disconnect all
5315 		 * included channels.
5316 		 */
5317 		if (chan->omtu > mtu) {
5318 			BT_ERR("chan %p decreased MTU %u -> %u", chan,
5319 			       chan->omtu, mtu);
5320 			result = L2CAP_RECONF_INVALID_MTU;
5321 		}
5322 
5323 		chan->omtu = mtu;
5324 		chan->remote_mps = mps;
5325 	}
5326 
5327 respond:
5328 	rsp.result = cpu_to_le16(result);
5329 
5330 	l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
5331 		       &rsp);
5332 
5333 	return 0;
5334 }
5335 
l2cap_ecred_reconf_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5336 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
5337 					 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5338 					 u8 *data)
5339 {
5340 	struct l2cap_chan *chan, *tmp;
5341 	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5342 	u16 result;
5343 
5344 	if (cmd_len < sizeof(*rsp))
5345 		return -EPROTO;
5346 
5347 	result = __le16_to_cpu(rsp->result);
5348 
5349 	BT_DBG("result 0x%4.4x", rsp->result);
5350 
5351 	if (!result)
5352 		return 0;
5353 
5354 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5355 		if (chan->ident != cmd->ident)
5356 			continue;
5357 
5358 		l2cap_chan_del(chan, ECONNRESET);
5359 	}
5360 
5361 	return 0;
5362 }
5363 
l2cap_le_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5364 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5365 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5366 				       u8 *data)
5367 {
5368 	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5369 	struct l2cap_chan *chan;
5370 
5371 	if (cmd_len < sizeof(*rej))
5372 		return -EPROTO;
5373 
5374 	mutex_lock(&conn->chan_lock);
5375 
5376 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5377 	if (!chan)
5378 		goto done;
5379 
5380 	chan = l2cap_chan_hold_unless_zero(chan);
5381 	if (!chan)
5382 		goto done;
5383 
5384 	l2cap_chan_lock(chan);
5385 	l2cap_chan_del(chan, ECONNREFUSED);
5386 	l2cap_chan_unlock(chan);
5387 	l2cap_chan_put(chan);
5388 
5389 done:
5390 	mutex_unlock(&conn->chan_lock);
5391 	return 0;
5392 }
5393 
l2cap_le_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5394 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5395 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5396 				   u8 *data)
5397 {
5398 	int err = 0;
5399 
5400 	switch (cmd->code) {
5401 	case L2CAP_COMMAND_REJ:
5402 		l2cap_le_command_rej(conn, cmd, cmd_len, data);
5403 		break;
5404 
5405 	case L2CAP_CONN_PARAM_UPDATE_REQ:
5406 		err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5407 		break;
5408 
5409 	case L2CAP_CONN_PARAM_UPDATE_RSP:
5410 		break;
5411 
5412 	case L2CAP_LE_CONN_RSP:
5413 		l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5414 		break;
5415 
5416 	case L2CAP_LE_CONN_REQ:
5417 		err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5418 		break;
5419 
5420 	case L2CAP_LE_CREDITS:
5421 		err = l2cap_le_credits(conn, cmd, cmd_len, data);
5422 		break;
5423 
5424 	case L2CAP_ECRED_CONN_REQ:
5425 		err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
5426 		break;
5427 
5428 	case L2CAP_ECRED_CONN_RSP:
5429 		err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
5430 		break;
5431 
5432 	case L2CAP_ECRED_RECONF_REQ:
5433 		err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
5434 		break;
5435 
5436 	case L2CAP_ECRED_RECONF_RSP:
5437 		err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
5438 		break;
5439 
5440 	case L2CAP_DISCONN_REQ:
5441 		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5442 		break;
5443 
5444 	case L2CAP_DISCONN_RSP:
5445 		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5446 		break;
5447 
5448 	default:
5449 		BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5450 		err = -EINVAL;
5451 		break;
5452 	}
5453 
5454 	return err;
5455 }
5456 
l2cap_le_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5457 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5458 					struct sk_buff *skb)
5459 {
5460 	struct hci_conn *hcon = conn->hcon;
5461 	struct l2cap_cmd_hdr *cmd;
5462 	u16 len;
5463 	int err;
5464 
5465 	if (hcon->type != LE_LINK)
5466 		goto drop;
5467 
5468 	if (skb->len < L2CAP_CMD_HDR_SIZE)
5469 		goto drop;
5470 
5471 	cmd = (void *) skb->data;
5472 	skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5473 
5474 	len = le16_to_cpu(cmd->len);
5475 
5476 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5477 
5478 	if (len != skb->len || !cmd->ident) {
5479 		BT_DBG("corrupted command");
5480 		goto drop;
5481 	}
5482 
5483 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5484 	if (err) {
5485 		struct l2cap_cmd_rej_unk rej;
5486 
5487 		BT_ERR("Wrong link type (%d)", err);
5488 
5489 		rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5490 		l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5491 			       sizeof(rej), &rej);
5492 	}
5493 
5494 drop:
5495 	kfree_skb(skb);
5496 }
5497 
l2cap_sig_send_rej(struct l2cap_conn * conn,u16 ident)5498 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
5499 {
5500 	struct l2cap_cmd_rej_unk rej;
5501 
5502 	rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5503 	l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5504 }
5505 
l2cap_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5506 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5507 				     struct sk_buff *skb)
5508 {
5509 	struct hci_conn *hcon = conn->hcon;
5510 	struct l2cap_cmd_hdr *cmd;
5511 	int err;
5512 
5513 	l2cap_raw_recv(conn, skb);
5514 
5515 	if (hcon->type != ACL_LINK)
5516 		goto drop;
5517 
5518 	while (skb->len >= L2CAP_CMD_HDR_SIZE) {
5519 		u16 len;
5520 
5521 		cmd = (void *) skb->data;
5522 		skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5523 
5524 		len = le16_to_cpu(cmd->len);
5525 
5526 		BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
5527 		       cmd->ident);
5528 
5529 		if (len > skb->len || !cmd->ident) {
5530 			BT_DBG("corrupted command");
5531 			l2cap_sig_send_rej(conn, cmd->ident);
5532 			skb_pull(skb, len > skb->len ? skb->len : len);
5533 			continue;
5534 		}
5535 
5536 		err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
5537 		if (err) {
5538 			BT_ERR("Wrong link type (%d)", err);
5539 			l2cap_sig_send_rej(conn, cmd->ident);
5540 		}
5541 
5542 		skb_pull(skb, len);
5543 	}
5544 
5545 	if (skb->len > 0) {
5546 		BT_DBG("corrupted command");
5547 		l2cap_sig_send_rej(conn, 0);
5548 	}
5549 
5550 drop:
5551 	kfree_skb(skb);
5552 }
5553 
l2cap_check_fcs(struct l2cap_chan * chan,struct sk_buff * skb)5554 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
5555 {
5556 	u16 our_fcs, rcv_fcs;
5557 	int hdr_size;
5558 
5559 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5560 		hdr_size = L2CAP_EXT_HDR_SIZE;
5561 	else
5562 		hdr_size = L2CAP_ENH_HDR_SIZE;
5563 
5564 	if (chan->fcs == L2CAP_FCS_CRC16) {
5565 		skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5566 		rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5567 		our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5568 
5569 		if (our_fcs != rcv_fcs)
5570 			return -EBADMSG;
5571 	}
5572 	return 0;
5573 }
5574 
l2cap_send_i_or_rr_or_rnr(struct l2cap_chan * chan)5575 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5576 {
5577 	struct l2cap_ctrl control;
5578 
5579 	BT_DBG("chan %p", chan);
5580 
5581 	memset(&control, 0, sizeof(control));
5582 	control.sframe = 1;
5583 	control.final = 1;
5584 	control.reqseq = chan->buffer_seq;
5585 	set_bit(CONN_SEND_FBIT, &chan->conn_state);
5586 
5587 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5588 		control.super = L2CAP_SUPER_RNR;
5589 		l2cap_send_sframe(chan, &control);
5590 	}
5591 
5592 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5593 	    chan->unacked_frames > 0)
5594 		__set_retrans_timer(chan);
5595 
5596 	/* Send pending iframes */
5597 	l2cap_ertm_send(chan);
5598 
5599 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5600 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5601 		/* F-bit wasn't sent in an s-frame or i-frame yet, so
5602 		 * send it now.
5603 		 */
5604 		control.super = L2CAP_SUPER_RR;
5605 		l2cap_send_sframe(chan, &control);
5606 	}
5607 }
5608 
append_skb_frag(struct sk_buff * skb,struct sk_buff * new_frag,struct sk_buff ** last_frag)5609 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5610 			    struct sk_buff **last_frag)
5611 {
5612 	/* skb->len reflects data in skb as well as all fragments
5613 	 * skb->data_len reflects only data in fragments
5614 	 */
5615 	if (!skb_has_frag_list(skb))
5616 		skb_shinfo(skb)->frag_list = new_frag;
5617 
5618 	new_frag->next = NULL;
5619 
5620 	(*last_frag)->next = new_frag;
5621 	*last_frag = new_frag;
5622 
5623 	skb->len += new_frag->len;
5624 	skb->data_len += new_frag->len;
5625 	skb->truesize += new_frag->truesize;
5626 }
5627 
l2cap_reassemble_sdu(struct l2cap_chan * chan,struct sk_buff * skb,struct l2cap_ctrl * control)5628 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5629 				struct l2cap_ctrl *control)
5630 {
5631 	int err = -EINVAL;
5632 
5633 	switch (control->sar) {
5634 	case L2CAP_SAR_UNSEGMENTED:
5635 		if (chan->sdu)
5636 			break;
5637 
5638 		err = chan->ops->recv(chan, skb);
5639 		break;
5640 
5641 	case L2CAP_SAR_START:
5642 		if (chan->sdu)
5643 			break;
5644 
5645 		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5646 			break;
5647 
5648 		chan->sdu_len = get_unaligned_le16(skb->data);
5649 		skb_pull(skb, L2CAP_SDULEN_SIZE);
5650 
5651 		if (chan->sdu_len > chan->imtu) {
5652 			err = -EMSGSIZE;
5653 			break;
5654 		}
5655 
5656 		if (skb->len >= chan->sdu_len)
5657 			break;
5658 
5659 		chan->sdu = skb;
5660 		chan->sdu_last_frag = skb;
5661 
5662 		skb = NULL;
5663 		err = 0;
5664 		break;
5665 
5666 	case L2CAP_SAR_CONTINUE:
5667 		if (!chan->sdu)
5668 			break;
5669 
5670 		append_skb_frag(chan->sdu, skb,
5671 				&chan->sdu_last_frag);
5672 		skb = NULL;
5673 
5674 		if (chan->sdu->len >= chan->sdu_len)
5675 			break;
5676 
5677 		err = 0;
5678 		break;
5679 
5680 	case L2CAP_SAR_END:
5681 		if (!chan->sdu)
5682 			break;
5683 
5684 		append_skb_frag(chan->sdu, skb,
5685 				&chan->sdu_last_frag);
5686 		skb = NULL;
5687 
5688 		if (chan->sdu->len != chan->sdu_len)
5689 			break;
5690 
5691 		err = chan->ops->recv(chan, chan->sdu);
5692 
5693 		if (!err) {
5694 			/* Reassembly complete */
5695 			chan->sdu = NULL;
5696 			chan->sdu_last_frag = NULL;
5697 			chan->sdu_len = 0;
5698 		}
5699 		break;
5700 	}
5701 
5702 	if (err) {
5703 		kfree_skb(skb);
5704 		kfree_skb(chan->sdu);
5705 		chan->sdu = NULL;
5706 		chan->sdu_last_frag = NULL;
5707 		chan->sdu_len = 0;
5708 	}
5709 
5710 	return err;
5711 }
5712 
l2cap_resegment(struct l2cap_chan * chan)5713 static int l2cap_resegment(struct l2cap_chan *chan)
5714 {
5715 	/* Placeholder */
5716 	return 0;
5717 }
5718 
l2cap_chan_busy(struct l2cap_chan * chan,int busy)5719 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5720 {
5721 	u8 event;
5722 
5723 	if (chan->mode != L2CAP_MODE_ERTM)
5724 		return;
5725 
5726 	event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5727 	l2cap_tx(chan, NULL, NULL, event);
5728 }
5729 
l2cap_rx_queued_iframes(struct l2cap_chan * chan)5730 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5731 {
5732 	int err = 0;
5733 	/* Pass sequential frames to l2cap_reassemble_sdu()
5734 	 * until a gap is encountered.
5735 	 */
5736 
5737 	BT_DBG("chan %p", chan);
5738 
5739 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5740 		struct sk_buff *skb;
5741 		BT_DBG("Searching for skb with txseq %d (queue len %d)",
5742 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));
5743 
5744 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5745 
5746 		if (!skb)
5747 			break;
5748 
5749 		skb_unlink(skb, &chan->srej_q);
5750 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5751 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
5752 		if (err)
5753 			break;
5754 	}
5755 
5756 	if (skb_queue_empty(&chan->srej_q)) {
5757 		chan->rx_state = L2CAP_RX_STATE_RECV;
5758 		l2cap_send_ack(chan);
5759 	}
5760 
5761 	return err;
5762 }
5763 
l2cap_handle_srej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5764 static void l2cap_handle_srej(struct l2cap_chan *chan,
5765 			      struct l2cap_ctrl *control)
5766 {
5767 	struct sk_buff *skb;
5768 
5769 	BT_DBG("chan %p, control %p", chan, control);
5770 
5771 	if (control->reqseq == chan->next_tx_seq) {
5772 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5773 		l2cap_send_disconn_req(chan, ECONNRESET);
5774 		return;
5775 	}
5776 
5777 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5778 
5779 	if (skb == NULL) {
5780 		BT_DBG("Seq %d not available for retransmission",
5781 		       control->reqseq);
5782 		return;
5783 	}
5784 
5785 	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5786 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5787 		l2cap_send_disconn_req(chan, ECONNRESET);
5788 		return;
5789 	}
5790 
5791 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5792 
5793 	if (control->poll) {
5794 		l2cap_pass_to_tx(chan, control);
5795 
5796 		set_bit(CONN_SEND_FBIT, &chan->conn_state);
5797 		l2cap_retransmit(chan, control);
5798 		l2cap_ertm_send(chan);
5799 
5800 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5801 			set_bit(CONN_SREJ_ACT, &chan->conn_state);
5802 			chan->srej_save_reqseq = control->reqseq;
5803 		}
5804 	} else {
5805 		l2cap_pass_to_tx_fbit(chan, control);
5806 
5807 		if (control->final) {
5808 			if (chan->srej_save_reqseq != control->reqseq ||
5809 			    !test_and_clear_bit(CONN_SREJ_ACT,
5810 						&chan->conn_state))
5811 				l2cap_retransmit(chan, control);
5812 		} else {
5813 			l2cap_retransmit(chan, control);
5814 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5815 				set_bit(CONN_SREJ_ACT, &chan->conn_state);
5816 				chan->srej_save_reqseq = control->reqseq;
5817 			}
5818 		}
5819 	}
5820 }
5821 
l2cap_handle_rej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5822 static void l2cap_handle_rej(struct l2cap_chan *chan,
5823 			     struct l2cap_ctrl *control)
5824 {
5825 	struct sk_buff *skb;
5826 
5827 	BT_DBG("chan %p, control %p", chan, control);
5828 
5829 	if (control->reqseq == chan->next_tx_seq) {
5830 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5831 		l2cap_send_disconn_req(chan, ECONNRESET);
5832 		return;
5833 	}
5834 
5835 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5836 
5837 	if (chan->max_tx && skb &&
5838 	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5839 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5840 		l2cap_send_disconn_req(chan, ECONNRESET);
5841 		return;
5842 	}
5843 
5844 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5845 
5846 	l2cap_pass_to_tx(chan, control);
5847 
5848 	if (control->final) {
5849 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5850 			l2cap_retransmit_all(chan, control);
5851 	} else {
5852 		l2cap_retransmit_all(chan, control);
5853 		l2cap_ertm_send(chan);
5854 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5855 			set_bit(CONN_REJ_ACT, &chan->conn_state);
5856 	}
5857 }
5858 
l2cap_classify_txseq(struct l2cap_chan * chan,u16 txseq)5859 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5860 {
5861 	BT_DBG("chan %p, txseq %d", chan, txseq);
5862 
5863 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5864 	       chan->expected_tx_seq);
5865 
5866 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5867 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5868 		    chan->tx_win) {
5869 			/* See notes below regarding "double poll" and
5870 			 * invalid packets.
5871 			 */
5872 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5873 				BT_DBG("Invalid/Ignore - after SREJ");
5874 				return L2CAP_TXSEQ_INVALID_IGNORE;
5875 			} else {
5876 				BT_DBG("Invalid - in window after SREJ sent");
5877 				return L2CAP_TXSEQ_INVALID;
5878 			}
5879 		}
5880 
5881 		if (chan->srej_list.head == txseq) {
5882 			BT_DBG("Expected SREJ");
5883 			return L2CAP_TXSEQ_EXPECTED_SREJ;
5884 		}
5885 
5886 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5887 			BT_DBG("Duplicate SREJ - txseq already stored");
5888 			return L2CAP_TXSEQ_DUPLICATE_SREJ;
5889 		}
5890 
5891 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5892 			BT_DBG("Unexpected SREJ - not requested");
5893 			return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5894 		}
5895 	}
5896 
5897 	if (chan->expected_tx_seq == txseq) {
5898 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5899 		    chan->tx_win) {
5900 			BT_DBG("Invalid - txseq outside tx window");
5901 			return L2CAP_TXSEQ_INVALID;
5902 		} else {
5903 			BT_DBG("Expected");
5904 			return L2CAP_TXSEQ_EXPECTED;
5905 		}
5906 	}
5907 
5908 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <
5909 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
5910 		BT_DBG("Duplicate - expected_tx_seq later than txseq");
5911 		return L2CAP_TXSEQ_DUPLICATE;
5912 	}
5913 
5914 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5915 		/* A source of invalid packets is a "double poll" condition,
5916 		 * where delays cause us to send multiple poll packets.  If
5917 		 * the remote stack receives and processes both polls,
5918 		 * sequence numbers can wrap around in such a way that a
5919 		 * resent frame has a sequence number that looks like new data
5920 		 * with a sequence gap.  This would trigger an erroneous SREJ
5921 		 * request.
5922 		 *
5923 		 * Fortunately, this is impossible with a tx window that's
5924 		 * less than half of the maximum sequence number, which allows
5925 		 * invalid frames to be safely ignored.
5926 		 *
5927 		 * With tx window sizes greater than half of the tx window
5928 		 * maximum, the frame is invalid and cannot be ignored.  This
5929 		 * causes a disconnect.
5930 		 */
5931 
5932 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5933 			BT_DBG("Invalid/Ignore - txseq outside tx window");
5934 			return L2CAP_TXSEQ_INVALID_IGNORE;
5935 		} else {
5936 			BT_DBG("Invalid - txseq outside tx window");
5937 			return L2CAP_TXSEQ_INVALID;
5938 		}
5939 	} else {
5940 		BT_DBG("Unexpected - txseq indicates missing frames");
5941 		return L2CAP_TXSEQ_UNEXPECTED;
5942 	}
5943 }
5944 
l2cap_rx_state_recv(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)5945 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5946 			       struct l2cap_ctrl *control,
5947 			       struct sk_buff *skb, u8 event)
5948 {
5949 	struct l2cap_ctrl local_control;
5950 	int err = 0;
5951 	bool skb_in_use = false;
5952 
5953 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5954 	       event);
5955 
5956 	switch (event) {
5957 	case L2CAP_EV_RECV_IFRAME:
5958 		switch (l2cap_classify_txseq(chan, control->txseq)) {
5959 		case L2CAP_TXSEQ_EXPECTED:
5960 			l2cap_pass_to_tx(chan, control);
5961 
5962 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5963 				BT_DBG("Busy, discarding expected seq %d",
5964 				       control->txseq);
5965 				break;
5966 			}
5967 
5968 			chan->expected_tx_seq = __next_seq(chan,
5969 							   control->txseq);
5970 
5971 			chan->buffer_seq = chan->expected_tx_seq;
5972 			skb_in_use = true;
5973 
5974 			/* l2cap_reassemble_sdu may free skb, hence invalidate
5975 			 * control, so make a copy in advance to use it after
5976 			 * l2cap_reassemble_sdu returns and to avoid the race
5977 			 * condition, for example:
5978 			 *
5979 			 * The current thread calls:
5980 			 *   l2cap_reassemble_sdu
5981 			 *     chan->ops->recv == l2cap_sock_recv_cb
5982 			 *       __sock_queue_rcv_skb
5983 			 * Another thread calls:
5984 			 *   bt_sock_recvmsg
5985 			 *     skb_recv_datagram
5986 			 *     skb_free_datagram
5987 			 * Then the current thread tries to access control, but
5988 			 * it was freed by skb_free_datagram.
5989 			 */
5990 			local_control = *control;
5991 			err = l2cap_reassemble_sdu(chan, skb, control);
5992 			if (err)
5993 				break;
5994 
5995 			if (local_control.final) {
5996 				if (!test_and_clear_bit(CONN_REJ_ACT,
5997 							&chan->conn_state)) {
5998 					local_control.final = 0;
5999 					l2cap_retransmit_all(chan, &local_control);
6000 					l2cap_ertm_send(chan);
6001 				}
6002 			}
6003 
6004 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6005 				l2cap_send_ack(chan);
6006 			break;
6007 		case L2CAP_TXSEQ_UNEXPECTED:
6008 			l2cap_pass_to_tx(chan, control);
6009 
6010 			/* Can't issue SREJ frames in the local busy state.
6011 			 * Drop this frame, it will be seen as missing
6012 			 * when local busy is exited.
6013 			 */
6014 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6015 				BT_DBG("Busy, discarding unexpected seq %d",
6016 				       control->txseq);
6017 				break;
6018 			}
6019 
6020 			/* There was a gap in the sequence, so an SREJ
6021 			 * must be sent for each missing frame.  The
6022 			 * current frame is stored for later use.
6023 			 */
6024 			skb_queue_tail(&chan->srej_q, skb);
6025 			skb_in_use = true;
6026 			BT_DBG("Queued %p (queue len %d)", skb,
6027 			       skb_queue_len(&chan->srej_q));
6028 
6029 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6030 			l2cap_seq_list_clear(&chan->srej_list);
6031 			l2cap_send_srej(chan, control->txseq);
6032 
6033 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6034 			break;
6035 		case L2CAP_TXSEQ_DUPLICATE:
6036 			l2cap_pass_to_tx(chan, control);
6037 			break;
6038 		case L2CAP_TXSEQ_INVALID_IGNORE:
6039 			break;
6040 		case L2CAP_TXSEQ_INVALID:
6041 		default:
6042 			l2cap_send_disconn_req(chan, ECONNRESET);
6043 			break;
6044 		}
6045 		break;
6046 	case L2CAP_EV_RECV_RR:
6047 		l2cap_pass_to_tx(chan, control);
6048 		if (control->final) {
6049 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6050 
6051 			if (!test_and_clear_bit(CONN_REJ_ACT,
6052 						&chan->conn_state)) {
6053 				control->final = 0;
6054 				l2cap_retransmit_all(chan, control);
6055 			}
6056 
6057 			l2cap_ertm_send(chan);
6058 		} else if (control->poll) {
6059 			l2cap_send_i_or_rr_or_rnr(chan);
6060 		} else {
6061 			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6062 					       &chan->conn_state) &&
6063 			    chan->unacked_frames)
6064 				__set_retrans_timer(chan);
6065 
6066 			l2cap_ertm_send(chan);
6067 		}
6068 		break;
6069 	case L2CAP_EV_RECV_RNR:
6070 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6071 		l2cap_pass_to_tx(chan, control);
6072 		if (control && control->poll) {
6073 			set_bit(CONN_SEND_FBIT, &chan->conn_state);
6074 			l2cap_send_rr_or_rnr(chan, 0);
6075 		}
6076 		__clear_retrans_timer(chan);
6077 		l2cap_seq_list_clear(&chan->retrans_list);
6078 		break;
6079 	case L2CAP_EV_RECV_REJ:
6080 		l2cap_handle_rej(chan, control);
6081 		break;
6082 	case L2CAP_EV_RECV_SREJ:
6083 		l2cap_handle_srej(chan, control);
6084 		break;
6085 	default:
6086 		break;
6087 	}
6088 
6089 	if (skb && !skb_in_use) {
6090 		BT_DBG("Freeing %p", skb);
6091 		kfree_skb(skb);
6092 	}
6093 
6094 	return err;
6095 }
6096 
l2cap_rx_state_srej_sent(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6097 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6098 				    struct l2cap_ctrl *control,
6099 				    struct sk_buff *skb, u8 event)
6100 {
6101 	int err = 0;
6102 	u16 txseq = control->txseq;
6103 	bool skb_in_use = false;
6104 
6105 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6106 	       event);
6107 
6108 	switch (event) {
6109 	case L2CAP_EV_RECV_IFRAME:
6110 		switch (l2cap_classify_txseq(chan, txseq)) {
6111 		case L2CAP_TXSEQ_EXPECTED:
6112 			/* Keep frame for reassembly later */
6113 			l2cap_pass_to_tx(chan, control);
6114 			skb_queue_tail(&chan->srej_q, skb);
6115 			skb_in_use = true;
6116 			BT_DBG("Queued %p (queue len %d)", skb,
6117 			       skb_queue_len(&chan->srej_q));
6118 
6119 			chan->expected_tx_seq = __next_seq(chan, txseq);
6120 			break;
6121 		case L2CAP_TXSEQ_EXPECTED_SREJ:
6122 			l2cap_seq_list_pop(&chan->srej_list);
6123 
6124 			l2cap_pass_to_tx(chan, control);
6125 			skb_queue_tail(&chan->srej_q, skb);
6126 			skb_in_use = true;
6127 			BT_DBG("Queued %p (queue len %d)", skb,
6128 			       skb_queue_len(&chan->srej_q));
6129 
6130 			err = l2cap_rx_queued_iframes(chan);
6131 			if (err)
6132 				break;
6133 
6134 			break;
6135 		case L2CAP_TXSEQ_UNEXPECTED:
6136 			/* Got a frame that can't be reassembled yet.
6137 			 * Save it for later, and send SREJs to cover
6138 			 * the missing frames.
6139 			 */
6140 			skb_queue_tail(&chan->srej_q, skb);
6141 			skb_in_use = true;
6142 			BT_DBG("Queued %p (queue len %d)", skb,
6143 			       skb_queue_len(&chan->srej_q));
6144 
6145 			l2cap_pass_to_tx(chan, control);
6146 			l2cap_send_srej(chan, control->txseq);
6147 			break;
6148 		case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6149 			/* This frame was requested with an SREJ, but
6150 			 * some expected retransmitted frames are
6151 			 * missing.  Request retransmission of missing
6152 			 * SREJ'd frames.
6153 			 */
6154 			skb_queue_tail(&chan->srej_q, skb);
6155 			skb_in_use = true;
6156 			BT_DBG("Queued %p (queue len %d)", skb,
6157 			       skb_queue_len(&chan->srej_q));
6158 
6159 			l2cap_pass_to_tx(chan, control);
6160 			l2cap_send_srej_list(chan, control->txseq);
6161 			break;
6162 		case L2CAP_TXSEQ_DUPLICATE_SREJ:
6163 			/* We've already queued this frame.  Drop this copy. */
6164 			l2cap_pass_to_tx(chan, control);
6165 			break;
6166 		case L2CAP_TXSEQ_DUPLICATE:
6167 			/* Expecting a later sequence number, so this frame
6168 			 * was already received.  Ignore it completely.
6169 			 */
6170 			break;
6171 		case L2CAP_TXSEQ_INVALID_IGNORE:
6172 			break;
6173 		case L2CAP_TXSEQ_INVALID:
6174 		default:
6175 			l2cap_send_disconn_req(chan, ECONNRESET);
6176 			break;
6177 		}
6178 		break;
6179 	case L2CAP_EV_RECV_RR:
6180 		l2cap_pass_to_tx(chan, control);
6181 		if (control->final) {
6182 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6183 
6184 			if (!test_and_clear_bit(CONN_REJ_ACT,
6185 						&chan->conn_state)) {
6186 				control->final = 0;
6187 				l2cap_retransmit_all(chan, control);
6188 			}
6189 
6190 			l2cap_ertm_send(chan);
6191 		} else if (control->poll) {
6192 			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6193 					       &chan->conn_state) &&
6194 			    chan->unacked_frames) {
6195 				__set_retrans_timer(chan);
6196 			}
6197 
6198 			set_bit(CONN_SEND_FBIT, &chan->conn_state);
6199 			l2cap_send_srej_tail(chan);
6200 		} else {
6201 			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6202 					       &chan->conn_state) &&
6203 			    chan->unacked_frames)
6204 				__set_retrans_timer(chan);
6205 
6206 			l2cap_send_ack(chan);
6207 		}
6208 		break;
6209 	case L2CAP_EV_RECV_RNR:
6210 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6211 		l2cap_pass_to_tx(chan, control);
6212 		if (control->poll) {
6213 			l2cap_send_srej_tail(chan);
6214 		} else {
6215 			struct l2cap_ctrl rr_control;
6216 			memset(&rr_control, 0, sizeof(rr_control));
6217 			rr_control.sframe = 1;
6218 			rr_control.super = L2CAP_SUPER_RR;
6219 			rr_control.reqseq = chan->buffer_seq;
6220 			l2cap_send_sframe(chan, &rr_control);
6221 		}
6222 
6223 		break;
6224 	case L2CAP_EV_RECV_REJ:
6225 		l2cap_handle_rej(chan, control);
6226 		break;
6227 	case L2CAP_EV_RECV_SREJ:
6228 		l2cap_handle_srej(chan, control);
6229 		break;
6230 	}
6231 
6232 	if (skb && !skb_in_use) {
6233 		BT_DBG("Freeing %p", skb);
6234 		kfree_skb(skb);
6235 	}
6236 
6237 	return err;
6238 }
6239 
l2cap_finish_move(struct l2cap_chan * chan)6240 static int l2cap_finish_move(struct l2cap_chan *chan)
6241 {
6242 	BT_DBG("chan %p", chan);
6243 
6244 	chan->rx_state = L2CAP_RX_STATE_RECV;
6245 	chan->conn->mtu = chan->conn->hcon->mtu;
6246 
6247 	return l2cap_resegment(chan);
6248 }
6249 
l2cap_rx_state_wait_p(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6250 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6251 				 struct l2cap_ctrl *control,
6252 				 struct sk_buff *skb, u8 event)
6253 {
6254 	int err;
6255 
6256 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6257 	       event);
6258 
6259 	if (!control->poll)
6260 		return -EPROTO;
6261 
6262 	l2cap_process_reqseq(chan, control->reqseq);
6263 
6264 	if (!skb_queue_empty(&chan->tx_q))
6265 		chan->tx_send_head = skb_peek(&chan->tx_q);
6266 	else
6267 		chan->tx_send_head = NULL;
6268 
6269 	/* Rewind next_tx_seq to the point expected
6270 	 * by the receiver.
6271 	 */
6272 	chan->next_tx_seq = control->reqseq;
6273 	chan->unacked_frames = 0;
6274 
6275 	err = l2cap_finish_move(chan);
6276 	if (err)
6277 		return err;
6278 
6279 	set_bit(CONN_SEND_FBIT, &chan->conn_state);
6280 	l2cap_send_i_or_rr_or_rnr(chan);
6281 
6282 	if (event == L2CAP_EV_RECV_IFRAME)
6283 		return -EPROTO;
6284 
6285 	return l2cap_rx_state_recv(chan, control, NULL, event);
6286 }
6287 
l2cap_rx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6288 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6289 				 struct l2cap_ctrl *control,
6290 				 struct sk_buff *skb, u8 event)
6291 {
6292 	int err;
6293 
6294 	if (!control->final)
6295 		return -EPROTO;
6296 
6297 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6298 
6299 	chan->rx_state = L2CAP_RX_STATE_RECV;
6300 	l2cap_process_reqseq(chan, control->reqseq);
6301 
6302 	if (!skb_queue_empty(&chan->tx_q))
6303 		chan->tx_send_head = skb_peek(&chan->tx_q);
6304 	else
6305 		chan->tx_send_head = NULL;
6306 
6307 	/* Rewind next_tx_seq to the point expected
6308 	 * by the receiver.
6309 	 */
6310 	chan->next_tx_seq = control->reqseq;
6311 	chan->unacked_frames = 0;
6312 	chan->conn->mtu = chan->conn->hcon->mtu;
6313 
6314 	err = l2cap_resegment(chan);
6315 
6316 	if (!err)
6317 		err = l2cap_rx_state_recv(chan, control, skb, event);
6318 
6319 	return err;
6320 }
6321 
__valid_reqseq(struct l2cap_chan * chan,u16 reqseq)6322 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6323 {
6324 	/* Make sure reqseq is for a packet that has been sent but not acked */
6325 	u16 unacked;
6326 
6327 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6328 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6329 }
6330 
l2cap_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6331 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6332 		    struct sk_buff *skb, u8 event)
6333 {
6334 	int err = 0;
6335 
6336 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6337 	       control, skb, event, chan->rx_state);
6338 
6339 	if (__valid_reqseq(chan, control->reqseq)) {
6340 		switch (chan->rx_state) {
6341 		case L2CAP_RX_STATE_RECV:
6342 			err = l2cap_rx_state_recv(chan, control, skb, event);
6343 			break;
6344 		case L2CAP_RX_STATE_SREJ_SENT:
6345 			err = l2cap_rx_state_srej_sent(chan, control, skb,
6346 						       event);
6347 			break;
6348 		case L2CAP_RX_STATE_WAIT_P:
6349 			err = l2cap_rx_state_wait_p(chan, control, skb, event);
6350 			break;
6351 		case L2CAP_RX_STATE_WAIT_F:
6352 			err = l2cap_rx_state_wait_f(chan, control, skb, event);
6353 			break;
6354 		default:
6355 			/* shut it down */
6356 			break;
6357 		}
6358 	} else {
6359 		BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6360 		       control->reqseq, chan->next_tx_seq,
6361 		       chan->expected_ack_seq);
6362 		l2cap_send_disconn_req(chan, ECONNRESET);
6363 	}
6364 
6365 	return err;
6366 }
6367 
l2cap_stream_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)6368 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6369 			   struct sk_buff *skb)
6370 {
6371 	/* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6372 	 * the txseq field in advance to use it after l2cap_reassemble_sdu
6373 	 * returns and to avoid the race condition, for example:
6374 	 *
6375 	 * The current thread calls:
6376 	 *   l2cap_reassemble_sdu
6377 	 *     chan->ops->recv == l2cap_sock_recv_cb
6378 	 *       __sock_queue_rcv_skb
6379 	 * Another thread calls:
6380 	 *   bt_sock_recvmsg
6381 	 *     skb_recv_datagram
6382 	 *     skb_free_datagram
6383 	 * Then the current thread tries to access control, but it was freed by
6384 	 * skb_free_datagram.
6385 	 */
6386 	u16 txseq = control->txseq;
6387 
6388 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6389 	       chan->rx_state);
6390 
6391 	if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
6392 		l2cap_pass_to_tx(chan, control);
6393 
6394 		BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
6395 		       __next_seq(chan, chan->buffer_seq));
6396 
6397 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6398 
6399 		l2cap_reassemble_sdu(chan, skb, control);
6400 	} else {
6401 		if (chan->sdu) {
6402 			kfree_skb(chan->sdu);
6403 			chan->sdu = NULL;
6404 		}
6405 		chan->sdu_last_frag = NULL;
6406 		chan->sdu_len = 0;
6407 
6408 		if (skb) {
6409 			BT_DBG("Freeing %p", skb);
6410 			kfree_skb(skb);
6411 		}
6412 	}
6413 
6414 	chan->last_acked_seq = txseq;
6415 	chan->expected_tx_seq = __next_seq(chan, txseq);
6416 
6417 	return 0;
6418 }
6419 
l2cap_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6420 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6421 {
6422 	struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6423 	u16 len;
6424 	u8 event;
6425 
6426 	__unpack_control(chan, skb);
6427 
6428 	len = skb->len;
6429 
6430 	/*
6431 	 * We can just drop the corrupted I-frame here.
6432 	 * Receiver will miss it and start proper recovery
6433 	 * procedures and ask for retransmission.
6434 	 */
6435 	if (l2cap_check_fcs(chan, skb))
6436 		goto drop;
6437 
6438 	if (!control->sframe && control->sar == L2CAP_SAR_START)
6439 		len -= L2CAP_SDULEN_SIZE;
6440 
6441 	if (chan->fcs == L2CAP_FCS_CRC16)
6442 		len -= L2CAP_FCS_SIZE;
6443 
6444 	if (len > chan->mps) {
6445 		l2cap_send_disconn_req(chan, ECONNRESET);
6446 		goto drop;
6447 	}
6448 
6449 	if (chan->ops->filter) {
6450 		if (chan->ops->filter(chan, skb))
6451 			goto drop;
6452 	}
6453 
6454 	if (!control->sframe) {
6455 		int err;
6456 
6457 		BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6458 		       control->sar, control->reqseq, control->final,
6459 		       control->txseq);
6460 
6461 		/* Validate F-bit - F=0 always valid, F=1 only
6462 		 * valid in TX WAIT_F
6463 		 */
6464 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6465 			goto drop;
6466 
6467 		if (chan->mode != L2CAP_MODE_STREAMING) {
6468 			event = L2CAP_EV_RECV_IFRAME;
6469 			err = l2cap_rx(chan, control, skb, event);
6470 		} else {
6471 			err = l2cap_stream_rx(chan, control, skb);
6472 		}
6473 
6474 		if (err)
6475 			l2cap_send_disconn_req(chan, ECONNRESET);
6476 	} else {
6477 		const u8 rx_func_to_event[4] = {
6478 			L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6479 			L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6480 		};
6481 
6482 		/* Only I-frames are expected in streaming mode */
6483 		if (chan->mode == L2CAP_MODE_STREAMING)
6484 			goto drop;
6485 
6486 		BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6487 		       control->reqseq, control->final, control->poll,
6488 		       control->super);
6489 
6490 		if (len != 0) {
6491 			BT_ERR("Trailing bytes: %d in sframe", len);
6492 			l2cap_send_disconn_req(chan, ECONNRESET);
6493 			goto drop;
6494 		}
6495 
6496 		/* Validate F and P bits */
6497 		if (control->final && (control->poll ||
6498 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6499 			goto drop;
6500 
6501 		event = rx_func_to_event[control->super];
6502 		if (l2cap_rx(chan, control, skb, event))
6503 			l2cap_send_disconn_req(chan, ECONNRESET);
6504 	}
6505 
6506 	return 0;
6507 
6508 drop:
6509 	kfree_skb(skb);
6510 	return 0;
6511 }
6512 
l2cap_chan_le_send_credits(struct l2cap_chan * chan)6513 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6514 {
6515 	struct l2cap_conn *conn = chan->conn;
6516 	struct l2cap_le_credits pkt;
6517 	u16 return_credits = l2cap_le_rx_credits(chan);
6518 
6519 	if (chan->rx_credits >= return_credits)
6520 		return;
6521 
6522 	return_credits -= chan->rx_credits;
6523 
6524 	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6525 
6526 	chan->rx_credits += return_credits;
6527 
6528 	pkt.cid     = cpu_to_le16(chan->scid);
6529 	pkt.credits = cpu_to_le16(return_credits);
6530 
6531 	chan->ident = l2cap_get_ident(conn);
6532 
6533 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6534 }
6535 
l2cap_chan_rx_avail(struct l2cap_chan * chan,ssize_t rx_avail)6536 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
6537 {
6538 	if (chan->rx_avail == rx_avail)
6539 		return;
6540 
6541 	BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail);
6542 
6543 	chan->rx_avail = rx_avail;
6544 
6545 	if (chan->state == BT_CONNECTED)
6546 		l2cap_chan_le_send_credits(chan);
6547 }
6548 
l2cap_ecred_recv(struct l2cap_chan * chan,struct sk_buff * skb)6549 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
6550 {
6551 	int err;
6552 
6553 	BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
6554 
6555 	/* Wait recv to confirm reception before updating the credits */
6556 	err = chan->ops->recv(chan, skb);
6557 
6558 	if (err < 0 && chan->rx_avail != -1) {
6559 		BT_ERR("Queueing received LE L2CAP data failed");
6560 		l2cap_send_disconn_req(chan, ECONNRESET);
6561 		return err;
6562 	}
6563 
6564 	/* Update credits whenever an SDU is received */
6565 	l2cap_chan_le_send_credits(chan);
6566 
6567 	return err;
6568 }
6569 
l2cap_ecred_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6570 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6571 {
6572 	int err;
6573 
6574 	if (!chan->rx_credits) {
6575 		BT_ERR("No credits to receive LE L2CAP data");
6576 		l2cap_send_disconn_req(chan, ECONNRESET);
6577 		return -ENOBUFS;
6578 	}
6579 
6580 	if (chan->imtu < skb->len) {
6581 		BT_ERR("Too big LE L2CAP PDU");
6582 		return -ENOBUFS;
6583 	}
6584 
6585 	chan->rx_credits--;
6586 	BT_DBG("chan %p: rx_credits %u -> %u",
6587 	       chan, chan->rx_credits + 1, chan->rx_credits);
6588 
6589 	/* Update if remote had run out of credits, this should only happens
6590 	 * if the remote is not using the entire MPS.
6591 	 */
6592 	if (!chan->rx_credits)
6593 		l2cap_chan_le_send_credits(chan);
6594 
6595 	err = 0;
6596 
6597 	if (!chan->sdu) {
6598 		u16 sdu_len;
6599 
6600 		sdu_len = get_unaligned_le16(skb->data);
6601 		skb_pull(skb, L2CAP_SDULEN_SIZE);
6602 
6603 		BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6604 		       sdu_len, skb->len, chan->imtu);
6605 
6606 		if (sdu_len > chan->imtu) {
6607 			BT_ERR("Too big LE L2CAP SDU length received");
6608 			err = -EMSGSIZE;
6609 			goto failed;
6610 		}
6611 
6612 		if (skb->len > sdu_len) {
6613 			BT_ERR("Too much LE L2CAP data received");
6614 			err = -EINVAL;
6615 			goto failed;
6616 		}
6617 
6618 		if (skb->len == sdu_len)
6619 			return l2cap_ecred_recv(chan, skb);
6620 
6621 		chan->sdu = skb;
6622 		chan->sdu_len = sdu_len;
6623 		chan->sdu_last_frag = skb;
6624 
6625 		/* Detect if remote is not able to use the selected MPS */
6626 		if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
6627 			u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
6628 
6629 			/* Adjust the number of credits */
6630 			BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
6631 			chan->mps = mps_len;
6632 			l2cap_chan_le_send_credits(chan);
6633 		}
6634 
6635 		return 0;
6636 	}
6637 
6638 	BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6639 	       chan->sdu->len, skb->len, chan->sdu_len);
6640 
6641 	if (chan->sdu->len + skb->len > chan->sdu_len) {
6642 		BT_ERR("Too much LE L2CAP data received");
6643 		err = -EINVAL;
6644 		goto failed;
6645 	}
6646 
6647 	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6648 	skb = NULL;
6649 
6650 	if (chan->sdu->len == chan->sdu_len) {
6651 		err = l2cap_ecred_recv(chan, chan->sdu);
6652 		if (!err) {
6653 			chan->sdu = NULL;
6654 			chan->sdu_last_frag = NULL;
6655 			chan->sdu_len = 0;
6656 		}
6657 	}
6658 
6659 failed:
6660 	if (err) {
6661 		kfree_skb(skb);
6662 		kfree_skb(chan->sdu);
6663 		chan->sdu = NULL;
6664 		chan->sdu_last_frag = NULL;
6665 		chan->sdu_len = 0;
6666 	}
6667 
6668 	/* We can't return an error here since we took care of the skb
6669 	 * freeing internally. An error return would cause the caller to
6670 	 * do a double-free of the skb.
6671 	 */
6672 	return 0;
6673 }
6674 
l2cap_data_channel(struct l2cap_conn * conn,u16 cid,struct sk_buff * skb)6675 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6676 			       struct sk_buff *skb)
6677 {
6678 	struct l2cap_chan *chan;
6679 
6680 	chan = l2cap_get_chan_by_scid(conn, cid);
6681 	if (!chan) {
6682 		BT_DBG("unknown cid 0x%4.4x", cid);
6683 		/* Drop packet and return */
6684 		kfree_skb(skb);
6685 		return;
6686 	}
6687 
6688 	BT_DBG("chan %p, len %d", chan, skb->len);
6689 
6690 	/* If we receive data on a fixed channel before the info req/rsp
6691 	 * procedure is done simply assume that the channel is supported
6692 	 * and mark it as ready.
6693 	 */
6694 	if (chan->chan_type == L2CAP_CHAN_FIXED)
6695 		l2cap_chan_ready(chan);
6696 
6697 	if (chan->state != BT_CONNECTED)
6698 		goto drop;
6699 
6700 	switch (chan->mode) {
6701 	case L2CAP_MODE_LE_FLOWCTL:
6702 	case L2CAP_MODE_EXT_FLOWCTL:
6703 		if (l2cap_ecred_data_rcv(chan, skb) < 0)
6704 			goto drop;
6705 
6706 		goto done;
6707 
6708 	case L2CAP_MODE_BASIC:
6709 		/* If socket recv buffers overflows we drop data here
6710 		 * which is *bad* because L2CAP has to be reliable.
6711 		 * But we don't have any other choice. L2CAP doesn't
6712 		 * provide flow control mechanism. */
6713 
6714 		if (chan->imtu < skb->len) {
6715 			BT_ERR("Dropping L2CAP data: receive buffer overflow");
6716 			goto drop;
6717 		}
6718 
6719 		if (!chan->ops->recv(chan, skb))
6720 			goto done;
6721 		break;
6722 
6723 	case L2CAP_MODE_ERTM:
6724 	case L2CAP_MODE_STREAMING:
6725 		l2cap_data_rcv(chan, skb);
6726 		goto done;
6727 
6728 	default:
6729 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6730 		break;
6731 	}
6732 
6733 drop:
6734 	kfree_skb(skb);
6735 
6736 done:
6737 	l2cap_chan_unlock(chan);
6738 	l2cap_chan_put(chan);
6739 }
6740 
l2cap_conless_channel(struct l2cap_conn * conn,__le16 psm,struct sk_buff * skb)6741 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6742 				  struct sk_buff *skb)
6743 {
6744 	struct hci_conn *hcon = conn->hcon;
6745 	struct l2cap_chan *chan;
6746 
6747 	if (hcon->type != ACL_LINK)
6748 		goto free_skb;
6749 
6750 	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6751 					ACL_LINK);
6752 	if (!chan)
6753 		goto free_skb;
6754 
6755 	BT_DBG("chan %p, len %d", chan, skb->len);
6756 
6757 	l2cap_chan_lock(chan);
6758 
6759 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6760 		goto drop;
6761 
6762 	if (chan->imtu < skb->len)
6763 		goto drop;
6764 
6765 	/* Store remote BD_ADDR and PSM for msg_name */
6766 	bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6767 	bt_cb(skb)->l2cap.psm = psm;
6768 
6769 	if (!chan->ops->recv(chan, skb)) {
6770 		l2cap_chan_unlock(chan);
6771 		l2cap_chan_put(chan);
6772 		return;
6773 	}
6774 
6775 drop:
6776 	l2cap_chan_unlock(chan);
6777 	l2cap_chan_put(chan);
6778 free_skb:
6779 	kfree_skb(skb);
6780 }
6781 
l2cap_recv_frame(struct l2cap_conn * conn,struct sk_buff * skb)6782 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6783 {
6784 	struct l2cap_hdr *lh = (void *) skb->data;
6785 	struct hci_conn *hcon = conn->hcon;
6786 	u16 cid, len;
6787 	__le16 psm;
6788 
6789 	if (hcon->state != BT_CONNECTED) {
6790 		BT_DBG("queueing pending rx skb");
6791 		skb_queue_tail(&conn->pending_rx, skb);
6792 		return;
6793 	}
6794 
6795 	skb_pull(skb, L2CAP_HDR_SIZE);
6796 	cid = __le16_to_cpu(lh->cid);
6797 	len = __le16_to_cpu(lh->len);
6798 
6799 	if (len != skb->len) {
6800 		kfree_skb(skb);
6801 		return;
6802 	}
6803 
6804 	/* Since we can't actively block incoming LE connections we must
6805 	 * at least ensure that we ignore incoming data from them.
6806 	 */
6807 	if (hcon->type == LE_LINK &&
6808 	    hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
6809 				   bdaddr_dst_type(hcon))) {
6810 		kfree_skb(skb);
6811 		return;
6812 	}
6813 
6814 	BT_DBG("len %d, cid 0x%4.4x", len, cid);
6815 
6816 	switch (cid) {
6817 	case L2CAP_CID_SIGNALING:
6818 		l2cap_sig_channel(conn, skb);
6819 		break;
6820 
6821 	case L2CAP_CID_CONN_LESS:
6822 		psm = get_unaligned((__le16 *) skb->data);
6823 		skb_pull(skb, L2CAP_PSMLEN_SIZE);
6824 		l2cap_conless_channel(conn, psm, skb);
6825 		break;
6826 
6827 	case L2CAP_CID_LE_SIGNALING:
6828 		l2cap_le_sig_channel(conn, skb);
6829 		break;
6830 
6831 	default:
6832 		l2cap_data_channel(conn, cid, skb);
6833 		break;
6834 	}
6835 }
6836 
process_pending_rx(struct work_struct * work)6837 static void process_pending_rx(struct work_struct *work)
6838 {
6839 	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6840 					       pending_rx_work);
6841 	struct sk_buff *skb;
6842 
6843 	BT_DBG("");
6844 
6845 	while ((skb = skb_dequeue(&conn->pending_rx)))
6846 		l2cap_recv_frame(conn, skb);
6847 }
6848 
l2cap_conn_add(struct hci_conn * hcon)6849 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6850 {
6851 	struct l2cap_conn *conn = hcon->l2cap_data;
6852 	struct hci_chan *hchan;
6853 
6854 	if (conn)
6855 		return conn;
6856 
6857 	hchan = hci_chan_create(hcon);
6858 	if (!hchan)
6859 		return NULL;
6860 
6861 	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
6862 	if (!conn) {
6863 		hci_chan_del(hchan);
6864 		return NULL;
6865 	}
6866 
6867 	kref_init(&conn->ref);
6868 	hcon->l2cap_data = conn;
6869 	conn->hcon = hci_conn_get(hcon);
6870 	conn->hchan = hchan;
6871 
6872 	BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6873 
6874 	conn->mtu = hcon->mtu;
6875 	conn->feat_mask = 0;
6876 
6877 	conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
6878 
6879 	if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
6880 	    (bredr_sc_enabled(hcon->hdev) ||
6881 	     hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
6882 		conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
6883 
6884 	mutex_init(&conn->ident_lock);
6885 	mutex_init(&conn->chan_lock);
6886 
6887 	INIT_LIST_HEAD(&conn->chan_l);
6888 	INIT_LIST_HEAD(&conn->users);
6889 
6890 	INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
6891 
6892 	skb_queue_head_init(&conn->pending_rx);
6893 	INIT_WORK(&conn->pending_rx_work, process_pending_rx);
6894 	INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
6895 
6896 	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
6897 
6898 	return conn;
6899 }
6900 
is_valid_psm(u16 psm,u8 dst_type)6901 static bool is_valid_psm(u16 psm, u8 dst_type)
6902 {
6903 	if (!psm)
6904 		return false;
6905 
6906 	if (bdaddr_type_is_le(dst_type))
6907 		return (psm <= 0x00ff);
6908 
6909 	/* PSM must be odd and lsb of upper byte must be 0 */
6910 	return ((psm & 0x0101) == 0x0001);
6911 }
6912 
6913 struct l2cap_chan_data {
6914 	struct l2cap_chan *chan;
6915 	struct pid *pid;
6916 	int count;
6917 };
6918 
l2cap_chan_by_pid(struct l2cap_chan * chan,void * data)6919 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
6920 {
6921 	struct l2cap_chan_data *d = data;
6922 	struct pid *pid;
6923 
6924 	if (chan == d->chan)
6925 		return;
6926 
6927 	if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
6928 		return;
6929 
6930 	pid = chan->ops->get_peer_pid(chan);
6931 
6932 	/* Only count deferred channels with the same PID/PSM */
6933 	if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
6934 	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
6935 		return;
6936 
6937 	d->count++;
6938 }
6939 
l2cap_chan_connect(struct l2cap_chan * chan,__le16 psm,u16 cid,bdaddr_t * dst,u8 dst_type)6940 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
6941 		       bdaddr_t *dst, u8 dst_type)
6942 {
6943 	struct l2cap_conn *conn;
6944 	struct hci_conn *hcon;
6945 	struct hci_dev *hdev;
6946 	int err;
6947 
6948 	BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
6949 	       dst, dst_type, __le16_to_cpu(psm), chan->mode);
6950 
6951 	hdev = hci_get_route(dst, &chan->src, chan->src_type);
6952 	if (!hdev)
6953 		return -EHOSTUNREACH;
6954 
6955 	hci_dev_lock(hdev);
6956 
6957 	if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
6958 	    chan->chan_type != L2CAP_CHAN_RAW) {
6959 		err = -EINVAL;
6960 		goto done;
6961 	}
6962 
6963 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
6964 		err = -EINVAL;
6965 		goto done;
6966 	}
6967 
6968 	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
6969 		err = -EINVAL;
6970 		goto done;
6971 	}
6972 
6973 	switch (chan->mode) {
6974 	case L2CAP_MODE_BASIC:
6975 		break;
6976 	case L2CAP_MODE_LE_FLOWCTL:
6977 		break;
6978 	case L2CAP_MODE_EXT_FLOWCTL:
6979 		if (!enable_ecred) {
6980 			err = -EOPNOTSUPP;
6981 			goto done;
6982 		}
6983 		break;
6984 	case L2CAP_MODE_ERTM:
6985 	case L2CAP_MODE_STREAMING:
6986 		if (!disable_ertm)
6987 			break;
6988 		fallthrough;
6989 	default:
6990 		err = -EOPNOTSUPP;
6991 		goto done;
6992 	}
6993 
6994 	switch (chan->state) {
6995 	case BT_CONNECT:
6996 	case BT_CONNECT2:
6997 	case BT_CONFIG:
6998 		/* Already connecting */
6999 		err = 0;
7000 		goto done;
7001 
7002 	case BT_CONNECTED:
7003 		/* Already connected */
7004 		err = -EISCONN;
7005 		goto done;
7006 
7007 	case BT_OPEN:
7008 	case BT_BOUND:
7009 		/* Can connect */
7010 		break;
7011 
7012 	default:
7013 		err = -EBADFD;
7014 		goto done;
7015 	}
7016 
7017 	/* Set destination address and psm */
7018 	bacpy(&chan->dst, dst);
7019 	chan->dst_type = dst_type;
7020 
7021 	chan->psm = psm;
7022 	chan->dcid = cid;
7023 
7024 	if (bdaddr_type_is_le(dst_type)) {
7025 		/* Convert from L2CAP channel address type to HCI address type
7026 		 */
7027 		if (dst_type == BDADDR_LE_PUBLIC)
7028 			dst_type = ADDR_LE_DEV_PUBLIC;
7029 		else
7030 			dst_type = ADDR_LE_DEV_RANDOM;
7031 
7032 		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7033 			hcon = hci_connect_le(hdev, dst, dst_type, false,
7034 					      chan->sec_level,
7035 					      HCI_LE_CONN_TIMEOUT,
7036 					      HCI_ROLE_SLAVE);
7037 		else
7038 			hcon = hci_connect_le_scan(hdev, dst, dst_type,
7039 						   chan->sec_level,
7040 						   HCI_LE_CONN_TIMEOUT,
7041 						   CONN_REASON_L2CAP_CHAN);
7042 
7043 	} else {
7044 		u8 auth_type = l2cap_get_auth_type(chan);
7045 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7046 				       CONN_REASON_L2CAP_CHAN);
7047 	}
7048 
7049 	if (IS_ERR(hcon)) {
7050 		err = PTR_ERR(hcon);
7051 		goto done;
7052 	}
7053 
7054 	conn = l2cap_conn_add(hcon);
7055 	if (!conn) {
7056 		hci_conn_drop(hcon);
7057 		err = -ENOMEM;
7058 		goto done;
7059 	}
7060 
7061 	if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7062 		struct l2cap_chan_data data;
7063 
7064 		data.chan = chan;
7065 		data.pid = chan->ops->get_peer_pid(chan);
7066 		data.count = 1;
7067 
7068 		l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7069 
7070 		/* Check if there isn't too many channels being connected */
7071 		if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7072 			hci_conn_drop(hcon);
7073 			err = -EPROTO;
7074 			goto done;
7075 		}
7076 	}
7077 
7078 	mutex_lock(&conn->chan_lock);
7079 	l2cap_chan_lock(chan);
7080 
7081 	if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7082 		hci_conn_drop(hcon);
7083 		err = -EBUSY;
7084 		goto chan_unlock;
7085 	}
7086 
7087 	/* Update source addr of the socket */
7088 	bacpy(&chan->src, &hcon->src);
7089 	chan->src_type = bdaddr_src_type(hcon);
7090 
7091 	__l2cap_chan_add(conn, chan);
7092 
7093 	/* l2cap_chan_add takes its own ref so we can drop this one */
7094 	hci_conn_drop(hcon);
7095 
7096 	l2cap_state_change(chan, BT_CONNECT);
7097 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7098 
7099 	/* Release chan->sport so that it can be reused by other
7100 	 * sockets (as it's only used for listening sockets).
7101 	 */
7102 	write_lock(&chan_list_lock);
7103 	chan->sport = 0;
7104 	write_unlock(&chan_list_lock);
7105 
7106 	if (hcon->state == BT_CONNECTED) {
7107 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7108 			__clear_chan_timer(chan);
7109 			if (l2cap_chan_check_security(chan, true))
7110 				l2cap_state_change(chan, BT_CONNECTED);
7111 		} else
7112 			l2cap_do_start(chan);
7113 	}
7114 
7115 	err = 0;
7116 
7117 chan_unlock:
7118 	l2cap_chan_unlock(chan);
7119 	mutex_unlock(&conn->chan_lock);
7120 done:
7121 	hci_dev_unlock(hdev);
7122 	hci_dev_put(hdev);
7123 	return err;
7124 }
7125 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7126 
l2cap_ecred_reconfigure(struct l2cap_chan * chan)7127 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
7128 {
7129 	struct l2cap_conn *conn = chan->conn;
7130 	struct {
7131 		struct l2cap_ecred_reconf_req req;
7132 		__le16 scid;
7133 	} pdu;
7134 
7135 	pdu.req.mtu = cpu_to_le16(chan->imtu);
7136 	pdu.req.mps = cpu_to_le16(chan->mps);
7137 	pdu.scid    = cpu_to_le16(chan->scid);
7138 
7139 	chan->ident = l2cap_get_ident(conn);
7140 
7141 	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
7142 		       sizeof(pdu), &pdu);
7143 }
7144 
l2cap_chan_reconfigure(struct l2cap_chan * chan,__u16 mtu)7145 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
7146 {
7147 	if (chan->imtu > mtu)
7148 		return -EINVAL;
7149 
7150 	BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
7151 
7152 	chan->imtu = mtu;
7153 
7154 	l2cap_ecred_reconfigure(chan);
7155 
7156 	return 0;
7157 }
7158 
7159 /* ---- L2CAP interface with lower layer (HCI) ---- */
7160 
l2cap_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr)7161 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7162 {
7163 	int exact = 0, lm1 = 0, lm2 = 0;
7164 	struct l2cap_chan *c;
7165 
7166 	BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7167 
7168 	/* Find listening sockets and check their link_mode */
7169 	read_lock(&chan_list_lock);
7170 	list_for_each_entry(c, &chan_list, global_l) {
7171 		if (c->state != BT_LISTEN)
7172 			continue;
7173 
7174 		if (!bacmp(&c->src, &hdev->bdaddr)) {
7175 			lm1 |= HCI_LM_ACCEPT;
7176 			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7177 				lm1 |= HCI_LM_MASTER;
7178 			exact++;
7179 		} else if (!bacmp(&c->src, BDADDR_ANY)) {
7180 			lm2 |= HCI_LM_ACCEPT;
7181 			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7182 				lm2 |= HCI_LM_MASTER;
7183 		}
7184 	}
7185 	read_unlock(&chan_list_lock);
7186 
7187 	return exact ? lm1 : lm2;
7188 }
7189 
7190 /* Find the next fixed channel in BT_LISTEN state, continue iteration
7191  * from an existing channel in the list or from the beginning of the
7192  * global list (by passing NULL as first parameter).
7193  */
l2cap_global_fixed_chan(struct l2cap_chan * c,struct hci_conn * hcon)7194 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7195 						  struct hci_conn *hcon)
7196 {
7197 	u8 src_type = bdaddr_src_type(hcon);
7198 
7199 	read_lock(&chan_list_lock);
7200 
7201 	if (c)
7202 		c = list_next_entry(c, global_l);
7203 	else
7204 		c = list_entry(chan_list.next, typeof(*c), global_l);
7205 
7206 	list_for_each_entry_from(c, &chan_list, global_l) {
7207 		if (c->chan_type != L2CAP_CHAN_FIXED)
7208 			continue;
7209 		if (c->state != BT_LISTEN)
7210 			continue;
7211 		if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7212 			continue;
7213 		if (src_type != c->src_type)
7214 			continue;
7215 
7216 		c = l2cap_chan_hold_unless_zero(c);
7217 		read_unlock(&chan_list_lock);
7218 		return c;
7219 	}
7220 
7221 	read_unlock(&chan_list_lock);
7222 
7223 	return NULL;
7224 }
7225 
l2cap_connect_cfm(struct hci_conn * hcon,u8 status)7226 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7227 {
7228 	struct hci_dev *hdev = hcon->hdev;
7229 	struct l2cap_conn *conn;
7230 	struct l2cap_chan *pchan;
7231 	u8 dst_type;
7232 
7233 	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7234 		return;
7235 
7236 	BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7237 
7238 	if (status) {
7239 		l2cap_conn_del(hcon, bt_to_errno(status));
7240 		return;
7241 	}
7242 
7243 	conn = l2cap_conn_add(hcon);
7244 	if (!conn)
7245 		return;
7246 
7247 	dst_type = bdaddr_dst_type(hcon);
7248 
7249 	/* If device is blocked, do not create channels for it */
7250 	if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
7251 		return;
7252 
7253 	/* Find fixed channels and notify them of the new connection. We
7254 	 * use multiple individual lookups, continuing each time where
7255 	 * we left off, because the list lock would prevent calling the
7256 	 * potentially sleeping l2cap_chan_lock() function.
7257 	 */
7258 	pchan = l2cap_global_fixed_chan(NULL, hcon);
7259 	while (pchan) {
7260 		struct l2cap_chan *chan, *next;
7261 
7262 		/* Client fixed channels should override server ones */
7263 		if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7264 			goto next;
7265 
7266 		l2cap_chan_lock(pchan);
7267 		chan = pchan->ops->new_connection(pchan);
7268 		if (chan) {
7269 			bacpy(&chan->src, &hcon->src);
7270 			bacpy(&chan->dst, &hcon->dst);
7271 			chan->src_type = bdaddr_src_type(hcon);
7272 			chan->dst_type = dst_type;
7273 
7274 			__l2cap_chan_add(conn, chan);
7275 		}
7276 
7277 		l2cap_chan_unlock(pchan);
7278 next:
7279 		next = l2cap_global_fixed_chan(pchan, hcon);
7280 		l2cap_chan_put(pchan);
7281 		pchan = next;
7282 	}
7283 
7284 	l2cap_conn_ready(conn);
7285 }
7286 
l2cap_disconn_ind(struct hci_conn * hcon)7287 int l2cap_disconn_ind(struct hci_conn *hcon)
7288 {
7289 	struct l2cap_conn *conn = hcon->l2cap_data;
7290 
7291 	BT_DBG("hcon %p", hcon);
7292 
7293 	if (!conn)
7294 		return HCI_ERROR_REMOTE_USER_TERM;
7295 	return conn->disc_reason;
7296 }
7297 
l2cap_disconn_cfm(struct hci_conn * hcon,u8 reason)7298 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7299 {
7300 	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7301 		return;
7302 
7303 	BT_DBG("hcon %p reason %d", hcon, reason);
7304 
7305 	l2cap_conn_del(hcon, bt_to_errno(reason));
7306 }
7307 
l2cap_check_encryption(struct l2cap_chan * chan,u8 encrypt)7308 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7309 {
7310 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7311 		return;
7312 
7313 	if (encrypt == 0x00) {
7314 		if (chan->sec_level == BT_SECURITY_MEDIUM) {
7315 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7316 		} else if (chan->sec_level == BT_SECURITY_HIGH ||
7317 			   chan->sec_level == BT_SECURITY_FIPS)
7318 			l2cap_chan_close(chan, ECONNREFUSED);
7319 	} else {
7320 		if (chan->sec_level == BT_SECURITY_MEDIUM)
7321 			__clear_chan_timer(chan);
7322 	}
7323 }
7324 
l2cap_security_cfm(struct hci_conn * hcon,u8 status,u8 encrypt)7325 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7326 {
7327 	struct l2cap_conn *conn = hcon->l2cap_data;
7328 	struct l2cap_chan *chan;
7329 
7330 	if (!conn)
7331 		return;
7332 
7333 	BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7334 
7335 	mutex_lock(&conn->chan_lock);
7336 
7337 	list_for_each_entry(chan, &conn->chan_l, list) {
7338 		l2cap_chan_lock(chan);
7339 
7340 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7341 		       state_to_string(chan->state));
7342 
7343 		if (!status && encrypt)
7344 			chan->sec_level = hcon->sec_level;
7345 
7346 		if (!__l2cap_no_conn_pending(chan)) {
7347 			l2cap_chan_unlock(chan);
7348 			continue;
7349 		}
7350 
7351 		if (!status && (chan->state == BT_CONNECTED ||
7352 				chan->state == BT_CONFIG)) {
7353 			chan->ops->resume(chan);
7354 			l2cap_check_encryption(chan, encrypt);
7355 			l2cap_chan_unlock(chan);
7356 			continue;
7357 		}
7358 
7359 		if (chan->state == BT_CONNECT) {
7360 			if (!status && l2cap_check_enc_key_size(hcon))
7361 				l2cap_start_connection(chan);
7362 			else
7363 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7364 		} else if (chan->state == BT_CONNECT2 &&
7365 			   !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
7366 			     chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
7367 			struct l2cap_conn_rsp rsp;
7368 			__u16 res, stat;
7369 
7370 			if (!status && l2cap_check_enc_key_size(hcon)) {
7371 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
7372 					res = L2CAP_CR_PEND;
7373 					stat = L2CAP_CS_AUTHOR_PEND;
7374 					chan->ops->defer(chan);
7375 				} else {
7376 					l2cap_state_change(chan, BT_CONFIG);
7377 					res = L2CAP_CR_SUCCESS;
7378 					stat = L2CAP_CS_NO_INFO;
7379 				}
7380 			} else {
7381 				l2cap_state_change(chan, BT_DISCONN);
7382 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7383 				res = L2CAP_CR_SEC_BLOCK;
7384 				stat = L2CAP_CS_NO_INFO;
7385 			}
7386 
7387 			rsp.scid   = cpu_to_le16(chan->dcid);
7388 			rsp.dcid   = cpu_to_le16(chan->scid);
7389 			rsp.result = cpu_to_le16(res);
7390 			rsp.status = cpu_to_le16(stat);
7391 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7392 				       sizeof(rsp), &rsp);
7393 
7394 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7395 			    res == L2CAP_CR_SUCCESS) {
7396 				char buf[128];
7397 				set_bit(CONF_REQ_SENT, &chan->conf_state);
7398 				l2cap_send_cmd(conn, l2cap_get_ident(conn),
7399 					       L2CAP_CONF_REQ,
7400 					       l2cap_build_conf_req(chan, buf, sizeof(buf)),
7401 					       buf);
7402 				chan->num_conf_req++;
7403 			}
7404 		}
7405 
7406 		l2cap_chan_unlock(chan);
7407 	}
7408 
7409 	mutex_unlock(&conn->chan_lock);
7410 }
7411 
7412 /* Append fragment into frame respecting the maximum len of rx_skb */
l2cap_recv_frag(struct l2cap_conn * conn,struct sk_buff * skb,u16 len)7413 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
7414 			   u16 len)
7415 {
7416 	if (!conn->rx_skb) {
7417 		/* Allocate skb for the complete frame (with header) */
7418 		conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7419 		if (!conn->rx_skb)
7420 			return -ENOMEM;
7421 		/* Init rx_len */
7422 		conn->rx_len = len;
7423 	}
7424 
7425 	/* Copy as much as the rx_skb can hold */
7426 	len = min_t(u16, len, skb->len);
7427 	skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
7428 	skb_pull(skb, len);
7429 	conn->rx_len -= len;
7430 
7431 	return len;
7432 }
7433 
l2cap_recv_len(struct l2cap_conn * conn,struct sk_buff * skb)7434 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
7435 {
7436 	struct sk_buff *rx_skb;
7437 	int len;
7438 
7439 	/* Append just enough to complete the header */
7440 	len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
7441 
7442 	/* If header could not be read just continue */
7443 	if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
7444 		return len;
7445 
7446 	rx_skb = conn->rx_skb;
7447 	len = get_unaligned_le16(rx_skb->data);
7448 
7449 	/* Check if rx_skb has enough space to received all fragments */
7450 	if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
7451 		/* Update expected len */
7452 		conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
7453 		return L2CAP_LEN_SIZE;
7454 	}
7455 
7456 	/* Reset conn->rx_skb since it will need to be reallocated in order to
7457 	 * fit all fragments.
7458 	 */
7459 	conn->rx_skb = NULL;
7460 
7461 	/* Reallocates rx_skb using the exact expected length */
7462 	len = l2cap_recv_frag(conn, rx_skb,
7463 			      len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
7464 	kfree_skb(rx_skb);
7465 
7466 	return len;
7467 }
7468 
l2cap_recv_reset(struct l2cap_conn * conn)7469 static void l2cap_recv_reset(struct l2cap_conn *conn)
7470 {
7471 	kfree_skb(conn->rx_skb);
7472 	conn->rx_skb = NULL;
7473 	conn->rx_len = 0;
7474 }
7475 
l2cap_recv_acldata(struct hci_conn * hcon,struct sk_buff * skb,u16 flags)7476 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
7477 {
7478 	struct l2cap_conn *conn = hcon->l2cap_data;
7479 	int len;
7480 
7481 	if (!conn)
7482 		conn = l2cap_conn_add(hcon);
7483 
7484 	if (!conn)
7485 		goto drop;
7486 
7487 	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
7488 
7489 	switch (flags) {
7490 	case ACL_START:
7491 	case ACL_START_NO_FLUSH:
7492 	case ACL_COMPLETE:
7493 		if (conn->rx_skb) {
7494 			BT_ERR("Unexpected start frame (len %d)", skb->len);
7495 			l2cap_recv_reset(conn);
7496 			l2cap_conn_unreliable(conn, ECOMM);
7497 		}
7498 
7499 		/* Start fragment may not contain the L2CAP length so just
7500 		 * copy the initial byte when that happens and use conn->mtu as
7501 		 * expected length.
7502 		 */
7503 		if (skb->len < L2CAP_LEN_SIZE) {
7504 			l2cap_recv_frag(conn, skb, conn->mtu);
7505 			break;
7506 		}
7507 
7508 		len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
7509 
7510 		if (len == skb->len) {
7511 			/* Complete frame received */
7512 			l2cap_recv_frame(conn, skb);
7513 			return;
7514 		}
7515 
7516 		BT_DBG("Start: total len %d, frag len %u", len, skb->len);
7517 
7518 		if (skb->len > len) {
7519 			BT_ERR("Frame is too long (len %u, expected len %d)",
7520 			       skb->len, len);
7521 			l2cap_conn_unreliable(conn, ECOMM);
7522 			goto drop;
7523 		}
7524 
7525 		/* Append fragment into frame (with header) */
7526 		if (l2cap_recv_frag(conn, skb, len) < 0)
7527 			goto drop;
7528 
7529 		break;
7530 
7531 	case ACL_CONT:
7532 		BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
7533 
7534 		if (!conn->rx_skb) {
7535 			BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7536 			l2cap_conn_unreliable(conn, ECOMM);
7537 			goto drop;
7538 		}
7539 
7540 		/* Complete the L2CAP length if it has not been read */
7541 		if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
7542 			if (l2cap_recv_len(conn, skb) < 0) {
7543 				l2cap_conn_unreliable(conn, ECOMM);
7544 				goto drop;
7545 			}
7546 
7547 			/* Header still could not be read just continue */
7548 			if (conn->rx_skb->len < L2CAP_LEN_SIZE)
7549 				break;
7550 		}
7551 
7552 		if (skb->len > conn->rx_len) {
7553 			BT_ERR("Fragment is too long (len %u, expected %u)",
7554 			       skb->len, conn->rx_len);
7555 			l2cap_recv_reset(conn);
7556 			l2cap_conn_unreliable(conn, ECOMM);
7557 			goto drop;
7558 		}
7559 
7560 		/* Append fragment into frame (with header) */
7561 		l2cap_recv_frag(conn, skb, skb->len);
7562 
7563 		if (!conn->rx_len) {
7564 			/* Complete frame received. l2cap_recv_frame
7565 			 * takes ownership of the skb so set the global
7566 			 * rx_skb pointer to NULL first.
7567 			 */
7568 			struct sk_buff *rx_skb = conn->rx_skb;
7569 			conn->rx_skb = NULL;
7570 			l2cap_recv_frame(conn, rx_skb);
7571 		}
7572 		break;
7573 	}
7574 
7575 drop:
7576 	kfree_skb(skb);
7577 }
7578 
7579 static struct hci_cb l2cap_cb = {
7580 	.name		= "L2CAP",
7581 	.connect_cfm	= l2cap_connect_cfm,
7582 	.disconn_cfm	= l2cap_disconn_cfm,
7583 	.security_cfm	= l2cap_security_cfm,
7584 };
7585 
l2cap_debugfs_show(struct seq_file * f,void * p)7586 static int l2cap_debugfs_show(struct seq_file *f, void *p)
7587 {
7588 	struct l2cap_chan *c;
7589 
7590 	read_lock(&chan_list_lock);
7591 
7592 	list_for_each_entry(c, &chan_list, global_l) {
7593 		seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7594 			   &c->src, c->src_type, &c->dst, c->dst_type,
7595 			   c->state, __le16_to_cpu(c->psm),
7596 			   c->scid, c->dcid, c->imtu, c->omtu,
7597 			   c->sec_level, c->mode);
7598 	}
7599 
7600 	read_unlock(&chan_list_lock);
7601 
7602 	return 0;
7603 }
7604 
7605 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
7606 
7607 static struct dentry *l2cap_debugfs;
7608 
l2cap_init(void)7609 int __init l2cap_init(void)
7610 {
7611 	int err;
7612 
7613 	err = l2cap_init_sockets();
7614 	if (err < 0)
7615 		return err;
7616 
7617 	hci_register_cb(&l2cap_cb);
7618 
7619 	if (IS_ERR_OR_NULL(bt_debugfs))
7620 		return 0;
7621 
7622 	l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7623 					    NULL, &l2cap_debugfs_fops);
7624 
7625 	return 0;
7626 }
7627 
l2cap_exit(void)7628 void l2cap_exit(void)
7629 {
7630 	debugfs_remove(l2cap_debugfs);
7631 	hci_unregister_cb(&l2cap_cb);
7632 	l2cap_cleanup_sockets();
7633 }
7634 
7635 module_param(disable_ertm, bool, 0644);
7636 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
7637 
7638 module_param(enable_ecred, bool, 0644);
7639 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
7640