1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 5 Copyright (C) 2010 Google Inc. 6 Copyright (C) 2011 ProFUSION Embedded Systems 7 8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 9 10 This program is free software; you can redistribute it and/or modify 11 it under the terms of the GNU General Public License version 2 as 12 published by the Free Software Foundation; 13 14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 22 23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 25 SOFTWARE IS DISCLAIMED. 26 */ 27 28 /* Bluetooth L2CAP sockets. */ 29 30 #include <linux/module.h> 31 #include <linux/export.h> 32 33 #include <net/bluetooth/bluetooth.h> 34 #include <net/bluetooth/hci_core.h> 35 #include <net/bluetooth/l2cap.h> 36 37 #include "smp.h" 38 39 static struct bt_sock_list l2cap_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock) 41 }; 42 43 static const struct proto_ops l2cap_sock_ops; 44 static void l2cap_sock_init(struct sock *sk, struct sock *parent); 45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 46 int proto, gfp_t prio); 47 48 bool l2cap_is_socket(struct socket *sock) 49 { 50 return sock && sock->ops == &l2cap_sock_ops; 51 } 52 EXPORT_SYMBOL(l2cap_is_socket); 53 54 static int l2cap_validate_bredr_psm(u16 psm) 55 { 56 /* PSM must be odd and lsb of upper byte must be 0 */ 57 if ((psm & 0x0101) != 0x0001) 58 return -EINVAL; 59 60 /* Restrict usage of well-known PSMs */ 61 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) 62 return -EACCES; 63 64 return 0; 65 } 66 67 static int l2cap_validate_le_psm(u16 psm) 68 { 69 /* Valid LE_PSM ranges are defined only until 0x00ff */ 70 if (psm > 0x00ff) 71 return -EINVAL; 72 73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */ 74 if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE)) 75 return -EACCES; 76 77 return 0; 78 } 79 80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) 81 { 82 struct sock *sk = sock->sk; 83 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 84 struct sockaddr_l2 la; 85 int len, err = 0; 86 87 BT_DBG("sk %p", sk); 88 89 if (!addr || addr->sa_family != AF_BLUETOOTH) 90 return -EINVAL; 91 92 memset(&la, 0, sizeof(la)); 93 len = min_t(unsigned int, sizeof(la), alen); 94 memcpy(&la, addr, len); 95 96 if (la.l2_cid && la.l2_psm) 97 return -EINVAL; 98 99 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 100 return -EINVAL; 101 102 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 103 /* We only allow ATT user space socket */ 104 if (la.l2_cid && 105 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 106 return -EINVAL; 107 } 108 109 lock_sock(sk); 110 111 if (sk->sk_state != BT_OPEN) { 112 err = -EBADFD; 113 goto done; 114 } 115 116 if (la.l2_psm) { 117 __u16 psm = __le16_to_cpu(la.l2_psm); 118 119 if (la.l2_bdaddr_type == BDADDR_BREDR) 120 err = l2cap_validate_bredr_psm(psm); 121 else 122 err = l2cap_validate_le_psm(psm); 123 124 if (err) 125 goto done; 126 } 127 128 if (la.l2_cid) 129 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid)); 130 else 131 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm); 132 133 if (err < 0) 134 goto done; 135 136 switch (chan->chan_type) { 137 case L2CAP_CHAN_CONN_LESS: 138 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP) 139 chan->sec_level = BT_SECURITY_SDP; 140 break; 141 case L2CAP_CHAN_CONN_ORIENTED: 142 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP || 143 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM) 144 chan->sec_level = BT_SECURITY_SDP; 145 break; 146 case L2CAP_CHAN_RAW: 147 chan->sec_level = BT_SECURITY_SDP; 148 break; 149 case L2CAP_CHAN_FIXED: 150 /* Fixed channels default to the L2CAP core not holding a 151 * hci_conn reference for them. For fixed channels mapping to 152 * L2CAP sockets we do want to hold a reference so set the 153 * appropriate flag to request it. 154 */ 155 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags); 156 break; 157 } 158 159 bacpy(&chan->src, &la.l2_bdaddr); 160 chan->src_type = la.l2_bdaddr_type; 161 162 if (chan->psm && bdaddr_type_is_le(chan->src_type)) 163 chan->mode = L2CAP_MODE_LE_FLOWCTL; 164 165 chan->state = BT_BOUND; 166 sk->sk_state = BT_BOUND; 167 168 done: 169 release_sock(sk); 170 return err; 171 } 172 173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, 174 int alen, int flags) 175 { 176 struct sock *sk = sock->sk; 177 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 178 struct sockaddr_l2 la; 179 int len, err = 0; 180 181 BT_DBG("sk %p", sk); 182 183 if (!addr || alen < sizeof(addr->sa_family) || 184 addr->sa_family != AF_BLUETOOTH) 185 return -EINVAL; 186 187 memset(&la, 0, sizeof(la)); 188 len = min_t(unsigned int, sizeof(la), alen); 189 memcpy(&la, addr, len); 190 191 if (la.l2_cid && la.l2_psm) 192 return -EINVAL; 193 194 if (!bdaddr_type_is_valid(la.l2_bdaddr_type)) 195 return -EINVAL; 196 197 /* Check that the socket wasn't bound to something that 198 * conflicts with the address given to connect(). If chan->src 199 * is BDADDR_ANY it means bind() was never used, in which case 200 * chan->src_type and la.l2_bdaddr_type do not need to match. 201 */ 202 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) && 203 bdaddr_type_is_le(la.l2_bdaddr_type)) { 204 /* Old user space versions will try to incorrectly bind 205 * the ATT socket using BDADDR_BREDR. We need to accept 206 * this and fix up the source address type only when 207 * both the source CID and destination CID indicate 208 * ATT. Anything else is an invalid combination. 209 */ 210 if (chan->scid != L2CAP_CID_ATT || 211 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 212 return -EINVAL; 213 214 /* We don't have the hdev available here to make a 215 * better decision on random vs public, but since all 216 * user space versions that exhibit this issue anyway do 217 * not support random local addresses assuming public 218 * here is good enough. 219 */ 220 chan->src_type = BDADDR_LE_PUBLIC; 221 } 222 223 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR) 224 return -EINVAL; 225 226 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 227 /* We only allow ATT user space socket */ 228 if (la.l2_cid && 229 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT)) 230 return -EINVAL; 231 } 232 233 if (chan->psm && bdaddr_type_is_le(chan->src_type)) 234 chan->mode = L2CAP_MODE_LE_FLOWCTL; 235 236 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid), 237 &la.l2_bdaddr, la.l2_bdaddr_type); 238 if (err) 239 return err; 240 241 lock_sock(sk); 242 243 err = bt_sock_wait_state(sk, BT_CONNECTED, 244 sock_sndtimeo(sk, flags & O_NONBLOCK)); 245 246 release_sock(sk); 247 248 return err; 249 } 250 251 static int l2cap_sock_listen(struct socket *sock, int backlog) 252 { 253 struct sock *sk = sock->sk; 254 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 255 int err = 0; 256 257 BT_DBG("sk %p backlog %d", sk, backlog); 258 259 lock_sock(sk); 260 261 if (sk->sk_state != BT_BOUND) { 262 err = -EBADFD; 263 goto done; 264 } 265 266 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) { 267 err = -EINVAL; 268 goto done; 269 } 270 271 switch (chan->mode) { 272 case L2CAP_MODE_BASIC: 273 case L2CAP_MODE_LE_FLOWCTL: 274 break; 275 case L2CAP_MODE_ERTM: 276 case L2CAP_MODE_STREAMING: 277 if (!disable_ertm) 278 break; 279 /* fall through */ 280 default: 281 err = -EOPNOTSUPP; 282 goto done; 283 } 284 285 sk->sk_max_ack_backlog = backlog; 286 sk->sk_ack_backlog = 0; 287 288 chan->state = BT_LISTEN; 289 sk->sk_state = BT_LISTEN; 290 291 done: 292 release_sock(sk); 293 return err; 294 } 295 296 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, 297 int flags) 298 { 299 DECLARE_WAITQUEUE(wait, current); 300 struct sock *sk = sock->sk, *nsk; 301 long timeo; 302 int err = 0; 303 304 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 305 306 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 307 308 BT_DBG("sk %p timeo %ld", sk, timeo); 309 310 /* Wait for an incoming connection. (wake-one). */ 311 add_wait_queue_exclusive(sk_sleep(sk), &wait); 312 while (1) { 313 set_current_state(TASK_INTERRUPTIBLE); 314 315 if (sk->sk_state != BT_LISTEN) { 316 err = -EBADFD; 317 break; 318 } 319 320 nsk = bt_accept_dequeue(sk, newsock); 321 if (nsk) 322 break; 323 324 if (!timeo) { 325 err = -EAGAIN; 326 break; 327 } 328 329 if (signal_pending(current)) { 330 err = sock_intr_errno(timeo); 331 break; 332 } 333 334 release_sock(sk); 335 timeo = schedule_timeout(timeo); 336 lock_sock_nested(sk, SINGLE_DEPTH_NESTING); 337 } 338 __set_current_state(TASK_RUNNING); 339 remove_wait_queue(sk_sleep(sk), &wait); 340 341 if (err) 342 goto done; 343 344 newsock->state = SS_CONNECTED; 345 346 BT_DBG("new socket %p", nsk); 347 348 done: 349 release_sock(sk); 350 return err; 351 } 352 353 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, 354 int *len, int peer) 355 { 356 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr; 357 struct sock *sk = sock->sk; 358 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 359 360 BT_DBG("sock %p, sk %p", sock, sk); 361 362 if (peer && sk->sk_state != BT_CONNECTED && 363 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 && 364 sk->sk_state != BT_CONFIG) 365 return -ENOTCONN; 366 367 memset(la, 0, sizeof(struct sockaddr_l2)); 368 addr->sa_family = AF_BLUETOOTH; 369 *len = sizeof(struct sockaddr_l2); 370 371 la->l2_psm = chan->psm; 372 373 if (peer) { 374 bacpy(&la->l2_bdaddr, &chan->dst); 375 la->l2_cid = cpu_to_le16(chan->dcid); 376 la->l2_bdaddr_type = chan->dst_type; 377 } else { 378 bacpy(&la->l2_bdaddr, &chan->src); 379 la->l2_cid = cpu_to_le16(chan->scid); 380 la->l2_bdaddr_type = chan->src_type; 381 } 382 383 return 0; 384 } 385 386 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, 387 char __user *optval, int __user *optlen) 388 { 389 struct sock *sk = sock->sk; 390 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 391 struct l2cap_options opts; 392 struct l2cap_conninfo cinfo; 393 int len, err = 0; 394 u32 opt; 395 396 BT_DBG("sk %p", sk); 397 398 if (get_user(len, optlen)) 399 return -EFAULT; 400 401 lock_sock(sk); 402 403 switch (optname) { 404 case L2CAP_OPTIONS: 405 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since 406 * legacy ATT code depends on getsockopt for 407 * L2CAP_OPTIONS we need to let this pass. 408 */ 409 if (bdaddr_type_is_le(chan->src_type) && 410 chan->scid != L2CAP_CID_ATT) { 411 err = -EINVAL; 412 break; 413 } 414 415 memset(&opts, 0, sizeof(opts)); 416 opts.imtu = chan->imtu; 417 opts.omtu = chan->omtu; 418 opts.flush_to = chan->flush_to; 419 opts.mode = chan->mode; 420 opts.fcs = chan->fcs; 421 opts.max_tx = chan->max_tx; 422 opts.txwin_size = chan->tx_win; 423 424 len = min_t(unsigned int, len, sizeof(opts)); 425 if (copy_to_user(optval, (char *) &opts, len)) 426 err = -EFAULT; 427 428 break; 429 430 case L2CAP_LM: 431 switch (chan->sec_level) { 432 case BT_SECURITY_LOW: 433 opt = L2CAP_LM_AUTH; 434 break; 435 case BT_SECURITY_MEDIUM: 436 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT; 437 break; 438 case BT_SECURITY_HIGH: 439 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 440 L2CAP_LM_SECURE; 441 break; 442 case BT_SECURITY_FIPS: 443 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT | 444 L2CAP_LM_SECURE | L2CAP_LM_FIPS; 445 break; 446 default: 447 opt = 0; 448 break; 449 } 450 451 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags)) 452 opt |= L2CAP_LM_MASTER; 453 454 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 455 opt |= L2CAP_LM_RELIABLE; 456 457 if (put_user(opt, (u32 __user *) optval)) 458 err = -EFAULT; 459 460 break; 461 462 case L2CAP_CONNINFO: 463 if (sk->sk_state != BT_CONNECTED && 464 !(sk->sk_state == BT_CONNECT2 && 465 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 466 err = -ENOTCONN; 467 break; 468 } 469 470 memset(&cinfo, 0, sizeof(cinfo)); 471 cinfo.hci_handle = chan->conn->hcon->handle; 472 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3); 473 474 len = min_t(unsigned int, len, sizeof(cinfo)); 475 if (copy_to_user(optval, (char *) &cinfo, len)) 476 err = -EFAULT; 477 478 break; 479 480 default: 481 err = -ENOPROTOOPT; 482 break; 483 } 484 485 release_sock(sk); 486 return err; 487 } 488 489 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, 490 char __user *optval, int __user *optlen) 491 { 492 struct sock *sk = sock->sk; 493 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 494 struct bt_security sec; 495 struct bt_power pwr; 496 int len, err = 0; 497 498 BT_DBG("sk %p", sk); 499 500 if (level == SOL_L2CAP) 501 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen); 502 503 if (level != SOL_BLUETOOTH) 504 return -ENOPROTOOPT; 505 506 if (get_user(len, optlen)) 507 return -EFAULT; 508 509 lock_sock(sk); 510 511 switch (optname) { 512 case BT_SECURITY: 513 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 514 chan->chan_type != L2CAP_CHAN_FIXED && 515 chan->chan_type != L2CAP_CHAN_RAW) { 516 err = -EINVAL; 517 break; 518 } 519 520 memset(&sec, 0, sizeof(sec)); 521 if (chan->conn) { 522 sec.level = chan->conn->hcon->sec_level; 523 524 if (sk->sk_state == BT_CONNECTED) 525 sec.key_size = chan->conn->hcon->enc_key_size; 526 } else { 527 sec.level = chan->sec_level; 528 } 529 530 len = min_t(unsigned int, len, sizeof(sec)); 531 if (copy_to_user(optval, (char *) &sec, len)) 532 err = -EFAULT; 533 534 break; 535 536 case BT_DEFER_SETUP: 537 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 538 err = -EINVAL; 539 break; 540 } 541 542 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags), 543 (u32 __user *) optval)) 544 err = -EFAULT; 545 546 break; 547 548 case BT_FLUSHABLE: 549 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags), 550 (u32 __user *) optval)) 551 err = -EFAULT; 552 553 break; 554 555 case BT_POWER: 556 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM 557 && sk->sk_type != SOCK_RAW) { 558 err = -EINVAL; 559 break; 560 } 561 562 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 563 564 len = min_t(unsigned int, len, sizeof(pwr)); 565 if (copy_to_user(optval, (char *) &pwr, len)) 566 err = -EFAULT; 567 568 break; 569 570 case BT_CHANNEL_POLICY: 571 if (put_user(chan->chan_policy, (u32 __user *) optval)) 572 err = -EFAULT; 573 break; 574 575 case BT_SNDMTU: 576 if (!bdaddr_type_is_le(chan->src_type)) { 577 err = -EINVAL; 578 break; 579 } 580 581 if (sk->sk_state != BT_CONNECTED) { 582 err = -ENOTCONN; 583 break; 584 } 585 586 if (put_user(chan->omtu, (u16 __user *) optval)) 587 err = -EFAULT; 588 break; 589 590 case BT_RCVMTU: 591 if (!bdaddr_type_is_le(chan->src_type)) { 592 err = -EINVAL; 593 break; 594 } 595 596 if (put_user(chan->imtu, (u16 __user *) optval)) 597 err = -EFAULT; 598 break; 599 600 default: 601 err = -ENOPROTOOPT; 602 break; 603 } 604 605 release_sock(sk); 606 return err; 607 } 608 609 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu) 610 { 611 switch (chan->scid) { 612 case L2CAP_CID_ATT: 613 if (mtu < L2CAP_LE_MIN_MTU) 614 return false; 615 break; 616 617 default: 618 if (mtu < L2CAP_DEFAULT_MIN_MTU) 619 return false; 620 } 621 622 return true; 623 } 624 625 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, 626 char __user *optval, unsigned int optlen) 627 { 628 struct sock *sk = sock->sk; 629 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 630 struct l2cap_options opts; 631 int len, err = 0; 632 u32 opt; 633 634 BT_DBG("sk %p", sk); 635 636 lock_sock(sk); 637 638 switch (optname) { 639 case L2CAP_OPTIONS: 640 if (bdaddr_type_is_le(chan->src_type)) { 641 err = -EINVAL; 642 break; 643 } 644 645 if (sk->sk_state == BT_CONNECTED) { 646 err = -EINVAL; 647 break; 648 } 649 650 opts.imtu = chan->imtu; 651 opts.omtu = chan->omtu; 652 opts.flush_to = chan->flush_to; 653 opts.mode = chan->mode; 654 opts.fcs = chan->fcs; 655 opts.max_tx = chan->max_tx; 656 opts.txwin_size = chan->tx_win; 657 658 len = min_t(unsigned int, sizeof(opts), optlen); 659 if (copy_from_user((char *) &opts, optval, len)) { 660 err = -EFAULT; 661 break; 662 } 663 664 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { 665 err = -EINVAL; 666 break; 667 } 668 669 if (!l2cap_valid_mtu(chan, opts.imtu)) { 670 err = -EINVAL; 671 break; 672 } 673 674 chan->mode = opts.mode; 675 switch (chan->mode) { 676 case L2CAP_MODE_LE_FLOWCTL: 677 break; 678 case L2CAP_MODE_BASIC: 679 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); 680 break; 681 case L2CAP_MODE_ERTM: 682 case L2CAP_MODE_STREAMING: 683 if (!disable_ertm) 684 break; 685 /* fall through */ 686 default: 687 err = -EINVAL; 688 break; 689 } 690 691 chan->imtu = opts.imtu; 692 chan->omtu = opts.omtu; 693 chan->fcs = opts.fcs; 694 chan->max_tx = opts.max_tx; 695 chan->tx_win = opts.txwin_size; 696 chan->flush_to = opts.flush_to; 697 break; 698 699 case L2CAP_LM: 700 if (get_user(opt, (u32 __user *) optval)) { 701 err = -EFAULT; 702 break; 703 } 704 705 if (opt & L2CAP_LM_FIPS) { 706 err = -EINVAL; 707 break; 708 } 709 710 if (opt & L2CAP_LM_AUTH) 711 chan->sec_level = BT_SECURITY_LOW; 712 if (opt & L2CAP_LM_ENCRYPT) 713 chan->sec_level = BT_SECURITY_MEDIUM; 714 if (opt & L2CAP_LM_SECURE) 715 chan->sec_level = BT_SECURITY_HIGH; 716 717 if (opt & L2CAP_LM_MASTER) 718 set_bit(FLAG_ROLE_SWITCH, &chan->flags); 719 else 720 clear_bit(FLAG_ROLE_SWITCH, &chan->flags); 721 722 if (opt & L2CAP_LM_RELIABLE) 723 set_bit(FLAG_FORCE_RELIABLE, &chan->flags); 724 else 725 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags); 726 break; 727 728 default: 729 err = -ENOPROTOOPT; 730 break; 731 } 732 733 release_sock(sk); 734 return err; 735 } 736 737 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, 738 char __user *optval, unsigned int optlen) 739 { 740 struct sock *sk = sock->sk; 741 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 742 struct bt_security sec; 743 struct bt_power pwr; 744 struct l2cap_conn *conn; 745 int len, err = 0; 746 u32 opt; 747 748 BT_DBG("sk %p", sk); 749 750 if (level == SOL_L2CAP) 751 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen); 752 753 if (level != SOL_BLUETOOTH) 754 return -ENOPROTOOPT; 755 756 lock_sock(sk); 757 758 switch (optname) { 759 case BT_SECURITY: 760 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 761 chan->chan_type != L2CAP_CHAN_FIXED && 762 chan->chan_type != L2CAP_CHAN_RAW) { 763 err = -EINVAL; 764 break; 765 } 766 767 sec.level = BT_SECURITY_LOW; 768 769 len = min_t(unsigned int, sizeof(sec), optlen); 770 if (copy_from_user((char *) &sec, optval, len)) { 771 err = -EFAULT; 772 break; 773 } 774 775 if (sec.level < BT_SECURITY_LOW || 776 sec.level > BT_SECURITY_HIGH) { 777 err = -EINVAL; 778 break; 779 } 780 781 chan->sec_level = sec.level; 782 783 if (!chan->conn) 784 break; 785 786 conn = chan->conn; 787 788 /*change security for LE channels */ 789 if (chan->scid == L2CAP_CID_ATT) { 790 if (smp_conn_security(conn->hcon, sec.level)) 791 break; 792 set_bit(FLAG_PENDING_SECURITY, &chan->flags); 793 sk->sk_state = BT_CONFIG; 794 chan->state = BT_CONFIG; 795 796 /* or for ACL link */ 797 } else if ((sk->sk_state == BT_CONNECT2 && 798 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) || 799 sk->sk_state == BT_CONNECTED) { 800 if (!l2cap_chan_check_security(chan, true)) 801 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 802 else 803 sk->sk_state_change(sk); 804 } else { 805 err = -EINVAL; 806 } 807 break; 808 809 case BT_DEFER_SETUP: 810 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 811 err = -EINVAL; 812 break; 813 } 814 815 if (get_user(opt, (u32 __user *) optval)) { 816 err = -EFAULT; 817 break; 818 } 819 820 if (opt) { 821 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 822 set_bit(FLAG_DEFER_SETUP, &chan->flags); 823 } else { 824 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 825 clear_bit(FLAG_DEFER_SETUP, &chan->flags); 826 } 827 break; 828 829 case BT_FLUSHABLE: 830 if (get_user(opt, (u32 __user *) optval)) { 831 err = -EFAULT; 832 break; 833 } 834 835 if (opt > BT_FLUSHABLE_ON) { 836 err = -EINVAL; 837 break; 838 } 839 840 if (opt == BT_FLUSHABLE_OFF) { 841 conn = chan->conn; 842 /* proceed further only when we have l2cap_conn and 843 No Flush support in the LM */ 844 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) { 845 err = -EINVAL; 846 break; 847 } 848 } 849 850 if (opt) 851 set_bit(FLAG_FLUSHABLE, &chan->flags); 852 else 853 clear_bit(FLAG_FLUSHABLE, &chan->flags); 854 break; 855 856 case BT_POWER: 857 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED && 858 chan->chan_type != L2CAP_CHAN_RAW) { 859 err = -EINVAL; 860 break; 861 } 862 863 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; 864 865 len = min_t(unsigned int, sizeof(pwr), optlen); 866 if (copy_from_user((char *) &pwr, optval, len)) { 867 err = -EFAULT; 868 break; 869 } 870 871 if (pwr.force_active) 872 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 873 else 874 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags); 875 break; 876 877 case BT_CHANNEL_POLICY: 878 if (get_user(opt, (u32 __user *) optval)) { 879 err = -EFAULT; 880 break; 881 } 882 883 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) { 884 err = -EINVAL; 885 break; 886 } 887 888 if (chan->mode != L2CAP_MODE_ERTM && 889 chan->mode != L2CAP_MODE_STREAMING) { 890 err = -EOPNOTSUPP; 891 break; 892 } 893 894 chan->chan_policy = (u8) opt; 895 896 if (sk->sk_state == BT_CONNECTED && 897 chan->move_role == L2CAP_MOVE_ROLE_NONE) 898 l2cap_move_start(chan); 899 900 break; 901 902 case BT_SNDMTU: 903 if (!bdaddr_type_is_le(chan->src_type)) { 904 err = -EINVAL; 905 break; 906 } 907 908 /* Setting is not supported as it's the remote side that 909 * decides this. 910 */ 911 err = -EPERM; 912 break; 913 914 case BT_RCVMTU: 915 if (!bdaddr_type_is_le(chan->src_type)) { 916 err = -EINVAL; 917 break; 918 } 919 920 if (sk->sk_state == BT_CONNECTED) { 921 err = -EISCONN; 922 break; 923 } 924 925 if (get_user(opt, (u32 __user *) optval)) { 926 err = -EFAULT; 927 break; 928 } 929 930 chan->imtu = opt; 931 break; 932 933 default: 934 err = -ENOPROTOOPT; 935 break; 936 } 937 938 release_sock(sk); 939 return err; 940 } 941 942 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 943 struct msghdr *msg, size_t len) 944 { 945 struct sock *sk = sock->sk; 946 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 947 int err; 948 949 BT_DBG("sock %p, sk %p", sock, sk); 950 951 err = sock_error(sk); 952 if (err) 953 return err; 954 955 if (msg->msg_flags & MSG_OOB) 956 return -EOPNOTSUPP; 957 958 if (sk->sk_state != BT_CONNECTED) 959 return -ENOTCONN; 960 961 lock_sock(sk); 962 err = bt_sock_wait_ready(sk, msg->msg_flags); 963 release_sock(sk); 964 if (err) 965 return err; 966 967 l2cap_chan_lock(chan); 968 err = l2cap_chan_send(chan, msg, len); 969 l2cap_chan_unlock(chan); 970 971 return err; 972 } 973 974 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 975 struct msghdr *msg, size_t len, int flags) 976 { 977 struct sock *sk = sock->sk; 978 struct l2cap_pinfo *pi = l2cap_pi(sk); 979 int err; 980 981 lock_sock(sk); 982 983 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP, 984 &bt_sk(sk)->flags)) { 985 if (bdaddr_type_is_le(pi->chan->src_type)) { 986 sk->sk_state = BT_CONNECTED; 987 pi->chan->state = BT_CONNECTED; 988 __l2cap_le_connect_rsp_defer(pi->chan); 989 } else { 990 sk->sk_state = BT_CONFIG; 991 pi->chan->state = BT_CONFIG; 992 __l2cap_connect_rsp_defer(pi->chan); 993 } 994 995 err = 0; 996 goto done; 997 } 998 999 release_sock(sk); 1000 1001 if (sock->type == SOCK_STREAM) 1002 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags); 1003 else 1004 err = bt_sock_recvmsg(iocb, sock, msg, len, flags); 1005 1006 if (pi->chan->mode != L2CAP_MODE_ERTM) 1007 return err; 1008 1009 /* Attempt to put pending rx data in the socket buffer */ 1010 1011 lock_sock(sk); 1012 1013 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state)) 1014 goto done; 1015 1016 if (pi->rx_busy_skb) { 1017 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb)) 1018 pi->rx_busy_skb = NULL; 1019 else 1020 goto done; 1021 } 1022 1023 /* Restore data flow when half of the receive buffer is 1024 * available. This avoids resending large numbers of 1025 * frames. 1026 */ 1027 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1) 1028 l2cap_chan_busy(pi->chan, 0); 1029 1030 done: 1031 release_sock(sk); 1032 return err; 1033 } 1034 1035 /* Kill socket (only if zapped and orphan) 1036 * Must be called on unlocked socket. 1037 */ 1038 static void l2cap_sock_kill(struct sock *sk) 1039 { 1040 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 1041 return; 1042 1043 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); 1044 1045 /* Kill poor orphan */ 1046 1047 l2cap_chan_put(l2cap_pi(sk)->chan); 1048 sock_set_flag(sk, SOCK_DEAD); 1049 sock_put(sk); 1050 } 1051 1052 static int __l2cap_wait_ack(struct sock *sk) 1053 { 1054 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1055 DECLARE_WAITQUEUE(wait, current); 1056 int err = 0; 1057 int timeo = HZ/5; 1058 1059 add_wait_queue(sk_sleep(sk), &wait); 1060 set_current_state(TASK_INTERRUPTIBLE); 1061 while (chan->unacked_frames > 0 && chan->conn) { 1062 if (!timeo) 1063 timeo = HZ/5; 1064 1065 if (signal_pending(current)) { 1066 err = sock_intr_errno(timeo); 1067 break; 1068 } 1069 1070 release_sock(sk); 1071 timeo = schedule_timeout(timeo); 1072 lock_sock(sk); 1073 set_current_state(TASK_INTERRUPTIBLE); 1074 1075 err = sock_error(sk); 1076 if (err) 1077 break; 1078 } 1079 set_current_state(TASK_RUNNING); 1080 remove_wait_queue(sk_sleep(sk), &wait); 1081 return err; 1082 } 1083 1084 static int l2cap_sock_shutdown(struct socket *sock, int how) 1085 { 1086 struct sock *sk = sock->sk; 1087 struct l2cap_chan *chan; 1088 struct l2cap_conn *conn; 1089 int err = 0; 1090 1091 BT_DBG("sock %p, sk %p", sock, sk); 1092 1093 if (!sk) 1094 return 0; 1095 1096 chan = l2cap_pi(sk)->chan; 1097 conn = chan->conn; 1098 1099 if (conn) 1100 mutex_lock(&conn->chan_lock); 1101 1102 l2cap_chan_lock(chan); 1103 lock_sock(sk); 1104 1105 if (!sk->sk_shutdown) { 1106 if (chan->mode == L2CAP_MODE_ERTM) 1107 err = __l2cap_wait_ack(sk); 1108 1109 sk->sk_shutdown = SHUTDOWN_MASK; 1110 1111 release_sock(sk); 1112 l2cap_chan_close(chan, 0); 1113 lock_sock(sk); 1114 1115 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1116 !(current->flags & PF_EXITING)) 1117 err = bt_sock_wait_state(sk, BT_CLOSED, 1118 sk->sk_lingertime); 1119 } 1120 1121 if (!err && sk->sk_err) 1122 err = -sk->sk_err; 1123 1124 release_sock(sk); 1125 l2cap_chan_unlock(chan); 1126 1127 if (conn) 1128 mutex_unlock(&conn->chan_lock); 1129 1130 return err; 1131 } 1132 1133 static int l2cap_sock_release(struct socket *sock) 1134 { 1135 struct sock *sk = sock->sk; 1136 int err; 1137 1138 BT_DBG("sock %p, sk %p", sock, sk); 1139 1140 if (!sk) 1141 return 0; 1142 1143 bt_sock_unlink(&l2cap_sk_list, sk); 1144 1145 err = l2cap_sock_shutdown(sock, 2); 1146 1147 sock_orphan(sk); 1148 l2cap_sock_kill(sk); 1149 return err; 1150 } 1151 1152 static void l2cap_sock_cleanup_listen(struct sock *parent) 1153 { 1154 struct sock *sk; 1155 1156 BT_DBG("parent %p", parent); 1157 1158 /* Close not yet accepted channels */ 1159 while ((sk = bt_accept_dequeue(parent, NULL))) { 1160 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1161 1162 l2cap_chan_lock(chan); 1163 __clear_chan_timer(chan); 1164 l2cap_chan_close(chan, ECONNRESET); 1165 l2cap_chan_unlock(chan); 1166 1167 l2cap_sock_kill(sk); 1168 } 1169 } 1170 1171 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) 1172 { 1173 struct sock *sk, *parent = chan->data; 1174 1175 lock_sock(parent); 1176 1177 /* Check for backlog size */ 1178 if (sk_acceptq_is_full(parent)) { 1179 BT_DBG("backlog full %d", parent->sk_ack_backlog); 1180 release_sock(parent); 1181 return NULL; 1182 } 1183 1184 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, 1185 GFP_ATOMIC); 1186 if (!sk) { 1187 release_sock(parent); 1188 return NULL; 1189 } 1190 1191 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP); 1192 1193 l2cap_sock_init(sk, parent); 1194 1195 bt_accept_enqueue(parent, sk); 1196 1197 release_sock(parent); 1198 1199 return l2cap_pi(sk)->chan; 1200 } 1201 1202 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) 1203 { 1204 struct sock *sk = chan->data; 1205 int err; 1206 1207 lock_sock(sk); 1208 1209 if (l2cap_pi(sk)->rx_busy_skb) { 1210 err = -ENOMEM; 1211 goto done; 1212 } 1213 1214 err = sock_queue_rcv_skb(sk, skb); 1215 1216 /* For ERTM, handle one skb that doesn't fit into the recv 1217 * buffer. This is important to do because the data frames 1218 * have already been acked, so the skb cannot be discarded. 1219 * 1220 * Notify the l2cap core that the buffer is full, so the 1221 * LOCAL_BUSY state is entered and no more frames are 1222 * acked and reassembled until there is buffer space 1223 * available. 1224 */ 1225 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) { 1226 l2cap_pi(sk)->rx_busy_skb = skb; 1227 l2cap_chan_busy(chan, 1); 1228 err = 0; 1229 } 1230 1231 done: 1232 release_sock(sk); 1233 1234 return err; 1235 } 1236 1237 static void l2cap_sock_close_cb(struct l2cap_chan *chan) 1238 { 1239 struct sock *sk = chan->data; 1240 1241 l2cap_sock_kill(sk); 1242 } 1243 1244 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) 1245 { 1246 struct sock *sk = chan->data; 1247 struct sock *parent; 1248 1249 lock_sock(sk); 1250 1251 parent = bt_sk(sk)->parent; 1252 1253 sock_set_flag(sk, SOCK_ZAPPED); 1254 1255 switch (chan->state) { 1256 case BT_OPEN: 1257 case BT_BOUND: 1258 case BT_CLOSED: 1259 break; 1260 case BT_LISTEN: 1261 l2cap_sock_cleanup_listen(sk); 1262 sk->sk_state = BT_CLOSED; 1263 chan->state = BT_CLOSED; 1264 1265 break; 1266 default: 1267 sk->sk_state = BT_CLOSED; 1268 chan->state = BT_CLOSED; 1269 1270 sk->sk_err = err; 1271 1272 if (parent) { 1273 bt_accept_unlink(sk); 1274 parent->sk_data_ready(parent); 1275 } else { 1276 sk->sk_state_change(sk); 1277 } 1278 1279 break; 1280 } 1281 1282 release_sock(sk); 1283 } 1284 1285 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, 1286 int err) 1287 { 1288 struct sock *sk = chan->data; 1289 1290 sk->sk_state = state; 1291 1292 if (err) 1293 sk->sk_err = err; 1294 } 1295 1296 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, 1297 unsigned long hdr_len, 1298 unsigned long len, int nb) 1299 { 1300 struct sock *sk = chan->data; 1301 struct sk_buff *skb; 1302 int err; 1303 1304 l2cap_chan_unlock(chan); 1305 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err); 1306 l2cap_chan_lock(chan); 1307 1308 if (!skb) 1309 return ERR_PTR(err); 1310 1311 skb->priority = sk->sk_priority; 1312 1313 bt_cb(skb)->chan = chan; 1314 1315 return skb; 1316 } 1317 1318 static int l2cap_sock_memcpy_fromiovec_cb(struct l2cap_chan *chan, 1319 unsigned char *kdata, 1320 struct iovec *iov, int len) 1321 { 1322 return memcpy_fromiovec(kdata, iov, len); 1323 } 1324 1325 static void l2cap_sock_ready_cb(struct l2cap_chan *chan) 1326 { 1327 struct sock *sk = chan->data; 1328 struct sock *parent; 1329 1330 lock_sock(sk); 1331 1332 parent = bt_sk(sk)->parent; 1333 1334 BT_DBG("sk %p, parent %p", sk, parent); 1335 1336 sk->sk_state = BT_CONNECTED; 1337 sk->sk_state_change(sk); 1338 1339 if (parent) 1340 parent->sk_data_ready(parent); 1341 1342 release_sock(sk); 1343 } 1344 1345 static void l2cap_sock_defer_cb(struct l2cap_chan *chan) 1346 { 1347 struct sock *parent, *sk = chan->data; 1348 1349 lock_sock(sk); 1350 1351 parent = bt_sk(sk)->parent; 1352 if (parent) 1353 parent->sk_data_ready(parent); 1354 1355 release_sock(sk); 1356 } 1357 1358 static void l2cap_sock_resume_cb(struct l2cap_chan *chan) 1359 { 1360 struct sock *sk = chan->data; 1361 1362 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) { 1363 sk->sk_state = BT_CONNECTED; 1364 chan->state = BT_CONNECTED; 1365 } 1366 1367 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1368 sk->sk_state_change(sk); 1369 } 1370 1371 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan) 1372 { 1373 struct sock *sk = chan->data; 1374 1375 lock_sock(sk); 1376 sk->sk_shutdown = SHUTDOWN_MASK; 1377 release_sock(sk); 1378 } 1379 1380 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan) 1381 { 1382 struct sock *sk = chan->data; 1383 1384 return sk->sk_sndtimeo; 1385 } 1386 1387 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) 1388 { 1389 struct sock *sk = chan->data; 1390 1391 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags); 1392 sk->sk_state_change(sk); 1393 } 1394 1395 static const struct l2cap_ops l2cap_chan_ops = { 1396 .name = "L2CAP Socket Interface", 1397 .new_connection = l2cap_sock_new_connection_cb, 1398 .recv = l2cap_sock_recv_cb, 1399 .close = l2cap_sock_close_cb, 1400 .teardown = l2cap_sock_teardown_cb, 1401 .state_change = l2cap_sock_state_change_cb, 1402 .ready = l2cap_sock_ready_cb, 1403 .defer = l2cap_sock_defer_cb, 1404 .resume = l2cap_sock_resume_cb, 1405 .suspend = l2cap_sock_suspend_cb, 1406 .set_shutdown = l2cap_sock_set_shutdown_cb, 1407 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, 1408 .alloc_skb = l2cap_sock_alloc_skb_cb, 1409 .memcpy_fromiovec = l2cap_sock_memcpy_fromiovec_cb, 1410 }; 1411 1412 static void l2cap_sock_destruct(struct sock *sk) 1413 { 1414 BT_DBG("sk %p", sk); 1415 1416 if (l2cap_pi(sk)->chan) 1417 l2cap_chan_put(l2cap_pi(sk)->chan); 1418 1419 if (l2cap_pi(sk)->rx_busy_skb) { 1420 kfree_skb(l2cap_pi(sk)->rx_busy_skb); 1421 l2cap_pi(sk)->rx_busy_skb = NULL; 1422 } 1423 1424 skb_queue_purge(&sk->sk_receive_queue); 1425 skb_queue_purge(&sk->sk_write_queue); 1426 } 1427 1428 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name, 1429 int *msg_namelen) 1430 { 1431 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name); 1432 1433 memset(la, 0, sizeof(struct sockaddr_l2)); 1434 la->l2_family = AF_BLUETOOTH; 1435 la->l2_psm = bt_cb(skb)->psm; 1436 bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr); 1437 1438 *msg_namelen = sizeof(struct sockaddr_l2); 1439 } 1440 1441 static void l2cap_sock_init(struct sock *sk, struct sock *parent) 1442 { 1443 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1444 1445 BT_DBG("sk %p", sk); 1446 1447 if (parent) { 1448 struct l2cap_chan *pchan = l2cap_pi(parent)->chan; 1449 1450 sk->sk_type = parent->sk_type; 1451 bt_sk(sk)->flags = bt_sk(parent)->flags; 1452 1453 chan->chan_type = pchan->chan_type; 1454 chan->imtu = pchan->imtu; 1455 chan->omtu = pchan->omtu; 1456 chan->conf_state = pchan->conf_state; 1457 chan->mode = pchan->mode; 1458 chan->fcs = pchan->fcs; 1459 chan->max_tx = pchan->max_tx; 1460 chan->tx_win = pchan->tx_win; 1461 chan->tx_win_max = pchan->tx_win_max; 1462 chan->sec_level = pchan->sec_level; 1463 chan->flags = pchan->flags; 1464 chan->tx_credits = pchan->tx_credits; 1465 chan->rx_credits = pchan->rx_credits; 1466 1467 if (chan->chan_type == L2CAP_CHAN_FIXED) { 1468 chan->scid = pchan->scid; 1469 chan->dcid = pchan->scid; 1470 } 1471 1472 security_sk_clone(parent, sk); 1473 } else { 1474 switch (sk->sk_type) { 1475 case SOCK_RAW: 1476 chan->chan_type = L2CAP_CHAN_RAW; 1477 break; 1478 case SOCK_DGRAM: 1479 chan->chan_type = L2CAP_CHAN_CONN_LESS; 1480 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name; 1481 break; 1482 case SOCK_SEQPACKET: 1483 case SOCK_STREAM: 1484 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED; 1485 break; 1486 } 1487 1488 chan->imtu = L2CAP_DEFAULT_MTU; 1489 chan->omtu = 0; 1490 if (!disable_ertm && sk->sk_type == SOCK_STREAM) { 1491 chan->mode = L2CAP_MODE_ERTM; 1492 set_bit(CONF_STATE2_DEVICE, &chan->conf_state); 1493 } else { 1494 chan->mode = L2CAP_MODE_BASIC; 1495 } 1496 1497 l2cap_chan_set_defaults(chan); 1498 } 1499 1500 /* Default config options */ 1501 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 1502 1503 chan->data = sk; 1504 chan->ops = &l2cap_chan_ops; 1505 } 1506 1507 static struct proto l2cap_proto = { 1508 .name = "L2CAP", 1509 .owner = THIS_MODULE, 1510 .obj_size = sizeof(struct l2cap_pinfo) 1511 }; 1512 1513 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 1514 int proto, gfp_t prio) 1515 { 1516 struct sock *sk; 1517 struct l2cap_chan *chan; 1518 1519 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto); 1520 if (!sk) 1521 return NULL; 1522 1523 sock_init_data(sock, sk); 1524 INIT_LIST_HEAD(&bt_sk(sk)->accept_q); 1525 1526 sk->sk_destruct = l2cap_sock_destruct; 1527 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT; 1528 1529 sock_reset_flag(sk, SOCK_ZAPPED); 1530 1531 sk->sk_protocol = proto; 1532 sk->sk_state = BT_OPEN; 1533 1534 chan = l2cap_chan_create(); 1535 if (!chan) { 1536 sk_free(sk); 1537 return NULL; 1538 } 1539 1540 l2cap_chan_hold(chan); 1541 1542 l2cap_pi(sk)->chan = chan; 1543 1544 return sk; 1545 } 1546 1547 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol, 1548 int kern) 1549 { 1550 struct sock *sk; 1551 1552 BT_DBG("sock %p", sock); 1553 1554 sock->state = SS_UNCONNECTED; 1555 1556 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM && 1557 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW) 1558 return -ESOCKTNOSUPPORT; 1559 1560 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) 1561 return -EPERM; 1562 1563 sock->ops = &l2cap_sock_ops; 1564 1565 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC); 1566 if (!sk) 1567 return -ENOMEM; 1568 1569 l2cap_sock_init(sk, NULL); 1570 bt_sock_link(&l2cap_sk_list, sk); 1571 return 0; 1572 } 1573 1574 static const struct proto_ops l2cap_sock_ops = { 1575 .family = PF_BLUETOOTH, 1576 .owner = THIS_MODULE, 1577 .release = l2cap_sock_release, 1578 .bind = l2cap_sock_bind, 1579 .connect = l2cap_sock_connect, 1580 .listen = l2cap_sock_listen, 1581 .accept = l2cap_sock_accept, 1582 .getname = l2cap_sock_getname, 1583 .sendmsg = l2cap_sock_sendmsg, 1584 .recvmsg = l2cap_sock_recvmsg, 1585 .poll = bt_sock_poll, 1586 .ioctl = bt_sock_ioctl, 1587 .mmap = sock_no_mmap, 1588 .socketpair = sock_no_socketpair, 1589 .shutdown = l2cap_sock_shutdown, 1590 .setsockopt = l2cap_sock_setsockopt, 1591 .getsockopt = l2cap_sock_getsockopt 1592 }; 1593 1594 static const struct net_proto_family l2cap_sock_family_ops = { 1595 .family = PF_BLUETOOTH, 1596 .owner = THIS_MODULE, 1597 .create = l2cap_sock_create, 1598 }; 1599 1600 int __init l2cap_init_sockets(void) 1601 { 1602 int err; 1603 1604 err = proto_register(&l2cap_proto, 0); 1605 if (err < 0) 1606 return err; 1607 1608 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops); 1609 if (err < 0) { 1610 BT_ERR("L2CAP socket registration failed"); 1611 goto error; 1612 } 1613 1614 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list, 1615 NULL); 1616 if (err < 0) { 1617 BT_ERR("Failed to create L2CAP proc file"); 1618 bt_sock_unregister(BTPROTO_L2CAP); 1619 goto error; 1620 } 1621 1622 BT_INFO("L2CAP socket layer initialized"); 1623 1624 return 0; 1625 1626 error: 1627 proto_unregister(&l2cap_proto); 1628 return err; 1629 } 1630 1631 void l2cap_cleanup_sockets(void) 1632 { 1633 bt_procfs_cleanup(&init_net, "l2cap"); 1634 bt_sock_unregister(BTPROTO_L2CAP); 1635 proto_unregister(&l2cap_proto); 1636 } 1637