xref: /openbmc/linux/net/bluetooth/l2cap_sock.c (revision 3831971355d901ccfb76533a422b4395072849a3)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5    Copyright (C) 2010 Google Inc.
6    Copyright (C) 2011 ProFUSION Embedded Systems
7 
8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9 
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License version 2 as
12    published by the Free Software Foundation;
13 
14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 
23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25    SOFTWARE IS DISCLAIMED.
26 */
27 
28 /* Bluetooth L2CAP sockets. */
29 
30 #include <linux/module.h>
31 #include <linux/export.h>
32 
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
36 
37 #include "smp.h"
38 
39 bool enable_lecoc;
40 
41 static struct bt_sock_list l2cap_sk_list = {
42 	.lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
43 };
44 
45 static const struct proto_ops l2cap_sock_ops;
46 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
47 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
48 				     int proto, gfp_t prio);
49 
50 bool l2cap_is_socket(struct socket *sock)
51 {
52 	return sock && sock->ops == &l2cap_sock_ops;
53 }
54 EXPORT_SYMBOL(l2cap_is_socket);
55 
56 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
57 {
58 	struct sock *sk = sock->sk;
59 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
60 	struct sockaddr_l2 la;
61 	int len, err = 0;
62 
63 	BT_DBG("sk %p", sk);
64 
65 	if (!addr || addr->sa_family != AF_BLUETOOTH)
66 		return -EINVAL;
67 
68 	memset(&la, 0, sizeof(la));
69 	len = min_t(unsigned int, sizeof(la), alen);
70 	memcpy(&la, addr, len);
71 
72 	if (la.l2_cid && la.l2_psm)
73 		return -EINVAL;
74 
75 	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
76 		return -EINVAL;
77 
78 	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
79 		if (!enable_lecoc && la.l2_psm)
80 			return -EINVAL;
81 		/* We only allow ATT user space socket */
82 		if (la.l2_cid &&
83 		    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
84 			return -EINVAL;
85 	}
86 
87 	lock_sock(sk);
88 
89 	if (sk->sk_state != BT_OPEN) {
90 		err = -EBADFD;
91 		goto done;
92 	}
93 
94 	if (la.l2_psm) {
95 		__u16 psm = __le16_to_cpu(la.l2_psm);
96 
97 		/* PSM must be odd and lsb of upper byte must be 0 */
98 		if ((psm & 0x0101) != 0x0001) {
99 			err = -EINVAL;
100 			goto done;
101 		}
102 
103 		/* Restrict usage of well-known PSMs */
104 		if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
105 			err = -EACCES;
106 			goto done;
107 		}
108 	}
109 
110 	if (la.l2_cid)
111 		err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
112 	else
113 		err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
114 
115 	if (err < 0)
116 		goto done;
117 
118 	switch (chan->chan_type) {
119 	case L2CAP_CHAN_CONN_LESS:
120 		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
121 			chan->sec_level = BT_SECURITY_SDP;
122 		break;
123 	case L2CAP_CHAN_CONN_ORIENTED:
124 		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
125 		    __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
126 			chan->sec_level = BT_SECURITY_SDP;
127 		break;
128 	}
129 
130 	bacpy(&chan->src, &la.l2_bdaddr);
131 	chan->src_type = la.l2_bdaddr_type;
132 
133 	if (chan->psm && bdaddr_type_is_le(chan->src_type))
134 		l2cap_le_flowctl_init(chan);
135 
136 	chan->state = BT_BOUND;
137 	sk->sk_state = BT_BOUND;
138 
139 done:
140 	release_sock(sk);
141 	return err;
142 }
143 
144 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
145 			      int alen, int flags)
146 {
147 	struct sock *sk = sock->sk;
148 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
149 	struct sockaddr_l2 la;
150 	int len, err = 0;
151 
152 	BT_DBG("sk %p", sk);
153 
154 	if (!addr || alen < sizeof(addr->sa_family) ||
155 	    addr->sa_family != AF_BLUETOOTH)
156 		return -EINVAL;
157 
158 	memset(&la, 0, sizeof(la));
159 	len = min_t(unsigned int, sizeof(la), alen);
160 	memcpy(&la, addr, len);
161 
162 	if (la.l2_cid && la.l2_psm)
163 		return -EINVAL;
164 
165 	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
166 		return -EINVAL;
167 
168 	/* Check that the socket wasn't bound to something that
169 	 * conflicts with the address given to connect(). If chan->src
170 	 * is BDADDR_ANY it means bind() was never used, in which case
171 	 * chan->src_type and la.l2_bdaddr_type do not need to match.
172 	 */
173 	if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
174 	    bdaddr_type_is_le(la.l2_bdaddr_type)) {
175 		/* Old user space versions will try to incorrectly bind
176 		 * the ATT socket using BDADDR_BREDR. We need to accept
177 		 * this and fix up the source address type only when
178 		 * both the source CID and destination CID indicate
179 		 * ATT. Anything else is an invalid combination.
180 		 */
181 		if (chan->scid != L2CAP_CID_ATT ||
182 		    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
183 			return -EINVAL;
184 
185 		/* We don't have the hdev available here to make a
186 		 * better decision on random vs public, but since all
187 		 * user space versions that exhibit this issue anyway do
188 		 * not support random local addresses assuming public
189 		 * here is good enough.
190 		 */
191 		chan->src_type = BDADDR_LE_PUBLIC;
192 	}
193 
194 	if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
195 		return -EINVAL;
196 
197 	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
198 		if (!enable_lecoc && la.l2_psm)
199 			return -EINVAL;
200 		/* We only allow ATT user space socket */
201 		if (la.l2_cid &&
202 		    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
203 			return -EINVAL;
204 	}
205 
206 	if (chan->psm && bdaddr_type_is_le(chan->src_type))
207 		l2cap_le_flowctl_init(chan);
208 
209 	err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
210 				 &la.l2_bdaddr, la.l2_bdaddr_type);
211 	if (err)
212 		return err;
213 
214 	lock_sock(sk);
215 
216 	err = bt_sock_wait_state(sk, BT_CONNECTED,
217 				 sock_sndtimeo(sk, flags & O_NONBLOCK));
218 
219 	release_sock(sk);
220 
221 	return err;
222 }
223 
224 static int l2cap_sock_listen(struct socket *sock, int backlog)
225 {
226 	struct sock *sk = sock->sk;
227 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
228 	int err = 0;
229 
230 	BT_DBG("sk %p backlog %d", sk, backlog);
231 
232 	lock_sock(sk);
233 
234 	if (sk->sk_state != BT_BOUND) {
235 		err = -EBADFD;
236 		goto done;
237 	}
238 
239 	if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
240 		err = -EINVAL;
241 		goto done;
242 	}
243 
244 	switch (chan->mode) {
245 	case L2CAP_MODE_BASIC:
246 	case L2CAP_MODE_LE_FLOWCTL:
247 		break;
248 	case L2CAP_MODE_ERTM:
249 	case L2CAP_MODE_STREAMING:
250 		if (!disable_ertm)
251 			break;
252 		/* fall through */
253 	default:
254 		err = -ENOTSUPP;
255 		goto done;
256 	}
257 
258 	sk->sk_max_ack_backlog = backlog;
259 	sk->sk_ack_backlog = 0;
260 
261 	chan->state = BT_LISTEN;
262 	sk->sk_state = BT_LISTEN;
263 
264 done:
265 	release_sock(sk);
266 	return err;
267 }
268 
269 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
270 			     int flags)
271 {
272 	DECLARE_WAITQUEUE(wait, current);
273 	struct sock *sk = sock->sk, *nsk;
274 	long timeo;
275 	int err = 0;
276 
277 	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
278 
279 	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
280 
281 	BT_DBG("sk %p timeo %ld", sk, timeo);
282 
283 	/* Wait for an incoming connection. (wake-one). */
284 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
285 	while (1) {
286 		set_current_state(TASK_INTERRUPTIBLE);
287 
288 		if (sk->sk_state != BT_LISTEN) {
289 			err = -EBADFD;
290 			break;
291 		}
292 
293 		nsk = bt_accept_dequeue(sk, newsock);
294 		if (nsk)
295 			break;
296 
297 		if (!timeo) {
298 			err = -EAGAIN;
299 			break;
300 		}
301 
302 		if (signal_pending(current)) {
303 			err = sock_intr_errno(timeo);
304 			break;
305 		}
306 
307 		release_sock(sk);
308 		timeo = schedule_timeout(timeo);
309 		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
310 	}
311 	__set_current_state(TASK_RUNNING);
312 	remove_wait_queue(sk_sleep(sk), &wait);
313 
314 	if (err)
315 		goto done;
316 
317 	newsock->state = SS_CONNECTED;
318 
319 	BT_DBG("new socket %p", nsk);
320 
321 done:
322 	release_sock(sk);
323 	return err;
324 }
325 
326 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
327 			      int *len, int peer)
328 {
329 	struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
330 	struct sock *sk = sock->sk;
331 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
332 
333 	BT_DBG("sock %p, sk %p", sock, sk);
334 
335 	memset(la, 0, sizeof(struct sockaddr_l2));
336 	addr->sa_family = AF_BLUETOOTH;
337 	*len = sizeof(struct sockaddr_l2);
338 
339 	if (peer) {
340 		la->l2_psm = chan->psm;
341 		bacpy(&la->l2_bdaddr, &chan->dst);
342 		la->l2_cid = cpu_to_le16(chan->dcid);
343 		la->l2_bdaddr_type = chan->dst_type;
344 	} else {
345 		la->l2_psm = chan->sport;
346 		bacpy(&la->l2_bdaddr, &chan->src);
347 		la->l2_cid = cpu_to_le16(chan->scid);
348 		la->l2_bdaddr_type = chan->src_type;
349 	}
350 
351 	return 0;
352 }
353 
354 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
355 				     char __user *optval, int __user *optlen)
356 {
357 	struct sock *sk = sock->sk;
358 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
359 	struct l2cap_options opts;
360 	struct l2cap_conninfo cinfo;
361 	int len, err = 0;
362 	u32 opt;
363 
364 	BT_DBG("sk %p", sk);
365 
366 	if (get_user(len, optlen))
367 		return -EFAULT;
368 
369 	lock_sock(sk);
370 
371 	switch (optname) {
372 	case L2CAP_OPTIONS:
373 		memset(&opts, 0, sizeof(opts));
374 		opts.imtu     = chan->imtu;
375 		opts.omtu     = chan->omtu;
376 		opts.flush_to = chan->flush_to;
377 		opts.mode     = chan->mode;
378 		opts.fcs      = chan->fcs;
379 		opts.max_tx   = chan->max_tx;
380 		opts.txwin_size = chan->tx_win;
381 
382 		len = min_t(unsigned int, len, sizeof(opts));
383 		if (copy_to_user(optval, (char *) &opts, len))
384 			err = -EFAULT;
385 
386 		break;
387 
388 	case L2CAP_LM:
389 		switch (chan->sec_level) {
390 		case BT_SECURITY_LOW:
391 			opt = L2CAP_LM_AUTH;
392 			break;
393 		case BT_SECURITY_MEDIUM:
394 			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
395 			break;
396 		case BT_SECURITY_HIGH:
397 			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
398 			      L2CAP_LM_SECURE;
399 			break;
400 		default:
401 			opt = 0;
402 			break;
403 		}
404 
405 		if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
406 			opt |= L2CAP_LM_MASTER;
407 
408 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
409 			opt |= L2CAP_LM_RELIABLE;
410 
411 		if (put_user(opt, (u32 __user *) optval))
412 			err = -EFAULT;
413 		break;
414 
415 	case L2CAP_CONNINFO:
416 		if (sk->sk_state != BT_CONNECTED &&
417 		    !(sk->sk_state == BT_CONNECT2 &&
418 		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
419 			err = -ENOTCONN;
420 			break;
421 		}
422 
423 		memset(&cinfo, 0, sizeof(cinfo));
424 		cinfo.hci_handle = chan->conn->hcon->handle;
425 		memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
426 
427 		len = min_t(unsigned int, len, sizeof(cinfo));
428 		if (copy_to_user(optval, (char *) &cinfo, len))
429 			err = -EFAULT;
430 
431 		break;
432 
433 	default:
434 		err = -ENOPROTOOPT;
435 		break;
436 	}
437 
438 	release_sock(sk);
439 	return err;
440 }
441 
442 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
443 				 char __user *optval, int __user *optlen)
444 {
445 	struct sock *sk = sock->sk;
446 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
447 	struct bt_security sec;
448 	struct bt_power pwr;
449 	int len, err = 0;
450 
451 	BT_DBG("sk %p", sk);
452 
453 	if (level == SOL_L2CAP)
454 		return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
455 
456 	if (level != SOL_BLUETOOTH)
457 		return -ENOPROTOOPT;
458 
459 	if (get_user(len, optlen))
460 		return -EFAULT;
461 
462 	lock_sock(sk);
463 
464 	switch (optname) {
465 	case BT_SECURITY:
466 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
467 		    chan->chan_type != L2CAP_CHAN_RAW) {
468 			err = -EINVAL;
469 			break;
470 		}
471 
472 		memset(&sec, 0, sizeof(sec));
473 		if (chan->conn) {
474 			sec.level = chan->conn->hcon->sec_level;
475 
476 			if (sk->sk_state == BT_CONNECTED)
477 				sec.key_size = chan->conn->hcon->enc_key_size;
478 		} else {
479 			sec.level = chan->sec_level;
480 		}
481 
482 		len = min_t(unsigned int, len, sizeof(sec));
483 		if (copy_to_user(optval, (char *) &sec, len))
484 			err = -EFAULT;
485 
486 		break;
487 
488 	case BT_DEFER_SETUP:
489 		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
490 			err = -EINVAL;
491 			break;
492 		}
493 
494 		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
495 			     (u32 __user *) optval))
496 			err = -EFAULT;
497 
498 		break;
499 
500 	case BT_FLUSHABLE:
501 		if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
502 			     (u32 __user *) optval))
503 			err = -EFAULT;
504 
505 		break;
506 
507 	case BT_POWER:
508 		if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
509 		    && sk->sk_type != SOCK_RAW) {
510 			err = -EINVAL;
511 			break;
512 		}
513 
514 		pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
515 
516 		len = min_t(unsigned int, len, sizeof(pwr));
517 		if (copy_to_user(optval, (char *) &pwr, len))
518 			err = -EFAULT;
519 
520 		break;
521 
522 	case BT_CHANNEL_POLICY:
523 		if (put_user(chan->chan_policy, (u32 __user *) optval))
524 			err = -EFAULT;
525 		break;
526 
527 	default:
528 		err = -ENOPROTOOPT;
529 		break;
530 	}
531 
532 	release_sock(sk);
533 	return err;
534 }
535 
536 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
537 {
538 	switch (chan->scid) {
539 	case L2CAP_CID_ATT:
540 		if (mtu < L2CAP_LE_MIN_MTU)
541 			return false;
542 		break;
543 
544 	default:
545 		if (mtu < L2CAP_DEFAULT_MIN_MTU)
546 			return false;
547 	}
548 
549 	return true;
550 }
551 
552 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
553 				     char __user *optval, unsigned int optlen)
554 {
555 	struct sock *sk = sock->sk;
556 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
557 	struct l2cap_options opts;
558 	int len, err = 0;
559 	u32 opt;
560 
561 	BT_DBG("sk %p", sk);
562 
563 	lock_sock(sk);
564 
565 	switch (optname) {
566 	case L2CAP_OPTIONS:
567 		if (sk->sk_state == BT_CONNECTED) {
568 			err = -EINVAL;
569 			break;
570 		}
571 
572 		opts.imtu     = chan->imtu;
573 		opts.omtu     = chan->omtu;
574 		opts.flush_to = chan->flush_to;
575 		opts.mode     = chan->mode;
576 		opts.fcs      = chan->fcs;
577 		opts.max_tx   = chan->max_tx;
578 		opts.txwin_size = chan->tx_win;
579 
580 		len = min_t(unsigned int, sizeof(opts), optlen);
581 		if (copy_from_user((char *) &opts, optval, len)) {
582 			err = -EFAULT;
583 			break;
584 		}
585 
586 		if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
587 			err = -EINVAL;
588 			break;
589 		}
590 
591 		if (!l2cap_valid_mtu(chan, opts.imtu)) {
592 			err = -EINVAL;
593 			break;
594 		}
595 
596 		chan->mode = opts.mode;
597 		switch (chan->mode) {
598 		case L2CAP_MODE_LE_FLOWCTL:
599 			break;
600 		case L2CAP_MODE_BASIC:
601 			clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
602 			break;
603 		case L2CAP_MODE_ERTM:
604 		case L2CAP_MODE_STREAMING:
605 			if (!disable_ertm)
606 				break;
607 			/* fall through */
608 		default:
609 			err = -EINVAL;
610 			break;
611 		}
612 
613 		chan->imtu = opts.imtu;
614 		chan->omtu = opts.omtu;
615 		chan->fcs  = opts.fcs;
616 		chan->max_tx = opts.max_tx;
617 		chan->tx_win = opts.txwin_size;
618 		chan->flush_to = opts.flush_to;
619 		break;
620 
621 	case L2CAP_LM:
622 		if (get_user(opt, (u32 __user *) optval)) {
623 			err = -EFAULT;
624 			break;
625 		}
626 
627 		if (opt & L2CAP_LM_AUTH)
628 			chan->sec_level = BT_SECURITY_LOW;
629 		if (opt & L2CAP_LM_ENCRYPT)
630 			chan->sec_level = BT_SECURITY_MEDIUM;
631 		if (opt & L2CAP_LM_SECURE)
632 			chan->sec_level = BT_SECURITY_HIGH;
633 
634 		if (opt & L2CAP_LM_MASTER)
635 			set_bit(FLAG_ROLE_SWITCH, &chan->flags);
636 		else
637 			clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
638 
639 		if (opt & L2CAP_LM_RELIABLE)
640 			set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
641 		else
642 			clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
643 		break;
644 
645 	default:
646 		err = -ENOPROTOOPT;
647 		break;
648 	}
649 
650 	release_sock(sk);
651 	return err;
652 }
653 
654 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
655 				 char __user *optval, unsigned int optlen)
656 {
657 	struct sock *sk = sock->sk;
658 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
659 	struct bt_security sec;
660 	struct bt_power pwr;
661 	struct l2cap_conn *conn;
662 	int len, err = 0;
663 	u32 opt;
664 
665 	BT_DBG("sk %p", sk);
666 
667 	if (level == SOL_L2CAP)
668 		return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
669 
670 	if (level != SOL_BLUETOOTH)
671 		return -ENOPROTOOPT;
672 
673 	lock_sock(sk);
674 
675 	switch (optname) {
676 	case BT_SECURITY:
677 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
678 		    chan->chan_type != L2CAP_CHAN_RAW) {
679 			err = -EINVAL;
680 			break;
681 		}
682 
683 		sec.level = BT_SECURITY_LOW;
684 
685 		len = min_t(unsigned int, sizeof(sec), optlen);
686 		if (copy_from_user((char *) &sec, optval, len)) {
687 			err = -EFAULT;
688 			break;
689 		}
690 
691 		if (sec.level < BT_SECURITY_LOW ||
692 		    sec.level > BT_SECURITY_HIGH) {
693 			err = -EINVAL;
694 			break;
695 		}
696 
697 		chan->sec_level = sec.level;
698 
699 		if (!chan->conn)
700 			break;
701 
702 		conn = chan->conn;
703 
704 		/*change security for LE channels */
705 		if (chan->scid == L2CAP_CID_ATT) {
706 			if (!conn->hcon->out) {
707 				err = -EINVAL;
708 				break;
709 			}
710 
711 			if (smp_conn_security(conn->hcon, sec.level))
712 				break;
713 			sk->sk_state = BT_CONFIG;
714 			chan->state = BT_CONFIG;
715 
716 		/* or for ACL link */
717 		} else if ((sk->sk_state == BT_CONNECT2 &&
718 			    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
719 			   sk->sk_state == BT_CONNECTED) {
720 			if (!l2cap_chan_check_security(chan))
721 				set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
722 			else
723 				sk->sk_state_change(sk);
724 		} else {
725 			err = -EINVAL;
726 		}
727 		break;
728 
729 	case BT_DEFER_SETUP:
730 		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
731 			err = -EINVAL;
732 			break;
733 		}
734 
735 		if (get_user(opt, (u32 __user *) optval)) {
736 			err = -EFAULT;
737 			break;
738 		}
739 
740 		if (opt) {
741 			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
742 			set_bit(FLAG_DEFER_SETUP, &chan->flags);
743 		} else {
744 			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
745 			clear_bit(FLAG_DEFER_SETUP, &chan->flags);
746 		}
747 		break;
748 
749 	case BT_FLUSHABLE:
750 		if (get_user(opt, (u32 __user *) optval)) {
751 			err = -EFAULT;
752 			break;
753 		}
754 
755 		if (opt > BT_FLUSHABLE_ON) {
756 			err = -EINVAL;
757 			break;
758 		}
759 
760 		if (opt == BT_FLUSHABLE_OFF) {
761 			conn = chan->conn;
762 			/* proceed further only when we have l2cap_conn and
763 			   No Flush support in the LM */
764 			if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
765 				err = -EINVAL;
766 				break;
767 			}
768 		}
769 
770 		if (opt)
771 			set_bit(FLAG_FLUSHABLE, &chan->flags);
772 		else
773 			clear_bit(FLAG_FLUSHABLE, &chan->flags);
774 		break;
775 
776 	case BT_POWER:
777 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
778 		    chan->chan_type != L2CAP_CHAN_RAW) {
779 			err = -EINVAL;
780 			break;
781 		}
782 
783 		pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
784 
785 		len = min_t(unsigned int, sizeof(pwr), optlen);
786 		if (copy_from_user((char *) &pwr, optval, len)) {
787 			err = -EFAULT;
788 			break;
789 		}
790 
791 		if (pwr.force_active)
792 			set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
793 		else
794 			clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
795 		break;
796 
797 	case BT_CHANNEL_POLICY:
798 		if (get_user(opt, (u32 __user *) optval)) {
799 			err = -EFAULT;
800 			break;
801 		}
802 
803 		if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
804 			err = -EINVAL;
805 			break;
806 		}
807 
808 		if (chan->mode != L2CAP_MODE_ERTM &&
809 		    chan->mode != L2CAP_MODE_STREAMING) {
810 			err = -EOPNOTSUPP;
811 			break;
812 		}
813 
814 		chan->chan_policy = (u8) opt;
815 
816 		if (sk->sk_state == BT_CONNECTED &&
817 		    chan->move_role == L2CAP_MOVE_ROLE_NONE)
818 			l2cap_move_start(chan);
819 
820 		break;
821 
822 	default:
823 		err = -ENOPROTOOPT;
824 		break;
825 	}
826 
827 	release_sock(sk);
828 	return err;
829 }
830 
831 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
832 			      struct msghdr *msg, size_t len)
833 {
834 	struct sock *sk = sock->sk;
835 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
836 	int err;
837 
838 	BT_DBG("sock %p, sk %p", sock, sk);
839 
840 	err = sock_error(sk);
841 	if (err)
842 		return err;
843 
844 	if (msg->msg_flags & MSG_OOB)
845 		return -EOPNOTSUPP;
846 
847 	if (sk->sk_state != BT_CONNECTED)
848 		return -ENOTCONN;
849 
850 	lock_sock(sk);
851 	err = bt_sock_wait_ready(sk, msg->msg_flags);
852 	release_sock(sk);
853 	if (err)
854 		return err;
855 
856 	l2cap_chan_lock(chan);
857 	err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
858 	l2cap_chan_unlock(chan);
859 
860 	return err;
861 }
862 
863 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
864 			      struct msghdr *msg, size_t len, int flags)
865 {
866 	struct sock *sk = sock->sk;
867 	struct l2cap_pinfo *pi = l2cap_pi(sk);
868 	int err;
869 
870 	lock_sock(sk);
871 
872 	if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
873 						    &bt_sk(sk)->flags)) {
874 		if (bdaddr_type_is_le(pi->chan->src_type)) {
875 			sk->sk_state = BT_CONNECTED;
876 			pi->chan->state = BT_CONNECTED;
877 			__l2cap_le_connect_rsp_defer(pi->chan);
878 		} else {
879 			sk->sk_state = BT_CONFIG;
880 			pi->chan->state = BT_CONFIG;
881 			__l2cap_connect_rsp_defer(pi->chan);
882 		}
883 
884 		err = 0;
885 		goto done;
886 	}
887 
888 	release_sock(sk);
889 
890 	if (sock->type == SOCK_STREAM)
891 		err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
892 	else
893 		err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
894 
895 	if (pi->chan->mode != L2CAP_MODE_ERTM)
896 		return err;
897 
898 	/* Attempt to put pending rx data in the socket buffer */
899 
900 	lock_sock(sk);
901 
902 	if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
903 		goto done;
904 
905 	if (pi->rx_busy_skb) {
906 		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
907 			pi->rx_busy_skb = NULL;
908 		else
909 			goto done;
910 	}
911 
912 	/* Restore data flow when half of the receive buffer is
913 	 * available.  This avoids resending large numbers of
914 	 * frames.
915 	 */
916 	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
917 		l2cap_chan_busy(pi->chan, 0);
918 
919 done:
920 	release_sock(sk);
921 	return err;
922 }
923 
924 /* Kill socket (only if zapped and orphan)
925  * Must be called on unlocked socket.
926  */
927 static void l2cap_sock_kill(struct sock *sk)
928 {
929 	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
930 		return;
931 
932 	BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
933 
934 	/* Kill poor orphan */
935 
936 	l2cap_chan_put(l2cap_pi(sk)->chan);
937 	sock_set_flag(sk, SOCK_DEAD);
938 	sock_put(sk);
939 }
940 
941 static int __l2cap_wait_ack(struct sock *sk)
942 {
943 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
944 	DECLARE_WAITQUEUE(wait, current);
945 	int err = 0;
946 	int timeo = HZ/5;
947 
948 	add_wait_queue(sk_sleep(sk), &wait);
949 	set_current_state(TASK_INTERRUPTIBLE);
950 	while (chan->unacked_frames > 0 && chan->conn) {
951 		if (!timeo)
952 			timeo = HZ/5;
953 
954 		if (signal_pending(current)) {
955 			err = sock_intr_errno(timeo);
956 			break;
957 		}
958 
959 		release_sock(sk);
960 		timeo = schedule_timeout(timeo);
961 		lock_sock(sk);
962 		set_current_state(TASK_INTERRUPTIBLE);
963 
964 		err = sock_error(sk);
965 		if (err)
966 			break;
967 	}
968 	set_current_state(TASK_RUNNING);
969 	remove_wait_queue(sk_sleep(sk), &wait);
970 	return err;
971 }
972 
973 static int l2cap_sock_shutdown(struct socket *sock, int how)
974 {
975 	struct sock *sk = sock->sk;
976 	struct l2cap_chan *chan;
977 	struct l2cap_conn *conn;
978 	int err = 0;
979 
980 	BT_DBG("sock %p, sk %p", sock, sk);
981 
982 	if (!sk)
983 		return 0;
984 
985 	chan = l2cap_pi(sk)->chan;
986 	conn = chan->conn;
987 
988 	if (conn)
989 		mutex_lock(&conn->chan_lock);
990 
991 	l2cap_chan_lock(chan);
992 	lock_sock(sk);
993 
994 	if (!sk->sk_shutdown) {
995 		if (chan->mode == L2CAP_MODE_ERTM)
996 			err = __l2cap_wait_ack(sk);
997 
998 		sk->sk_shutdown = SHUTDOWN_MASK;
999 
1000 		release_sock(sk);
1001 		l2cap_chan_close(chan, 0);
1002 		lock_sock(sk);
1003 
1004 		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1005 			err = bt_sock_wait_state(sk, BT_CLOSED,
1006 						 sk->sk_lingertime);
1007 	}
1008 
1009 	if (!err && sk->sk_err)
1010 		err = -sk->sk_err;
1011 
1012 	release_sock(sk);
1013 	l2cap_chan_unlock(chan);
1014 
1015 	if (conn)
1016 		mutex_unlock(&conn->chan_lock);
1017 
1018 	return err;
1019 }
1020 
1021 static int l2cap_sock_release(struct socket *sock)
1022 {
1023 	struct sock *sk = sock->sk;
1024 	int err;
1025 
1026 	BT_DBG("sock %p, sk %p", sock, sk);
1027 
1028 	if (!sk)
1029 		return 0;
1030 
1031 	bt_sock_unlink(&l2cap_sk_list, sk);
1032 
1033 	err = l2cap_sock_shutdown(sock, 2);
1034 
1035 	sock_orphan(sk);
1036 	l2cap_sock_kill(sk);
1037 	return err;
1038 }
1039 
1040 static void l2cap_sock_cleanup_listen(struct sock *parent)
1041 {
1042 	struct sock *sk;
1043 
1044 	BT_DBG("parent %p", parent);
1045 
1046 	/* Close not yet accepted channels */
1047 	while ((sk = bt_accept_dequeue(parent, NULL))) {
1048 		struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1049 
1050 		l2cap_chan_lock(chan);
1051 		__clear_chan_timer(chan);
1052 		l2cap_chan_close(chan, ECONNRESET);
1053 		l2cap_chan_unlock(chan);
1054 
1055 		l2cap_sock_kill(sk);
1056 	}
1057 }
1058 
1059 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1060 {
1061 	struct sock *sk, *parent = chan->data;
1062 
1063 	lock_sock(parent);
1064 
1065 	/* Check for backlog size */
1066 	if (sk_acceptq_is_full(parent)) {
1067 		BT_DBG("backlog full %d", parent->sk_ack_backlog);
1068 		return NULL;
1069 	}
1070 
1071 	sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1072 			      GFP_ATOMIC);
1073 	if (!sk)
1074 		return NULL;
1075 
1076 	bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1077 
1078 	l2cap_sock_init(sk, parent);
1079 
1080 	bt_accept_enqueue(parent, sk);
1081 
1082 	release_sock(parent);
1083 
1084 	return l2cap_pi(sk)->chan;
1085 }
1086 
1087 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1088 {
1089 	struct sock *sk = chan->data;
1090 	int err;
1091 
1092 	lock_sock(sk);
1093 
1094 	if (l2cap_pi(sk)->rx_busy_skb) {
1095 		err = -ENOMEM;
1096 		goto done;
1097 	}
1098 
1099 	err = sock_queue_rcv_skb(sk, skb);
1100 
1101 	/* For ERTM, handle one skb that doesn't fit into the recv
1102 	 * buffer.  This is important to do because the data frames
1103 	 * have already been acked, so the skb cannot be discarded.
1104 	 *
1105 	 * Notify the l2cap core that the buffer is full, so the
1106 	 * LOCAL_BUSY state is entered and no more frames are
1107 	 * acked and reassembled until there is buffer space
1108 	 * available.
1109 	 */
1110 	if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1111 		l2cap_pi(sk)->rx_busy_skb = skb;
1112 		l2cap_chan_busy(chan, 1);
1113 		err = 0;
1114 	}
1115 
1116 done:
1117 	release_sock(sk);
1118 
1119 	return err;
1120 }
1121 
1122 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1123 {
1124 	struct sock *sk = chan->data;
1125 
1126 	l2cap_sock_kill(sk);
1127 }
1128 
1129 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1130 {
1131 	struct sock *sk = chan->data;
1132 	struct sock *parent;
1133 
1134 	lock_sock(sk);
1135 
1136 	parent = bt_sk(sk)->parent;
1137 
1138 	sock_set_flag(sk, SOCK_ZAPPED);
1139 
1140 	switch (chan->state) {
1141 	case BT_OPEN:
1142 	case BT_BOUND:
1143 	case BT_CLOSED:
1144 		break;
1145 	case BT_LISTEN:
1146 		l2cap_sock_cleanup_listen(sk);
1147 		sk->sk_state = BT_CLOSED;
1148 		chan->state = BT_CLOSED;
1149 
1150 		break;
1151 	default:
1152 		sk->sk_state = BT_CLOSED;
1153 		chan->state = BT_CLOSED;
1154 
1155 		sk->sk_err = err;
1156 
1157 		if (parent) {
1158 			bt_accept_unlink(sk);
1159 			parent->sk_data_ready(parent, 0);
1160 		} else {
1161 			sk->sk_state_change(sk);
1162 		}
1163 
1164 		break;
1165 	}
1166 
1167 	release_sock(sk);
1168 }
1169 
1170 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1171 				       int err)
1172 {
1173 	struct sock *sk = chan->data;
1174 
1175 	sk->sk_state = state;
1176 
1177 	if (err)
1178 		sk->sk_err = err;
1179 }
1180 
1181 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1182 					       unsigned long len, int nb)
1183 {
1184 	struct sock *sk = chan->data;
1185 	struct sk_buff *skb;
1186 	int err;
1187 
1188 	l2cap_chan_unlock(chan);
1189 	skb = bt_skb_send_alloc(sk, len, nb, &err);
1190 	l2cap_chan_lock(chan);
1191 
1192 	if (!skb)
1193 		return ERR_PTR(err);
1194 
1195 	bt_cb(skb)->chan = chan;
1196 
1197 	return skb;
1198 }
1199 
1200 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1201 {
1202 	struct sock *sk = chan->data;
1203 	struct sock *parent;
1204 
1205 	lock_sock(sk);
1206 
1207 	parent = bt_sk(sk)->parent;
1208 
1209 	BT_DBG("sk %p, parent %p", sk, parent);
1210 
1211 	sk->sk_state = BT_CONNECTED;
1212 	sk->sk_state_change(sk);
1213 
1214 	if (parent)
1215 		parent->sk_data_ready(parent, 0);
1216 
1217 	release_sock(sk);
1218 }
1219 
1220 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1221 {
1222 	struct sock *parent, *sk = chan->data;
1223 
1224 	lock_sock(sk);
1225 
1226 	parent = bt_sk(sk)->parent;
1227 	if (parent)
1228 		parent->sk_data_ready(parent, 0);
1229 
1230 	release_sock(sk);
1231 }
1232 
1233 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1234 {
1235 	struct sock *sk = chan->data;
1236 
1237 	clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1238 	sk->sk_state_change(sk);
1239 }
1240 
1241 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1242 {
1243 	struct sock *sk = chan->data;
1244 
1245 	lock_sock(sk);
1246 	sk->sk_shutdown = SHUTDOWN_MASK;
1247 	release_sock(sk);
1248 }
1249 
1250 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1251 {
1252 	struct sock *sk = chan->data;
1253 
1254 	return sk->sk_sndtimeo;
1255 }
1256 
1257 static struct l2cap_ops l2cap_chan_ops = {
1258 	.name		= "L2CAP Socket Interface",
1259 	.new_connection	= l2cap_sock_new_connection_cb,
1260 	.recv		= l2cap_sock_recv_cb,
1261 	.close		= l2cap_sock_close_cb,
1262 	.teardown	= l2cap_sock_teardown_cb,
1263 	.state_change	= l2cap_sock_state_change_cb,
1264 	.ready		= l2cap_sock_ready_cb,
1265 	.defer		= l2cap_sock_defer_cb,
1266 	.resume		= l2cap_sock_resume_cb,
1267 	.set_shutdown	= l2cap_sock_set_shutdown_cb,
1268 	.get_sndtimeo	= l2cap_sock_get_sndtimeo_cb,
1269 	.alloc_skb	= l2cap_sock_alloc_skb_cb,
1270 };
1271 
1272 static void l2cap_sock_destruct(struct sock *sk)
1273 {
1274 	BT_DBG("sk %p", sk);
1275 
1276 	if (l2cap_pi(sk)->chan)
1277 		l2cap_chan_put(l2cap_pi(sk)->chan);
1278 
1279 	if (l2cap_pi(sk)->rx_busy_skb) {
1280 		kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1281 		l2cap_pi(sk)->rx_busy_skb = NULL;
1282 	}
1283 
1284 	skb_queue_purge(&sk->sk_receive_queue);
1285 	skb_queue_purge(&sk->sk_write_queue);
1286 }
1287 
1288 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1289 			       int *msg_namelen)
1290 {
1291 	struct sockaddr_l2 *la = (struct sockaddr_l2 *) msg_name;
1292 
1293 	memset(la, 0, sizeof(struct sockaddr_l2));
1294 	la->l2_family = AF_BLUETOOTH;
1295 	la->l2_psm = bt_cb(skb)->psm;
1296 	bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1297 
1298 	*msg_namelen = sizeof(struct sockaddr_l2);
1299 }
1300 
1301 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1302 {
1303 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1304 
1305 	BT_DBG("sk %p", sk);
1306 
1307 	if (parent) {
1308 		struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1309 
1310 		sk->sk_type = parent->sk_type;
1311 		bt_sk(sk)->flags = bt_sk(parent)->flags;
1312 
1313 		chan->chan_type = pchan->chan_type;
1314 		chan->imtu = pchan->imtu;
1315 		chan->omtu = pchan->omtu;
1316 		chan->conf_state = pchan->conf_state;
1317 		chan->mode = pchan->mode;
1318 		chan->fcs  = pchan->fcs;
1319 		chan->max_tx = pchan->max_tx;
1320 		chan->tx_win = pchan->tx_win;
1321 		chan->tx_win_max = pchan->tx_win_max;
1322 		chan->sec_level = pchan->sec_level;
1323 		chan->flags = pchan->flags;
1324 
1325 		security_sk_clone(parent, sk);
1326 	} else {
1327 		switch (sk->sk_type) {
1328 		case SOCK_RAW:
1329 			chan->chan_type = L2CAP_CHAN_RAW;
1330 			break;
1331 		case SOCK_DGRAM:
1332 			chan->chan_type = L2CAP_CHAN_CONN_LESS;
1333 			bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1334 			break;
1335 		case SOCK_SEQPACKET:
1336 		case SOCK_STREAM:
1337 			chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1338 			break;
1339 		}
1340 
1341 		chan->imtu = L2CAP_DEFAULT_MTU;
1342 		chan->omtu = 0;
1343 		if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1344 			chan->mode = L2CAP_MODE_ERTM;
1345 			set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1346 		} else {
1347 			chan->mode = L2CAP_MODE_BASIC;
1348 		}
1349 
1350 		l2cap_chan_set_defaults(chan);
1351 	}
1352 
1353 	/* Default config options */
1354 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1355 
1356 	chan->data = sk;
1357 	chan->ops = &l2cap_chan_ops;
1358 }
1359 
1360 static struct proto l2cap_proto = {
1361 	.name		= "L2CAP",
1362 	.owner		= THIS_MODULE,
1363 	.obj_size	= sizeof(struct l2cap_pinfo)
1364 };
1365 
1366 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1367 				     int proto, gfp_t prio)
1368 {
1369 	struct sock *sk;
1370 	struct l2cap_chan *chan;
1371 
1372 	sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1373 	if (!sk)
1374 		return NULL;
1375 
1376 	sock_init_data(sock, sk);
1377 	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1378 
1379 	sk->sk_destruct = l2cap_sock_destruct;
1380 	sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1381 
1382 	sock_reset_flag(sk, SOCK_ZAPPED);
1383 
1384 	sk->sk_protocol = proto;
1385 	sk->sk_state = BT_OPEN;
1386 
1387 	chan = l2cap_chan_create();
1388 	if (!chan) {
1389 		sk_free(sk);
1390 		return NULL;
1391 	}
1392 
1393 	l2cap_chan_hold(chan);
1394 
1395 	l2cap_pi(sk)->chan = chan;
1396 
1397 	return sk;
1398 }
1399 
1400 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1401 			     int kern)
1402 {
1403 	struct sock *sk;
1404 
1405 	BT_DBG("sock %p", sock);
1406 
1407 	sock->state = SS_UNCONNECTED;
1408 
1409 	if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1410 	    sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1411 		return -ESOCKTNOSUPPORT;
1412 
1413 	if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1414 		return -EPERM;
1415 
1416 	sock->ops = &l2cap_sock_ops;
1417 
1418 	sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1419 	if (!sk)
1420 		return -ENOMEM;
1421 
1422 	l2cap_sock_init(sk, NULL);
1423 	bt_sock_link(&l2cap_sk_list, sk);
1424 	return 0;
1425 }
1426 
1427 static const struct proto_ops l2cap_sock_ops = {
1428 	.family		= PF_BLUETOOTH,
1429 	.owner		= THIS_MODULE,
1430 	.release	= l2cap_sock_release,
1431 	.bind		= l2cap_sock_bind,
1432 	.connect	= l2cap_sock_connect,
1433 	.listen		= l2cap_sock_listen,
1434 	.accept		= l2cap_sock_accept,
1435 	.getname	= l2cap_sock_getname,
1436 	.sendmsg	= l2cap_sock_sendmsg,
1437 	.recvmsg	= l2cap_sock_recvmsg,
1438 	.poll		= bt_sock_poll,
1439 	.ioctl		= bt_sock_ioctl,
1440 	.mmap		= sock_no_mmap,
1441 	.socketpair	= sock_no_socketpair,
1442 	.shutdown	= l2cap_sock_shutdown,
1443 	.setsockopt	= l2cap_sock_setsockopt,
1444 	.getsockopt	= l2cap_sock_getsockopt
1445 };
1446 
1447 static const struct net_proto_family l2cap_sock_family_ops = {
1448 	.family	= PF_BLUETOOTH,
1449 	.owner	= THIS_MODULE,
1450 	.create	= l2cap_sock_create,
1451 };
1452 
1453 int __init l2cap_init_sockets(void)
1454 {
1455 	int err;
1456 
1457 	err = proto_register(&l2cap_proto, 0);
1458 	if (err < 0)
1459 		return err;
1460 
1461 	err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1462 	if (err < 0) {
1463 		BT_ERR("L2CAP socket registration failed");
1464 		goto error;
1465 	}
1466 
1467 	err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1468 			     NULL);
1469 	if (err < 0) {
1470 		BT_ERR("Failed to create L2CAP proc file");
1471 		bt_sock_unregister(BTPROTO_L2CAP);
1472 		goto error;
1473 	}
1474 
1475 	BT_INFO("L2CAP socket layer initialized");
1476 
1477 	return 0;
1478 
1479 error:
1480 	proto_unregister(&l2cap_proto);
1481 	return err;
1482 }
1483 
1484 void l2cap_cleanup_sockets(void)
1485 {
1486 	bt_procfs_cleanup(&init_net, "l2cap");
1487 	bt_sock_unregister(BTPROTO_L2CAP);
1488 	proto_unregister(&l2cap_proto);
1489 }
1490 
1491 module_param(enable_lecoc, bool, 0644);
1492 MODULE_PARM_DESC(enable_lecoc, "Enable support for LE CoC");
1493