1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26 SOFTWARE IS DISCLAIMED.
27 */
28
29 /* Bluetooth L2CAP core. */
30
31 #include <linux/module.h>
32
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
35 #include <linux/filter.h>
36
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
40
41 #include "smp.h"
42
43 #define LE_FLOWCTL_MAX_CREDITS 65535
44
45 bool disable_ertm;
46 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED);
47
48 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
49
50 static LIST_HEAD(chan_list);
51 static DEFINE_RWLOCK(chan_list_lock);
52
53 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
54 u8 code, u8 ident, u16 dlen, void *data);
55 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
56 void *data);
57 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
58 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
59
60 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
61 struct sk_buff_head *skbs, u8 event);
62 static void l2cap_retrans_timeout(struct work_struct *work);
63 static void l2cap_monitor_timeout(struct work_struct *work);
64 static void l2cap_ack_timeout(struct work_struct *work);
65
bdaddr_type(u8 link_type,u8 bdaddr_type)66 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
67 {
68 if (link_type == LE_LINK) {
69 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
70 return BDADDR_LE_PUBLIC;
71 else
72 return BDADDR_LE_RANDOM;
73 }
74
75 return BDADDR_BREDR;
76 }
77
bdaddr_src_type(struct hci_conn * hcon)78 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
79 {
80 return bdaddr_type(hcon->type, hcon->src_type);
81 }
82
bdaddr_dst_type(struct hci_conn * hcon)83 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
84 {
85 return bdaddr_type(hcon->type, hcon->dst_type);
86 }
87
88 /* ---- L2CAP channels ---- */
89
__l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)90 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
91 u16 cid)
92 {
93 struct l2cap_chan *c;
94
95 list_for_each_entry(c, &conn->chan_l, list) {
96 if (c->dcid == cid)
97 return c;
98 }
99 return NULL;
100 }
101
__l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)102 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
103 u16 cid)
104 {
105 struct l2cap_chan *c;
106
107 list_for_each_entry(c, &conn->chan_l, list) {
108 if (c->scid == cid)
109 return c;
110 }
111 return NULL;
112 }
113
114 /* Find channel with given SCID.
115 * Returns a reference locked channel.
116 */
l2cap_get_chan_by_scid(struct l2cap_conn * conn,u16 cid)117 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
118 u16 cid)
119 {
120 struct l2cap_chan *c;
121
122 mutex_lock(&conn->chan_lock);
123 c = __l2cap_get_chan_by_scid(conn, cid);
124 if (c) {
125 /* Only lock if chan reference is not 0 */
126 c = l2cap_chan_hold_unless_zero(c);
127 if (c)
128 l2cap_chan_lock(c);
129 }
130 mutex_unlock(&conn->chan_lock);
131
132 return c;
133 }
134
135 /* Find channel with given DCID.
136 * Returns a reference locked channel.
137 */
l2cap_get_chan_by_dcid(struct l2cap_conn * conn,u16 cid)138 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
139 u16 cid)
140 {
141 struct l2cap_chan *c;
142
143 mutex_lock(&conn->chan_lock);
144 c = __l2cap_get_chan_by_dcid(conn, cid);
145 if (c) {
146 /* Only lock if chan reference is not 0 */
147 c = l2cap_chan_hold_unless_zero(c);
148 if (c)
149 l2cap_chan_lock(c);
150 }
151 mutex_unlock(&conn->chan_lock);
152
153 return c;
154 }
155
__l2cap_get_chan_by_ident(struct l2cap_conn * conn,u8 ident)156 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
157 u8 ident)
158 {
159 struct l2cap_chan *c;
160
161 list_for_each_entry(c, &conn->chan_l, list) {
162 if (c->ident == ident)
163 return c;
164 }
165 return NULL;
166 }
167
__l2cap_global_chan_by_addr(__le16 psm,bdaddr_t * src,u8 src_type)168 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
169 u8 src_type)
170 {
171 struct l2cap_chan *c;
172
173 list_for_each_entry(c, &chan_list, global_l) {
174 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
175 continue;
176
177 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
178 continue;
179
180 if (c->sport == psm && !bacmp(&c->src, src))
181 return c;
182 }
183 return NULL;
184 }
185
l2cap_add_psm(struct l2cap_chan * chan,bdaddr_t * src,__le16 psm)186 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
187 {
188 int err;
189
190 write_lock(&chan_list_lock);
191
192 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
193 err = -EADDRINUSE;
194 goto done;
195 }
196
197 if (psm) {
198 chan->psm = psm;
199 chan->sport = psm;
200 err = 0;
201 } else {
202 u16 p, start, end, incr;
203
204 if (chan->src_type == BDADDR_BREDR) {
205 start = L2CAP_PSM_DYN_START;
206 end = L2CAP_PSM_AUTO_END;
207 incr = 2;
208 } else {
209 start = L2CAP_PSM_LE_DYN_START;
210 end = L2CAP_PSM_LE_DYN_END;
211 incr = 1;
212 }
213
214 err = -EINVAL;
215 for (p = start; p <= end; p += incr)
216 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
217 chan->src_type)) {
218 chan->psm = cpu_to_le16(p);
219 chan->sport = cpu_to_le16(p);
220 err = 0;
221 break;
222 }
223 }
224
225 done:
226 write_unlock(&chan_list_lock);
227 return err;
228 }
229 EXPORT_SYMBOL_GPL(l2cap_add_psm);
230
l2cap_add_scid(struct l2cap_chan * chan,__u16 scid)231 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
232 {
233 write_lock(&chan_list_lock);
234
235 /* Override the defaults (which are for conn-oriented) */
236 chan->omtu = L2CAP_DEFAULT_MTU;
237 chan->chan_type = L2CAP_CHAN_FIXED;
238
239 chan->scid = scid;
240
241 write_unlock(&chan_list_lock);
242
243 return 0;
244 }
245
l2cap_alloc_cid(struct l2cap_conn * conn)246 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
247 {
248 u16 cid, dyn_end;
249
250 if (conn->hcon->type == LE_LINK)
251 dyn_end = L2CAP_CID_LE_DYN_END;
252 else
253 dyn_end = L2CAP_CID_DYN_END;
254
255 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
256 if (!__l2cap_get_chan_by_scid(conn, cid))
257 return cid;
258 }
259
260 return 0;
261 }
262
l2cap_state_change(struct l2cap_chan * chan,int state)263 static void l2cap_state_change(struct l2cap_chan *chan, int state)
264 {
265 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
266 state_to_string(state));
267
268 chan->state = state;
269 chan->ops->state_change(chan, state, 0);
270 }
271
l2cap_state_change_and_error(struct l2cap_chan * chan,int state,int err)272 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
273 int state, int err)
274 {
275 chan->state = state;
276 chan->ops->state_change(chan, chan->state, err);
277 }
278
l2cap_chan_set_err(struct l2cap_chan * chan,int err)279 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
280 {
281 chan->ops->state_change(chan, chan->state, err);
282 }
283
__set_retrans_timer(struct l2cap_chan * chan)284 static void __set_retrans_timer(struct l2cap_chan *chan)
285 {
286 if (!delayed_work_pending(&chan->monitor_timer) &&
287 chan->retrans_timeout) {
288 l2cap_set_timer(chan, &chan->retrans_timer,
289 msecs_to_jiffies(chan->retrans_timeout));
290 }
291 }
292
__set_monitor_timer(struct l2cap_chan * chan)293 static void __set_monitor_timer(struct l2cap_chan *chan)
294 {
295 __clear_retrans_timer(chan);
296 if (chan->monitor_timeout) {
297 l2cap_set_timer(chan, &chan->monitor_timer,
298 msecs_to_jiffies(chan->monitor_timeout));
299 }
300 }
301
l2cap_ertm_seq_in_queue(struct sk_buff_head * head,u16 seq)302 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
303 u16 seq)
304 {
305 struct sk_buff *skb;
306
307 skb_queue_walk(head, skb) {
308 if (bt_cb(skb)->l2cap.txseq == seq)
309 return skb;
310 }
311
312 return NULL;
313 }
314
315 /* ---- L2CAP sequence number lists ---- */
316
317 /* For ERTM, ordered lists of sequence numbers must be tracked for
318 * SREJ requests that are received and for frames that are to be
319 * retransmitted. These seq_list functions implement a singly-linked
320 * list in an array, where membership in the list can also be checked
321 * in constant time. Items can also be added to the tail of the list
322 * and removed from the head in constant time, without further memory
323 * allocs or frees.
324 */
325
l2cap_seq_list_init(struct l2cap_seq_list * seq_list,u16 size)326 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
327 {
328 size_t alloc_size, i;
329
330 /* Allocated size is a power of 2 to map sequence numbers
331 * (which may be up to 14 bits) in to a smaller array that is
332 * sized for the negotiated ERTM transmit windows.
333 */
334 alloc_size = roundup_pow_of_two(size);
335
336 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
337 if (!seq_list->list)
338 return -ENOMEM;
339
340 seq_list->mask = alloc_size - 1;
341 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
342 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
343 for (i = 0; i < alloc_size; i++)
344 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
345
346 return 0;
347 }
348
l2cap_seq_list_free(struct l2cap_seq_list * seq_list)349 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
350 {
351 kfree(seq_list->list);
352 }
353
l2cap_seq_list_contains(struct l2cap_seq_list * seq_list,u16 seq)354 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
355 u16 seq)
356 {
357 /* Constant-time check for list membership */
358 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
359 }
360
l2cap_seq_list_pop(struct l2cap_seq_list * seq_list)361 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
362 {
363 u16 seq = seq_list->head;
364 u16 mask = seq_list->mask;
365
366 seq_list->head = seq_list->list[seq & mask];
367 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
368
369 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
370 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
371 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
372 }
373
374 return seq;
375 }
376
l2cap_seq_list_clear(struct l2cap_seq_list * seq_list)377 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
378 {
379 u16 i;
380
381 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
382 return;
383
384 for (i = 0; i <= seq_list->mask; i++)
385 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
386
387 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
388 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
389 }
390
l2cap_seq_list_append(struct l2cap_seq_list * seq_list,u16 seq)391 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
392 {
393 u16 mask = seq_list->mask;
394
395 /* All appends happen in constant time */
396
397 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
398 return;
399
400 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
401 seq_list->head = seq;
402 else
403 seq_list->list[seq_list->tail & mask] = seq;
404
405 seq_list->tail = seq;
406 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
407 }
408
l2cap_chan_timeout(struct work_struct * work)409 static void l2cap_chan_timeout(struct work_struct *work)
410 {
411 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
412 chan_timer.work);
413 struct l2cap_conn *conn = chan->conn;
414 int reason;
415
416 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
417
418 if (!conn)
419 return;
420
421 mutex_lock(&conn->chan_lock);
422 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
423 * this work. No need to call l2cap_chan_hold(chan) here again.
424 */
425 l2cap_chan_lock(chan);
426
427 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
428 reason = ECONNREFUSED;
429 else if (chan->state == BT_CONNECT &&
430 chan->sec_level != BT_SECURITY_SDP)
431 reason = ECONNREFUSED;
432 else
433 reason = ETIMEDOUT;
434
435 l2cap_chan_close(chan, reason);
436
437 chan->ops->close(chan);
438
439 l2cap_chan_unlock(chan);
440 l2cap_chan_put(chan);
441
442 mutex_unlock(&conn->chan_lock);
443 }
444
l2cap_chan_create(void)445 struct l2cap_chan *l2cap_chan_create(void)
446 {
447 struct l2cap_chan *chan;
448
449 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
450 if (!chan)
451 return NULL;
452
453 skb_queue_head_init(&chan->tx_q);
454 skb_queue_head_init(&chan->srej_q);
455 mutex_init(&chan->lock);
456
457 /* Set default lock nesting level */
458 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
459
460 /* Available receive buffer space is initially unknown */
461 chan->rx_avail = -1;
462
463 write_lock(&chan_list_lock);
464 list_add(&chan->global_l, &chan_list);
465 write_unlock(&chan_list_lock);
466
467 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
468 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
469 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
470 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
471
472 chan->state = BT_OPEN;
473
474 kref_init(&chan->kref);
475
476 /* This flag is cleared in l2cap_chan_ready() */
477 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
478
479 BT_DBG("chan %p", chan);
480
481 return chan;
482 }
483 EXPORT_SYMBOL_GPL(l2cap_chan_create);
484
l2cap_chan_destroy(struct kref * kref)485 static void l2cap_chan_destroy(struct kref *kref)
486 {
487 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
488
489 BT_DBG("chan %p", chan);
490
491 write_lock(&chan_list_lock);
492 list_del(&chan->global_l);
493 write_unlock(&chan_list_lock);
494
495 kfree(chan);
496 }
497
l2cap_chan_hold(struct l2cap_chan * c)498 void l2cap_chan_hold(struct l2cap_chan *c)
499 {
500 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
501
502 kref_get(&c->kref);
503 }
504
l2cap_chan_hold_unless_zero(struct l2cap_chan * c)505 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
506 {
507 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
508
509 if (!kref_get_unless_zero(&c->kref))
510 return NULL;
511
512 return c;
513 }
514
l2cap_chan_put(struct l2cap_chan * c)515 void l2cap_chan_put(struct l2cap_chan *c)
516 {
517 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
518
519 kref_put(&c->kref, l2cap_chan_destroy);
520 }
521 EXPORT_SYMBOL_GPL(l2cap_chan_put);
522
l2cap_chan_set_defaults(struct l2cap_chan * chan)523 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
524 {
525 chan->fcs = L2CAP_FCS_CRC16;
526 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
527 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
528 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
529 chan->remote_max_tx = chan->max_tx;
530 chan->remote_tx_win = chan->tx_win;
531 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
532 chan->sec_level = BT_SECURITY_LOW;
533 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
534 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
535 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
536
537 chan->conf_state = 0;
538 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
539
540 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
541 }
542 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
543
l2cap_le_rx_credits(struct l2cap_chan * chan)544 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan)
545 {
546 size_t sdu_len = chan->sdu ? chan->sdu->len : 0;
547
548 if (chan->mps == 0)
549 return 0;
550
551 /* If we don't know the available space in the receiver buffer, give
552 * enough credits for a full packet.
553 */
554 if (chan->rx_avail == -1)
555 return (chan->imtu / chan->mps) + 1;
556
557 /* If we know how much space is available in the receive buffer, give
558 * out as many credits as would fill the buffer.
559 */
560 if (chan->rx_avail <= sdu_len)
561 return 0;
562
563 return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps);
564 }
565
l2cap_le_flowctl_init(struct l2cap_chan * chan,u16 tx_credits)566 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
567 {
568 chan->sdu = NULL;
569 chan->sdu_last_frag = NULL;
570 chan->sdu_len = 0;
571 chan->tx_credits = tx_credits;
572 /* Derive MPS from connection MTU to stop HCI fragmentation */
573 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
574 chan->rx_credits = l2cap_le_rx_credits(chan);
575
576 skb_queue_head_init(&chan->tx_q);
577 }
578
l2cap_ecred_init(struct l2cap_chan * chan,u16 tx_credits)579 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
580 {
581 l2cap_le_flowctl_init(chan, tx_credits);
582
583 /* L2CAP implementations shall support a minimum MPS of 64 octets */
584 if (chan->mps < L2CAP_ECRED_MIN_MPS) {
585 chan->mps = L2CAP_ECRED_MIN_MPS;
586 chan->rx_credits = l2cap_le_rx_credits(chan);
587 }
588 }
589
__l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)590 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
591 {
592 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
593 __le16_to_cpu(chan->psm), chan->dcid);
594
595 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
596
597 chan->conn = conn;
598
599 switch (chan->chan_type) {
600 case L2CAP_CHAN_CONN_ORIENTED:
601 /* Alloc CID for connection-oriented socket */
602 chan->scid = l2cap_alloc_cid(conn);
603 if (conn->hcon->type == ACL_LINK)
604 chan->omtu = L2CAP_DEFAULT_MTU;
605 break;
606
607 case L2CAP_CHAN_CONN_LESS:
608 /* Connectionless socket */
609 chan->scid = L2CAP_CID_CONN_LESS;
610 chan->dcid = L2CAP_CID_CONN_LESS;
611 chan->omtu = L2CAP_DEFAULT_MTU;
612 break;
613
614 case L2CAP_CHAN_FIXED:
615 /* Caller will set CID and CID specific MTU values */
616 break;
617
618 default:
619 /* Raw socket can send/recv signalling messages only */
620 chan->scid = L2CAP_CID_SIGNALING;
621 chan->dcid = L2CAP_CID_SIGNALING;
622 chan->omtu = L2CAP_DEFAULT_MTU;
623 }
624
625 chan->local_id = L2CAP_BESTEFFORT_ID;
626 chan->local_stype = L2CAP_SERV_BESTEFFORT;
627 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
628 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
629 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
630 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
631
632 l2cap_chan_hold(chan);
633
634 /* Only keep a reference for fixed channels if they requested it */
635 if (chan->chan_type != L2CAP_CHAN_FIXED ||
636 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
637 hci_conn_hold(conn->hcon);
638
639 list_add(&chan->list, &conn->chan_l);
640 }
641
l2cap_chan_add(struct l2cap_conn * conn,struct l2cap_chan * chan)642 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643 {
644 mutex_lock(&conn->chan_lock);
645 __l2cap_chan_add(conn, chan);
646 mutex_unlock(&conn->chan_lock);
647 }
648
l2cap_chan_del(struct l2cap_chan * chan,int err)649 void l2cap_chan_del(struct l2cap_chan *chan, int err)
650 {
651 struct l2cap_conn *conn = chan->conn;
652
653 __clear_chan_timer(chan);
654
655 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
656 state_to_string(chan->state));
657
658 chan->ops->teardown(chan, err);
659
660 if (conn) {
661 /* Delete from channel list */
662 list_del(&chan->list);
663
664 l2cap_chan_put(chan);
665
666 chan->conn = NULL;
667
668 /* Reference was only held for non-fixed channels or
669 * fixed channels that explicitly requested it using the
670 * FLAG_HOLD_HCI_CONN flag.
671 */
672 if (chan->chan_type != L2CAP_CHAN_FIXED ||
673 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
674 hci_conn_drop(conn->hcon);
675 }
676
677 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
678 return;
679
680 switch (chan->mode) {
681 case L2CAP_MODE_BASIC:
682 break;
683
684 case L2CAP_MODE_LE_FLOWCTL:
685 case L2CAP_MODE_EXT_FLOWCTL:
686 skb_queue_purge(&chan->tx_q);
687 break;
688
689 case L2CAP_MODE_ERTM:
690 __clear_retrans_timer(chan);
691 __clear_monitor_timer(chan);
692 __clear_ack_timer(chan);
693
694 skb_queue_purge(&chan->srej_q);
695
696 l2cap_seq_list_free(&chan->srej_list);
697 l2cap_seq_list_free(&chan->retrans_list);
698 fallthrough;
699
700 case L2CAP_MODE_STREAMING:
701 skb_queue_purge(&chan->tx_q);
702 break;
703 }
704 }
705 EXPORT_SYMBOL_GPL(l2cap_chan_del);
706
__l2cap_chan_list_id(struct l2cap_conn * conn,u16 id,l2cap_chan_func_t func,void * data)707 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
708 l2cap_chan_func_t func, void *data)
709 {
710 struct l2cap_chan *chan, *l;
711
712 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
713 if (chan->ident == id)
714 func(chan, data);
715 }
716 }
717
__l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)718 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
719 void *data)
720 {
721 struct l2cap_chan *chan;
722
723 list_for_each_entry(chan, &conn->chan_l, list) {
724 func(chan, data);
725 }
726 }
727
l2cap_chan_list(struct l2cap_conn * conn,l2cap_chan_func_t func,void * data)728 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
729 void *data)
730 {
731 if (!conn)
732 return;
733
734 mutex_lock(&conn->chan_lock);
735 __l2cap_chan_list(conn, func, data);
736 mutex_unlock(&conn->chan_lock);
737 }
738
739 EXPORT_SYMBOL_GPL(l2cap_chan_list);
740
l2cap_conn_update_id_addr(struct work_struct * work)741 static void l2cap_conn_update_id_addr(struct work_struct *work)
742 {
743 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
744 id_addr_timer.work);
745 struct hci_conn *hcon = conn->hcon;
746 struct l2cap_chan *chan;
747
748 mutex_lock(&conn->chan_lock);
749
750 list_for_each_entry(chan, &conn->chan_l, list) {
751 l2cap_chan_lock(chan);
752 bacpy(&chan->dst, &hcon->dst);
753 chan->dst_type = bdaddr_dst_type(hcon);
754 l2cap_chan_unlock(chan);
755 }
756
757 mutex_unlock(&conn->chan_lock);
758 }
759
l2cap_chan_le_connect_reject(struct l2cap_chan * chan)760 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
761 {
762 struct l2cap_conn *conn = chan->conn;
763 struct l2cap_le_conn_rsp rsp;
764 u16 result;
765
766 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
767 result = L2CAP_CR_LE_AUTHORIZATION;
768 else
769 result = L2CAP_CR_LE_BAD_PSM;
770
771 l2cap_state_change(chan, BT_DISCONN);
772
773 rsp.dcid = cpu_to_le16(chan->scid);
774 rsp.mtu = cpu_to_le16(chan->imtu);
775 rsp.mps = cpu_to_le16(chan->mps);
776 rsp.credits = cpu_to_le16(chan->rx_credits);
777 rsp.result = cpu_to_le16(result);
778
779 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
780 &rsp);
781 }
782
l2cap_chan_ecred_connect_reject(struct l2cap_chan * chan)783 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
784 {
785 l2cap_state_change(chan, BT_DISCONN);
786
787 __l2cap_ecred_conn_rsp_defer(chan);
788 }
789
l2cap_chan_connect_reject(struct l2cap_chan * chan)790 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
791 {
792 struct l2cap_conn *conn = chan->conn;
793 struct l2cap_conn_rsp rsp;
794 u16 result;
795
796 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
797 result = L2CAP_CR_SEC_BLOCK;
798 else
799 result = L2CAP_CR_BAD_PSM;
800
801 l2cap_state_change(chan, BT_DISCONN);
802
803 rsp.scid = cpu_to_le16(chan->dcid);
804 rsp.dcid = cpu_to_le16(chan->scid);
805 rsp.result = cpu_to_le16(result);
806 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
807
808 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
809 }
810
l2cap_chan_close(struct l2cap_chan * chan,int reason)811 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
812 {
813 struct l2cap_conn *conn = chan->conn;
814
815 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
816
817 switch (chan->state) {
818 case BT_LISTEN:
819 chan->ops->teardown(chan, 0);
820 break;
821
822 case BT_CONNECTED:
823 case BT_CONFIG:
824 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
825 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
826 l2cap_send_disconn_req(chan, reason);
827 } else
828 l2cap_chan_del(chan, reason);
829 break;
830
831 case BT_CONNECT2:
832 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
833 if (conn->hcon->type == ACL_LINK)
834 l2cap_chan_connect_reject(chan);
835 else if (conn->hcon->type == LE_LINK) {
836 switch (chan->mode) {
837 case L2CAP_MODE_LE_FLOWCTL:
838 l2cap_chan_le_connect_reject(chan);
839 break;
840 case L2CAP_MODE_EXT_FLOWCTL:
841 l2cap_chan_ecred_connect_reject(chan);
842 return;
843 }
844 }
845 }
846
847 l2cap_chan_del(chan, reason);
848 break;
849
850 case BT_CONNECT:
851 case BT_DISCONN:
852 l2cap_chan_del(chan, reason);
853 break;
854
855 default:
856 chan->ops->teardown(chan, 0);
857 break;
858 }
859 }
860 EXPORT_SYMBOL(l2cap_chan_close);
861
l2cap_get_auth_type(struct l2cap_chan * chan)862 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
863 {
864 switch (chan->chan_type) {
865 case L2CAP_CHAN_RAW:
866 switch (chan->sec_level) {
867 case BT_SECURITY_HIGH:
868 case BT_SECURITY_FIPS:
869 return HCI_AT_DEDICATED_BONDING_MITM;
870 case BT_SECURITY_MEDIUM:
871 return HCI_AT_DEDICATED_BONDING;
872 default:
873 return HCI_AT_NO_BONDING;
874 }
875 break;
876 case L2CAP_CHAN_CONN_LESS:
877 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
878 if (chan->sec_level == BT_SECURITY_LOW)
879 chan->sec_level = BT_SECURITY_SDP;
880 }
881 if (chan->sec_level == BT_SECURITY_HIGH ||
882 chan->sec_level == BT_SECURITY_FIPS)
883 return HCI_AT_NO_BONDING_MITM;
884 else
885 return HCI_AT_NO_BONDING;
886 break;
887 case L2CAP_CHAN_CONN_ORIENTED:
888 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
889 if (chan->sec_level == BT_SECURITY_LOW)
890 chan->sec_level = BT_SECURITY_SDP;
891
892 if (chan->sec_level == BT_SECURITY_HIGH ||
893 chan->sec_level == BT_SECURITY_FIPS)
894 return HCI_AT_NO_BONDING_MITM;
895 else
896 return HCI_AT_NO_BONDING;
897 }
898 fallthrough;
899
900 default:
901 switch (chan->sec_level) {
902 case BT_SECURITY_HIGH:
903 case BT_SECURITY_FIPS:
904 return HCI_AT_GENERAL_BONDING_MITM;
905 case BT_SECURITY_MEDIUM:
906 return HCI_AT_GENERAL_BONDING;
907 default:
908 return HCI_AT_NO_BONDING;
909 }
910 break;
911 }
912 }
913
914 /* Service level security */
l2cap_chan_check_security(struct l2cap_chan * chan,bool initiator)915 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
916 {
917 struct l2cap_conn *conn = chan->conn;
918 __u8 auth_type;
919
920 if (conn->hcon->type == LE_LINK)
921 return smp_conn_security(conn->hcon, chan->sec_level);
922
923 auth_type = l2cap_get_auth_type(chan);
924
925 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
926 initiator);
927 }
928
l2cap_get_ident(struct l2cap_conn * conn)929 static u8 l2cap_get_ident(struct l2cap_conn *conn)
930 {
931 u8 id;
932
933 /* Get next available identificator.
934 * 1 - 128 are used by kernel.
935 * 129 - 199 are reserved.
936 * 200 - 254 are used by utilities like l2ping, etc.
937 */
938
939 mutex_lock(&conn->ident_lock);
940
941 if (++conn->tx_ident > 128)
942 conn->tx_ident = 1;
943
944 id = conn->tx_ident;
945
946 mutex_unlock(&conn->ident_lock);
947
948 return id;
949 }
950
l2cap_send_cmd(struct l2cap_conn * conn,u8 ident,u8 code,u16 len,void * data)951 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
952 void *data)
953 {
954 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
955 u8 flags;
956
957 BT_DBG("code 0x%2.2x", code);
958
959 if (!skb)
960 return;
961
962 /* Use NO_FLUSH if supported or we have an LE link (which does
963 * not support auto-flushing packets) */
964 if (lmp_no_flush_capable(conn->hcon->hdev) ||
965 conn->hcon->type == LE_LINK)
966 flags = ACL_START_NO_FLUSH;
967 else
968 flags = ACL_START;
969
970 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
971 skb->priority = HCI_PRIO_MAX;
972
973 hci_send_acl(conn->hchan, skb, flags);
974 }
975
l2cap_do_send(struct l2cap_chan * chan,struct sk_buff * skb)976 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
977 {
978 struct hci_conn *hcon = chan->conn->hcon;
979 u16 flags;
980
981 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
982 skb->priority);
983
984 /* Use NO_FLUSH for LE links (where this is the only option) or
985 * if the BR/EDR link supports it and flushing has not been
986 * explicitly requested (through FLAG_FLUSHABLE).
987 */
988 if (hcon->type == LE_LINK ||
989 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
990 lmp_no_flush_capable(hcon->hdev)))
991 flags = ACL_START_NO_FLUSH;
992 else
993 flags = ACL_START;
994
995 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
996 hci_send_acl(chan->conn->hchan, skb, flags);
997 }
998
__unpack_enhanced_control(u16 enh,struct l2cap_ctrl * control)999 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
1000 {
1001 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
1002 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
1003
1004 if (enh & L2CAP_CTRL_FRAME_TYPE) {
1005 /* S-Frame */
1006 control->sframe = 1;
1007 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1008 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1009
1010 control->sar = 0;
1011 control->txseq = 0;
1012 } else {
1013 /* I-Frame */
1014 control->sframe = 0;
1015 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1016 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1017
1018 control->poll = 0;
1019 control->super = 0;
1020 }
1021 }
1022
__unpack_extended_control(u32 ext,struct l2cap_ctrl * control)1023 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1024 {
1025 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1026 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1027
1028 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1029 /* S-Frame */
1030 control->sframe = 1;
1031 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1032 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1033
1034 control->sar = 0;
1035 control->txseq = 0;
1036 } else {
1037 /* I-Frame */
1038 control->sframe = 0;
1039 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1040 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1041
1042 control->poll = 0;
1043 control->super = 0;
1044 }
1045 }
1046
__unpack_control(struct l2cap_chan * chan,struct sk_buff * skb)1047 static inline void __unpack_control(struct l2cap_chan *chan,
1048 struct sk_buff *skb)
1049 {
1050 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1051 __unpack_extended_control(get_unaligned_le32(skb->data),
1052 &bt_cb(skb)->l2cap);
1053 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1054 } else {
1055 __unpack_enhanced_control(get_unaligned_le16(skb->data),
1056 &bt_cb(skb)->l2cap);
1057 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1058 }
1059 }
1060
__pack_extended_control(struct l2cap_ctrl * control)1061 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1062 {
1063 u32 packed;
1064
1065 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1066 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1067
1068 if (control->sframe) {
1069 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1070 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1071 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1072 } else {
1073 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1074 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1075 }
1076
1077 return packed;
1078 }
1079
__pack_enhanced_control(struct l2cap_ctrl * control)1080 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1081 {
1082 u16 packed;
1083
1084 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1085 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1086
1087 if (control->sframe) {
1088 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1089 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1090 packed |= L2CAP_CTRL_FRAME_TYPE;
1091 } else {
1092 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1093 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1094 }
1095
1096 return packed;
1097 }
1098
__pack_control(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)1099 static inline void __pack_control(struct l2cap_chan *chan,
1100 struct l2cap_ctrl *control,
1101 struct sk_buff *skb)
1102 {
1103 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1104 put_unaligned_le32(__pack_extended_control(control),
1105 skb->data + L2CAP_HDR_SIZE);
1106 } else {
1107 put_unaligned_le16(__pack_enhanced_control(control),
1108 skb->data + L2CAP_HDR_SIZE);
1109 }
1110 }
1111
__ertm_hdr_size(struct l2cap_chan * chan)1112 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1113 {
1114 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1115 return L2CAP_EXT_HDR_SIZE;
1116 else
1117 return L2CAP_ENH_HDR_SIZE;
1118 }
1119
l2cap_create_sframe_pdu(struct l2cap_chan * chan,u32 control)1120 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1121 u32 control)
1122 {
1123 struct sk_buff *skb;
1124 struct l2cap_hdr *lh;
1125 int hlen = __ertm_hdr_size(chan);
1126
1127 if (chan->fcs == L2CAP_FCS_CRC16)
1128 hlen += L2CAP_FCS_SIZE;
1129
1130 skb = bt_skb_alloc(hlen, GFP_KERNEL);
1131
1132 if (!skb)
1133 return ERR_PTR(-ENOMEM);
1134
1135 lh = skb_put(skb, L2CAP_HDR_SIZE);
1136 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1137 lh->cid = cpu_to_le16(chan->dcid);
1138
1139 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1140 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1141 else
1142 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1143
1144 if (chan->fcs == L2CAP_FCS_CRC16) {
1145 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1146 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1147 }
1148
1149 skb->priority = HCI_PRIO_MAX;
1150 return skb;
1151 }
1152
l2cap_send_sframe(struct l2cap_chan * chan,struct l2cap_ctrl * control)1153 static void l2cap_send_sframe(struct l2cap_chan *chan,
1154 struct l2cap_ctrl *control)
1155 {
1156 struct sk_buff *skb;
1157 u32 control_field;
1158
1159 BT_DBG("chan %p, control %p", chan, control);
1160
1161 if (!control->sframe)
1162 return;
1163
1164 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1165 !control->poll)
1166 control->final = 1;
1167
1168 if (control->super == L2CAP_SUPER_RR)
1169 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1170 else if (control->super == L2CAP_SUPER_RNR)
1171 set_bit(CONN_RNR_SENT, &chan->conn_state);
1172
1173 if (control->super != L2CAP_SUPER_SREJ) {
1174 chan->last_acked_seq = control->reqseq;
1175 __clear_ack_timer(chan);
1176 }
1177
1178 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1179 control->final, control->poll, control->super);
1180
1181 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1182 control_field = __pack_extended_control(control);
1183 else
1184 control_field = __pack_enhanced_control(control);
1185
1186 skb = l2cap_create_sframe_pdu(chan, control_field);
1187 if (!IS_ERR(skb))
1188 l2cap_do_send(chan, skb);
1189 }
1190
l2cap_send_rr_or_rnr(struct l2cap_chan * chan,bool poll)1191 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1192 {
1193 struct l2cap_ctrl control;
1194
1195 BT_DBG("chan %p, poll %d", chan, poll);
1196
1197 memset(&control, 0, sizeof(control));
1198 control.sframe = 1;
1199 control.poll = poll;
1200
1201 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1202 control.super = L2CAP_SUPER_RNR;
1203 else
1204 control.super = L2CAP_SUPER_RR;
1205
1206 control.reqseq = chan->buffer_seq;
1207 l2cap_send_sframe(chan, &control);
1208 }
1209
__l2cap_no_conn_pending(struct l2cap_chan * chan)1210 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1211 {
1212 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1213 return true;
1214
1215 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1216 }
1217
l2cap_send_conn_req(struct l2cap_chan * chan)1218 void l2cap_send_conn_req(struct l2cap_chan *chan)
1219 {
1220 struct l2cap_conn *conn = chan->conn;
1221 struct l2cap_conn_req req;
1222
1223 req.scid = cpu_to_le16(chan->scid);
1224 req.psm = chan->psm;
1225
1226 chan->ident = l2cap_get_ident(conn);
1227
1228 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1229
1230 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1231 }
1232
l2cap_chan_ready(struct l2cap_chan * chan)1233 static void l2cap_chan_ready(struct l2cap_chan *chan)
1234 {
1235 /* The channel may have already been flagged as connected in
1236 * case of receiving data before the L2CAP info req/rsp
1237 * procedure is complete.
1238 */
1239 if (chan->state == BT_CONNECTED)
1240 return;
1241
1242 /* This clears all conf flags, including CONF_NOT_COMPLETE */
1243 chan->conf_state = 0;
1244 __clear_chan_timer(chan);
1245
1246 switch (chan->mode) {
1247 case L2CAP_MODE_LE_FLOWCTL:
1248 case L2CAP_MODE_EXT_FLOWCTL:
1249 if (!chan->tx_credits)
1250 chan->ops->suspend(chan);
1251 break;
1252 }
1253
1254 chan->state = BT_CONNECTED;
1255
1256 chan->ops->ready(chan);
1257 }
1258
l2cap_le_connect(struct l2cap_chan * chan)1259 static void l2cap_le_connect(struct l2cap_chan *chan)
1260 {
1261 struct l2cap_conn *conn = chan->conn;
1262 struct l2cap_le_conn_req req;
1263
1264 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1265 return;
1266
1267 if (!chan->imtu)
1268 chan->imtu = chan->conn->mtu;
1269
1270 l2cap_le_flowctl_init(chan, 0);
1271
1272 memset(&req, 0, sizeof(req));
1273 req.psm = chan->psm;
1274 req.scid = cpu_to_le16(chan->scid);
1275 req.mtu = cpu_to_le16(chan->imtu);
1276 req.mps = cpu_to_le16(chan->mps);
1277 req.credits = cpu_to_le16(chan->rx_credits);
1278
1279 chan->ident = l2cap_get_ident(conn);
1280
1281 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1282 sizeof(req), &req);
1283 }
1284
1285 struct l2cap_ecred_conn_data {
1286 struct {
1287 struct l2cap_ecred_conn_req req;
1288 __le16 scid[5];
1289 } __packed pdu;
1290 struct l2cap_chan *chan;
1291 struct pid *pid;
1292 int count;
1293 };
1294
l2cap_ecred_defer_connect(struct l2cap_chan * chan,void * data)1295 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1296 {
1297 struct l2cap_ecred_conn_data *conn = data;
1298 struct pid *pid;
1299
1300 if (chan == conn->chan)
1301 return;
1302
1303 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1304 return;
1305
1306 pid = chan->ops->get_peer_pid(chan);
1307
1308 /* Only add deferred channels with the same PID/PSM */
1309 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1310 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1311 return;
1312
1313 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1314 return;
1315
1316 l2cap_ecred_init(chan, 0);
1317
1318 /* Set the same ident so we can match on the rsp */
1319 chan->ident = conn->chan->ident;
1320
1321 /* Include all channels deferred */
1322 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1323
1324 conn->count++;
1325 }
1326
l2cap_ecred_connect(struct l2cap_chan * chan)1327 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1328 {
1329 struct l2cap_conn *conn = chan->conn;
1330 struct l2cap_ecred_conn_data data;
1331
1332 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1333 return;
1334
1335 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1336 return;
1337
1338 l2cap_ecred_init(chan, 0);
1339
1340 memset(&data, 0, sizeof(data));
1341 data.pdu.req.psm = chan->psm;
1342 data.pdu.req.mtu = cpu_to_le16(chan->imtu);
1343 data.pdu.req.mps = cpu_to_le16(chan->mps);
1344 data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1345 data.pdu.scid[0] = cpu_to_le16(chan->scid);
1346
1347 chan->ident = l2cap_get_ident(conn);
1348
1349 data.count = 1;
1350 data.chan = chan;
1351 data.pid = chan->ops->get_peer_pid(chan);
1352
1353 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1354
1355 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1356 sizeof(data.pdu.req) + data.count * sizeof(__le16),
1357 &data.pdu);
1358 }
1359
l2cap_le_start(struct l2cap_chan * chan)1360 static void l2cap_le_start(struct l2cap_chan *chan)
1361 {
1362 struct l2cap_conn *conn = chan->conn;
1363
1364 if (!smp_conn_security(conn->hcon, chan->sec_level))
1365 return;
1366
1367 if (!chan->psm) {
1368 l2cap_chan_ready(chan);
1369 return;
1370 }
1371
1372 if (chan->state == BT_CONNECT) {
1373 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1374 l2cap_ecred_connect(chan);
1375 else
1376 l2cap_le_connect(chan);
1377 }
1378 }
1379
l2cap_start_connection(struct l2cap_chan * chan)1380 static void l2cap_start_connection(struct l2cap_chan *chan)
1381 {
1382 if (chan->conn->hcon->type == LE_LINK) {
1383 l2cap_le_start(chan);
1384 } else {
1385 l2cap_send_conn_req(chan);
1386 }
1387 }
1388
l2cap_request_info(struct l2cap_conn * conn)1389 static void l2cap_request_info(struct l2cap_conn *conn)
1390 {
1391 struct l2cap_info_req req;
1392
1393 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1394 return;
1395
1396 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1397
1398 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1399 conn->info_ident = l2cap_get_ident(conn);
1400
1401 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1402
1403 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1404 sizeof(req), &req);
1405 }
1406
l2cap_check_enc_key_size(struct hci_conn * hcon)1407 static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1408 {
1409 /* The minimum encryption key size needs to be enforced by the
1410 * host stack before establishing any L2CAP connections. The
1411 * specification in theory allows a minimum of 1, but to align
1412 * BR/EDR and LE transports, a minimum of 7 is chosen.
1413 *
1414 * This check might also be called for unencrypted connections
1415 * that have no key size requirements. Ensure that the link is
1416 * actually encrypted before enforcing a key size.
1417 */
1418 int min_key_size = hcon->hdev->min_enc_key_size;
1419
1420 /* On FIPS security level, key size must be 16 bytes */
1421 if (hcon->sec_level == BT_SECURITY_FIPS)
1422 min_key_size = 16;
1423
1424 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1425 hcon->enc_key_size >= min_key_size);
1426 }
1427
l2cap_do_start(struct l2cap_chan * chan)1428 static void l2cap_do_start(struct l2cap_chan *chan)
1429 {
1430 struct l2cap_conn *conn = chan->conn;
1431
1432 if (conn->hcon->type == LE_LINK) {
1433 l2cap_le_start(chan);
1434 return;
1435 }
1436
1437 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1438 l2cap_request_info(conn);
1439 return;
1440 }
1441
1442 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1443 return;
1444
1445 if (!l2cap_chan_check_security(chan, true) ||
1446 !__l2cap_no_conn_pending(chan))
1447 return;
1448
1449 if (l2cap_check_enc_key_size(conn->hcon))
1450 l2cap_start_connection(chan);
1451 else
1452 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1453 }
1454
l2cap_mode_supported(__u8 mode,__u32 feat_mask)1455 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1456 {
1457 u32 local_feat_mask = l2cap_feat_mask;
1458 if (!disable_ertm)
1459 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1460
1461 switch (mode) {
1462 case L2CAP_MODE_ERTM:
1463 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1464 case L2CAP_MODE_STREAMING:
1465 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1466 default:
1467 return 0x00;
1468 }
1469 }
1470
l2cap_send_disconn_req(struct l2cap_chan * chan,int err)1471 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1472 {
1473 struct l2cap_conn *conn = chan->conn;
1474 struct l2cap_disconn_req req;
1475
1476 if (!conn)
1477 return;
1478
1479 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1480 __clear_retrans_timer(chan);
1481 __clear_monitor_timer(chan);
1482 __clear_ack_timer(chan);
1483 }
1484
1485 req.dcid = cpu_to_le16(chan->dcid);
1486 req.scid = cpu_to_le16(chan->scid);
1487 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1488 sizeof(req), &req);
1489
1490 l2cap_state_change_and_error(chan, BT_DISCONN, err);
1491 }
1492
1493 /* ---- L2CAP connections ---- */
l2cap_conn_start(struct l2cap_conn * conn)1494 static void l2cap_conn_start(struct l2cap_conn *conn)
1495 {
1496 struct l2cap_chan *chan, *tmp;
1497
1498 BT_DBG("conn %p", conn);
1499
1500 mutex_lock(&conn->chan_lock);
1501
1502 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1503 l2cap_chan_lock(chan);
1504
1505 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1506 l2cap_chan_ready(chan);
1507 l2cap_chan_unlock(chan);
1508 continue;
1509 }
1510
1511 if (chan->state == BT_CONNECT) {
1512 if (!l2cap_chan_check_security(chan, true) ||
1513 !__l2cap_no_conn_pending(chan)) {
1514 l2cap_chan_unlock(chan);
1515 continue;
1516 }
1517
1518 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1519 && test_bit(CONF_STATE2_DEVICE,
1520 &chan->conf_state)) {
1521 l2cap_chan_close(chan, ECONNRESET);
1522 l2cap_chan_unlock(chan);
1523 continue;
1524 }
1525
1526 if (l2cap_check_enc_key_size(conn->hcon))
1527 l2cap_start_connection(chan);
1528 else
1529 l2cap_chan_close(chan, ECONNREFUSED);
1530
1531 } else if (chan->state == BT_CONNECT2) {
1532 struct l2cap_conn_rsp rsp;
1533 char buf[128];
1534 rsp.scid = cpu_to_le16(chan->dcid);
1535 rsp.dcid = cpu_to_le16(chan->scid);
1536
1537 if (l2cap_chan_check_security(chan, false)) {
1538 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1539 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1540 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1541 chan->ops->defer(chan);
1542
1543 } else {
1544 l2cap_state_change(chan, BT_CONFIG);
1545 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1546 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1547 }
1548 } else {
1549 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1550 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1551 }
1552
1553 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1554 sizeof(rsp), &rsp);
1555
1556 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1557 rsp.result != L2CAP_CR_SUCCESS) {
1558 l2cap_chan_unlock(chan);
1559 continue;
1560 }
1561
1562 set_bit(CONF_REQ_SENT, &chan->conf_state);
1563 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1564 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1565 chan->num_conf_req++;
1566 }
1567
1568 l2cap_chan_unlock(chan);
1569 }
1570
1571 mutex_unlock(&conn->chan_lock);
1572 }
1573
l2cap_le_conn_ready(struct l2cap_conn * conn)1574 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1575 {
1576 struct hci_conn *hcon = conn->hcon;
1577 struct hci_dev *hdev = hcon->hdev;
1578
1579 BT_DBG("%s conn %p", hdev->name, conn);
1580
1581 /* For outgoing pairing which doesn't necessarily have an
1582 * associated socket (e.g. mgmt_pair_device).
1583 */
1584 if (hcon->out)
1585 smp_conn_security(hcon, hcon->pending_sec_level);
1586
1587 /* For LE peripheral connections, make sure the connection interval
1588 * is in the range of the minimum and maximum interval that has
1589 * been configured for this connection. If not, then trigger
1590 * the connection update procedure.
1591 */
1592 if (hcon->role == HCI_ROLE_SLAVE &&
1593 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1594 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1595 struct l2cap_conn_param_update_req req;
1596
1597 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1598 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1599 req.latency = cpu_to_le16(hcon->le_conn_latency);
1600 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1601
1602 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1603 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1604 }
1605 }
1606
l2cap_conn_ready(struct l2cap_conn * conn)1607 static void l2cap_conn_ready(struct l2cap_conn *conn)
1608 {
1609 struct l2cap_chan *chan;
1610 struct hci_conn *hcon = conn->hcon;
1611
1612 BT_DBG("conn %p", conn);
1613
1614 if (hcon->type == ACL_LINK)
1615 l2cap_request_info(conn);
1616
1617 mutex_lock(&conn->chan_lock);
1618
1619 list_for_each_entry(chan, &conn->chan_l, list) {
1620
1621 l2cap_chan_lock(chan);
1622
1623 if (hcon->type == LE_LINK) {
1624 l2cap_le_start(chan);
1625 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1626 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1627 l2cap_chan_ready(chan);
1628 } else if (chan->state == BT_CONNECT) {
1629 l2cap_do_start(chan);
1630 }
1631
1632 l2cap_chan_unlock(chan);
1633 }
1634
1635 mutex_unlock(&conn->chan_lock);
1636
1637 if (hcon->type == LE_LINK)
1638 l2cap_le_conn_ready(conn);
1639
1640 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1641 }
1642
1643 /* Notify sockets that we cannot guaranty reliability anymore */
l2cap_conn_unreliable(struct l2cap_conn * conn,int err)1644 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1645 {
1646 struct l2cap_chan *chan;
1647
1648 BT_DBG("conn %p", conn);
1649
1650 mutex_lock(&conn->chan_lock);
1651
1652 list_for_each_entry(chan, &conn->chan_l, list) {
1653 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1654 l2cap_chan_set_err(chan, err);
1655 }
1656
1657 mutex_unlock(&conn->chan_lock);
1658 }
1659
l2cap_info_timeout(struct work_struct * work)1660 static void l2cap_info_timeout(struct work_struct *work)
1661 {
1662 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1663 info_timer.work);
1664
1665 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1666 conn->info_ident = 0;
1667
1668 l2cap_conn_start(conn);
1669 }
1670
1671 /*
1672 * l2cap_user
1673 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1674 * callback is called during registration. The ->remove callback is called
1675 * during unregistration.
1676 * An l2cap_user object can either be explicitly unregistered or when the
1677 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1678 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1679 * External modules must own a reference to the l2cap_conn object if they intend
1680 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1681 * any time if they don't.
1682 */
1683
l2cap_register_user(struct l2cap_conn * conn,struct l2cap_user * user)1684 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1685 {
1686 struct hci_dev *hdev = conn->hcon->hdev;
1687 int ret;
1688
1689 /* We need to check whether l2cap_conn is registered. If it is not, we
1690 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1691 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1692 * relies on the parent hci_conn object to be locked. This itself relies
1693 * on the hci_dev object to be locked. So we must lock the hci device
1694 * here, too. */
1695
1696 hci_dev_lock(hdev);
1697
1698 if (!list_empty(&user->list)) {
1699 ret = -EINVAL;
1700 goto out_unlock;
1701 }
1702
1703 /* conn->hchan is NULL after l2cap_conn_del() was called */
1704 if (!conn->hchan) {
1705 ret = -ENODEV;
1706 goto out_unlock;
1707 }
1708
1709 ret = user->probe(conn, user);
1710 if (ret)
1711 goto out_unlock;
1712
1713 list_add(&user->list, &conn->users);
1714 ret = 0;
1715
1716 out_unlock:
1717 hci_dev_unlock(hdev);
1718 return ret;
1719 }
1720 EXPORT_SYMBOL(l2cap_register_user);
1721
l2cap_unregister_user(struct l2cap_conn * conn,struct l2cap_user * user)1722 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1723 {
1724 struct hci_dev *hdev = conn->hcon->hdev;
1725
1726 hci_dev_lock(hdev);
1727
1728 if (list_empty(&user->list))
1729 goto out_unlock;
1730
1731 list_del_init(&user->list);
1732 user->remove(conn, user);
1733
1734 out_unlock:
1735 hci_dev_unlock(hdev);
1736 }
1737 EXPORT_SYMBOL(l2cap_unregister_user);
1738
l2cap_unregister_all_users(struct l2cap_conn * conn)1739 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1740 {
1741 struct l2cap_user *user;
1742
1743 while (!list_empty(&conn->users)) {
1744 user = list_first_entry(&conn->users, struct l2cap_user, list);
1745 list_del_init(&user->list);
1746 user->remove(conn, user);
1747 }
1748 }
1749
l2cap_conn_del(struct hci_conn * hcon,int err)1750 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1751 {
1752 struct l2cap_conn *conn = hcon->l2cap_data;
1753 struct l2cap_chan *chan, *l;
1754
1755 if (!conn)
1756 return;
1757
1758 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1759
1760 kfree_skb(conn->rx_skb);
1761
1762 skb_queue_purge(&conn->pending_rx);
1763
1764 /* We can not call flush_work(&conn->pending_rx_work) here since we
1765 * might block if we are running on a worker from the same workqueue
1766 * pending_rx_work is waiting on.
1767 */
1768 if (work_pending(&conn->pending_rx_work))
1769 cancel_work_sync(&conn->pending_rx_work);
1770
1771 cancel_delayed_work_sync(&conn->id_addr_timer);
1772
1773 l2cap_unregister_all_users(conn);
1774
1775 /* Force the connection to be immediately dropped */
1776 hcon->disc_timeout = 0;
1777
1778 mutex_lock(&conn->chan_lock);
1779
1780 /* Kill channels */
1781 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1782 l2cap_chan_hold(chan);
1783 l2cap_chan_lock(chan);
1784
1785 l2cap_chan_del(chan, err);
1786
1787 chan->ops->close(chan);
1788
1789 l2cap_chan_unlock(chan);
1790 l2cap_chan_put(chan);
1791 }
1792
1793 mutex_unlock(&conn->chan_lock);
1794
1795 hci_chan_del(conn->hchan);
1796
1797 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1798 cancel_delayed_work_sync(&conn->info_timer);
1799
1800 hcon->l2cap_data = NULL;
1801 conn->hchan = NULL;
1802 l2cap_conn_put(conn);
1803 }
1804
l2cap_conn_free(struct kref * ref)1805 static void l2cap_conn_free(struct kref *ref)
1806 {
1807 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1808
1809 hci_conn_put(conn->hcon);
1810 kfree(conn);
1811 }
1812
l2cap_conn_get(struct l2cap_conn * conn)1813 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1814 {
1815 kref_get(&conn->ref);
1816 return conn;
1817 }
1818 EXPORT_SYMBOL(l2cap_conn_get);
1819
l2cap_conn_put(struct l2cap_conn * conn)1820 void l2cap_conn_put(struct l2cap_conn *conn)
1821 {
1822 kref_put(&conn->ref, l2cap_conn_free);
1823 }
1824 EXPORT_SYMBOL(l2cap_conn_put);
1825
1826 /* ---- Socket interface ---- */
1827
1828 /* Find socket with psm and source / destination bdaddr.
1829 * Returns closest match.
1830 */
l2cap_global_chan_by_psm(int state,__le16 psm,bdaddr_t * src,bdaddr_t * dst,u8 link_type)1831 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1832 bdaddr_t *src,
1833 bdaddr_t *dst,
1834 u8 link_type)
1835 {
1836 struct l2cap_chan *c, *tmp, *c1 = NULL;
1837
1838 read_lock(&chan_list_lock);
1839
1840 list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1841 if (state && c->state != state)
1842 continue;
1843
1844 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1845 continue;
1846
1847 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1848 continue;
1849
1850 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
1851 int src_match, dst_match;
1852 int src_any, dst_any;
1853
1854 /* Exact match. */
1855 src_match = !bacmp(&c->src, src);
1856 dst_match = !bacmp(&c->dst, dst);
1857 if (src_match && dst_match) {
1858 if (!l2cap_chan_hold_unless_zero(c))
1859 continue;
1860
1861 read_unlock(&chan_list_lock);
1862 return c;
1863 }
1864
1865 /* Closest match */
1866 src_any = !bacmp(&c->src, BDADDR_ANY);
1867 dst_any = !bacmp(&c->dst, BDADDR_ANY);
1868 if ((src_match && dst_any) || (src_any && dst_match) ||
1869 (src_any && dst_any))
1870 c1 = c;
1871 }
1872 }
1873
1874 if (c1)
1875 c1 = l2cap_chan_hold_unless_zero(c1);
1876
1877 read_unlock(&chan_list_lock);
1878
1879 return c1;
1880 }
1881
l2cap_monitor_timeout(struct work_struct * work)1882 static void l2cap_monitor_timeout(struct work_struct *work)
1883 {
1884 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1885 monitor_timer.work);
1886
1887 BT_DBG("chan %p", chan);
1888
1889 l2cap_chan_lock(chan);
1890
1891 if (!chan->conn) {
1892 l2cap_chan_unlock(chan);
1893 l2cap_chan_put(chan);
1894 return;
1895 }
1896
1897 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1898
1899 l2cap_chan_unlock(chan);
1900 l2cap_chan_put(chan);
1901 }
1902
l2cap_retrans_timeout(struct work_struct * work)1903 static void l2cap_retrans_timeout(struct work_struct *work)
1904 {
1905 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1906 retrans_timer.work);
1907
1908 BT_DBG("chan %p", chan);
1909
1910 l2cap_chan_lock(chan);
1911
1912 if (!chan->conn) {
1913 l2cap_chan_unlock(chan);
1914 l2cap_chan_put(chan);
1915 return;
1916 }
1917
1918 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1919 l2cap_chan_unlock(chan);
1920 l2cap_chan_put(chan);
1921 }
1922
l2cap_streaming_send(struct l2cap_chan * chan,struct sk_buff_head * skbs)1923 static void l2cap_streaming_send(struct l2cap_chan *chan,
1924 struct sk_buff_head *skbs)
1925 {
1926 struct sk_buff *skb;
1927 struct l2cap_ctrl *control;
1928
1929 BT_DBG("chan %p, skbs %p", chan, skbs);
1930
1931 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1932
1933 while (!skb_queue_empty(&chan->tx_q)) {
1934
1935 skb = skb_dequeue(&chan->tx_q);
1936
1937 bt_cb(skb)->l2cap.retries = 1;
1938 control = &bt_cb(skb)->l2cap;
1939
1940 control->reqseq = 0;
1941 control->txseq = chan->next_tx_seq;
1942
1943 __pack_control(chan, control, skb);
1944
1945 if (chan->fcs == L2CAP_FCS_CRC16) {
1946 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1947 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1948 }
1949
1950 l2cap_do_send(chan, skb);
1951
1952 BT_DBG("Sent txseq %u", control->txseq);
1953
1954 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1955 chan->frames_sent++;
1956 }
1957 }
1958
l2cap_ertm_send(struct l2cap_chan * chan)1959 static int l2cap_ertm_send(struct l2cap_chan *chan)
1960 {
1961 struct sk_buff *skb, *tx_skb;
1962 struct l2cap_ctrl *control;
1963 int sent = 0;
1964
1965 BT_DBG("chan %p", chan);
1966
1967 if (chan->state != BT_CONNECTED)
1968 return -ENOTCONN;
1969
1970 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1971 return 0;
1972
1973 while (chan->tx_send_head &&
1974 chan->unacked_frames < chan->remote_tx_win &&
1975 chan->tx_state == L2CAP_TX_STATE_XMIT) {
1976
1977 skb = chan->tx_send_head;
1978
1979 bt_cb(skb)->l2cap.retries = 1;
1980 control = &bt_cb(skb)->l2cap;
1981
1982 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1983 control->final = 1;
1984
1985 control->reqseq = chan->buffer_seq;
1986 chan->last_acked_seq = chan->buffer_seq;
1987 control->txseq = chan->next_tx_seq;
1988
1989 __pack_control(chan, control, skb);
1990
1991 if (chan->fcs == L2CAP_FCS_CRC16) {
1992 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1993 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1994 }
1995
1996 /* Clone after data has been modified. Data is assumed to be
1997 read-only (for locking purposes) on cloned sk_buffs.
1998 */
1999 tx_skb = skb_clone(skb, GFP_KERNEL);
2000
2001 if (!tx_skb)
2002 break;
2003
2004 __set_retrans_timer(chan);
2005
2006 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2007 chan->unacked_frames++;
2008 chan->frames_sent++;
2009 sent++;
2010
2011 if (skb_queue_is_last(&chan->tx_q, skb))
2012 chan->tx_send_head = NULL;
2013 else
2014 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2015
2016 l2cap_do_send(chan, tx_skb);
2017 BT_DBG("Sent txseq %u", control->txseq);
2018 }
2019
2020 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2021 chan->unacked_frames, skb_queue_len(&chan->tx_q));
2022
2023 return sent;
2024 }
2025
l2cap_ertm_resend(struct l2cap_chan * chan)2026 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2027 {
2028 struct l2cap_ctrl control;
2029 struct sk_buff *skb;
2030 struct sk_buff *tx_skb;
2031 u16 seq;
2032
2033 BT_DBG("chan %p", chan);
2034
2035 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2036 return;
2037
2038 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2039 seq = l2cap_seq_list_pop(&chan->retrans_list);
2040
2041 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2042 if (!skb) {
2043 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2044 seq);
2045 continue;
2046 }
2047
2048 bt_cb(skb)->l2cap.retries++;
2049 control = bt_cb(skb)->l2cap;
2050
2051 if (chan->max_tx != 0 &&
2052 bt_cb(skb)->l2cap.retries > chan->max_tx) {
2053 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2054 l2cap_send_disconn_req(chan, ECONNRESET);
2055 l2cap_seq_list_clear(&chan->retrans_list);
2056 break;
2057 }
2058
2059 control.reqseq = chan->buffer_seq;
2060 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2061 control.final = 1;
2062 else
2063 control.final = 0;
2064
2065 if (skb_cloned(skb)) {
2066 /* Cloned sk_buffs are read-only, so we need a
2067 * writeable copy
2068 */
2069 tx_skb = skb_copy(skb, GFP_KERNEL);
2070 } else {
2071 tx_skb = skb_clone(skb, GFP_KERNEL);
2072 }
2073
2074 if (!tx_skb) {
2075 l2cap_seq_list_clear(&chan->retrans_list);
2076 break;
2077 }
2078
2079 /* Update skb contents */
2080 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2081 put_unaligned_le32(__pack_extended_control(&control),
2082 tx_skb->data + L2CAP_HDR_SIZE);
2083 } else {
2084 put_unaligned_le16(__pack_enhanced_control(&control),
2085 tx_skb->data + L2CAP_HDR_SIZE);
2086 }
2087
2088 /* Update FCS */
2089 if (chan->fcs == L2CAP_FCS_CRC16) {
2090 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2091 tx_skb->len - L2CAP_FCS_SIZE);
2092 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2093 L2CAP_FCS_SIZE);
2094 }
2095
2096 l2cap_do_send(chan, tx_skb);
2097
2098 BT_DBG("Resent txseq %d", control.txseq);
2099
2100 chan->last_acked_seq = chan->buffer_seq;
2101 }
2102 }
2103
l2cap_retransmit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2104 static void l2cap_retransmit(struct l2cap_chan *chan,
2105 struct l2cap_ctrl *control)
2106 {
2107 BT_DBG("chan %p, control %p", chan, control);
2108
2109 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2110 l2cap_ertm_resend(chan);
2111 }
2112
l2cap_retransmit_all(struct l2cap_chan * chan,struct l2cap_ctrl * control)2113 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2114 struct l2cap_ctrl *control)
2115 {
2116 struct sk_buff *skb;
2117
2118 BT_DBG("chan %p, control %p", chan, control);
2119
2120 if (control->poll)
2121 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2122
2123 l2cap_seq_list_clear(&chan->retrans_list);
2124
2125 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2126 return;
2127
2128 if (chan->unacked_frames) {
2129 skb_queue_walk(&chan->tx_q, skb) {
2130 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2131 skb == chan->tx_send_head)
2132 break;
2133 }
2134
2135 skb_queue_walk_from(&chan->tx_q, skb) {
2136 if (skb == chan->tx_send_head)
2137 break;
2138
2139 l2cap_seq_list_append(&chan->retrans_list,
2140 bt_cb(skb)->l2cap.txseq);
2141 }
2142
2143 l2cap_ertm_resend(chan);
2144 }
2145 }
2146
l2cap_send_ack(struct l2cap_chan * chan)2147 static void l2cap_send_ack(struct l2cap_chan *chan)
2148 {
2149 struct l2cap_ctrl control;
2150 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2151 chan->last_acked_seq);
2152 int threshold;
2153
2154 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2155 chan, chan->last_acked_seq, chan->buffer_seq);
2156
2157 memset(&control, 0, sizeof(control));
2158 control.sframe = 1;
2159
2160 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2161 chan->rx_state == L2CAP_RX_STATE_RECV) {
2162 __clear_ack_timer(chan);
2163 control.super = L2CAP_SUPER_RNR;
2164 control.reqseq = chan->buffer_seq;
2165 l2cap_send_sframe(chan, &control);
2166 } else {
2167 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2168 l2cap_ertm_send(chan);
2169 /* If any i-frames were sent, they included an ack */
2170 if (chan->buffer_seq == chan->last_acked_seq)
2171 frames_to_ack = 0;
2172 }
2173
2174 /* Ack now if the window is 3/4ths full.
2175 * Calculate without mul or div
2176 */
2177 threshold = chan->ack_win;
2178 threshold += threshold << 1;
2179 threshold >>= 2;
2180
2181 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2182 threshold);
2183
2184 if (frames_to_ack >= threshold) {
2185 __clear_ack_timer(chan);
2186 control.super = L2CAP_SUPER_RR;
2187 control.reqseq = chan->buffer_seq;
2188 l2cap_send_sframe(chan, &control);
2189 frames_to_ack = 0;
2190 }
2191
2192 if (frames_to_ack)
2193 __set_ack_timer(chan);
2194 }
2195 }
2196
l2cap_skbuff_fromiovec(struct l2cap_chan * chan,struct msghdr * msg,int len,int count,struct sk_buff * skb)2197 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2198 struct msghdr *msg, int len,
2199 int count, struct sk_buff *skb)
2200 {
2201 struct l2cap_conn *conn = chan->conn;
2202 struct sk_buff **frag;
2203 int sent = 0;
2204
2205 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2206 return -EFAULT;
2207
2208 sent += count;
2209 len -= count;
2210
2211 /* Continuation fragments (no L2CAP header) */
2212 frag = &skb_shinfo(skb)->frag_list;
2213 while (len) {
2214 struct sk_buff *tmp;
2215
2216 count = min_t(unsigned int, conn->mtu, len);
2217
2218 tmp = chan->ops->alloc_skb(chan, 0, count,
2219 msg->msg_flags & MSG_DONTWAIT);
2220 if (IS_ERR(tmp))
2221 return PTR_ERR(tmp);
2222
2223 *frag = tmp;
2224
2225 if (!copy_from_iter_full(skb_put(*frag, count), count,
2226 &msg->msg_iter))
2227 return -EFAULT;
2228
2229 sent += count;
2230 len -= count;
2231
2232 skb->len += (*frag)->len;
2233 skb->data_len += (*frag)->len;
2234
2235 frag = &(*frag)->next;
2236 }
2237
2238 return sent;
2239 }
2240
l2cap_create_connless_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2241 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2242 struct msghdr *msg, size_t len)
2243 {
2244 struct l2cap_conn *conn = chan->conn;
2245 struct sk_buff *skb;
2246 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2247 struct l2cap_hdr *lh;
2248
2249 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2250 __le16_to_cpu(chan->psm), len);
2251
2252 count = min_t(unsigned int, (conn->mtu - hlen), len);
2253
2254 skb = chan->ops->alloc_skb(chan, hlen, count,
2255 msg->msg_flags & MSG_DONTWAIT);
2256 if (IS_ERR(skb))
2257 return skb;
2258
2259 /* Create L2CAP header */
2260 lh = skb_put(skb, L2CAP_HDR_SIZE);
2261 lh->cid = cpu_to_le16(chan->dcid);
2262 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2263 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2264
2265 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2266 if (unlikely(err < 0)) {
2267 kfree_skb(skb);
2268 return ERR_PTR(err);
2269 }
2270 return skb;
2271 }
2272
l2cap_create_basic_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2273 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2274 struct msghdr *msg, size_t len)
2275 {
2276 struct l2cap_conn *conn = chan->conn;
2277 struct sk_buff *skb;
2278 int err, count;
2279 struct l2cap_hdr *lh;
2280
2281 BT_DBG("chan %p len %zu", chan, len);
2282
2283 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2284
2285 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2286 msg->msg_flags & MSG_DONTWAIT);
2287 if (IS_ERR(skb))
2288 return skb;
2289
2290 /* Create L2CAP header */
2291 lh = skb_put(skb, L2CAP_HDR_SIZE);
2292 lh->cid = cpu_to_le16(chan->dcid);
2293 lh->len = cpu_to_le16(len);
2294
2295 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2296 if (unlikely(err < 0)) {
2297 kfree_skb(skb);
2298 return ERR_PTR(err);
2299 }
2300 return skb;
2301 }
2302
l2cap_create_iframe_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2303 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2304 struct msghdr *msg, size_t len,
2305 u16 sdulen)
2306 {
2307 struct l2cap_conn *conn = chan->conn;
2308 struct sk_buff *skb;
2309 int err, count, hlen;
2310 struct l2cap_hdr *lh;
2311
2312 BT_DBG("chan %p len %zu", chan, len);
2313
2314 if (!conn)
2315 return ERR_PTR(-ENOTCONN);
2316
2317 hlen = __ertm_hdr_size(chan);
2318
2319 if (sdulen)
2320 hlen += L2CAP_SDULEN_SIZE;
2321
2322 if (chan->fcs == L2CAP_FCS_CRC16)
2323 hlen += L2CAP_FCS_SIZE;
2324
2325 count = min_t(unsigned int, (conn->mtu - hlen), len);
2326
2327 skb = chan->ops->alloc_skb(chan, hlen, count,
2328 msg->msg_flags & MSG_DONTWAIT);
2329 if (IS_ERR(skb))
2330 return skb;
2331
2332 /* Create L2CAP header */
2333 lh = skb_put(skb, L2CAP_HDR_SIZE);
2334 lh->cid = cpu_to_le16(chan->dcid);
2335 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2336
2337 /* Control header is populated later */
2338 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2339 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2340 else
2341 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2342
2343 if (sdulen)
2344 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2345
2346 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2347 if (unlikely(err < 0)) {
2348 kfree_skb(skb);
2349 return ERR_PTR(err);
2350 }
2351
2352 bt_cb(skb)->l2cap.fcs = chan->fcs;
2353 bt_cb(skb)->l2cap.retries = 0;
2354 return skb;
2355 }
2356
l2cap_segment_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2357 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2358 struct sk_buff_head *seg_queue,
2359 struct msghdr *msg, size_t len)
2360 {
2361 struct sk_buff *skb;
2362 u16 sdu_len;
2363 size_t pdu_len;
2364 u8 sar;
2365
2366 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2367
2368 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2369 * so fragmented skbs are not used. The HCI layer's handling
2370 * of fragmented skbs is not compatible with ERTM's queueing.
2371 */
2372
2373 /* PDU size is derived from the HCI MTU */
2374 pdu_len = chan->conn->mtu;
2375
2376 /* Constrain PDU size for BR/EDR connections */
2377 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2378
2379 /* Adjust for largest possible L2CAP overhead. */
2380 if (chan->fcs)
2381 pdu_len -= L2CAP_FCS_SIZE;
2382
2383 pdu_len -= __ertm_hdr_size(chan);
2384
2385 /* Remote device may have requested smaller PDUs */
2386 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2387
2388 if (len <= pdu_len) {
2389 sar = L2CAP_SAR_UNSEGMENTED;
2390 sdu_len = 0;
2391 pdu_len = len;
2392 } else {
2393 sar = L2CAP_SAR_START;
2394 sdu_len = len;
2395 }
2396
2397 while (len > 0) {
2398 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2399
2400 if (IS_ERR(skb)) {
2401 __skb_queue_purge(seg_queue);
2402 return PTR_ERR(skb);
2403 }
2404
2405 bt_cb(skb)->l2cap.sar = sar;
2406 __skb_queue_tail(seg_queue, skb);
2407
2408 len -= pdu_len;
2409 if (sdu_len)
2410 sdu_len = 0;
2411
2412 if (len <= pdu_len) {
2413 sar = L2CAP_SAR_END;
2414 pdu_len = len;
2415 } else {
2416 sar = L2CAP_SAR_CONTINUE;
2417 }
2418 }
2419
2420 return 0;
2421 }
2422
l2cap_create_le_flowctl_pdu(struct l2cap_chan * chan,struct msghdr * msg,size_t len,u16 sdulen)2423 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2424 struct msghdr *msg,
2425 size_t len, u16 sdulen)
2426 {
2427 struct l2cap_conn *conn = chan->conn;
2428 struct sk_buff *skb;
2429 int err, count, hlen;
2430 struct l2cap_hdr *lh;
2431
2432 BT_DBG("chan %p len %zu", chan, len);
2433
2434 if (!conn)
2435 return ERR_PTR(-ENOTCONN);
2436
2437 hlen = L2CAP_HDR_SIZE;
2438
2439 if (sdulen)
2440 hlen += L2CAP_SDULEN_SIZE;
2441
2442 count = min_t(unsigned int, (conn->mtu - hlen), len);
2443
2444 skb = chan->ops->alloc_skb(chan, hlen, count,
2445 msg->msg_flags & MSG_DONTWAIT);
2446 if (IS_ERR(skb))
2447 return skb;
2448
2449 /* Create L2CAP header */
2450 lh = skb_put(skb, L2CAP_HDR_SIZE);
2451 lh->cid = cpu_to_le16(chan->dcid);
2452 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2453
2454 if (sdulen)
2455 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2456
2457 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2458 if (unlikely(err < 0)) {
2459 kfree_skb(skb);
2460 return ERR_PTR(err);
2461 }
2462
2463 return skb;
2464 }
2465
l2cap_segment_le_sdu(struct l2cap_chan * chan,struct sk_buff_head * seg_queue,struct msghdr * msg,size_t len)2466 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2467 struct sk_buff_head *seg_queue,
2468 struct msghdr *msg, size_t len)
2469 {
2470 struct sk_buff *skb;
2471 size_t pdu_len;
2472 u16 sdu_len;
2473
2474 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2475
2476 sdu_len = len;
2477 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2478
2479 while (len > 0) {
2480 if (len <= pdu_len)
2481 pdu_len = len;
2482
2483 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2484 if (IS_ERR(skb)) {
2485 __skb_queue_purge(seg_queue);
2486 return PTR_ERR(skb);
2487 }
2488
2489 __skb_queue_tail(seg_queue, skb);
2490
2491 len -= pdu_len;
2492
2493 if (sdu_len) {
2494 sdu_len = 0;
2495 pdu_len += L2CAP_SDULEN_SIZE;
2496 }
2497 }
2498
2499 return 0;
2500 }
2501
l2cap_le_flowctl_send(struct l2cap_chan * chan)2502 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2503 {
2504 int sent = 0;
2505
2506 BT_DBG("chan %p", chan);
2507
2508 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2509 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2510 chan->tx_credits--;
2511 sent++;
2512 }
2513
2514 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2515 skb_queue_len(&chan->tx_q));
2516 }
2517
l2cap_chan_send(struct l2cap_chan * chan,struct msghdr * msg,size_t len)2518 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2519 {
2520 struct sk_buff *skb;
2521 int err;
2522 struct sk_buff_head seg_queue;
2523
2524 if (!chan->conn)
2525 return -ENOTCONN;
2526
2527 /* Connectionless channel */
2528 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2529 skb = l2cap_create_connless_pdu(chan, msg, len);
2530 if (IS_ERR(skb))
2531 return PTR_ERR(skb);
2532
2533 l2cap_do_send(chan, skb);
2534 return len;
2535 }
2536
2537 switch (chan->mode) {
2538 case L2CAP_MODE_LE_FLOWCTL:
2539 case L2CAP_MODE_EXT_FLOWCTL:
2540 /* Check outgoing MTU */
2541 if (len > chan->omtu)
2542 return -EMSGSIZE;
2543
2544 __skb_queue_head_init(&seg_queue);
2545
2546 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2547
2548 if (chan->state != BT_CONNECTED) {
2549 __skb_queue_purge(&seg_queue);
2550 err = -ENOTCONN;
2551 }
2552
2553 if (err)
2554 return err;
2555
2556 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2557
2558 l2cap_le_flowctl_send(chan);
2559
2560 if (!chan->tx_credits)
2561 chan->ops->suspend(chan);
2562
2563 err = len;
2564
2565 break;
2566
2567 case L2CAP_MODE_BASIC:
2568 /* Check outgoing MTU */
2569 if (len > chan->omtu)
2570 return -EMSGSIZE;
2571
2572 /* Create a basic PDU */
2573 skb = l2cap_create_basic_pdu(chan, msg, len);
2574 if (IS_ERR(skb))
2575 return PTR_ERR(skb);
2576
2577 l2cap_do_send(chan, skb);
2578 err = len;
2579 break;
2580
2581 case L2CAP_MODE_ERTM:
2582 case L2CAP_MODE_STREAMING:
2583 /* Check outgoing MTU */
2584 if (len > chan->omtu) {
2585 err = -EMSGSIZE;
2586 break;
2587 }
2588
2589 __skb_queue_head_init(&seg_queue);
2590
2591 /* Do segmentation before calling in to the state machine,
2592 * since it's possible to block while waiting for memory
2593 * allocation.
2594 */
2595 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2596
2597 if (err)
2598 break;
2599
2600 if (chan->mode == L2CAP_MODE_ERTM)
2601 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2602 else
2603 l2cap_streaming_send(chan, &seg_queue);
2604
2605 err = len;
2606
2607 /* If the skbs were not queued for sending, they'll still be in
2608 * seg_queue and need to be purged.
2609 */
2610 __skb_queue_purge(&seg_queue);
2611 break;
2612
2613 default:
2614 BT_DBG("bad state %1.1x", chan->mode);
2615 err = -EBADFD;
2616 }
2617
2618 return err;
2619 }
2620 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2621
l2cap_send_srej(struct l2cap_chan * chan,u16 txseq)2622 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2623 {
2624 struct l2cap_ctrl control;
2625 u16 seq;
2626
2627 BT_DBG("chan %p, txseq %u", chan, txseq);
2628
2629 memset(&control, 0, sizeof(control));
2630 control.sframe = 1;
2631 control.super = L2CAP_SUPER_SREJ;
2632
2633 for (seq = chan->expected_tx_seq; seq != txseq;
2634 seq = __next_seq(chan, seq)) {
2635 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2636 control.reqseq = seq;
2637 l2cap_send_sframe(chan, &control);
2638 l2cap_seq_list_append(&chan->srej_list, seq);
2639 }
2640 }
2641
2642 chan->expected_tx_seq = __next_seq(chan, txseq);
2643 }
2644
l2cap_send_srej_tail(struct l2cap_chan * chan)2645 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2646 {
2647 struct l2cap_ctrl control;
2648
2649 BT_DBG("chan %p", chan);
2650
2651 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2652 return;
2653
2654 memset(&control, 0, sizeof(control));
2655 control.sframe = 1;
2656 control.super = L2CAP_SUPER_SREJ;
2657 control.reqseq = chan->srej_list.tail;
2658 l2cap_send_sframe(chan, &control);
2659 }
2660
l2cap_send_srej_list(struct l2cap_chan * chan,u16 txseq)2661 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2662 {
2663 struct l2cap_ctrl control;
2664 u16 initial_head;
2665 u16 seq;
2666
2667 BT_DBG("chan %p, txseq %u", chan, txseq);
2668
2669 memset(&control, 0, sizeof(control));
2670 control.sframe = 1;
2671 control.super = L2CAP_SUPER_SREJ;
2672
2673 /* Capture initial list head to allow only one pass through the list. */
2674 initial_head = chan->srej_list.head;
2675
2676 do {
2677 seq = l2cap_seq_list_pop(&chan->srej_list);
2678 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2679 break;
2680
2681 control.reqseq = seq;
2682 l2cap_send_sframe(chan, &control);
2683 l2cap_seq_list_append(&chan->srej_list, seq);
2684 } while (chan->srej_list.head != initial_head);
2685 }
2686
l2cap_process_reqseq(struct l2cap_chan * chan,u16 reqseq)2687 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2688 {
2689 struct sk_buff *acked_skb;
2690 u16 ackseq;
2691
2692 BT_DBG("chan %p, reqseq %u", chan, reqseq);
2693
2694 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2695 return;
2696
2697 BT_DBG("expected_ack_seq %u, unacked_frames %u",
2698 chan->expected_ack_seq, chan->unacked_frames);
2699
2700 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2701 ackseq = __next_seq(chan, ackseq)) {
2702
2703 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2704 if (acked_skb) {
2705 skb_unlink(acked_skb, &chan->tx_q);
2706 kfree_skb(acked_skb);
2707 chan->unacked_frames--;
2708 }
2709 }
2710
2711 chan->expected_ack_seq = reqseq;
2712
2713 if (chan->unacked_frames == 0)
2714 __clear_retrans_timer(chan);
2715
2716 BT_DBG("unacked_frames %u", chan->unacked_frames);
2717 }
2718
l2cap_abort_rx_srej_sent(struct l2cap_chan * chan)2719 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2720 {
2721 BT_DBG("chan %p", chan);
2722
2723 chan->expected_tx_seq = chan->buffer_seq;
2724 l2cap_seq_list_clear(&chan->srej_list);
2725 skb_queue_purge(&chan->srej_q);
2726 chan->rx_state = L2CAP_RX_STATE_RECV;
2727 }
2728
l2cap_tx_state_xmit(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2729 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2730 struct l2cap_ctrl *control,
2731 struct sk_buff_head *skbs, u8 event)
2732 {
2733 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2734 event);
2735
2736 switch (event) {
2737 case L2CAP_EV_DATA_REQUEST:
2738 if (chan->tx_send_head == NULL)
2739 chan->tx_send_head = skb_peek(skbs);
2740
2741 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2742 l2cap_ertm_send(chan);
2743 break;
2744 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2745 BT_DBG("Enter LOCAL_BUSY");
2746 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2747
2748 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2749 /* The SREJ_SENT state must be aborted if we are to
2750 * enter the LOCAL_BUSY state.
2751 */
2752 l2cap_abort_rx_srej_sent(chan);
2753 }
2754
2755 l2cap_send_ack(chan);
2756
2757 break;
2758 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2759 BT_DBG("Exit LOCAL_BUSY");
2760 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2761
2762 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2763 struct l2cap_ctrl local_control;
2764
2765 memset(&local_control, 0, sizeof(local_control));
2766 local_control.sframe = 1;
2767 local_control.super = L2CAP_SUPER_RR;
2768 local_control.poll = 1;
2769 local_control.reqseq = chan->buffer_seq;
2770 l2cap_send_sframe(chan, &local_control);
2771
2772 chan->retry_count = 1;
2773 __set_monitor_timer(chan);
2774 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2775 }
2776 break;
2777 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2778 l2cap_process_reqseq(chan, control->reqseq);
2779 break;
2780 case L2CAP_EV_EXPLICIT_POLL:
2781 l2cap_send_rr_or_rnr(chan, 1);
2782 chan->retry_count = 1;
2783 __set_monitor_timer(chan);
2784 __clear_ack_timer(chan);
2785 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2786 break;
2787 case L2CAP_EV_RETRANS_TO:
2788 l2cap_send_rr_or_rnr(chan, 1);
2789 chan->retry_count = 1;
2790 __set_monitor_timer(chan);
2791 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2792 break;
2793 case L2CAP_EV_RECV_FBIT:
2794 /* Nothing to process */
2795 break;
2796 default:
2797 break;
2798 }
2799 }
2800
l2cap_tx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2801 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2802 struct l2cap_ctrl *control,
2803 struct sk_buff_head *skbs, u8 event)
2804 {
2805 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2806 event);
2807
2808 switch (event) {
2809 case L2CAP_EV_DATA_REQUEST:
2810 if (chan->tx_send_head == NULL)
2811 chan->tx_send_head = skb_peek(skbs);
2812 /* Queue data, but don't send. */
2813 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2814 break;
2815 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2816 BT_DBG("Enter LOCAL_BUSY");
2817 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2818
2819 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2820 /* The SREJ_SENT state must be aborted if we are to
2821 * enter the LOCAL_BUSY state.
2822 */
2823 l2cap_abort_rx_srej_sent(chan);
2824 }
2825
2826 l2cap_send_ack(chan);
2827
2828 break;
2829 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2830 BT_DBG("Exit LOCAL_BUSY");
2831 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2832
2833 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2834 struct l2cap_ctrl local_control;
2835 memset(&local_control, 0, sizeof(local_control));
2836 local_control.sframe = 1;
2837 local_control.super = L2CAP_SUPER_RR;
2838 local_control.poll = 1;
2839 local_control.reqseq = chan->buffer_seq;
2840 l2cap_send_sframe(chan, &local_control);
2841
2842 chan->retry_count = 1;
2843 __set_monitor_timer(chan);
2844 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2845 }
2846 break;
2847 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2848 l2cap_process_reqseq(chan, control->reqseq);
2849 fallthrough;
2850
2851 case L2CAP_EV_RECV_FBIT:
2852 if (control && control->final) {
2853 __clear_monitor_timer(chan);
2854 if (chan->unacked_frames > 0)
2855 __set_retrans_timer(chan);
2856 chan->retry_count = 0;
2857 chan->tx_state = L2CAP_TX_STATE_XMIT;
2858 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2859 }
2860 break;
2861 case L2CAP_EV_EXPLICIT_POLL:
2862 /* Ignore */
2863 break;
2864 case L2CAP_EV_MONITOR_TO:
2865 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2866 l2cap_send_rr_or_rnr(chan, 1);
2867 __set_monitor_timer(chan);
2868 chan->retry_count++;
2869 } else {
2870 l2cap_send_disconn_req(chan, ECONNABORTED);
2871 }
2872 break;
2873 default:
2874 break;
2875 }
2876 }
2877
l2cap_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff_head * skbs,u8 event)2878 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2879 struct sk_buff_head *skbs, u8 event)
2880 {
2881 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2882 chan, control, skbs, event, chan->tx_state);
2883
2884 switch (chan->tx_state) {
2885 case L2CAP_TX_STATE_XMIT:
2886 l2cap_tx_state_xmit(chan, control, skbs, event);
2887 break;
2888 case L2CAP_TX_STATE_WAIT_F:
2889 l2cap_tx_state_wait_f(chan, control, skbs, event);
2890 break;
2891 default:
2892 /* Ignore event */
2893 break;
2894 }
2895 }
2896
l2cap_pass_to_tx(struct l2cap_chan * chan,struct l2cap_ctrl * control)2897 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2898 struct l2cap_ctrl *control)
2899 {
2900 BT_DBG("chan %p, control %p", chan, control);
2901 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2902 }
2903
l2cap_pass_to_tx_fbit(struct l2cap_chan * chan,struct l2cap_ctrl * control)2904 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2905 struct l2cap_ctrl *control)
2906 {
2907 BT_DBG("chan %p, control %p", chan, control);
2908 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2909 }
2910
2911 /* Copy frame to all raw sockets on that connection */
l2cap_raw_recv(struct l2cap_conn * conn,struct sk_buff * skb)2912 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2913 {
2914 struct sk_buff *nskb;
2915 struct l2cap_chan *chan;
2916
2917 BT_DBG("conn %p", conn);
2918
2919 mutex_lock(&conn->chan_lock);
2920
2921 list_for_each_entry(chan, &conn->chan_l, list) {
2922 if (chan->chan_type != L2CAP_CHAN_RAW)
2923 continue;
2924
2925 /* Don't send frame to the channel it came from */
2926 if (bt_cb(skb)->l2cap.chan == chan)
2927 continue;
2928
2929 nskb = skb_clone(skb, GFP_KERNEL);
2930 if (!nskb)
2931 continue;
2932 if (chan->ops->recv(chan, nskb))
2933 kfree_skb(nskb);
2934 }
2935
2936 mutex_unlock(&conn->chan_lock);
2937 }
2938
2939 /* ---- L2CAP signalling commands ---- */
l2cap_build_cmd(struct l2cap_conn * conn,u8 code,u8 ident,u16 dlen,void * data)2940 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2941 u8 ident, u16 dlen, void *data)
2942 {
2943 struct sk_buff *skb, **frag;
2944 struct l2cap_cmd_hdr *cmd;
2945 struct l2cap_hdr *lh;
2946 int len, count;
2947
2948 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2949 conn, code, ident, dlen);
2950
2951 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2952 return NULL;
2953
2954 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2955 count = min_t(unsigned int, conn->mtu, len);
2956
2957 skb = bt_skb_alloc(count, GFP_KERNEL);
2958 if (!skb)
2959 return NULL;
2960
2961 lh = skb_put(skb, L2CAP_HDR_SIZE);
2962 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2963
2964 if (conn->hcon->type == LE_LINK)
2965 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2966 else
2967 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2968
2969 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
2970 cmd->code = code;
2971 cmd->ident = ident;
2972 cmd->len = cpu_to_le16(dlen);
2973
2974 if (dlen) {
2975 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2976 skb_put_data(skb, data, count);
2977 data += count;
2978 }
2979
2980 len -= skb->len;
2981
2982 /* Continuation fragments (no L2CAP header) */
2983 frag = &skb_shinfo(skb)->frag_list;
2984 while (len) {
2985 count = min_t(unsigned int, conn->mtu, len);
2986
2987 *frag = bt_skb_alloc(count, GFP_KERNEL);
2988 if (!*frag)
2989 goto fail;
2990
2991 skb_put_data(*frag, data, count);
2992
2993 len -= count;
2994 data += count;
2995
2996 frag = &(*frag)->next;
2997 }
2998
2999 return skb;
3000
3001 fail:
3002 kfree_skb(skb);
3003 return NULL;
3004 }
3005
l2cap_get_conf_opt(void ** ptr,int * type,int * olen,unsigned long * val)3006 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3007 unsigned long *val)
3008 {
3009 struct l2cap_conf_opt *opt = *ptr;
3010 int len;
3011
3012 len = L2CAP_CONF_OPT_SIZE + opt->len;
3013 *ptr += len;
3014
3015 *type = opt->type;
3016 *olen = opt->len;
3017
3018 switch (opt->len) {
3019 case 1:
3020 *val = *((u8 *) opt->val);
3021 break;
3022
3023 case 2:
3024 *val = get_unaligned_le16(opt->val);
3025 break;
3026
3027 case 4:
3028 *val = get_unaligned_le32(opt->val);
3029 break;
3030
3031 default:
3032 *val = (unsigned long) opt->val;
3033 break;
3034 }
3035
3036 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3037 return len;
3038 }
3039
l2cap_add_conf_opt(void ** ptr,u8 type,u8 len,unsigned long val,size_t size)3040 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3041 {
3042 struct l2cap_conf_opt *opt = *ptr;
3043
3044 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3045
3046 if (size < L2CAP_CONF_OPT_SIZE + len)
3047 return;
3048
3049 opt->type = type;
3050 opt->len = len;
3051
3052 switch (len) {
3053 case 1:
3054 *((u8 *) opt->val) = val;
3055 break;
3056
3057 case 2:
3058 put_unaligned_le16(val, opt->val);
3059 break;
3060
3061 case 4:
3062 put_unaligned_le32(val, opt->val);
3063 break;
3064
3065 default:
3066 memcpy(opt->val, (void *) val, len);
3067 break;
3068 }
3069
3070 *ptr += L2CAP_CONF_OPT_SIZE + len;
3071 }
3072
l2cap_add_opt_efs(void ** ptr,struct l2cap_chan * chan,size_t size)3073 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3074 {
3075 struct l2cap_conf_efs efs;
3076
3077 switch (chan->mode) {
3078 case L2CAP_MODE_ERTM:
3079 efs.id = chan->local_id;
3080 efs.stype = chan->local_stype;
3081 efs.msdu = cpu_to_le16(chan->local_msdu);
3082 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3083 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3084 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3085 break;
3086
3087 case L2CAP_MODE_STREAMING:
3088 efs.id = 1;
3089 efs.stype = L2CAP_SERV_BESTEFFORT;
3090 efs.msdu = cpu_to_le16(chan->local_msdu);
3091 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3092 efs.acc_lat = 0;
3093 efs.flush_to = 0;
3094 break;
3095
3096 default:
3097 return;
3098 }
3099
3100 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3101 (unsigned long) &efs, size);
3102 }
3103
l2cap_ack_timeout(struct work_struct * work)3104 static void l2cap_ack_timeout(struct work_struct *work)
3105 {
3106 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3107 ack_timer.work);
3108 u16 frames_to_ack;
3109
3110 BT_DBG("chan %p", chan);
3111
3112 l2cap_chan_lock(chan);
3113
3114 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3115 chan->last_acked_seq);
3116
3117 if (frames_to_ack)
3118 l2cap_send_rr_or_rnr(chan, 0);
3119
3120 l2cap_chan_unlock(chan);
3121 l2cap_chan_put(chan);
3122 }
3123
l2cap_ertm_init(struct l2cap_chan * chan)3124 int l2cap_ertm_init(struct l2cap_chan *chan)
3125 {
3126 int err;
3127
3128 chan->next_tx_seq = 0;
3129 chan->expected_tx_seq = 0;
3130 chan->expected_ack_seq = 0;
3131 chan->unacked_frames = 0;
3132 chan->buffer_seq = 0;
3133 chan->frames_sent = 0;
3134 chan->last_acked_seq = 0;
3135 chan->sdu = NULL;
3136 chan->sdu_last_frag = NULL;
3137 chan->sdu_len = 0;
3138
3139 skb_queue_head_init(&chan->tx_q);
3140
3141 if (chan->mode != L2CAP_MODE_ERTM)
3142 return 0;
3143
3144 chan->rx_state = L2CAP_RX_STATE_RECV;
3145 chan->tx_state = L2CAP_TX_STATE_XMIT;
3146
3147 skb_queue_head_init(&chan->srej_q);
3148
3149 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3150 if (err < 0)
3151 return err;
3152
3153 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3154 if (err < 0)
3155 l2cap_seq_list_free(&chan->srej_list);
3156
3157 return err;
3158 }
3159
l2cap_select_mode(__u8 mode,__u16 remote_feat_mask)3160 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3161 {
3162 switch (mode) {
3163 case L2CAP_MODE_STREAMING:
3164 case L2CAP_MODE_ERTM:
3165 if (l2cap_mode_supported(mode, remote_feat_mask))
3166 return mode;
3167 fallthrough;
3168 default:
3169 return L2CAP_MODE_BASIC;
3170 }
3171 }
3172
__l2cap_ews_supported(struct l2cap_conn * conn)3173 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3174 {
3175 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
3176 }
3177
__l2cap_efs_supported(struct l2cap_conn * conn)3178 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3179 {
3180 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
3181 }
3182
__l2cap_set_ertm_timeouts(struct l2cap_chan * chan,struct l2cap_conf_rfc * rfc)3183 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3184 struct l2cap_conf_rfc *rfc)
3185 {
3186 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3187 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3188 }
3189
l2cap_txwin_setup(struct l2cap_chan * chan)3190 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3191 {
3192 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3193 __l2cap_ews_supported(chan->conn)) {
3194 /* use extended control field */
3195 set_bit(FLAG_EXT_CTRL, &chan->flags);
3196 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3197 } else {
3198 chan->tx_win = min_t(u16, chan->tx_win,
3199 L2CAP_DEFAULT_TX_WINDOW);
3200 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3201 }
3202 chan->ack_win = chan->tx_win;
3203 }
3204
l2cap_mtu_auto(struct l2cap_chan * chan)3205 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3206 {
3207 struct hci_conn *conn = chan->conn->hcon;
3208
3209 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3210
3211 /* The 2-DH1 packet has between 2 and 56 information bytes
3212 * (including the 2-byte payload header)
3213 */
3214 if (!(conn->pkt_type & HCI_2DH1))
3215 chan->imtu = 54;
3216
3217 /* The 3-DH1 packet has between 2 and 85 information bytes
3218 * (including the 2-byte payload header)
3219 */
3220 if (!(conn->pkt_type & HCI_3DH1))
3221 chan->imtu = 83;
3222
3223 /* The 2-DH3 packet has between 2 and 369 information bytes
3224 * (including the 2-byte payload header)
3225 */
3226 if (!(conn->pkt_type & HCI_2DH3))
3227 chan->imtu = 367;
3228
3229 /* The 3-DH3 packet has between 2 and 554 information bytes
3230 * (including the 2-byte payload header)
3231 */
3232 if (!(conn->pkt_type & HCI_3DH3))
3233 chan->imtu = 552;
3234
3235 /* The 2-DH5 packet has between 2 and 681 information bytes
3236 * (including the 2-byte payload header)
3237 */
3238 if (!(conn->pkt_type & HCI_2DH5))
3239 chan->imtu = 679;
3240
3241 /* The 3-DH5 packet has between 2 and 1023 information bytes
3242 * (including the 2-byte payload header)
3243 */
3244 if (!(conn->pkt_type & HCI_3DH5))
3245 chan->imtu = 1021;
3246 }
3247
l2cap_build_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3248 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3249 {
3250 struct l2cap_conf_req *req = data;
3251 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3252 void *ptr = req->data;
3253 void *endptr = data + data_size;
3254 u16 size;
3255
3256 BT_DBG("chan %p", chan);
3257
3258 if (chan->num_conf_req || chan->num_conf_rsp)
3259 goto done;
3260
3261 switch (chan->mode) {
3262 case L2CAP_MODE_STREAMING:
3263 case L2CAP_MODE_ERTM:
3264 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3265 break;
3266
3267 if (__l2cap_efs_supported(chan->conn))
3268 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3269
3270 fallthrough;
3271 default:
3272 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3273 break;
3274 }
3275
3276 done:
3277 if (chan->imtu != L2CAP_DEFAULT_MTU) {
3278 if (!chan->imtu)
3279 l2cap_mtu_auto(chan);
3280 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3281 endptr - ptr);
3282 }
3283
3284 switch (chan->mode) {
3285 case L2CAP_MODE_BASIC:
3286 if (disable_ertm)
3287 break;
3288
3289 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3290 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3291 break;
3292
3293 rfc.mode = L2CAP_MODE_BASIC;
3294 rfc.txwin_size = 0;
3295 rfc.max_transmit = 0;
3296 rfc.retrans_timeout = 0;
3297 rfc.monitor_timeout = 0;
3298 rfc.max_pdu_size = 0;
3299
3300 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3301 (unsigned long) &rfc, endptr - ptr);
3302 break;
3303
3304 case L2CAP_MODE_ERTM:
3305 rfc.mode = L2CAP_MODE_ERTM;
3306 rfc.max_transmit = chan->max_tx;
3307
3308 __l2cap_set_ertm_timeouts(chan, &rfc);
3309
3310 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3311 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3312 L2CAP_FCS_SIZE);
3313 rfc.max_pdu_size = cpu_to_le16(size);
3314
3315 l2cap_txwin_setup(chan);
3316
3317 rfc.txwin_size = min_t(u16, chan->tx_win,
3318 L2CAP_DEFAULT_TX_WINDOW);
3319
3320 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3321 (unsigned long) &rfc, endptr - ptr);
3322
3323 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3324 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3325
3326 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3327 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3328 chan->tx_win, endptr - ptr);
3329
3330 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3331 if (chan->fcs == L2CAP_FCS_NONE ||
3332 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3333 chan->fcs = L2CAP_FCS_NONE;
3334 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3335 chan->fcs, endptr - ptr);
3336 }
3337 break;
3338
3339 case L2CAP_MODE_STREAMING:
3340 l2cap_txwin_setup(chan);
3341 rfc.mode = L2CAP_MODE_STREAMING;
3342 rfc.txwin_size = 0;
3343 rfc.max_transmit = 0;
3344 rfc.retrans_timeout = 0;
3345 rfc.monitor_timeout = 0;
3346
3347 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3348 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3349 L2CAP_FCS_SIZE);
3350 rfc.max_pdu_size = cpu_to_le16(size);
3351
3352 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3353 (unsigned long) &rfc, endptr - ptr);
3354
3355 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3356 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3357
3358 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3359 if (chan->fcs == L2CAP_FCS_NONE ||
3360 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3361 chan->fcs = L2CAP_FCS_NONE;
3362 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3363 chan->fcs, endptr - ptr);
3364 }
3365 break;
3366 }
3367
3368 req->dcid = cpu_to_le16(chan->dcid);
3369 req->flags = cpu_to_le16(0);
3370
3371 return ptr - data;
3372 }
3373
l2cap_parse_conf_req(struct l2cap_chan * chan,void * data,size_t data_size)3374 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3375 {
3376 struct l2cap_conf_rsp *rsp = data;
3377 void *ptr = rsp->data;
3378 void *endptr = data + data_size;
3379 void *req = chan->conf_req;
3380 int len = chan->conf_len;
3381 int type, hint, olen;
3382 unsigned long val;
3383 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3384 struct l2cap_conf_efs efs;
3385 u8 remote_efs = 0;
3386 u16 mtu = L2CAP_DEFAULT_MTU;
3387 u16 result = L2CAP_CONF_SUCCESS;
3388 u16 size;
3389
3390 BT_DBG("chan %p", chan);
3391
3392 while (len >= L2CAP_CONF_OPT_SIZE) {
3393 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3394 if (len < 0)
3395 break;
3396
3397 hint = type & L2CAP_CONF_HINT;
3398 type &= L2CAP_CONF_MASK;
3399
3400 switch (type) {
3401 case L2CAP_CONF_MTU:
3402 if (olen != 2)
3403 break;
3404 mtu = val;
3405 break;
3406
3407 case L2CAP_CONF_FLUSH_TO:
3408 if (olen != 2)
3409 break;
3410 chan->flush_to = val;
3411 break;
3412
3413 case L2CAP_CONF_QOS:
3414 break;
3415
3416 case L2CAP_CONF_RFC:
3417 if (olen != sizeof(rfc))
3418 break;
3419 memcpy(&rfc, (void *) val, olen);
3420 break;
3421
3422 case L2CAP_CONF_FCS:
3423 if (olen != 1)
3424 break;
3425 if (val == L2CAP_FCS_NONE)
3426 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3427 break;
3428
3429 case L2CAP_CONF_EFS:
3430 if (olen != sizeof(efs))
3431 break;
3432 remote_efs = 1;
3433 memcpy(&efs, (void *) val, olen);
3434 break;
3435
3436 case L2CAP_CONF_EWS:
3437 if (olen != 2)
3438 break;
3439 return -ECONNREFUSED;
3440
3441 default:
3442 if (hint)
3443 break;
3444 result = L2CAP_CONF_UNKNOWN;
3445 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3446 break;
3447 }
3448 }
3449
3450 if (chan->num_conf_rsp || chan->num_conf_req > 1)
3451 goto done;
3452
3453 switch (chan->mode) {
3454 case L2CAP_MODE_STREAMING:
3455 case L2CAP_MODE_ERTM:
3456 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3457 chan->mode = l2cap_select_mode(rfc.mode,
3458 chan->conn->feat_mask);
3459 break;
3460 }
3461
3462 if (remote_efs) {
3463 if (__l2cap_efs_supported(chan->conn))
3464 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3465 else
3466 return -ECONNREFUSED;
3467 }
3468
3469 if (chan->mode != rfc.mode)
3470 return -ECONNREFUSED;
3471
3472 break;
3473 }
3474
3475 done:
3476 if (chan->mode != rfc.mode) {
3477 result = L2CAP_CONF_UNACCEPT;
3478 rfc.mode = chan->mode;
3479
3480 if (chan->num_conf_rsp == 1)
3481 return -ECONNREFUSED;
3482
3483 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3484 (unsigned long) &rfc, endptr - ptr);
3485 }
3486
3487 if (result == L2CAP_CONF_SUCCESS) {
3488 /* Configure output options and let the other side know
3489 * which ones we don't like. */
3490
3491 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3492 result = L2CAP_CONF_UNACCEPT;
3493 else {
3494 chan->omtu = mtu;
3495 set_bit(CONF_MTU_DONE, &chan->conf_state);
3496 }
3497 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3498
3499 if (remote_efs) {
3500 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3501 efs.stype != L2CAP_SERV_NOTRAFIC &&
3502 efs.stype != chan->local_stype) {
3503
3504 result = L2CAP_CONF_UNACCEPT;
3505
3506 if (chan->num_conf_req >= 1)
3507 return -ECONNREFUSED;
3508
3509 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3510 sizeof(efs),
3511 (unsigned long) &efs, endptr - ptr);
3512 } else {
3513 /* Send PENDING Conf Rsp */
3514 result = L2CAP_CONF_PENDING;
3515 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3516 }
3517 }
3518
3519 switch (rfc.mode) {
3520 case L2CAP_MODE_BASIC:
3521 chan->fcs = L2CAP_FCS_NONE;
3522 set_bit(CONF_MODE_DONE, &chan->conf_state);
3523 break;
3524
3525 case L2CAP_MODE_ERTM:
3526 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3527 chan->remote_tx_win = rfc.txwin_size;
3528 else
3529 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3530
3531 chan->remote_max_tx = rfc.max_transmit;
3532
3533 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3534 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3535 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3536 rfc.max_pdu_size = cpu_to_le16(size);
3537 chan->remote_mps = size;
3538
3539 __l2cap_set_ertm_timeouts(chan, &rfc);
3540
3541 set_bit(CONF_MODE_DONE, &chan->conf_state);
3542
3543 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3544 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3545
3546 if (remote_efs &&
3547 test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3548 chan->remote_id = efs.id;
3549 chan->remote_stype = efs.stype;
3550 chan->remote_msdu = le16_to_cpu(efs.msdu);
3551 chan->remote_flush_to =
3552 le32_to_cpu(efs.flush_to);
3553 chan->remote_acc_lat =
3554 le32_to_cpu(efs.acc_lat);
3555 chan->remote_sdu_itime =
3556 le32_to_cpu(efs.sdu_itime);
3557 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3558 sizeof(efs),
3559 (unsigned long) &efs, endptr - ptr);
3560 }
3561 break;
3562
3563 case L2CAP_MODE_STREAMING:
3564 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3565 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3566 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3567 rfc.max_pdu_size = cpu_to_le16(size);
3568 chan->remote_mps = size;
3569
3570 set_bit(CONF_MODE_DONE, &chan->conf_state);
3571
3572 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3573 (unsigned long) &rfc, endptr - ptr);
3574
3575 break;
3576
3577 default:
3578 result = L2CAP_CONF_UNACCEPT;
3579
3580 memset(&rfc, 0, sizeof(rfc));
3581 rfc.mode = chan->mode;
3582 }
3583
3584 if (result == L2CAP_CONF_SUCCESS)
3585 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3586 }
3587 rsp->scid = cpu_to_le16(chan->dcid);
3588 rsp->result = cpu_to_le16(result);
3589 rsp->flags = cpu_to_le16(0);
3590
3591 return ptr - data;
3592 }
3593
l2cap_parse_conf_rsp(struct l2cap_chan * chan,void * rsp,int len,void * data,size_t size,u16 * result)3594 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3595 void *data, size_t size, u16 *result)
3596 {
3597 struct l2cap_conf_req *req = data;
3598 void *ptr = req->data;
3599 void *endptr = data + size;
3600 int type, olen;
3601 unsigned long val;
3602 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3603 struct l2cap_conf_efs efs;
3604
3605 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3606
3607 while (len >= L2CAP_CONF_OPT_SIZE) {
3608 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3609 if (len < 0)
3610 break;
3611
3612 switch (type) {
3613 case L2CAP_CONF_MTU:
3614 if (olen != 2)
3615 break;
3616 if (val < L2CAP_DEFAULT_MIN_MTU) {
3617 *result = L2CAP_CONF_UNACCEPT;
3618 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3619 } else
3620 chan->imtu = val;
3621 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3622 endptr - ptr);
3623 break;
3624
3625 case L2CAP_CONF_FLUSH_TO:
3626 if (olen != 2)
3627 break;
3628 chan->flush_to = val;
3629 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3630 chan->flush_to, endptr - ptr);
3631 break;
3632
3633 case L2CAP_CONF_RFC:
3634 if (olen != sizeof(rfc))
3635 break;
3636 memcpy(&rfc, (void *)val, olen);
3637 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3638 rfc.mode != chan->mode)
3639 return -ECONNREFUSED;
3640 chan->fcs = 0;
3641 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3642 (unsigned long) &rfc, endptr - ptr);
3643 break;
3644
3645 case L2CAP_CONF_EWS:
3646 if (olen != 2)
3647 break;
3648 chan->ack_win = min_t(u16, val, chan->ack_win);
3649 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3650 chan->tx_win, endptr - ptr);
3651 break;
3652
3653 case L2CAP_CONF_EFS:
3654 if (olen != sizeof(efs))
3655 break;
3656 memcpy(&efs, (void *)val, olen);
3657 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3658 efs.stype != L2CAP_SERV_NOTRAFIC &&
3659 efs.stype != chan->local_stype)
3660 return -ECONNREFUSED;
3661 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3662 (unsigned long) &efs, endptr - ptr);
3663 break;
3664
3665 case L2CAP_CONF_FCS:
3666 if (olen != 1)
3667 break;
3668 if (*result == L2CAP_CONF_PENDING)
3669 if (val == L2CAP_FCS_NONE)
3670 set_bit(CONF_RECV_NO_FCS,
3671 &chan->conf_state);
3672 break;
3673 }
3674 }
3675
3676 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3677 return -ECONNREFUSED;
3678
3679 chan->mode = rfc.mode;
3680
3681 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3682 switch (rfc.mode) {
3683 case L2CAP_MODE_ERTM:
3684 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3685 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3686 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3687 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3688 chan->ack_win = min_t(u16, chan->ack_win,
3689 rfc.txwin_size);
3690
3691 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3692 chan->local_msdu = le16_to_cpu(efs.msdu);
3693 chan->local_sdu_itime =
3694 le32_to_cpu(efs.sdu_itime);
3695 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3696 chan->local_flush_to =
3697 le32_to_cpu(efs.flush_to);
3698 }
3699 break;
3700
3701 case L2CAP_MODE_STREAMING:
3702 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3703 }
3704 }
3705
3706 req->dcid = cpu_to_le16(chan->dcid);
3707 req->flags = cpu_to_le16(0);
3708
3709 return ptr - data;
3710 }
3711
l2cap_build_conf_rsp(struct l2cap_chan * chan,void * data,u16 result,u16 flags)3712 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3713 u16 result, u16 flags)
3714 {
3715 struct l2cap_conf_rsp *rsp = data;
3716 void *ptr = rsp->data;
3717
3718 BT_DBG("chan %p", chan);
3719
3720 rsp->scid = cpu_to_le16(chan->dcid);
3721 rsp->result = cpu_to_le16(result);
3722 rsp->flags = cpu_to_le16(flags);
3723
3724 return ptr - data;
3725 }
3726
__l2cap_le_connect_rsp_defer(struct l2cap_chan * chan)3727 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3728 {
3729 struct l2cap_le_conn_rsp rsp;
3730 struct l2cap_conn *conn = chan->conn;
3731
3732 BT_DBG("chan %p", chan);
3733
3734 rsp.dcid = cpu_to_le16(chan->scid);
3735 rsp.mtu = cpu_to_le16(chan->imtu);
3736 rsp.mps = cpu_to_le16(chan->mps);
3737 rsp.credits = cpu_to_le16(chan->rx_credits);
3738 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3739
3740 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3741 &rsp);
3742 }
3743
l2cap_ecred_list_defer(struct l2cap_chan * chan,void * data)3744 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
3745 {
3746 int *result = data;
3747
3748 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3749 return;
3750
3751 switch (chan->state) {
3752 case BT_CONNECT2:
3753 /* If channel still pending accept add to result */
3754 (*result)++;
3755 return;
3756 case BT_CONNECTED:
3757 return;
3758 default:
3759 /* If not connected or pending accept it has been refused */
3760 *result = -ECONNREFUSED;
3761 return;
3762 }
3763 }
3764
3765 struct l2cap_ecred_rsp_data {
3766 struct {
3767 struct l2cap_ecred_conn_rsp rsp;
3768 __le16 scid[L2CAP_ECRED_MAX_CID];
3769 } __packed pdu;
3770 int count;
3771 };
3772
l2cap_ecred_rsp_defer(struct l2cap_chan * chan,void * data)3773 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
3774 {
3775 struct l2cap_ecred_rsp_data *rsp = data;
3776
3777 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3778 return;
3779
3780 /* Reset ident so only one response is sent */
3781 chan->ident = 0;
3782
3783 /* Include all channels pending with the same ident */
3784 if (!rsp->pdu.rsp.result)
3785 rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
3786 else
3787 l2cap_chan_del(chan, ECONNRESET);
3788 }
3789
__l2cap_ecred_conn_rsp_defer(struct l2cap_chan * chan)3790 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3791 {
3792 struct l2cap_conn *conn = chan->conn;
3793 struct l2cap_ecred_rsp_data data;
3794 u16 id = chan->ident;
3795 int result = 0;
3796
3797 if (!id)
3798 return;
3799
3800 BT_DBG("chan %p id %d", chan, id);
3801
3802 memset(&data, 0, sizeof(data));
3803
3804 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu);
3805 data.pdu.rsp.mps = cpu_to_le16(chan->mps);
3806 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3807 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3808
3809 /* Verify that all channels are ready */
3810 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
3811
3812 if (result > 0)
3813 return;
3814
3815 if (result < 0)
3816 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
3817
3818 /* Build response */
3819 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
3820
3821 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
3822 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
3823 &data.pdu);
3824 }
3825
__l2cap_connect_rsp_defer(struct l2cap_chan * chan)3826 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3827 {
3828 struct l2cap_conn_rsp rsp;
3829 struct l2cap_conn *conn = chan->conn;
3830 u8 buf[128];
3831 u8 rsp_code;
3832
3833 rsp.scid = cpu_to_le16(chan->dcid);
3834 rsp.dcid = cpu_to_le16(chan->scid);
3835 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3836 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3837 rsp_code = L2CAP_CONN_RSP;
3838
3839 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3840
3841 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3842
3843 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3844 return;
3845
3846 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3847 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
3848 chan->num_conf_req++;
3849 }
3850
l2cap_conf_rfc_get(struct l2cap_chan * chan,void * rsp,int len)3851 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3852 {
3853 int type, olen;
3854 unsigned long val;
3855 /* Use sane default values in case a misbehaving remote device
3856 * did not send an RFC or extended window size option.
3857 */
3858 u16 txwin_ext = chan->ack_win;
3859 struct l2cap_conf_rfc rfc = {
3860 .mode = chan->mode,
3861 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3862 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3863 .max_pdu_size = cpu_to_le16(chan->imtu),
3864 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3865 };
3866
3867 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3868
3869 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3870 return;
3871
3872 while (len >= L2CAP_CONF_OPT_SIZE) {
3873 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3874 if (len < 0)
3875 break;
3876
3877 switch (type) {
3878 case L2CAP_CONF_RFC:
3879 if (olen != sizeof(rfc))
3880 break;
3881 memcpy(&rfc, (void *)val, olen);
3882 break;
3883 case L2CAP_CONF_EWS:
3884 if (olen != 2)
3885 break;
3886 txwin_ext = val;
3887 break;
3888 }
3889 }
3890
3891 switch (rfc.mode) {
3892 case L2CAP_MODE_ERTM:
3893 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3894 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3895 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3896 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3897 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3898 else
3899 chan->ack_win = min_t(u16, chan->ack_win,
3900 rfc.txwin_size);
3901 break;
3902 case L2CAP_MODE_STREAMING:
3903 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3904 }
3905 }
3906
l2cap_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)3907 static inline int l2cap_command_rej(struct l2cap_conn *conn,
3908 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3909 u8 *data)
3910 {
3911 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3912
3913 if (cmd_len < sizeof(*rej))
3914 return -EPROTO;
3915
3916 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3917 return 0;
3918
3919 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3920 cmd->ident == conn->info_ident) {
3921 cancel_delayed_work(&conn->info_timer);
3922
3923 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3924 conn->info_ident = 0;
3925
3926 l2cap_conn_start(conn);
3927 }
3928
3929 return 0;
3930 }
3931
l2cap_connect(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u8 * data,u8 rsp_code)3932 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
3933 u8 *data, u8 rsp_code)
3934 {
3935 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3936 struct l2cap_conn_rsp rsp;
3937 struct l2cap_chan *chan = NULL, *pchan = NULL;
3938 int result, status = L2CAP_CS_NO_INFO;
3939
3940 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3941 __le16 psm = req->psm;
3942
3943 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3944
3945 /* Check if we have socket listening on psm */
3946 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
3947 &conn->hcon->dst, ACL_LINK);
3948 if (!pchan) {
3949 result = L2CAP_CR_BAD_PSM;
3950 goto response;
3951 }
3952
3953 mutex_lock(&conn->chan_lock);
3954 l2cap_chan_lock(pchan);
3955
3956 /* Check if the ACL is secure enough (if not SDP) */
3957 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3958 !hci_conn_check_link_mode(conn->hcon)) {
3959 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3960 result = L2CAP_CR_SEC_BLOCK;
3961 goto response;
3962 }
3963
3964 result = L2CAP_CR_NO_MEM;
3965
3966 /* Check for valid dynamic CID range (as per Erratum 3253) */
3967 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
3968 result = L2CAP_CR_INVALID_SCID;
3969 goto response;
3970 }
3971
3972 /* Check if we already have channel with that dcid */
3973 if (__l2cap_get_chan_by_dcid(conn, scid)) {
3974 result = L2CAP_CR_SCID_IN_USE;
3975 goto response;
3976 }
3977
3978 chan = pchan->ops->new_connection(pchan);
3979 if (!chan)
3980 goto response;
3981
3982 /* For certain devices (ex: HID mouse), support for authentication,
3983 * pairing and bonding is optional. For such devices, inorder to avoid
3984 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3985 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3986 */
3987 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3988
3989 bacpy(&chan->src, &conn->hcon->src);
3990 bacpy(&chan->dst, &conn->hcon->dst);
3991 chan->src_type = bdaddr_src_type(conn->hcon);
3992 chan->dst_type = bdaddr_dst_type(conn->hcon);
3993 chan->psm = psm;
3994 chan->dcid = scid;
3995
3996 __l2cap_chan_add(conn, chan);
3997
3998 dcid = chan->scid;
3999
4000 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4001
4002 chan->ident = cmd->ident;
4003
4004 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4005 if (l2cap_chan_check_security(chan, false)) {
4006 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4007 l2cap_state_change(chan, BT_CONNECT2);
4008 result = L2CAP_CR_PEND;
4009 status = L2CAP_CS_AUTHOR_PEND;
4010 chan->ops->defer(chan);
4011 } else {
4012 l2cap_state_change(chan, BT_CONFIG);
4013 result = L2CAP_CR_SUCCESS;
4014 status = L2CAP_CS_NO_INFO;
4015 }
4016 } else {
4017 l2cap_state_change(chan, BT_CONNECT2);
4018 result = L2CAP_CR_PEND;
4019 status = L2CAP_CS_AUTHEN_PEND;
4020 }
4021 } else {
4022 l2cap_state_change(chan, BT_CONNECT2);
4023 result = L2CAP_CR_PEND;
4024 status = L2CAP_CS_NO_INFO;
4025 }
4026
4027 response:
4028 rsp.scid = cpu_to_le16(scid);
4029 rsp.dcid = cpu_to_le16(dcid);
4030 rsp.result = cpu_to_le16(result);
4031 rsp.status = cpu_to_le16(status);
4032 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4033
4034 if (!pchan)
4035 return;
4036
4037 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4038 struct l2cap_info_req info;
4039 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4040
4041 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4042 conn->info_ident = l2cap_get_ident(conn);
4043
4044 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4045
4046 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4047 sizeof(info), &info);
4048 }
4049
4050 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4051 result == L2CAP_CR_SUCCESS) {
4052 u8 buf[128];
4053 set_bit(CONF_REQ_SENT, &chan->conf_state);
4054 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4055 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4056 chan->num_conf_req++;
4057 }
4058
4059 l2cap_chan_unlock(pchan);
4060 mutex_unlock(&conn->chan_lock);
4061 l2cap_chan_put(pchan);
4062 }
4063
l2cap_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4064 static int l2cap_connect_req(struct l2cap_conn *conn,
4065 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4066 {
4067 struct hci_dev *hdev = conn->hcon->hdev;
4068 struct hci_conn *hcon = conn->hcon;
4069
4070 if (cmd_len < sizeof(struct l2cap_conn_req))
4071 return -EPROTO;
4072
4073 hci_dev_lock(hdev);
4074 if (hci_dev_test_flag(hdev, HCI_MGMT))
4075 mgmt_device_connected(hdev, hcon, NULL, 0);
4076 hci_dev_unlock(hdev);
4077
4078 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
4079 return 0;
4080 }
4081
l2cap_connect_create_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4082 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4083 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4084 u8 *data)
4085 {
4086 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4087 u16 scid, dcid, result, status;
4088 struct l2cap_chan *chan;
4089 u8 req[128];
4090 int err;
4091
4092 if (cmd_len < sizeof(*rsp))
4093 return -EPROTO;
4094
4095 scid = __le16_to_cpu(rsp->scid);
4096 dcid = __le16_to_cpu(rsp->dcid);
4097 result = __le16_to_cpu(rsp->result);
4098 status = __le16_to_cpu(rsp->status);
4099
4100 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
4101 dcid > L2CAP_CID_DYN_END))
4102 return -EPROTO;
4103
4104 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4105 dcid, scid, result, status);
4106
4107 mutex_lock(&conn->chan_lock);
4108
4109 if (scid) {
4110 chan = __l2cap_get_chan_by_scid(conn, scid);
4111 if (!chan) {
4112 err = -EBADSLT;
4113 goto unlock;
4114 }
4115 } else {
4116 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4117 if (!chan) {
4118 err = -EBADSLT;
4119 goto unlock;
4120 }
4121 }
4122
4123 chan = l2cap_chan_hold_unless_zero(chan);
4124 if (!chan) {
4125 err = -EBADSLT;
4126 goto unlock;
4127 }
4128
4129 err = 0;
4130
4131 l2cap_chan_lock(chan);
4132
4133 switch (result) {
4134 case L2CAP_CR_SUCCESS:
4135 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4136 err = -EBADSLT;
4137 break;
4138 }
4139
4140 l2cap_state_change(chan, BT_CONFIG);
4141 chan->ident = 0;
4142 chan->dcid = dcid;
4143 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4144
4145 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4146 break;
4147
4148 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4149 l2cap_build_conf_req(chan, req, sizeof(req)), req);
4150 chan->num_conf_req++;
4151 break;
4152
4153 case L2CAP_CR_PEND:
4154 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4155 break;
4156
4157 default:
4158 l2cap_chan_del(chan, ECONNREFUSED);
4159 break;
4160 }
4161
4162 l2cap_chan_unlock(chan);
4163 l2cap_chan_put(chan);
4164
4165 unlock:
4166 mutex_unlock(&conn->chan_lock);
4167
4168 return err;
4169 }
4170
set_default_fcs(struct l2cap_chan * chan)4171 static inline void set_default_fcs(struct l2cap_chan *chan)
4172 {
4173 /* FCS is enabled only in ERTM or streaming mode, if one or both
4174 * sides request it.
4175 */
4176 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4177 chan->fcs = L2CAP_FCS_NONE;
4178 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4179 chan->fcs = L2CAP_FCS_CRC16;
4180 }
4181
l2cap_send_efs_conf_rsp(struct l2cap_chan * chan,void * data,u8 ident,u16 flags)4182 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4183 u8 ident, u16 flags)
4184 {
4185 struct l2cap_conn *conn = chan->conn;
4186
4187 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4188 flags);
4189
4190 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4191 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4192
4193 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4194 l2cap_build_conf_rsp(chan, data,
4195 L2CAP_CONF_SUCCESS, flags), data);
4196 }
4197
cmd_reject_invalid_cid(struct l2cap_conn * conn,u8 ident,u16 scid,u16 dcid)4198 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4199 u16 scid, u16 dcid)
4200 {
4201 struct l2cap_cmd_rej_cid rej;
4202
4203 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4204 rej.scid = __cpu_to_le16(scid);
4205 rej.dcid = __cpu_to_le16(dcid);
4206
4207 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4208 }
4209
l2cap_config_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4210 static inline int l2cap_config_req(struct l2cap_conn *conn,
4211 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4212 u8 *data)
4213 {
4214 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4215 u16 dcid, flags;
4216 u8 rsp[64];
4217 struct l2cap_chan *chan;
4218 int len, err = 0;
4219
4220 if (cmd_len < sizeof(*req))
4221 return -EPROTO;
4222
4223 dcid = __le16_to_cpu(req->dcid);
4224 flags = __le16_to_cpu(req->flags);
4225
4226 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4227
4228 chan = l2cap_get_chan_by_scid(conn, dcid);
4229 if (!chan) {
4230 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4231 return 0;
4232 }
4233
4234 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4235 chan->state != BT_CONNECTED) {
4236 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4237 chan->dcid);
4238 goto unlock;
4239 }
4240
4241 /* Reject if config buffer is too small. */
4242 len = cmd_len - sizeof(*req);
4243 if (chan->conf_len + len > sizeof(chan->conf_req)) {
4244 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4245 l2cap_build_conf_rsp(chan, rsp,
4246 L2CAP_CONF_REJECT, flags), rsp);
4247 goto unlock;
4248 }
4249
4250 /* Store config. */
4251 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4252 chan->conf_len += len;
4253
4254 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4255 /* Incomplete config. Send empty response. */
4256 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4257 l2cap_build_conf_rsp(chan, rsp,
4258 L2CAP_CONF_SUCCESS, flags), rsp);
4259 goto unlock;
4260 }
4261
4262 /* Complete config. */
4263 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4264 if (len < 0) {
4265 l2cap_send_disconn_req(chan, ECONNRESET);
4266 goto unlock;
4267 }
4268
4269 chan->ident = cmd->ident;
4270 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4271 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4272 chan->num_conf_rsp++;
4273
4274 /* Reset config buffer. */
4275 chan->conf_len = 0;
4276
4277 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4278 goto unlock;
4279
4280 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4281 set_default_fcs(chan);
4282
4283 if (chan->mode == L2CAP_MODE_ERTM ||
4284 chan->mode == L2CAP_MODE_STREAMING)
4285 err = l2cap_ertm_init(chan);
4286
4287 if (err < 0)
4288 l2cap_send_disconn_req(chan, -err);
4289 else
4290 l2cap_chan_ready(chan);
4291
4292 goto unlock;
4293 }
4294
4295 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4296 u8 buf[64];
4297 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4298 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4299 chan->num_conf_req++;
4300 }
4301
4302 /* Got Conf Rsp PENDING from remote side and assume we sent
4303 Conf Rsp PENDING in the code above */
4304 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4305 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4306
4307 /* check compatibility */
4308
4309 /* Send rsp for BR/EDR channel */
4310 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4311 }
4312
4313 unlock:
4314 l2cap_chan_unlock(chan);
4315 l2cap_chan_put(chan);
4316 return err;
4317 }
4318
l2cap_config_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4319 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4320 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4321 u8 *data)
4322 {
4323 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4324 u16 scid, flags, result;
4325 struct l2cap_chan *chan;
4326 int len = cmd_len - sizeof(*rsp);
4327 int err = 0;
4328
4329 if (cmd_len < sizeof(*rsp))
4330 return -EPROTO;
4331
4332 scid = __le16_to_cpu(rsp->scid);
4333 flags = __le16_to_cpu(rsp->flags);
4334 result = __le16_to_cpu(rsp->result);
4335
4336 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4337 result, len);
4338
4339 chan = l2cap_get_chan_by_scid(conn, scid);
4340 if (!chan)
4341 return 0;
4342
4343 switch (result) {
4344 case L2CAP_CONF_SUCCESS:
4345 l2cap_conf_rfc_get(chan, rsp->data, len);
4346 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4347 break;
4348
4349 case L2CAP_CONF_PENDING:
4350 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4351
4352 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4353 char buf[64];
4354
4355 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4356 buf, sizeof(buf), &result);
4357 if (len < 0) {
4358 l2cap_send_disconn_req(chan, ECONNRESET);
4359 goto done;
4360 }
4361
4362 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
4363 }
4364 goto done;
4365
4366 case L2CAP_CONF_UNKNOWN:
4367 case L2CAP_CONF_UNACCEPT:
4368 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4369 char req[64];
4370
4371 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4372 l2cap_send_disconn_req(chan, ECONNRESET);
4373 goto done;
4374 }
4375
4376 /* throw out any old stored conf requests */
4377 result = L2CAP_CONF_SUCCESS;
4378 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4379 req, sizeof(req), &result);
4380 if (len < 0) {
4381 l2cap_send_disconn_req(chan, ECONNRESET);
4382 goto done;
4383 }
4384
4385 l2cap_send_cmd(conn, l2cap_get_ident(conn),
4386 L2CAP_CONF_REQ, len, req);
4387 chan->num_conf_req++;
4388 if (result != L2CAP_CONF_SUCCESS)
4389 goto done;
4390 break;
4391 }
4392 fallthrough;
4393
4394 default:
4395 l2cap_chan_set_err(chan, ECONNRESET);
4396
4397 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4398 l2cap_send_disconn_req(chan, ECONNRESET);
4399 goto done;
4400 }
4401
4402 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4403 goto done;
4404
4405 set_bit(CONF_INPUT_DONE, &chan->conf_state);
4406
4407 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4408 set_default_fcs(chan);
4409
4410 if (chan->mode == L2CAP_MODE_ERTM ||
4411 chan->mode == L2CAP_MODE_STREAMING)
4412 err = l2cap_ertm_init(chan);
4413
4414 if (err < 0)
4415 l2cap_send_disconn_req(chan, -err);
4416 else
4417 l2cap_chan_ready(chan);
4418 }
4419
4420 done:
4421 l2cap_chan_unlock(chan);
4422 l2cap_chan_put(chan);
4423 return err;
4424 }
4425
l2cap_disconnect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4426 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4427 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4428 u8 *data)
4429 {
4430 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4431 struct l2cap_disconn_rsp rsp;
4432 u16 dcid, scid;
4433 struct l2cap_chan *chan;
4434
4435 if (cmd_len != sizeof(*req))
4436 return -EPROTO;
4437
4438 scid = __le16_to_cpu(req->scid);
4439 dcid = __le16_to_cpu(req->dcid);
4440
4441 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4442
4443 chan = l2cap_get_chan_by_scid(conn, dcid);
4444 if (!chan) {
4445 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4446 return 0;
4447 }
4448
4449 rsp.dcid = cpu_to_le16(chan->scid);
4450 rsp.scid = cpu_to_le16(chan->dcid);
4451 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4452
4453 chan->ops->set_shutdown(chan);
4454
4455 l2cap_chan_unlock(chan);
4456 mutex_lock(&conn->chan_lock);
4457 l2cap_chan_lock(chan);
4458 l2cap_chan_del(chan, ECONNRESET);
4459 mutex_unlock(&conn->chan_lock);
4460
4461 chan->ops->close(chan);
4462
4463 l2cap_chan_unlock(chan);
4464 l2cap_chan_put(chan);
4465
4466 return 0;
4467 }
4468
l2cap_disconnect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4469 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4470 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4471 u8 *data)
4472 {
4473 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4474 u16 dcid, scid;
4475 struct l2cap_chan *chan;
4476
4477 if (cmd_len != sizeof(*rsp))
4478 return -EPROTO;
4479
4480 scid = __le16_to_cpu(rsp->scid);
4481 dcid = __le16_to_cpu(rsp->dcid);
4482
4483 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4484
4485 chan = l2cap_get_chan_by_scid(conn, scid);
4486 if (!chan) {
4487 return 0;
4488 }
4489
4490 if (chan->state != BT_DISCONN) {
4491 l2cap_chan_unlock(chan);
4492 l2cap_chan_put(chan);
4493 return 0;
4494 }
4495
4496 l2cap_chan_unlock(chan);
4497 mutex_lock(&conn->chan_lock);
4498 l2cap_chan_lock(chan);
4499 l2cap_chan_del(chan, 0);
4500 mutex_unlock(&conn->chan_lock);
4501
4502 chan->ops->close(chan);
4503
4504 l2cap_chan_unlock(chan);
4505 l2cap_chan_put(chan);
4506
4507 return 0;
4508 }
4509
l2cap_information_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4510 static inline int l2cap_information_req(struct l2cap_conn *conn,
4511 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4512 u8 *data)
4513 {
4514 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4515 u16 type;
4516
4517 if (cmd_len != sizeof(*req))
4518 return -EPROTO;
4519
4520 type = __le16_to_cpu(req->type);
4521
4522 BT_DBG("type 0x%4.4x", type);
4523
4524 if (type == L2CAP_IT_FEAT_MASK) {
4525 u8 buf[8];
4526 u32 feat_mask = l2cap_feat_mask;
4527 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4528 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4529 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4530 if (!disable_ertm)
4531 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4532 | L2CAP_FEAT_FCS;
4533
4534 put_unaligned_le32(feat_mask, rsp->data);
4535 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4536 buf);
4537 } else if (type == L2CAP_IT_FIXED_CHAN) {
4538 u8 buf[12];
4539 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4540
4541 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4542 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4543 rsp->data[0] = conn->local_fixed_chan;
4544 memset(rsp->data + 1, 0, 7);
4545 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4546 buf);
4547 } else {
4548 struct l2cap_info_rsp rsp;
4549 rsp.type = cpu_to_le16(type);
4550 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4551 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4552 &rsp);
4553 }
4554
4555 return 0;
4556 }
4557
l2cap_information_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4558 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4559 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4560 u8 *data)
4561 {
4562 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4563 u16 type, result;
4564
4565 if (cmd_len < sizeof(*rsp))
4566 return -EPROTO;
4567
4568 type = __le16_to_cpu(rsp->type);
4569 result = __le16_to_cpu(rsp->result);
4570
4571 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4572
4573 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4574 if (cmd->ident != conn->info_ident ||
4575 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4576 return 0;
4577
4578 cancel_delayed_work(&conn->info_timer);
4579
4580 if (result != L2CAP_IR_SUCCESS) {
4581 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4582 conn->info_ident = 0;
4583
4584 l2cap_conn_start(conn);
4585
4586 return 0;
4587 }
4588
4589 switch (type) {
4590 case L2CAP_IT_FEAT_MASK:
4591 conn->feat_mask = get_unaligned_le32(rsp->data);
4592
4593 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4594 struct l2cap_info_req req;
4595 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4596
4597 conn->info_ident = l2cap_get_ident(conn);
4598
4599 l2cap_send_cmd(conn, conn->info_ident,
4600 L2CAP_INFO_REQ, sizeof(req), &req);
4601 } else {
4602 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4603 conn->info_ident = 0;
4604
4605 l2cap_conn_start(conn);
4606 }
4607 break;
4608
4609 case L2CAP_IT_FIXED_CHAN:
4610 conn->remote_fixed_chan = rsp->data[0];
4611 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4612 conn->info_ident = 0;
4613
4614 l2cap_conn_start(conn);
4615 break;
4616 }
4617
4618 return 0;
4619 }
4620
l2cap_conn_param_update_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4621 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4622 struct l2cap_cmd_hdr *cmd,
4623 u16 cmd_len, u8 *data)
4624 {
4625 struct hci_conn *hcon = conn->hcon;
4626 struct l2cap_conn_param_update_req *req;
4627 struct l2cap_conn_param_update_rsp rsp;
4628 u16 min, max, latency, to_multiplier;
4629 int err;
4630
4631 if (hcon->role != HCI_ROLE_MASTER)
4632 return -EINVAL;
4633
4634 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4635 return -EPROTO;
4636
4637 req = (struct l2cap_conn_param_update_req *) data;
4638 min = __le16_to_cpu(req->min);
4639 max = __le16_to_cpu(req->max);
4640 latency = __le16_to_cpu(req->latency);
4641 to_multiplier = __le16_to_cpu(req->to_multiplier);
4642
4643 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4644 min, max, latency, to_multiplier);
4645
4646 memset(&rsp, 0, sizeof(rsp));
4647
4648 err = hci_check_conn_params(min, max, latency, to_multiplier);
4649 if (err)
4650 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4651 else
4652 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4653
4654 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4655 sizeof(rsp), &rsp);
4656
4657 if (!err) {
4658 u8 store_hint;
4659
4660 store_hint = hci_le_conn_update(hcon, min, max, latency,
4661 to_multiplier);
4662 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
4663 store_hint, min, max, latency,
4664 to_multiplier);
4665
4666 }
4667
4668 return 0;
4669 }
4670
l2cap_le_connect_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4671 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
4672 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4673 u8 *data)
4674 {
4675 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
4676 struct hci_conn *hcon = conn->hcon;
4677 u16 dcid, mtu, mps, credits, result;
4678 struct l2cap_chan *chan;
4679 int err, sec_level;
4680
4681 if (cmd_len < sizeof(*rsp))
4682 return -EPROTO;
4683
4684 dcid = __le16_to_cpu(rsp->dcid);
4685 mtu = __le16_to_cpu(rsp->mtu);
4686 mps = __le16_to_cpu(rsp->mps);
4687 credits = __le16_to_cpu(rsp->credits);
4688 result = __le16_to_cpu(rsp->result);
4689
4690 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
4691 dcid < L2CAP_CID_DYN_START ||
4692 dcid > L2CAP_CID_LE_DYN_END))
4693 return -EPROTO;
4694
4695 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4696 dcid, mtu, mps, credits, result);
4697
4698 mutex_lock(&conn->chan_lock);
4699
4700 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4701 if (!chan) {
4702 err = -EBADSLT;
4703 goto unlock;
4704 }
4705
4706 err = 0;
4707
4708 l2cap_chan_lock(chan);
4709
4710 switch (result) {
4711 case L2CAP_CR_LE_SUCCESS:
4712 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4713 err = -EBADSLT;
4714 break;
4715 }
4716
4717 chan->ident = 0;
4718 chan->dcid = dcid;
4719 chan->omtu = mtu;
4720 chan->remote_mps = mps;
4721 chan->tx_credits = credits;
4722 l2cap_chan_ready(chan);
4723 break;
4724
4725 case L2CAP_CR_LE_AUTHENTICATION:
4726 case L2CAP_CR_LE_ENCRYPTION:
4727 /* If we already have MITM protection we can't do
4728 * anything.
4729 */
4730 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
4731 l2cap_chan_del(chan, ECONNREFUSED);
4732 break;
4733 }
4734
4735 sec_level = hcon->sec_level + 1;
4736 if (chan->sec_level < sec_level)
4737 chan->sec_level = sec_level;
4738
4739 /* We'll need to send a new Connect Request */
4740 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
4741
4742 smp_conn_security(hcon, chan->sec_level);
4743 break;
4744
4745 default:
4746 l2cap_chan_del(chan, ECONNREFUSED);
4747 break;
4748 }
4749
4750 l2cap_chan_unlock(chan);
4751
4752 unlock:
4753 mutex_unlock(&conn->chan_lock);
4754
4755 return err;
4756 }
4757
l2cap_bredr_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4758 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4759 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4760 u8 *data)
4761 {
4762 int err = 0;
4763
4764 switch (cmd->code) {
4765 case L2CAP_COMMAND_REJ:
4766 l2cap_command_rej(conn, cmd, cmd_len, data);
4767 break;
4768
4769 case L2CAP_CONN_REQ:
4770 err = l2cap_connect_req(conn, cmd, cmd_len, data);
4771 break;
4772
4773 case L2CAP_CONN_RSP:
4774 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
4775 break;
4776
4777 case L2CAP_CONF_REQ:
4778 err = l2cap_config_req(conn, cmd, cmd_len, data);
4779 break;
4780
4781 case L2CAP_CONF_RSP:
4782 l2cap_config_rsp(conn, cmd, cmd_len, data);
4783 break;
4784
4785 case L2CAP_DISCONN_REQ:
4786 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
4787 break;
4788
4789 case L2CAP_DISCONN_RSP:
4790 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
4791 break;
4792
4793 case L2CAP_ECHO_REQ:
4794 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4795 break;
4796
4797 case L2CAP_ECHO_RSP:
4798 break;
4799
4800 case L2CAP_INFO_REQ:
4801 err = l2cap_information_req(conn, cmd, cmd_len, data);
4802 break;
4803
4804 case L2CAP_INFO_RSP:
4805 l2cap_information_rsp(conn, cmd, cmd_len, data);
4806 break;
4807
4808 default:
4809 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4810 err = -EINVAL;
4811 break;
4812 }
4813
4814 return err;
4815 }
4816
l2cap_le_connect_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4817 static int l2cap_le_connect_req(struct l2cap_conn *conn,
4818 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4819 u8 *data)
4820 {
4821 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
4822 struct l2cap_le_conn_rsp rsp;
4823 struct l2cap_chan *chan, *pchan;
4824 u16 dcid, scid, credits, mtu, mps;
4825 __le16 psm;
4826 u8 result;
4827
4828 if (cmd_len != sizeof(*req))
4829 return -EPROTO;
4830
4831 scid = __le16_to_cpu(req->scid);
4832 mtu = __le16_to_cpu(req->mtu);
4833 mps = __le16_to_cpu(req->mps);
4834 psm = req->psm;
4835 dcid = 0;
4836 credits = 0;
4837
4838 if (mtu < 23 || mps < 23)
4839 return -EPROTO;
4840
4841 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
4842 scid, mtu, mps);
4843
4844 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
4845 * page 1059:
4846 *
4847 * Valid range: 0x0001-0x00ff
4848 *
4849 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
4850 */
4851 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
4852 result = L2CAP_CR_LE_BAD_PSM;
4853 chan = NULL;
4854 goto response;
4855 }
4856
4857 /* Check if we have socket listening on psm */
4858 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4859 &conn->hcon->dst, LE_LINK);
4860 if (!pchan) {
4861 result = L2CAP_CR_LE_BAD_PSM;
4862 chan = NULL;
4863 goto response;
4864 }
4865
4866 mutex_lock(&conn->chan_lock);
4867 l2cap_chan_lock(pchan);
4868
4869 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
4870 SMP_ALLOW_STK)) {
4871 result = L2CAP_CR_LE_AUTHENTICATION;
4872 chan = NULL;
4873 goto response_unlock;
4874 }
4875
4876 /* Check for valid dynamic CID range */
4877 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
4878 result = L2CAP_CR_LE_INVALID_SCID;
4879 chan = NULL;
4880 goto response_unlock;
4881 }
4882
4883 /* Check if we already have channel with that dcid */
4884 if (__l2cap_get_chan_by_dcid(conn, scid)) {
4885 result = L2CAP_CR_LE_SCID_IN_USE;
4886 chan = NULL;
4887 goto response_unlock;
4888 }
4889
4890 chan = pchan->ops->new_connection(pchan);
4891 if (!chan) {
4892 result = L2CAP_CR_LE_NO_MEM;
4893 goto response_unlock;
4894 }
4895
4896 bacpy(&chan->src, &conn->hcon->src);
4897 bacpy(&chan->dst, &conn->hcon->dst);
4898 chan->src_type = bdaddr_src_type(conn->hcon);
4899 chan->dst_type = bdaddr_dst_type(conn->hcon);
4900 chan->psm = psm;
4901 chan->dcid = scid;
4902 chan->omtu = mtu;
4903 chan->remote_mps = mps;
4904
4905 __l2cap_chan_add(conn, chan);
4906
4907 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
4908
4909 dcid = chan->scid;
4910 credits = chan->rx_credits;
4911
4912 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4913
4914 chan->ident = cmd->ident;
4915
4916 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4917 l2cap_state_change(chan, BT_CONNECT2);
4918 /* The following result value is actually not defined
4919 * for LE CoC but we use it to let the function know
4920 * that it should bail out after doing its cleanup
4921 * instead of sending a response.
4922 */
4923 result = L2CAP_CR_PEND;
4924 chan->ops->defer(chan);
4925 } else {
4926 l2cap_chan_ready(chan);
4927 result = L2CAP_CR_LE_SUCCESS;
4928 }
4929
4930 response_unlock:
4931 l2cap_chan_unlock(pchan);
4932 mutex_unlock(&conn->chan_lock);
4933 l2cap_chan_put(pchan);
4934
4935 if (result == L2CAP_CR_PEND)
4936 return 0;
4937
4938 response:
4939 if (chan) {
4940 rsp.mtu = cpu_to_le16(chan->imtu);
4941 rsp.mps = cpu_to_le16(chan->mps);
4942 } else {
4943 rsp.mtu = 0;
4944 rsp.mps = 0;
4945 }
4946
4947 rsp.dcid = cpu_to_le16(dcid);
4948 rsp.credits = cpu_to_le16(credits);
4949 rsp.result = cpu_to_le16(result);
4950
4951 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
4952
4953 return 0;
4954 }
4955
l2cap_le_credits(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)4956 static inline int l2cap_le_credits(struct l2cap_conn *conn,
4957 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4958 u8 *data)
4959 {
4960 struct l2cap_le_credits *pkt;
4961 struct l2cap_chan *chan;
4962 u16 cid, credits, max_credits;
4963
4964 if (cmd_len != sizeof(*pkt))
4965 return -EPROTO;
4966
4967 pkt = (struct l2cap_le_credits *) data;
4968 cid = __le16_to_cpu(pkt->cid);
4969 credits = __le16_to_cpu(pkt->credits);
4970
4971 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
4972
4973 chan = l2cap_get_chan_by_dcid(conn, cid);
4974 if (!chan)
4975 return -EBADSLT;
4976
4977 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
4978 if (credits > max_credits) {
4979 BT_ERR("LE credits overflow");
4980 l2cap_send_disconn_req(chan, ECONNRESET);
4981
4982 /* Return 0 so that we don't trigger an unnecessary
4983 * command reject packet.
4984 */
4985 goto unlock;
4986 }
4987
4988 chan->tx_credits += credits;
4989
4990 /* Resume sending */
4991 l2cap_le_flowctl_send(chan);
4992
4993 if (chan->tx_credits)
4994 chan->ops->resume(chan);
4995
4996 unlock:
4997 l2cap_chan_unlock(chan);
4998 l2cap_chan_put(chan);
4999
5000 return 0;
5001 }
5002
l2cap_ecred_conn_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5003 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
5004 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5005 u8 *data)
5006 {
5007 struct l2cap_ecred_conn_req *req = (void *) data;
5008 struct {
5009 struct l2cap_ecred_conn_rsp rsp;
5010 __le16 dcid[L2CAP_ECRED_MAX_CID];
5011 } __packed pdu;
5012 struct l2cap_chan *chan, *pchan;
5013 u16 mtu, mps;
5014 __le16 psm;
5015 u8 result, len = 0;
5016 int i, num_scid;
5017 bool defer = false;
5018
5019 if (!enable_ecred)
5020 return -EINVAL;
5021
5022 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5023 result = L2CAP_CR_LE_INVALID_PARAMS;
5024 goto response;
5025 }
5026
5027 cmd_len -= sizeof(*req);
5028 num_scid = cmd_len / sizeof(u16);
5029
5030 if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5031 result = L2CAP_CR_LE_INVALID_PARAMS;
5032 goto response;
5033 }
5034
5035 mtu = __le16_to_cpu(req->mtu);
5036 mps = __le16_to_cpu(req->mps);
5037
5038 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5039 result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5040 goto response;
5041 }
5042
5043 psm = req->psm;
5044
5045 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
5046 * page 1059:
5047 *
5048 * Valid range: 0x0001-0x00ff
5049 *
5050 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
5051 */
5052 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
5053 result = L2CAP_CR_LE_BAD_PSM;
5054 goto response;
5055 }
5056
5057 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5058
5059 memset(&pdu, 0, sizeof(pdu));
5060
5061 /* Check if we have socket listening on psm */
5062 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5063 &conn->hcon->dst, LE_LINK);
5064 if (!pchan) {
5065 result = L2CAP_CR_LE_BAD_PSM;
5066 goto response;
5067 }
5068
5069 mutex_lock(&conn->chan_lock);
5070 l2cap_chan_lock(pchan);
5071
5072 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5073 SMP_ALLOW_STK)) {
5074 result = L2CAP_CR_LE_AUTHENTICATION;
5075 goto unlock;
5076 }
5077
5078 result = L2CAP_CR_LE_SUCCESS;
5079
5080 for (i = 0; i < num_scid; i++) {
5081 u16 scid = __le16_to_cpu(req->scid[i]);
5082
5083 BT_DBG("scid[%d] 0x%4.4x", i, scid);
5084
5085 pdu.dcid[i] = 0x0000;
5086 len += sizeof(*pdu.dcid);
5087
5088 /* Check for valid dynamic CID range */
5089 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5090 result = L2CAP_CR_LE_INVALID_SCID;
5091 continue;
5092 }
5093
5094 /* Check if we already have channel with that dcid */
5095 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5096 result = L2CAP_CR_LE_SCID_IN_USE;
5097 continue;
5098 }
5099
5100 chan = pchan->ops->new_connection(pchan);
5101 if (!chan) {
5102 result = L2CAP_CR_LE_NO_MEM;
5103 continue;
5104 }
5105
5106 bacpy(&chan->src, &conn->hcon->src);
5107 bacpy(&chan->dst, &conn->hcon->dst);
5108 chan->src_type = bdaddr_src_type(conn->hcon);
5109 chan->dst_type = bdaddr_dst_type(conn->hcon);
5110 chan->psm = psm;
5111 chan->dcid = scid;
5112 chan->omtu = mtu;
5113 chan->remote_mps = mps;
5114
5115 __l2cap_chan_add(conn, chan);
5116
5117 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
5118
5119 /* Init response */
5120 if (!pdu.rsp.credits) {
5121 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
5122 pdu.rsp.mps = cpu_to_le16(chan->mps);
5123 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
5124 }
5125
5126 pdu.dcid[i] = cpu_to_le16(chan->scid);
5127
5128 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5129
5130 chan->ident = cmd->ident;
5131 chan->mode = L2CAP_MODE_EXT_FLOWCTL;
5132
5133 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5134 l2cap_state_change(chan, BT_CONNECT2);
5135 defer = true;
5136 chan->ops->defer(chan);
5137 } else {
5138 l2cap_chan_ready(chan);
5139 }
5140 }
5141
5142 unlock:
5143 l2cap_chan_unlock(pchan);
5144 mutex_unlock(&conn->chan_lock);
5145 l2cap_chan_put(pchan);
5146
5147 response:
5148 pdu.rsp.result = cpu_to_le16(result);
5149
5150 if (defer)
5151 return 0;
5152
5153 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
5154 sizeof(pdu.rsp) + len, &pdu);
5155
5156 return 0;
5157 }
5158
l2cap_ecred_conn_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5159 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
5160 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5161 u8 *data)
5162 {
5163 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5164 struct hci_conn *hcon = conn->hcon;
5165 u16 mtu, mps, credits, result;
5166 struct l2cap_chan *chan, *tmp;
5167 int err = 0, sec_level;
5168 int i = 0;
5169
5170 if (cmd_len < sizeof(*rsp))
5171 return -EPROTO;
5172
5173 mtu = __le16_to_cpu(rsp->mtu);
5174 mps = __le16_to_cpu(rsp->mps);
5175 credits = __le16_to_cpu(rsp->credits);
5176 result = __le16_to_cpu(rsp->result);
5177
5178 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5179 result);
5180
5181 mutex_lock(&conn->chan_lock);
5182
5183 cmd_len -= sizeof(*rsp);
5184
5185 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5186 u16 dcid;
5187
5188 if (chan->ident != cmd->ident ||
5189 chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
5190 chan->state == BT_CONNECTED)
5191 continue;
5192
5193 l2cap_chan_lock(chan);
5194
5195 /* Check that there is a dcid for each pending channel */
5196 if (cmd_len < sizeof(dcid)) {
5197 l2cap_chan_del(chan, ECONNREFUSED);
5198 l2cap_chan_unlock(chan);
5199 continue;
5200 }
5201
5202 dcid = __le16_to_cpu(rsp->dcid[i++]);
5203 cmd_len -= sizeof(u16);
5204
5205 BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
5206
5207 /* Check if dcid is already in use */
5208 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
5209 /* If a device receives a
5210 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
5211 * already-assigned Destination CID, then both the
5212 * original channel and the new channel shall be
5213 * immediately discarded and not used.
5214 */
5215 l2cap_chan_del(chan, ECONNREFUSED);
5216 l2cap_chan_unlock(chan);
5217 chan = __l2cap_get_chan_by_dcid(conn, dcid);
5218 l2cap_chan_lock(chan);
5219 l2cap_chan_del(chan, ECONNRESET);
5220 l2cap_chan_unlock(chan);
5221 continue;
5222 }
5223
5224 switch (result) {
5225 case L2CAP_CR_LE_AUTHENTICATION:
5226 case L2CAP_CR_LE_ENCRYPTION:
5227 /* If we already have MITM protection we can't do
5228 * anything.
5229 */
5230 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5231 l2cap_chan_del(chan, ECONNREFUSED);
5232 break;
5233 }
5234
5235 sec_level = hcon->sec_level + 1;
5236 if (chan->sec_level < sec_level)
5237 chan->sec_level = sec_level;
5238
5239 /* We'll need to send a new Connect Request */
5240 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
5241
5242 smp_conn_security(hcon, chan->sec_level);
5243 break;
5244
5245 case L2CAP_CR_LE_BAD_PSM:
5246 l2cap_chan_del(chan, ECONNREFUSED);
5247 break;
5248
5249 default:
5250 /* If dcid was not set it means channels was refused */
5251 if (!dcid) {
5252 l2cap_chan_del(chan, ECONNREFUSED);
5253 break;
5254 }
5255
5256 chan->ident = 0;
5257 chan->dcid = dcid;
5258 chan->omtu = mtu;
5259 chan->remote_mps = mps;
5260 chan->tx_credits = credits;
5261 l2cap_chan_ready(chan);
5262 break;
5263 }
5264
5265 l2cap_chan_unlock(chan);
5266 }
5267
5268 mutex_unlock(&conn->chan_lock);
5269
5270 return err;
5271 }
5272
l2cap_ecred_reconf_req(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5273 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
5274 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5275 u8 *data)
5276 {
5277 struct l2cap_ecred_reconf_req *req = (void *) data;
5278 struct l2cap_ecred_reconf_rsp rsp;
5279 u16 mtu, mps, result;
5280 struct l2cap_chan *chan;
5281 int i, num_scid;
5282
5283 if (!enable_ecred)
5284 return -EINVAL;
5285
5286 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
5287 result = L2CAP_CR_LE_INVALID_PARAMS;
5288 goto respond;
5289 }
5290
5291 mtu = __le16_to_cpu(req->mtu);
5292 mps = __le16_to_cpu(req->mps);
5293
5294 BT_DBG("mtu %u mps %u", mtu, mps);
5295
5296 if (mtu < L2CAP_ECRED_MIN_MTU) {
5297 result = L2CAP_RECONF_INVALID_MTU;
5298 goto respond;
5299 }
5300
5301 if (mps < L2CAP_ECRED_MIN_MPS) {
5302 result = L2CAP_RECONF_INVALID_MPS;
5303 goto respond;
5304 }
5305
5306 cmd_len -= sizeof(*req);
5307 num_scid = cmd_len / sizeof(u16);
5308 result = L2CAP_RECONF_SUCCESS;
5309
5310 for (i = 0; i < num_scid; i++) {
5311 u16 scid;
5312
5313 scid = __le16_to_cpu(req->scid[i]);
5314 if (!scid)
5315 return -EPROTO;
5316
5317 chan = __l2cap_get_chan_by_dcid(conn, scid);
5318 if (!chan)
5319 continue;
5320
5321 /* If the MTU value is decreased for any of the included
5322 * channels, then the receiver shall disconnect all
5323 * included channels.
5324 */
5325 if (chan->omtu > mtu) {
5326 BT_ERR("chan %p decreased MTU %u -> %u", chan,
5327 chan->omtu, mtu);
5328 result = L2CAP_RECONF_INVALID_MTU;
5329 }
5330
5331 chan->omtu = mtu;
5332 chan->remote_mps = mps;
5333 }
5334
5335 respond:
5336 rsp.result = cpu_to_le16(result);
5337
5338 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
5339 &rsp);
5340
5341 return 0;
5342 }
5343
l2cap_ecred_reconf_rsp(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5344 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
5345 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5346 u8 *data)
5347 {
5348 struct l2cap_chan *chan, *tmp;
5349 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5350 u16 result;
5351
5352 if (cmd_len < sizeof(*rsp))
5353 return -EPROTO;
5354
5355 result = __le16_to_cpu(rsp->result);
5356
5357 BT_DBG("result 0x%4.4x", rsp->result);
5358
5359 if (!result)
5360 return 0;
5361
5362 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5363 if (chan->ident != cmd->ident)
5364 continue;
5365
5366 l2cap_chan_del(chan, ECONNRESET);
5367 }
5368
5369 return 0;
5370 }
5371
l2cap_le_command_rej(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5372 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5373 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5374 u8 *data)
5375 {
5376 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5377 struct l2cap_chan *chan;
5378
5379 if (cmd_len < sizeof(*rej))
5380 return -EPROTO;
5381
5382 mutex_lock(&conn->chan_lock);
5383
5384 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5385 if (!chan)
5386 goto done;
5387
5388 chan = l2cap_chan_hold_unless_zero(chan);
5389 if (!chan)
5390 goto done;
5391
5392 l2cap_chan_lock(chan);
5393 l2cap_chan_del(chan, ECONNREFUSED);
5394 l2cap_chan_unlock(chan);
5395 l2cap_chan_put(chan);
5396
5397 done:
5398 mutex_unlock(&conn->chan_lock);
5399 return 0;
5400 }
5401
l2cap_le_sig_cmd(struct l2cap_conn * conn,struct l2cap_cmd_hdr * cmd,u16 cmd_len,u8 * data)5402 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5403 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5404 u8 *data)
5405 {
5406 int err = 0;
5407
5408 switch (cmd->code) {
5409 case L2CAP_COMMAND_REJ:
5410 l2cap_le_command_rej(conn, cmd, cmd_len, data);
5411 break;
5412
5413 case L2CAP_CONN_PARAM_UPDATE_REQ:
5414 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5415 break;
5416
5417 case L2CAP_CONN_PARAM_UPDATE_RSP:
5418 break;
5419
5420 case L2CAP_LE_CONN_RSP:
5421 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5422 break;
5423
5424 case L2CAP_LE_CONN_REQ:
5425 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5426 break;
5427
5428 case L2CAP_LE_CREDITS:
5429 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5430 break;
5431
5432 case L2CAP_ECRED_CONN_REQ:
5433 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
5434 break;
5435
5436 case L2CAP_ECRED_CONN_RSP:
5437 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
5438 break;
5439
5440 case L2CAP_ECRED_RECONF_REQ:
5441 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
5442 break;
5443
5444 case L2CAP_ECRED_RECONF_RSP:
5445 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
5446 break;
5447
5448 case L2CAP_DISCONN_REQ:
5449 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5450 break;
5451
5452 case L2CAP_DISCONN_RSP:
5453 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5454 break;
5455
5456 default:
5457 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5458 err = -EINVAL;
5459 break;
5460 }
5461
5462 return err;
5463 }
5464
l2cap_le_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5465 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5466 struct sk_buff *skb)
5467 {
5468 struct hci_conn *hcon = conn->hcon;
5469 struct l2cap_cmd_hdr *cmd;
5470 u16 len;
5471 int err;
5472
5473 if (hcon->type != LE_LINK)
5474 goto drop;
5475
5476 if (skb->len < L2CAP_CMD_HDR_SIZE)
5477 goto drop;
5478
5479 cmd = (void *) skb->data;
5480 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5481
5482 len = le16_to_cpu(cmd->len);
5483
5484 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5485
5486 if (len != skb->len || !cmd->ident) {
5487 BT_DBG("corrupted command");
5488 goto drop;
5489 }
5490
5491 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5492 if (err) {
5493 struct l2cap_cmd_rej_unk rej;
5494
5495 BT_ERR("Wrong link type (%d)", err);
5496
5497 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5498 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5499 sizeof(rej), &rej);
5500 }
5501
5502 drop:
5503 kfree_skb(skb);
5504 }
5505
l2cap_sig_send_rej(struct l2cap_conn * conn,u16 ident)5506 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
5507 {
5508 struct l2cap_cmd_rej_unk rej;
5509
5510 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5511 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5512 }
5513
l2cap_sig_channel(struct l2cap_conn * conn,struct sk_buff * skb)5514 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5515 struct sk_buff *skb)
5516 {
5517 struct hci_conn *hcon = conn->hcon;
5518 struct l2cap_cmd_hdr *cmd;
5519 int err;
5520
5521 l2cap_raw_recv(conn, skb);
5522
5523 if (hcon->type != ACL_LINK)
5524 goto drop;
5525
5526 while (skb->len >= L2CAP_CMD_HDR_SIZE) {
5527 u16 len;
5528
5529 cmd = (void *) skb->data;
5530 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5531
5532 len = le16_to_cpu(cmd->len);
5533
5534 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
5535 cmd->ident);
5536
5537 if (len > skb->len || !cmd->ident) {
5538 BT_DBG("corrupted command");
5539 l2cap_sig_send_rej(conn, cmd->ident);
5540 skb_pull(skb, len > skb->len ? skb->len : len);
5541 continue;
5542 }
5543
5544 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
5545 if (err) {
5546 BT_ERR("Wrong link type (%d)", err);
5547 l2cap_sig_send_rej(conn, cmd->ident);
5548 }
5549
5550 skb_pull(skb, len);
5551 }
5552
5553 if (skb->len > 0) {
5554 BT_DBG("corrupted command");
5555 l2cap_sig_send_rej(conn, 0);
5556 }
5557
5558 drop:
5559 kfree_skb(skb);
5560 }
5561
l2cap_check_fcs(struct l2cap_chan * chan,struct sk_buff * skb)5562 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
5563 {
5564 u16 our_fcs, rcv_fcs;
5565 int hdr_size;
5566
5567 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5568 hdr_size = L2CAP_EXT_HDR_SIZE;
5569 else
5570 hdr_size = L2CAP_ENH_HDR_SIZE;
5571
5572 if (chan->fcs == L2CAP_FCS_CRC16) {
5573 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5574 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5575 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5576
5577 if (our_fcs != rcv_fcs)
5578 return -EBADMSG;
5579 }
5580 return 0;
5581 }
5582
l2cap_send_i_or_rr_or_rnr(struct l2cap_chan * chan)5583 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5584 {
5585 struct l2cap_ctrl control;
5586
5587 BT_DBG("chan %p", chan);
5588
5589 memset(&control, 0, sizeof(control));
5590 control.sframe = 1;
5591 control.final = 1;
5592 control.reqseq = chan->buffer_seq;
5593 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5594
5595 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5596 control.super = L2CAP_SUPER_RNR;
5597 l2cap_send_sframe(chan, &control);
5598 }
5599
5600 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5601 chan->unacked_frames > 0)
5602 __set_retrans_timer(chan);
5603
5604 /* Send pending iframes */
5605 l2cap_ertm_send(chan);
5606
5607 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5608 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5609 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5610 * send it now.
5611 */
5612 control.super = L2CAP_SUPER_RR;
5613 l2cap_send_sframe(chan, &control);
5614 }
5615 }
5616
append_skb_frag(struct sk_buff * skb,struct sk_buff * new_frag,struct sk_buff ** last_frag)5617 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5618 struct sk_buff **last_frag)
5619 {
5620 /* skb->len reflects data in skb as well as all fragments
5621 * skb->data_len reflects only data in fragments
5622 */
5623 if (!skb_has_frag_list(skb))
5624 skb_shinfo(skb)->frag_list = new_frag;
5625
5626 new_frag->next = NULL;
5627
5628 (*last_frag)->next = new_frag;
5629 *last_frag = new_frag;
5630
5631 skb->len += new_frag->len;
5632 skb->data_len += new_frag->len;
5633 skb->truesize += new_frag->truesize;
5634 }
5635
l2cap_reassemble_sdu(struct l2cap_chan * chan,struct sk_buff * skb,struct l2cap_ctrl * control)5636 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5637 struct l2cap_ctrl *control)
5638 {
5639 int err = -EINVAL;
5640
5641 switch (control->sar) {
5642 case L2CAP_SAR_UNSEGMENTED:
5643 if (chan->sdu)
5644 break;
5645
5646 err = chan->ops->recv(chan, skb);
5647 break;
5648
5649 case L2CAP_SAR_START:
5650 if (chan->sdu)
5651 break;
5652
5653 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5654 break;
5655
5656 chan->sdu_len = get_unaligned_le16(skb->data);
5657 skb_pull(skb, L2CAP_SDULEN_SIZE);
5658
5659 if (chan->sdu_len > chan->imtu) {
5660 err = -EMSGSIZE;
5661 break;
5662 }
5663
5664 if (skb->len >= chan->sdu_len)
5665 break;
5666
5667 chan->sdu = skb;
5668 chan->sdu_last_frag = skb;
5669
5670 skb = NULL;
5671 err = 0;
5672 break;
5673
5674 case L2CAP_SAR_CONTINUE:
5675 if (!chan->sdu)
5676 break;
5677
5678 append_skb_frag(chan->sdu, skb,
5679 &chan->sdu_last_frag);
5680 skb = NULL;
5681
5682 if (chan->sdu->len >= chan->sdu_len)
5683 break;
5684
5685 err = 0;
5686 break;
5687
5688 case L2CAP_SAR_END:
5689 if (!chan->sdu)
5690 break;
5691
5692 append_skb_frag(chan->sdu, skb,
5693 &chan->sdu_last_frag);
5694 skb = NULL;
5695
5696 if (chan->sdu->len != chan->sdu_len)
5697 break;
5698
5699 err = chan->ops->recv(chan, chan->sdu);
5700
5701 if (!err) {
5702 /* Reassembly complete */
5703 chan->sdu = NULL;
5704 chan->sdu_last_frag = NULL;
5705 chan->sdu_len = 0;
5706 }
5707 break;
5708 }
5709
5710 if (err) {
5711 kfree_skb(skb);
5712 kfree_skb(chan->sdu);
5713 chan->sdu = NULL;
5714 chan->sdu_last_frag = NULL;
5715 chan->sdu_len = 0;
5716 }
5717
5718 return err;
5719 }
5720
l2cap_resegment(struct l2cap_chan * chan)5721 static int l2cap_resegment(struct l2cap_chan *chan)
5722 {
5723 /* Placeholder */
5724 return 0;
5725 }
5726
l2cap_chan_busy(struct l2cap_chan * chan,int busy)5727 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5728 {
5729 u8 event;
5730
5731 if (chan->mode != L2CAP_MODE_ERTM)
5732 return;
5733
5734 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5735 l2cap_tx(chan, NULL, NULL, event);
5736 }
5737
l2cap_rx_queued_iframes(struct l2cap_chan * chan)5738 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5739 {
5740 int err = 0;
5741 /* Pass sequential frames to l2cap_reassemble_sdu()
5742 * until a gap is encountered.
5743 */
5744
5745 BT_DBG("chan %p", chan);
5746
5747 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5748 struct sk_buff *skb;
5749 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5750 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5751
5752 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5753
5754 if (!skb)
5755 break;
5756
5757 skb_unlink(skb, &chan->srej_q);
5758 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5759 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
5760 if (err)
5761 break;
5762 }
5763
5764 if (skb_queue_empty(&chan->srej_q)) {
5765 chan->rx_state = L2CAP_RX_STATE_RECV;
5766 l2cap_send_ack(chan);
5767 }
5768
5769 return err;
5770 }
5771
l2cap_handle_srej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5772 static void l2cap_handle_srej(struct l2cap_chan *chan,
5773 struct l2cap_ctrl *control)
5774 {
5775 struct sk_buff *skb;
5776
5777 BT_DBG("chan %p, control %p", chan, control);
5778
5779 if (control->reqseq == chan->next_tx_seq) {
5780 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5781 l2cap_send_disconn_req(chan, ECONNRESET);
5782 return;
5783 }
5784
5785 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5786
5787 if (skb == NULL) {
5788 BT_DBG("Seq %d not available for retransmission",
5789 control->reqseq);
5790 return;
5791 }
5792
5793 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5794 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5795 l2cap_send_disconn_req(chan, ECONNRESET);
5796 return;
5797 }
5798
5799 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5800
5801 if (control->poll) {
5802 l2cap_pass_to_tx(chan, control);
5803
5804 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5805 l2cap_retransmit(chan, control);
5806 l2cap_ertm_send(chan);
5807
5808 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5809 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5810 chan->srej_save_reqseq = control->reqseq;
5811 }
5812 } else {
5813 l2cap_pass_to_tx_fbit(chan, control);
5814
5815 if (control->final) {
5816 if (chan->srej_save_reqseq != control->reqseq ||
5817 !test_and_clear_bit(CONN_SREJ_ACT,
5818 &chan->conn_state))
5819 l2cap_retransmit(chan, control);
5820 } else {
5821 l2cap_retransmit(chan, control);
5822 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5823 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5824 chan->srej_save_reqseq = control->reqseq;
5825 }
5826 }
5827 }
5828 }
5829
l2cap_handle_rej(struct l2cap_chan * chan,struct l2cap_ctrl * control)5830 static void l2cap_handle_rej(struct l2cap_chan *chan,
5831 struct l2cap_ctrl *control)
5832 {
5833 struct sk_buff *skb;
5834
5835 BT_DBG("chan %p, control %p", chan, control);
5836
5837 if (control->reqseq == chan->next_tx_seq) {
5838 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5839 l2cap_send_disconn_req(chan, ECONNRESET);
5840 return;
5841 }
5842
5843 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5844
5845 if (chan->max_tx && skb &&
5846 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5847 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5848 l2cap_send_disconn_req(chan, ECONNRESET);
5849 return;
5850 }
5851
5852 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5853
5854 l2cap_pass_to_tx(chan, control);
5855
5856 if (control->final) {
5857 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5858 l2cap_retransmit_all(chan, control);
5859 } else {
5860 l2cap_retransmit_all(chan, control);
5861 l2cap_ertm_send(chan);
5862 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5863 set_bit(CONN_REJ_ACT, &chan->conn_state);
5864 }
5865 }
5866
l2cap_classify_txseq(struct l2cap_chan * chan,u16 txseq)5867 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5868 {
5869 BT_DBG("chan %p, txseq %d", chan, txseq);
5870
5871 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5872 chan->expected_tx_seq);
5873
5874 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5875 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5876 chan->tx_win) {
5877 /* See notes below regarding "double poll" and
5878 * invalid packets.
5879 */
5880 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5881 BT_DBG("Invalid/Ignore - after SREJ");
5882 return L2CAP_TXSEQ_INVALID_IGNORE;
5883 } else {
5884 BT_DBG("Invalid - in window after SREJ sent");
5885 return L2CAP_TXSEQ_INVALID;
5886 }
5887 }
5888
5889 if (chan->srej_list.head == txseq) {
5890 BT_DBG("Expected SREJ");
5891 return L2CAP_TXSEQ_EXPECTED_SREJ;
5892 }
5893
5894 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5895 BT_DBG("Duplicate SREJ - txseq already stored");
5896 return L2CAP_TXSEQ_DUPLICATE_SREJ;
5897 }
5898
5899 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5900 BT_DBG("Unexpected SREJ - not requested");
5901 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5902 }
5903 }
5904
5905 if (chan->expected_tx_seq == txseq) {
5906 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5907 chan->tx_win) {
5908 BT_DBG("Invalid - txseq outside tx window");
5909 return L2CAP_TXSEQ_INVALID;
5910 } else {
5911 BT_DBG("Expected");
5912 return L2CAP_TXSEQ_EXPECTED;
5913 }
5914 }
5915
5916 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
5917 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
5918 BT_DBG("Duplicate - expected_tx_seq later than txseq");
5919 return L2CAP_TXSEQ_DUPLICATE;
5920 }
5921
5922 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5923 /* A source of invalid packets is a "double poll" condition,
5924 * where delays cause us to send multiple poll packets. If
5925 * the remote stack receives and processes both polls,
5926 * sequence numbers can wrap around in such a way that a
5927 * resent frame has a sequence number that looks like new data
5928 * with a sequence gap. This would trigger an erroneous SREJ
5929 * request.
5930 *
5931 * Fortunately, this is impossible with a tx window that's
5932 * less than half of the maximum sequence number, which allows
5933 * invalid frames to be safely ignored.
5934 *
5935 * With tx window sizes greater than half of the tx window
5936 * maximum, the frame is invalid and cannot be ignored. This
5937 * causes a disconnect.
5938 */
5939
5940 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5941 BT_DBG("Invalid/Ignore - txseq outside tx window");
5942 return L2CAP_TXSEQ_INVALID_IGNORE;
5943 } else {
5944 BT_DBG("Invalid - txseq outside tx window");
5945 return L2CAP_TXSEQ_INVALID;
5946 }
5947 } else {
5948 BT_DBG("Unexpected - txseq indicates missing frames");
5949 return L2CAP_TXSEQ_UNEXPECTED;
5950 }
5951 }
5952
l2cap_rx_state_recv(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)5953 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5954 struct l2cap_ctrl *control,
5955 struct sk_buff *skb, u8 event)
5956 {
5957 struct l2cap_ctrl local_control;
5958 int err = 0;
5959 bool skb_in_use = false;
5960
5961 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5962 event);
5963
5964 switch (event) {
5965 case L2CAP_EV_RECV_IFRAME:
5966 switch (l2cap_classify_txseq(chan, control->txseq)) {
5967 case L2CAP_TXSEQ_EXPECTED:
5968 l2cap_pass_to_tx(chan, control);
5969
5970 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5971 BT_DBG("Busy, discarding expected seq %d",
5972 control->txseq);
5973 break;
5974 }
5975
5976 chan->expected_tx_seq = __next_seq(chan,
5977 control->txseq);
5978
5979 chan->buffer_seq = chan->expected_tx_seq;
5980 skb_in_use = true;
5981
5982 /* l2cap_reassemble_sdu may free skb, hence invalidate
5983 * control, so make a copy in advance to use it after
5984 * l2cap_reassemble_sdu returns and to avoid the race
5985 * condition, for example:
5986 *
5987 * The current thread calls:
5988 * l2cap_reassemble_sdu
5989 * chan->ops->recv == l2cap_sock_recv_cb
5990 * __sock_queue_rcv_skb
5991 * Another thread calls:
5992 * bt_sock_recvmsg
5993 * skb_recv_datagram
5994 * skb_free_datagram
5995 * Then the current thread tries to access control, but
5996 * it was freed by skb_free_datagram.
5997 */
5998 local_control = *control;
5999 err = l2cap_reassemble_sdu(chan, skb, control);
6000 if (err)
6001 break;
6002
6003 if (local_control.final) {
6004 if (!test_and_clear_bit(CONN_REJ_ACT,
6005 &chan->conn_state)) {
6006 local_control.final = 0;
6007 l2cap_retransmit_all(chan, &local_control);
6008 l2cap_ertm_send(chan);
6009 }
6010 }
6011
6012 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6013 l2cap_send_ack(chan);
6014 break;
6015 case L2CAP_TXSEQ_UNEXPECTED:
6016 l2cap_pass_to_tx(chan, control);
6017
6018 /* Can't issue SREJ frames in the local busy state.
6019 * Drop this frame, it will be seen as missing
6020 * when local busy is exited.
6021 */
6022 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6023 BT_DBG("Busy, discarding unexpected seq %d",
6024 control->txseq);
6025 break;
6026 }
6027
6028 /* There was a gap in the sequence, so an SREJ
6029 * must be sent for each missing frame. The
6030 * current frame is stored for later use.
6031 */
6032 skb_queue_tail(&chan->srej_q, skb);
6033 skb_in_use = true;
6034 BT_DBG("Queued %p (queue len %d)", skb,
6035 skb_queue_len(&chan->srej_q));
6036
6037 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6038 l2cap_seq_list_clear(&chan->srej_list);
6039 l2cap_send_srej(chan, control->txseq);
6040
6041 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6042 break;
6043 case L2CAP_TXSEQ_DUPLICATE:
6044 l2cap_pass_to_tx(chan, control);
6045 break;
6046 case L2CAP_TXSEQ_INVALID_IGNORE:
6047 break;
6048 case L2CAP_TXSEQ_INVALID:
6049 default:
6050 l2cap_send_disconn_req(chan, ECONNRESET);
6051 break;
6052 }
6053 break;
6054 case L2CAP_EV_RECV_RR:
6055 l2cap_pass_to_tx(chan, control);
6056 if (control->final) {
6057 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6058
6059 if (!test_and_clear_bit(CONN_REJ_ACT,
6060 &chan->conn_state)) {
6061 control->final = 0;
6062 l2cap_retransmit_all(chan, control);
6063 }
6064
6065 l2cap_ertm_send(chan);
6066 } else if (control->poll) {
6067 l2cap_send_i_or_rr_or_rnr(chan);
6068 } else {
6069 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6070 &chan->conn_state) &&
6071 chan->unacked_frames)
6072 __set_retrans_timer(chan);
6073
6074 l2cap_ertm_send(chan);
6075 }
6076 break;
6077 case L2CAP_EV_RECV_RNR:
6078 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6079 l2cap_pass_to_tx(chan, control);
6080 if (control && control->poll) {
6081 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6082 l2cap_send_rr_or_rnr(chan, 0);
6083 }
6084 __clear_retrans_timer(chan);
6085 l2cap_seq_list_clear(&chan->retrans_list);
6086 break;
6087 case L2CAP_EV_RECV_REJ:
6088 l2cap_handle_rej(chan, control);
6089 break;
6090 case L2CAP_EV_RECV_SREJ:
6091 l2cap_handle_srej(chan, control);
6092 break;
6093 default:
6094 break;
6095 }
6096
6097 if (skb && !skb_in_use) {
6098 BT_DBG("Freeing %p", skb);
6099 kfree_skb(skb);
6100 }
6101
6102 return err;
6103 }
6104
l2cap_rx_state_srej_sent(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6105 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6106 struct l2cap_ctrl *control,
6107 struct sk_buff *skb, u8 event)
6108 {
6109 int err = 0;
6110 u16 txseq = control->txseq;
6111 bool skb_in_use = false;
6112
6113 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6114 event);
6115
6116 switch (event) {
6117 case L2CAP_EV_RECV_IFRAME:
6118 switch (l2cap_classify_txseq(chan, txseq)) {
6119 case L2CAP_TXSEQ_EXPECTED:
6120 /* Keep frame for reassembly later */
6121 l2cap_pass_to_tx(chan, control);
6122 skb_queue_tail(&chan->srej_q, skb);
6123 skb_in_use = true;
6124 BT_DBG("Queued %p (queue len %d)", skb,
6125 skb_queue_len(&chan->srej_q));
6126
6127 chan->expected_tx_seq = __next_seq(chan, txseq);
6128 break;
6129 case L2CAP_TXSEQ_EXPECTED_SREJ:
6130 l2cap_seq_list_pop(&chan->srej_list);
6131
6132 l2cap_pass_to_tx(chan, control);
6133 skb_queue_tail(&chan->srej_q, skb);
6134 skb_in_use = true;
6135 BT_DBG("Queued %p (queue len %d)", skb,
6136 skb_queue_len(&chan->srej_q));
6137
6138 err = l2cap_rx_queued_iframes(chan);
6139 if (err)
6140 break;
6141
6142 break;
6143 case L2CAP_TXSEQ_UNEXPECTED:
6144 /* Got a frame that can't be reassembled yet.
6145 * Save it for later, and send SREJs to cover
6146 * the missing frames.
6147 */
6148 skb_queue_tail(&chan->srej_q, skb);
6149 skb_in_use = true;
6150 BT_DBG("Queued %p (queue len %d)", skb,
6151 skb_queue_len(&chan->srej_q));
6152
6153 l2cap_pass_to_tx(chan, control);
6154 l2cap_send_srej(chan, control->txseq);
6155 break;
6156 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6157 /* This frame was requested with an SREJ, but
6158 * some expected retransmitted frames are
6159 * missing. Request retransmission of missing
6160 * SREJ'd frames.
6161 */
6162 skb_queue_tail(&chan->srej_q, skb);
6163 skb_in_use = true;
6164 BT_DBG("Queued %p (queue len %d)", skb,
6165 skb_queue_len(&chan->srej_q));
6166
6167 l2cap_pass_to_tx(chan, control);
6168 l2cap_send_srej_list(chan, control->txseq);
6169 break;
6170 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6171 /* We've already queued this frame. Drop this copy. */
6172 l2cap_pass_to_tx(chan, control);
6173 break;
6174 case L2CAP_TXSEQ_DUPLICATE:
6175 /* Expecting a later sequence number, so this frame
6176 * was already received. Ignore it completely.
6177 */
6178 break;
6179 case L2CAP_TXSEQ_INVALID_IGNORE:
6180 break;
6181 case L2CAP_TXSEQ_INVALID:
6182 default:
6183 l2cap_send_disconn_req(chan, ECONNRESET);
6184 break;
6185 }
6186 break;
6187 case L2CAP_EV_RECV_RR:
6188 l2cap_pass_to_tx(chan, control);
6189 if (control->final) {
6190 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6191
6192 if (!test_and_clear_bit(CONN_REJ_ACT,
6193 &chan->conn_state)) {
6194 control->final = 0;
6195 l2cap_retransmit_all(chan, control);
6196 }
6197
6198 l2cap_ertm_send(chan);
6199 } else if (control->poll) {
6200 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6201 &chan->conn_state) &&
6202 chan->unacked_frames) {
6203 __set_retrans_timer(chan);
6204 }
6205
6206 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6207 l2cap_send_srej_tail(chan);
6208 } else {
6209 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6210 &chan->conn_state) &&
6211 chan->unacked_frames)
6212 __set_retrans_timer(chan);
6213
6214 l2cap_send_ack(chan);
6215 }
6216 break;
6217 case L2CAP_EV_RECV_RNR:
6218 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6219 l2cap_pass_to_tx(chan, control);
6220 if (control->poll) {
6221 l2cap_send_srej_tail(chan);
6222 } else {
6223 struct l2cap_ctrl rr_control;
6224 memset(&rr_control, 0, sizeof(rr_control));
6225 rr_control.sframe = 1;
6226 rr_control.super = L2CAP_SUPER_RR;
6227 rr_control.reqseq = chan->buffer_seq;
6228 l2cap_send_sframe(chan, &rr_control);
6229 }
6230
6231 break;
6232 case L2CAP_EV_RECV_REJ:
6233 l2cap_handle_rej(chan, control);
6234 break;
6235 case L2CAP_EV_RECV_SREJ:
6236 l2cap_handle_srej(chan, control);
6237 break;
6238 }
6239
6240 if (skb && !skb_in_use) {
6241 BT_DBG("Freeing %p", skb);
6242 kfree_skb(skb);
6243 }
6244
6245 return err;
6246 }
6247
l2cap_finish_move(struct l2cap_chan * chan)6248 static int l2cap_finish_move(struct l2cap_chan *chan)
6249 {
6250 BT_DBG("chan %p", chan);
6251
6252 chan->rx_state = L2CAP_RX_STATE_RECV;
6253 chan->conn->mtu = chan->conn->hcon->mtu;
6254
6255 return l2cap_resegment(chan);
6256 }
6257
l2cap_rx_state_wait_p(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6258 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6259 struct l2cap_ctrl *control,
6260 struct sk_buff *skb, u8 event)
6261 {
6262 int err;
6263
6264 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6265 event);
6266
6267 if (!control->poll)
6268 return -EPROTO;
6269
6270 l2cap_process_reqseq(chan, control->reqseq);
6271
6272 if (!skb_queue_empty(&chan->tx_q))
6273 chan->tx_send_head = skb_peek(&chan->tx_q);
6274 else
6275 chan->tx_send_head = NULL;
6276
6277 /* Rewind next_tx_seq to the point expected
6278 * by the receiver.
6279 */
6280 chan->next_tx_seq = control->reqseq;
6281 chan->unacked_frames = 0;
6282
6283 err = l2cap_finish_move(chan);
6284 if (err)
6285 return err;
6286
6287 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6288 l2cap_send_i_or_rr_or_rnr(chan);
6289
6290 if (event == L2CAP_EV_RECV_IFRAME)
6291 return -EPROTO;
6292
6293 return l2cap_rx_state_recv(chan, control, NULL, event);
6294 }
6295
l2cap_rx_state_wait_f(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6296 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6297 struct l2cap_ctrl *control,
6298 struct sk_buff *skb, u8 event)
6299 {
6300 int err;
6301
6302 if (!control->final)
6303 return -EPROTO;
6304
6305 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6306
6307 chan->rx_state = L2CAP_RX_STATE_RECV;
6308 l2cap_process_reqseq(chan, control->reqseq);
6309
6310 if (!skb_queue_empty(&chan->tx_q))
6311 chan->tx_send_head = skb_peek(&chan->tx_q);
6312 else
6313 chan->tx_send_head = NULL;
6314
6315 /* Rewind next_tx_seq to the point expected
6316 * by the receiver.
6317 */
6318 chan->next_tx_seq = control->reqseq;
6319 chan->unacked_frames = 0;
6320 chan->conn->mtu = chan->conn->hcon->mtu;
6321
6322 err = l2cap_resegment(chan);
6323
6324 if (!err)
6325 err = l2cap_rx_state_recv(chan, control, skb, event);
6326
6327 return err;
6328 }
6329
__valid_reqseq(struct l2cap_chan * chan,u16 reqseq)6330 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6331 {
6332 /* Make sure reqseq is for a packet that has been sent but not acked */
6333 u16 unacked;
6334
6335 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6336 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6337 }
6338
l2cap_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb,u8 event)6339 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6340 struct sk_buff *skb, u8 event)
6341 {
6342 int err = 0;
6343
6344 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6345 control, skb, event, chan->rx_state);
6346
6347 if (__valid_reqseq(chan, control->reqseq)) {
6348 switch (chan->rx_state) {
6349 case L2CAP_RX_STATE_RECV:
6350 err = l2cap_rx_state_recv(chan, control, skb, event);
6351 break;
6352 case L2CAP_RX_STATE_SREJ_SENT:
6353 err = l2cap_rx_state_srej_sent(chan, control, skb,
6354 event);
6355 break;
6356 case L2CAP_RX_STATE_WAIT_P:
6357 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6358 break;
6359 case L2CAP_RX_STATE_WAIT_F:
6360 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6361 break;
6362 default:
6363 /* shut it down */
6364 break;
6365 }
6366 } else {
6367 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6368 control->reqseq, chan->next_tx_seq,
6369 chan->expected_ack_seq);
6370 l2cap_send_disconn_req(chan, ECONNRESET);
6371 }
6372
6373 return err;
6374 }
6375
l2cap_stream_rx(struct l2cap_chan * chan,struct l2cap_ctrl * control,struct sk_buff * skb)6376 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6377 struct sk_buff *skb)
6378 {
6379 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6380 * the txseq field in advance to use it after l2cap_reassemble_sdu
6381 * returns and to avoid the race condition, for example:
6382 *
6383 * The current thread calls:
6384 * l2cap_reassemble_sdu
6385 * chan->ops->recv == l2cap_sock_recv_cb
6386 * __sock_queue_rcv_skb
6387 * Another thread calls:
6388 * bt_sock_recvmsg
6389 * skb_recv_datagram
6390 * skb_free_datagram
6391 * Then the current thread tries to access control, but it was freed by
6392 * skb_free_datagram.
6393 */
6394 u16 txseq = control->txseq;
6395
6396 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6397 chan->rx_state);
6398
6399 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
6400 l2cap_pass_to_tx(chan, control);
6401
6402 BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
6403 __next_seq(chan, chan->buffer_seq));
6404
6405 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6406
6407 l2cap_reassemble_sdu(chan, skb, control);
6408 } else {
6409 if (chan->sdu) {
6410 kfree_skb(chan->sdu);
6411 chan->sdu = NULL;
6412 }
6413 chan->sdu_last_frag = NULL;
6414 chan->sdu_len = 0;
6415
6416 if (skb) {
6417 BT_DBG("Freeing %p", skb);
6418 kfree_skb(skb);
6419 }
6420 }
6421
6422 chan->last_acked_seq = txseq;
6423 chan->expected_tx_seq = __next_seq(chan, txseq);
6424
6425 return 0;
6426 }
6427
l2cap_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6428 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6429 {
6430 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6431 u16 len;
6432 u8 event;
6433
6434 __unpack_control(chan, skb);
6435
6436 len = skb->len;
6437
6438 /*
6439 * We can just drop the corrupted I-frame here.
6440 * Receiver will miss it and start proper recovery
6441 * procedures and ask for retransmission.
6442 */
6443 if (l2cap_check_fcs(chan, skb))
6444 goto drop;
6445
6446 if (!control->sframe && control->sar == L2CAP_SAR_START)
6447 len -= L2CAP_SDULEN_SIZE;
6448
6449 if (chan->fcs == L2CAP_FCS_CRC16)
6450 len -= L2CAP_FCS_SIZE;
6451
6452 if (len > chan->mps) {
6453 l2cap_send_disconn_req(chan, ECONNRESET);
6454 goto drop;
6455 }
6456
6457 if (chan->ops->filter) {
6458 if (chan->ops->filter(chan, skb))
6459 goto drop;
6460 }
6461
6462 if (!control->sframe) {
6463 int err;
6464
6465 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6466 control->sar, control->reqseq, control->final,
6467 control->txseq);
6468
6469 /* Validate F-bit - F=0 always valid, F=1 only
6470 * valid in TX WAIT_F
6471 */
6472 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6473 goto drop;
6474
6475 if (chan->mode != L2CAP_MODE_STREAMING) {
6476 event = L2CAP_EV_RECV_IFRAME;
6477 err = l2cap_rx(chan, control, skb, event);
6478 } else {
6479 err = l2cap_stream_rx(chan, control, skb);
6480 }
6481
6482 if (err)
6483 l2cap_send_disconn_req(chan, ECONNRESET);
6484 } else {
6485 const u8 rx_func_to_event[4] = {
6486 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6487 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6488 };
6489
6490 /* Only I-frames are expected in streaming mode */
6491 if (chan->mode == L2CAP_MODE_STREAMING)
6492 goto drop;
6493
6494 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6495 control->reqseq, control->final, control->poll,
6496 control->super);
6497
6498 if (len != 0) {
6499 BT_ERR("Trailing bytes: %d in sframe", len);
6500 l2cap_send_disconn_req(chan, ECONNRESET);
6501 goto drop;
6502 }
6503
6504 /* Validate F and P bits */
6505 if (control->final && (control->poll ||
6506 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6507 goto drop;
6508
6509 event = rx_func_to_event[control->super];
6510 if (l2cap_rx(chan, control, skb, event))
6511 l2cap_send_disconn_req(chan, ECONNRESET);
6512 }
6513
6514 return 0;
6515
6516 drop:
6517 kfree_skb(skb);
6518 return 0;
6519 }
6520
l2cap_chan_le_send_credits(struct l2cap_chan * chan)6521 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6522 {
6523 struct l2cap_conn *conn = chan->conn;
6524 struct l2cap_le_credits pkt;
6525 u16 return_credits = l2cap_le_rx_credits(chan);
6526
6527 if (chan->rx_credits >= return_credits)
6528 return;
6529
6530 return_credits -= chan->rx_credits;
6531
6532 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6533
6534 chan->rx_credits += return_credits;
6535
6536 pkt.cid = cpu_to_le16(chan->scid);
6537 pkt.credits = cpu_to_le16(return_credits);
6538
6539 chan->ident = l2cap_get_ident(conn);
6540
6541 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6542 }
6543
l2cap_chan_rx_avail(struct l2cap_chan * chan,ssize_t rx_avail)6544 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail)
6545 {
6546 if (chan->rx_avail == rx_avail)
6547 return;
6548
6549 BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail);
6550
6551 chan->rx_avail = rx_avail;
6552
6553 if (chan->state == BT_CONNECTED)
6554 l2cap_chan_le_send_credits(chan);
6555 }
6556
l2cap_ecred_recv(struct l2cap_chan * chan,struct sk_buff * skb)6557 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
6558 {
6559 int err;
6560
6561 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
6562
6563 /* Wait recv to confirm reception before updating the credits */
6564 err = chan->ops->recv(chan, skb);
6565
6566 if (err < 0 && chan->rx_avail != -1) {
6567 BT_ERR("Queueing received LE L2CAP data failed");
6568 l2cap_send_disconn_req(chan, ECONNRESET);
6569 return err;
6570 }
6571
6572 /* Update credits whenever an SDU is received */
6573 l2cap_chan_le_send_credits(chan);
6574
6575 return err;
6576 }
6577
l2cap_ecred_data_rcv(struct l2cap_chan * chan,struct sk_buff * skb)6578 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6579 {
6580 int err;
6581
6582 if (!chan->rx_credits) {
6583 BT_ERR("No credits to receive LE L2CAP data");
6584 l2cap_send_disconn_req(chan, ECONNRESET);
6585 return -ENOBUFS;
6586 }
6587
6588 if (chan->imtu < skb->len) {
6589 BT_ERR("Too big LE L2CAP PDU");
6590 return -ENOBUFS;
6591 }
6592
6593 chan->rx_credits--;
6594 BT_DBG("chan %p: rx_credits %u -> %u",
6595 chan, chan->rx_credits + 1, chan->rx_credits);
6596
6597 /* Update if remote had run out of credits, this should only happens
6598 * if the remote is not using the entire MPS.
6599 */
6600 if (!chan->rx_credits)
6601 l2cap_chan_le_send_credits(chan);
6602
6603 err = 0;
6604
6605 if (!chan->sdu) {
6606 u16 sdu_len;
6607
6608 sdu_len = get_unaligned_le16(skb->data);
6609 skb_pull(skb, L2CAP_SDULEN_SIZE);
6610
6611 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6612 sdu_len, skb->len, chan->imtu);
6613
6614 if (sdu_len > chan->imtu) {
6615 BT_ERR("Too big LE L2CAP SDU length received");
6616 err = -EMSGSIZE;
6617 goto failed;
6618 }
6619
6620 if (skb->len > sdu_len) {
6621 BT_ERR("Too much LE L2CAP data received");
6622 err = -EINVAL;
6623 goto failed;
6624 }
6625
6626 if (skb->len == sdu_len)
6627 return l2cap_ecred_recv(chan, skb);
6628
6629 chan->sdu = skb;
6630 chan->sdu_len = sdu_len;
6631 chan->sdu_last_frag = skb;
6632
6633 /* Detect if remote is not able to use the selected MPS */
6634 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
6635 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
6636
6637 /* Adjust the number of credits */
6638 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
6639 chan->mps = mps_len;
6640 l2cap_chan_le_send_credits(chan);
6641 }
6642
6643 return 0;
6644 }
6645
6646 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6647 chan->sdu->len, skb->len, chan->sdu_len);
6648
6649 if (chan->sdu->len + skb->len > chan->sdu_len) {
6650 BT_ERR("Too much LE L2CAP data received");
6651 err = -EINVAL;
6652 goto failed;
6653 }
6654
6655 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6656 skb = NULL;
6657
6658 if (chan->sdu->len == chan->sdu_len) {
6659 err = l2cap_ecred_recv(chan, chan->sdu);
6660 if (!err) {
6661 chan->sdu = NULL;
6662 chan->sdu_last_frag = NULL;
6663 chan->sdu_len = 0;
6664 }
6665 }
6666
6667 failed:
6668 if (err) {
6669 kfree_skb(skb);
6670 kfree_skb(chan->sdu);
6671 chan->sdu = NULL;
6672 chan->sdu_last_frag = NULL;
6673 chan->sdu_len = 0;
6674 }
6675
6676 /* We can't return an error here since we took care of the skb
6677 * freeing internally. An error return would cause the caller to
6678 * do a double-free of the skb.
6679 */
6680 return 0;
6681 }
6682
l2cap_data_channel(struct l2cap_conn * conn,u16 cid,struct sk_buff * skb)6683 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6684 struct sk_buff *skb)
6685 {
6686 struct l2cap_chan *chan;
6687
6688 chan = l2cap_get_chan_by_scid(conn, cid);
6689 if (!chan) {
6690 BT_DBG("unknown cid 0x%4.4x", cid);
6691 /* Drop packet and return */
6692 kfree_skb(skb);
6693 return;
6694 }
6695
6696 BT_DBG("chan %p, len %d", chan, skb->len);
6697
6698 /* If we receive data on a fixed channel before the info req/rsp
6699 * procedure is done simply assume that the channel is supported
6700 * and mark it as ready.
6701 */
6702 if (chan->chan_type == L2CAP_CHAN_FIXED)
6703 l2cap_chan_ready(chan);
6704
6705 if (chan->state != BT_CONNECTED)
6706 goto drop;
6707
6708 switch (chan->mode) {
6709 case L2CAP_MODE_LE_FLOWCTL:
6710 case L2CAP_MODE_EXT_FLOWCTL:
6711 if (l2cap_ecred_data_rcv(chan, skb) < 0)
6712 goto drop;
6713
6714 goto done;
6715
6716 case L2CAP_MODE_BASIC:
6717 /* If socket recv buffers overflows we drop data here
6718 * which is *bad* because L2CAP has to be reliable.
6719 * But we don't have any other choice. L2CAP doesn't
6720 * provide flow control mechanism. */
6721
6722 if (chan->imtu < skb->len) {
6723 BT_ERR("Dropping L2CAP data: receive buffer overflow");
6724 goto drop;
6725 }
6726
6727 if (!chan->ops->recv(chan, skb))
6728 goto done;
6729 break;
6730
6731 case L2CAP_MODE_ERTM:
6732 case L2CAP_MODE_STREAMING:
6733 l2cap_data_rcv(chan, skb);
6734 goto done;
6735
6736 default:
6737 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6738 break;
6739 }
6740
6741 drop:
6742 kfree_skb(skb);
6743
6744 done:
6745 l2cap_chan_unlock(chan);
6746 l2cap_chan_put(chan);
6747 }
6748
l2cap_conless_channel(struct l2cap_conn * conn,__le16 psm,struct sk_buff * skb)6749 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6750 struct sk_buff *skb)
6751 {
6752 struct hci_conn *hcon = conn->hcon;
6753 struct l2cap_chan *chan;
6754
6755 if (hcon->type != ACL_LINK)
6756 goto free_skb;
6757
6758 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6759 ACL_LINK);
6760 if (!chan)
6761 goto free_skb;
6762
6763 BT_DBG("chan %p, len %d", chan, skb->len);
6764
6765 l2cap_chan_lock(chan);
6766
6767 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6768 goto drop;
6769
6770 if (chan->imtu < skb->len)
6771 goto drop;
6772
6773 /* Store remote BD_ADDR and PSM for msg_name */
6774 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6775 bt_cb(skb)->l2cap.psm = psm;
6776
6777 if (!chan->ops->recv(chan, skb)) {
6778 l2cap_chan_unlock(chan);
6779 l2cap_chan_put(chan);
6780 return;
6781 }
6782
6783 drop:
6784 l2cap_chan_unlock(chan);
6785 l2cap_chan_put(chan);
6786 free_skb:
6787 kfree_skb(skb);
6788 }
6789
l2cap_recv_frame(struct l2cap_conn * conn,struct sk_buff * skb)6790 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6791 {
6792 struct l2cap_hdr *lh = (void *) skb->data;
6793 struct hci_conn *hcon = conn->hcon;
6794 u16 cid, len;
6795 __le16 psm;
6796
6797 if (hcon->state != BT_CONNECTED) {
6798 BT_DBG("queueing pending rx skb");
6799 skb_queue_tail(&conn->pending_rx, skb);
6800 return;
6801 }
6802
6803 skb_pull(skb, L2CAP_HDR_SIZE);
6804 cid = __le16_to_cpu(lh->cid);
6805 len = __le16_to_cpu(lh->len);
6806
6807 if (len != skb->len) {
6808 kfree_skb(skb);
6809 return;
6810 }
6811
6812 /* Since we can't actively block incoming LE connections we must
6813 * at least ensure that we ignore incoming data from them.
6814 */
6815 if (hcon->type == LE_LINK &&
6816 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
6817 bdaddr_dst_type(hcon))) {
6818 kfree_skb(skb);
6819 return;
6820 }
6821
6822 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6823
6824 switch (cid) {
6825 case L2CAP_CID_SIGNALING:
6826 l2cap_sig_channel(conn, skb);
6827 break;
6828
6829 case L2CAP_CID_CONN_LESS:
6830 psm = get_unaligned((__le16 *) skb->data);
6831 skb_pull(skb, L2CAP_PSMLEN_SIZE);
6832 l2cap_conless_channel(conn, psm, skb);
6833 break;
6834
6835 case L2CAP_CID_LE_SIGNALING:
6836 l2cap_le_sig_channel(conn, skb);
6837 break;
6838
6839 default:
6840 l2cap_data_channel(conn, cid, skb);
6841 break;
6842 }
6843 }
6844
process_pending_rx(struct work_struct * work)6845 static void process_pending_rx(struct work_struct *work)
6846 {
6847 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6848 pending_rx_work);
6849 struct sk_buff *skb;
6850
6851 BT_DBG("");
6852
6853 while ((skb = skb_dequeue(&conn->pending_rx)))
6854 l2cap_recv_frame(conn, skb);
6855 }
6856
l2cap_conn_add(struct hci_conn * hcon)6857 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6858 {
6859 struct l2cap_conn *conn = hcon->l2cap_data;
6860 struct hci_chan *hchan;
6861
6862 if (conn)
6863 return conn;
6864
6865 hchan = hci_chan_create(hcon);
6866 if (!hchan)
6867 return NULL;
6868
6869 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
6870 if (!conn) {
6871 hci_chan_del(hchan);
6872 return NULL;
6873 }
6874
6875 kref_init(&conn->ref);
6876 hcon->l2cap_data = conn;
6877 conn->hcon = hci_conn_get(hcon);
6878 conn->hchan = hchan;
6879
6880 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6881
6882 conn->mtu = hcon->mtu;
6883 conn->feat_mask = 0;
6884
6885 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
6886
6887 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
6888 (bredr_sc_enabled(hcon->hdev) ||
6889 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
6890 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
6891
6892 mutex_init(&conn->ident_lock);
6893 mutex_init(&conn->chan_lock);
6894
6895 INIT_LIST_HEAD(&conn->chan_l);
6896 INIT_LIST_HEAD(&conn->users);
6897
6898 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
6899
6900 skb_queue_head_init(&conn->pending_rx);
6901 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
6902 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
6903
6904 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
6905
6906 return conn;
6907 }
6908
is_valid_psm(u16 psm,u8 dst_type)6909 static bool is_valid_psm(u16 psm, u8 dst_type)
6910 {
6911 if (!psm)
6912 return false;
6913
6914 if (bdaddr_type_is_le(dst_type))
6915 return (psm <= 0x00ff);
6916
6917 /* PSM must be odd and lsb of upper byte must be 0 */
6918 return ((psm & 0x0101) == 0x0001);
6919 }
6920
6921 struct l2cap_chan_data {
6922 struct l2cap_chan *chan;
6923 struct pid *pid;
6924 int count;
6925 };
6926
l2cap_chan_by_pid(struct l2cap_chan * chan,void * data)6927 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
6928 {
6929 struct l2cap_chan_data *d = data;
6930 struct pid *pid;
6931
6932 if (chan == d->chan)
6933 return;
6934
6935 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
6936 return;
6937
6938 pid = chan->ops->get_peer_pid(chan);
6939
6940 /* Only count deferred channels with the same PID/PSM */
6941 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
6942 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
6943 return;
6944
6945 d->count++;
6946 }
6947
l2cap_chan_connect(struct l2cap_chan * chan,__le16 psm,u16 cid,bdaddr_t * dst,u8 dst_type)6948 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
6949 bdaddr_t *dst, u8 dst_type)
6950 {
6951 struct l2cap_conn *conn;
6952 struct hci_conn *hcon;
6953 struct hci_dev *hdev;
6954 int err;
6955
6956 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
6957 dst, dst_type, __le16_to_cpu(psm), chan->mode);
6958
6959 hdev = hci_get_route(dst, &chan->src, chan->src_type);
6960 if (!hdev)
6961 return -EHOSTUNREACH;
6962
6963 hci_dev_lock(hdev);
6964
6965 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
6966 chan->chan_type != L2CAP_CHAN_RAW) {
6967 err = -EINVAL;
6968 goto done;
6969 }
6970
6971 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
6972 err = -EINVAL;
6973 goto done;
6974 }
6975
6976 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
6977 err = -EINVAL;
6978 goto done;
6979 }
6980
6981 switch (chan->mode) {
6982 case L2CAP_MODE_BASIC:
6983 break;
6984 case L2CAP_MODE_LE_FLOWCTL:
6985 break;
6986 case L2CAP_MODE_EXT_FLOWCTL:
6987 if (!enable_ecred) {
6988 err = -EOPNOTSUPP;
6989 goto done;
6990 }
6991 break;
6992 case L2CAP_MODE_ERTM:
6993 case L2CAP_MODE_STREAMING:
6994 if (!disable_ertm)
6995 break;
6996 fallthrough;
6997 default:
6998 err = -EOPNOTSUPP;
6999 goto done;
7000 }
7001
7002 switch (chan->state) {
7003 case BT_CONNECT:
7004 case BT_CONNECT2:
7005 case BT_CONFIG:
7006 /* Already connecting */
7007 err = 0;
7008 goto done;
7009
7010 case BT_CONNECTED:
7011 /* Already connected */
7012 err = -EISCONN;
7013 goto done;
7014
7015 case BT_OPEN:
7016 case BT_BOUND:
7017 /* Can connect */
7018 break;
7019
7020 default:
7021 err = -EBADFD;
7022 goto done;
7023 }
7024
7025 /* Set destination address and psm */
7026 bacpy(&chan->dst, dst);
7027 chan->dst_type = dst_type;
7028
7029 chan->psm = psm;
7030 chan->dcid = cid;
7031
7032 if (bdaddr_type_is_le(dst_type)) {
7033 /* Convert from L2CAP channel address type to HCI address type
7034 */
7035 if (dst_type == BDADDR_LE_PUBLIC)
7036 dst_type = ADDR_LE_DEV_PUBLIC;
7037 else
7038 dst_type = ADDR_LE_DEV_RANDOM;
7039
7040 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7041 hcon = hci_connect_le(hdev, dst, dst_type, false,
7042 chan->sec_level,
7043 HCI_LE_CONN_TIMEOUT,
7044 HCI_ROLE_SLAVE);
7045 else
7046 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7047 chan->sec_level,
7048 HCI_LE_CONN_TIMEOUT,
7049 CONN_REASON_L2CAP_CHAN);
7050
7051 } else {
7052 u8 auth_type = l2cap_get_auth_type(chan);
7053 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7054 CONN_REASON_L2CAP_CHAN);
7055 }
7056
7057 if (IS_ERR(hcon)) {
7058 err = PTR_ERR(hcon);
7059 goto done;
7060 }
7061
7062 conn = l2cap_conn_add(hcon);
7063 if (!conn) {
7064 hci_conn_drop(hcon);
7065 err = -ENOMEM;
7066 goto done;
7067 }
7068
7069 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7070 struct l2cap_chan_data data;
7071
7072 data.chan = chan;
7073 data.pid = chan->ops->get_peer_pid(chan);
7074 data.count = 1;
7075
7076 l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7077
7078 /* Check if there isn't too many channels being connected */
7079 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7080 hci_conn_drop(hcon);
7081 err = -EPROTO;
7082 goto done;
7083 }
7084 }
7085
7086 mutex_lock(&conn->chan_lock);
7087 l2cap_chan_lock(chan);
7088
7089 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7090 hci_conn_drop(hcon);
7091 err = -EBUSY;
7092 goto chan_unlock;
7093 }
7094
7095 /* Update source addr of the socket */
7096 bacpy(&chan->src, &hcon->src);
7097 chan->src_type = bdaddr_src_type(hcon);
7098
7099 __l2cap_chan_add(conn, chan);
7100
7101 /* l2cap_chan_add takes its own ref so we can drop this one */
7102 hci_conn_drop(hcon);
7103
7104 l2cap_state_change(chan, BT_CONNECT);
7105 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7106
7107 /* Release chan->sport so that it can be reused by other
7108 * sockets (as it's only used for listening sockets).
7109 */
7110 write_lock(&chan_list_lock);
7111 chan->sport = 0;
7112 write_unlock(&chan_list_lock);
7113
7114 if (hcon->state == BT_CONNECTED) {
7115 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7116 __clear_chan_timer(chan);
7117 if (l2cap_chan_check_security(chan, true))
7118 l2cap_state_change(chan, BT_CONNECTED);
7119 } else
7120 l2cap_do_start(chan);
7121 }
7122
7123 err = 0;
7124
7125 chan_unlock:
7126 l2cap_chan_unlock(chan);
7127 mutex_unlock(&conn->chan_lock);
7128 done:
7129 hci_dev_unlock(hdev);
7130 hci_dev_put(hdev);
7131 return err;
7132 }
7133 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7134
l2cap_ecred_reconfigure(struct l2cap_chan * chan)7135 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
7136 {
7137 struct l2cap_conn *conn = chan->conn;
7138 struct {
7139 struct l2cap_ecred_reconf_req req;
7140 __le16 scid;
7141 } pdu;
7142
7143 pdu.req.mtu = cpu_to_le16(chan->imtu);
7144 pdu.req.mps = cpu_to_le16(chan->mps);
7145 pdu.scid = cpu_to_le16(chan->scid);
7146
7147 chan->ident = l2cap_get_ident(conn);
7148
7149 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
7150 sizeof(pdu), &pdu);
7151 }
7152
l2cap_chan_reconfigure(struct l2cap_chan * chan,__u16 mtu)7153 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
7154 {
7155 if (chan->imtu > mtu)
7156 return -EINVAL;
7157
7158 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
7159
7160 chan->imtu = mtu;
7161
7162 l2cap_ecred_reconfigure(chan);
7163
7164 return 0;
7165 }
7166
7167 /* ---- L2CAP interface with lower layer (HCI) ---- */
7168
l2cap_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr)7169 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7170 {
7171 int exact = 0, lm1 = 0, lm2 = 0;
7172 struct l2cap_chan *c;
7173
7174 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7175
7176 /* Find listening sockets and check their link_mode */
7177 read_lock(&chan_list_lock);
7178 list_for_each_entry(c, &chan_list, global_l) {
7179 if (c->state != BT_LISTEN)
7180 continue;
7181
7182 if (!bacmp(&c->src, &hdev->bdaddr)) {
7183 lm1 |= HCI_LM_ACCEPT;
7184 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7185 lm1 |= HCI_LM_MASTER;
7186 exact++;
7187 } else if (!bacmp(&c->src, BDADDR_ANY)) {
7188 lm2 |= HCI_LM_ACCEPT;
7189 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7190 lm2 |= HCI_LM_MASTER;
7191 }
7192 }
7193 read_unlock(&chan_list_lock);
7194
7195 return exact ? lm1 : lm2;
7196 }
7197
7198 /* Find the next fixed channel in BT_LISTEN state, continue iteration
7199 * from an existing channel in the list or from the beginning of the
7200 * global list (by passing NULL as first parameter).
7201 */
l2cap_global_fixed_chan(struct l2cap_chan * c,struct hci_conn * hcon)7202 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7203 struct hci_conn *hcon)
7204 {
7205 u8 src_type = bdaddr_src_type(hcon);
7206
7207 read_lock(&chan_list_lock);
7208
7209 if (c)
7210 c = list_next_entry(c, global_l);
7211 else
7212 c = list_entry(chan_list.next, typeof(*c), global_l);
7213
7214 list_for_each_entry_from(c, &chan_list, global_l) {
7215 if (c->chan_type != L2CAP_CHAN_FIXED)
7216 continue;
7217 if (c->state != BT_LISTEN)
7218 continue;
7219 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7220 continue;
7221 if (src_type != c->src_type)
7222 continue;
7223
7224 c = l2cap_chan_hold_unless_zero(c);
7225 read_unlock(&chan_list_lock);
7226 return c;
7227 }
7228
7229 read_unlock(&chan_list_lock);
7230
7231 return NULL;
7232 }
7233
l2cap_connect_cfm(struct hci_conn * hcon,u8 status)7234 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7235 {
7236 struct hci_dev *hdev = hcon->hdev;
7237 struct l2cap_conn *conn;
7238 struct l2cap_chan *pchan;
7239 u8 dst_type;
7240
7241 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7242 return;
7243
7244 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7245
7246 if (status) {
7247 l2cap_conn_del(hcon, bt_to_errno(status));
7248 return;
7249 }
7250
7251 conn = l2cap_conn_add(hcon);
7252 if (!conn)
7253 return;
7254
7255 dst_type = bdaddr_dst_type(hcon);
7256
7257 /* If device is blocked, do not create channels for it */
7258 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
7259 return;
7260
7261 /* Find fixed channels and notify them of the new connection. We
7262 * use multiple individual lookups, continuing each time where
7263 * we left off, because the list lock would prevent calling the
7264 * potentially sleeping l2cap_chan_lock() function.
7265 */
7266 pchan = l2cap_global_fixed_chan(NULL, hcon);
7267 while (pchan) {
7268 struct l2cap_chan *chan, *next;
7269
7270 /* Client fixed channels should override server ones */
7271 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7272 goto next;
7273
7274 l2cap_chan_lock(pchan);
7275 chan = pchan->ops->new_connection(pchan);
7276 if (chan) {
7277 bacpy(&chan->src, &hcon->src);
7278 bacpy(&chan->dst, &hcon->dst);
7279 chan->src_type = bdaddr_src_type(hcon);
7280 chan->dst_type = dst_type;
7281
7282 __l2cap_chan_add(conn, chan);
7283 }
7284
7285 l2cap_chan_unlock(pchan);
7286 next:
7287 next = l2cap_global_fixed_chan(pchan, hcon);
7288 l2cap_chan_put(pchan);
7289 pchan = next;
7290 }
7291
7292 l2cap_conn_ready(conn);
7293 }
7294
l2cap_disconn_ind(struct hci_conn * hcon)7295 int l2cap_disconn_ind(struct hci_conn *hcon)
7296 {
7297 struct l2cap_conn *conn = hcon->l2cap_data;
7298
7299 BT_DBG("hcon %p", hcon);
7300
7301 if (!conn)
7302 return HCI_ERROR_REMOTE_USER_TERM;
7303 return conn->disc_reason;
7304 }
7305
l2cap_disconn_cfm(struct hci_conn * hcon,u8 reason)7306 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7307 {
7308 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7309 return;
7310
7311 BT_DBG("hcon %p reason %d", hcon, reason);
7312
7313 l2cap_conn_del(hcon, bt_to_errno(reason));
7314 }
7315
l2cap_check_encryption(struct l2cap_chan * chan,u8 encrypt)7316 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7317 {
7318 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7319 return;
7320
7321 if (encrypt == 0x00) {
7322 if (chan->sec_level == BT_SECURITY_MEDIUM) {
7323 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7324 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7325 chan->sec_level == BT_SECURITY_FIPS)
7326 l2cap_chan_close(chan, ECONNREFUSED);
7327 } else {
7328 if (chan->sec_level == BT_SECURITY_MEDIUM)
7329 __clear_chan_timer(chan);
7330 }
7331 }
7332
l2cap_security_cfm(struct hci_conn * hcon,u8 status,u8 encrypt)7333 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7334 {
7335 struct l2cap_conn *conn = hcon->l2cap_data;
7336 struct l2cap_chan *chan;
7337
7338 if (!conn)
7339 return;
7340
7341 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7342
7343 mutex_lock(&conn->chan_lock);
7344
7345 list_for_each_entry(chan, &conn->chan_l, list) {
7346 l2cap_chan_lock(chan);
7347
7348 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7349 state_to_string(chan->state));
7350
7351 if (!status && encrypt)
7352 chan->sec_level = hcon->sec_level;
7353
7354 if (!__l2cap_no_conn_pending(chan)) {
7355 l2cap_chan_unlock(chan);
7356 continue;
7357 }
7358
7359 if (!status && (chan->state == BT_CONNECTED ||
7360 chan->state == BT_CONFIG)) {
7361 chan->ops->resume(chan);
7362 l2cap_check_encryption(chan, encrypt);
7363 l2cap_chan_unlock(chan);
7364 continue;
7365 }
7366
7367 if (chan->state == BT_CONNECT) {
7368 if (!status && l2cap_check_enc_key_size(hcon))
7369 l2cap_start_connection(chan);
7370 else
7371 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7372 } else if (chan->state == BT_CONNECT2 &&
7373 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
7374 chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
7375 struct l2cap_conn_rsp rsp;
7376 __u16 res, stat;
7377
7378 if (!status && l2cap_check_enc_key_size(hcon)) {
7379 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
7380 res = L2CAP_CR_PEND;
7381 stat = L2CAP_CS_AUTHOR_PEND;
7382 chan->ops->defer(chan);
7383 } else {
7384 l2cap_state_change(chan, BT_CONFIG);
7385 res = L2CAP_CR_SUCCESS;
7386 stat = L2CAP_CS_NO_INFO;
7387 }
7388 } else {
7389 l2cap_state_change(chan, BT_DISCONN);
7390 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7391 res = L2CAP_CR_SEC_BLOCK;
7392 stat = L2CAP_CS_NO_INFO;
7393 }
7394
7395 rsp.scid = cpu_to_le16(chan->dcid);
7396 rsp.dcid = cpu_to_le16(chan->scid);
7397 rsp.result = cpu_to_le16(res);
7398 rsp.status = cpu_to_le16(stat);
7399 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7400 sizeof(rsp), &rsp);
7401
7402 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7403 res == L2CAP_CR_SUCCESS) {
7404 char buf[128];
7405 set_bit(CONF_REQ_SENT, &chan->conf_state);
7406 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7407 L2CAP_CONF_REQ,
7408 l2cap_build_conf_req(chan, buf, sizeof(buf)),
7409 buf);
7410 chan->num_conf_req++;
7411 }
7412 }
7413
7414 l2cap_chan_unlock(chan);
7415 }
7416
7417 mutex_unlock(&conn->chan_lock);
7418 }
7419
7420 /* Append fragment into frame respecting the maximum len of rx_skb */
l2cap_recv_frag(struct l2cap_conn * conn,struct sk_buff * skb,u16 len)7421 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
7422 u16 len)
7423 {
7424 if (!conn->rx_skb) {
7425 /* Allocate skb for the complete frame (with header) */
7426 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7427 if (!conn->rx_skb)
7428 return -ENOMEM;
7429 /* Init rx_len */
7430 conn->rx_len = len;
7431 }
7432
7433 /* Copy as much as the rx_skb can hold */
7434 len = min_t(u16, len, skb->len);
7435 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
7436 skb_pull(skb, len);
7437 conn->rx_len -= len;
7438
7439 return len;
7440 }
7441
l2cap_recv_len(struct l2cap_conn * conn,struct sk_buff * skb)7442 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
7443 {
7444 struct sk_buff *rx_skb;
7445 int len;
7446
7447 /* Append just enough to complete the header */
7448 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
7449
7450 /* If header could not be read just continue */
7451 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
7452 return len;
7453
7454 rx_skb = conn->rx_skb;
7455 len = get_unaligned_le16(rx_skb->data);
7456
7457 /* Check if rx_skb has enough space to received all fragments */
7458 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
7459 /* Update expected len */
7460 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
7461 return L2CAP_LEN_SIZE;
7462 }
7463
7464 /* Reset conn->rx_skb since it will need to be reallocated in order to
7465 * fit all fragments.
7466 */
7467 conn->rx_skb = NULL;
7468
7469 /* Reallocates rx_skb using the exact expected length */
7470 len = l2cap_recv_frag(conn, rx_skb,
7471 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
7472 kfree_skb(rx_skb);
7473
7474 return len;
7475 }
7476
l2cap_recv_reset(struct l2cap_conn * conn)7477 static void l2cap_recv_reset(struct l2cap_conn *conn)
7478 {
7479 kfree_skb(conn->rx_skb);
7480 conn->rx_skb = NULL;
7481 conn->rx_len = 0;
7482 }
7483
l2cap_recv_acldata(struct hci_conn * hcon,struct sk_buff * skb,u16 flags)7484 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
7485 {
7486 struct l2cap_conn *conn = hcon->l2cap_data;
7487 int len;
7488
7489 if (!conn)
7490 conn = l2cap_conn_add(hcon);
7491
7492 if (!conn)
7493 goto drop;
7494
7495 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
7496
7497 switch (flags) {
7498 case ACL_START:
7499 case ACL_START_NO_FLUSH:
7500 case ACL_COMPLETE:
7501 if (conn->rx_skb) {
7502 BT_ERR("Unexpected start frame (len %d)", skb->len);
7503 l2cap_recv_reset(conn);
7504 l2cap_conn_unreliable(conn, ECOMM);
7505 }
7506
7507 /* Start fragment may not contain the L2CAP length so just
7508 * copy the initial byte when that happens and use conn->mtu as
7509 * expected length.
7510 */
7511 if (skb->len < L2CAP_LEN_SIZE) {
7512 l2cap_recv_frag(conn, skb, conn->mtu);
7513 break;
7514 }
7515
7516 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
7517
7518 if (len == skb->len) {
7519 /* Complete frame received */
7520 l2cap_recv_frame(conn, skb);
7521 return;
7522 }
7523
7524 BT_DBG("Start: total len %d, frag len %u", len, skb->len);
7525
7526 if (skb->len > len) {
7527 BT_ERR("Frame is too long (len %u, expected len %d)",
7528 skb->len, len);
7529 l2cap_conn_unreliable(conn, ECOMM);
7530 goto drop;
7531 }
7532
7533 /* Append fragment into frame (with header) */
7534 if (l2cap_recv_frag(conn, skb, len) < 0)
7535 goto drop;
7536
7537 break;
7538
7539 case ACL_CONT:
7540 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
7541
7542 if (!conn->rx_skb) {
7543 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7544 l2cap_conn_unreliable(conn, ECOMM);
7545 goto drop;
7546 }
7547
7548 /* Complete the L2CAP length if it has not been read */
7549 if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
7550 if (l2cap_recv_len(conn, skb) < 0) {
7551 l2cap_conn_unreliable(conn, ECOMM);
7552 goto drop;
7553 }
7554
7555 /* Header still could not be read just continue */
7556 if (conn->rx_skb->len < L2CAP_LEN_SIZE)
7557 break;
7558 }
7559
7560 if (skb->len > conn->rx_len) {
7561 BT_ERR("Fragment is too long (len %u, expected %u)",
7562 skb->len, conn->rx_len);
7563 l2cap_recv_reset(conn);
7564 l2cap_conn_unreliable(conn, ECOMM);
7565 goto drop;
7566 }
7567
7568 /* Append fragment into frame (with header) */
7569 l2cap_recv_frag(conn, skb, skb->len);
7570
7571 if (!conn->rx_len) {
7572 /* Complete frame received. l2cap_recv_frame
7573 * takes ownership of the skb so set the global
7574 * rx_skb pointer to NULL first.
7575 */
7576 struct sk_buff *rx_skb = conn->rx_skb;
7577 conn->rx_skb = NULL;
7578 l2cap_recv_frame(conn, rx_skb);
7579 }
7580 break;
7581 }
7582
7583 drop:
7584 kfree_skb(skb);
7585 }
7586
7587 static struct hci_cb l2cap_cb = {
7588 .name = "L2CAP",
7589 .connect_cfm = l2cap_connect_cfm,
7590 .disconn_cfm = l2cap_disconn_cfm,
7591 .security_cfm = l2cap_security_cfm,
7592 };
7593
l2cap_debugfs_show(struct seq_file * f,void * p)7594 static int l2cap_debugfs_show(struct seq_file *f, void *p)
7595 {
7596 struct l2cap_chan *c;
7597
7598 read_lock(&chan_list_lock);
7599
7600 list_for_each_entry(c, &chan_list, global_l) {
7601 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7602 &c->src, c->src_type, &c->dst, c->dst_type,
7603 c->state, __le16_to_cpu(c->psm),
7604 c->scid, c->dcid, c->imtu, c->omtu,
7605 c->sec_level, c->mode);
7606 }
7607
7608 read_unlock(&chan_list_lock);
7609
7610 return 0;
7611 }
7612
7613 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
7614
7615 static struct dentry *l2cap_debugfs;
7616
l2cap_init(void)7617 int __init l2cap_init(void)
7618 {
7619 int err;
7620
7621 err = l2cap_init_sockets();
7622 if (err < 0)
7623 return err;
7624
7625 hci_register_cb(&l2cap_cb);
7626
7627 if (IS_ERR_OR_NULL(bt_debugfs))
7628 return 0;
7629
7630 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7631 NULL, &l2cap_debugfs_fops);
7632
7633 return 0;
7634 }
7635
l2cap_exit(void)7636 void l2cap_exit(void)
7637 {
7638 debugfs_remove(l2cap_debugfs);
7639 hci_unregister_cb(&l2cap_cb);
7640 l2cap_cleanup_sockets();
7641 }
7642
7643 module_param(disable_ertm, bool, 0644);
7644 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
7645
7646 module_param(enable_ecred, bool, 0644);
7647 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
7648