1 files changed, 227 insertions, 249 deletions

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 8248303f44e..e8292369cdc 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -26,57 +26,16 @@
 
 /* Bluetooth L2CAP sockets. */
 
+#include <linux/security.h>
+
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
+#include <net/bluetooth/smp.h>
 
 static const struct proto_ops l2cap_sock_ops;
-
-/* ---- L2CAP timers ---- */
-static void l2cap_sock_timeout(unsigned long arg)
-{
-        struct sock *sk = (struct sock *) arg;
-        int reason;
-
-        BT_DBG("sock %p state %d", sk, sk->sk_state);
-
-        bh_lock_sock(sk);
-
-        if (sock_owned_by_user(sk)) {
-                /* sk is owned by user. Try again later */
-                l2cap_sock_set_timer(sk, HZ / 5);
-                bh_unlock_sock(sk);
-                sock_put(sk);
-                return;
-        }
-
-        if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
-                reason = ECONNREFUSED;
-        else if (sk->sk_state == BT_CONNECT &&
-                        l2cap_pi(sk)->chan->sec_level != BT_SECURITY_SDP)
-                reason = ECONNREFUSED;
-        else
-                reason = ETIMEDOUT;
-
-        __l2cap_sock_close(sk, reason);
-
-        bh_unlock_sock(sk);
-
-        l2cap_sock_kill(sk);
-        sock_put(sk);
-}
-
-void l2cap_sock_set_timer(struct sock *sk, long timeout)
-{
-        BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
-        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
-}
-
-void l2cap_sock_clear_timer(struct sock *sk)
-{
-        BT_DBG("sock %p state %d", sk, sk->sk_state);
-        sk_stop_timer(sk, &sk->sk_timer);
-}
+static void l2cap_sock_init(struct sock *sk, struct sock *parent);
+static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio);
 
 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
@@ -133,6 +92,8 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                 chan->sec_level = BT_SECURITY_SDP;
 
         bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
+
+        chan->state = BT_BOUND;
         sk->sk_state = BT_BOUND;
 
 done:
@@ -162,7 +123,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
 
         lock_sock(sk);
 
-        if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
+        if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED
                         && !(la.l2_psm || la.l2_cid)) {
                 err = -EINVAL;
                 goto done;
@@ -204,8 +165,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
         }
 
         /* PSM must be odd and lsb of upper byte must be 0 */
-        if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&
-                                sk->sk_type != SOCK_RAW && !la.l2_cid) {
+        if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 && !la.l2_cid &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
                 err = -EINVAL;
                 goto done;
         }
@@ -258,6 +219,8 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
 
         sk->sk_max_ack_backlog = backlog;
         sk->sk_ack_backlog = 0;
+
+        chan->state = BT_LISTEN;
         sk->sk_state = BT_LISTEN;
 
 done:
@@ -274,30 +237,26 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
 
         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
-
         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
         BT_DBG("sk %p timeo %ld", sk, timeo);
 
         /* Wait for an incoming connection. (wake-one). */
         add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                         break;
                 }
 
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+                nsk = bt_accept_dequeue(sk, newsock);
+                if (nsk)
+                        break;
 
-                if (sk->sk_state != BT_LISTEN) {
-                        err = -EBADFD;
+                if (!timeo) {
+                        err = -EAGAIN;
                         break;
                 }
 
@@ -305,8 +264,12 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
                         err = sock_intr_errno(timeo);
                         break;
                 }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
         }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
@@ -437,6 +400,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
         struct sock *sk = sock->sk;
         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct bt_security sec;
+        struct bt_power pwr;
         int len, err = 0;
 
         BT_DBG("sk %p", sk);
@@ -454,14 +418,18 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 
         switch (optname) {
         case BT_SECURITY:
-                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
-                                && sk->sk_type != SOCK_RAW) {
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
                         err = -EINVAL;
                         break;
                 }
 
+                memset(&sec, 0, sizeof(sec));
                 sec.level = chan->sec_level;
 
+                if (sk->sk_state == BT_CONNECTED)
+                        sec.key_size = chan->conn->hcon->enc_key_size;
+
                 len = min_t(unsigned int, len, sizeof(sec));
                 if (copy_to_user(optval, (char *) &sec, len))
                         err = -EFAULT;
@@ -485,6 +453,21 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 
                 break;
 
+        case BT_POWER:
+                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
+                                && sk->sk_type != SOCK_RAW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                pwr.force_active = chan->force_active;
+
+                len = min_t(unsigned int, len, sizeof(pwr));
+                if (copy_to_user(optval, (char *) &pwr, len))
+                        err = -EFAULT;
+
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -535,7 +518,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                 chan->mode = opts.mode;
                 switch (chan->mode) {
                 case L2CAP_MODE_BASIC:
-                        chan->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
+                        clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
                         break;
                 case L2CAP_MODE_ERTM:
                 case L2CAP_MODE_STREAMING:
@@ -585,6 +568,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
         struct sock *sk = sock->sk;
         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct bt_security sec;
+        struct bt_power pwr;
+        struct l2cap_conn *conn;
         int len, err = 0;
         u32 opt;
 
@@ -600,8 +585,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
 
         switch (optname) {
         case BT_SECURITY:
-                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
-                                && sk->sk_type != SOCK_RAW) {
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
                         err = -EINVAL;
                         break;
                 }
@@ -621,6 +606,20 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                 }
 
                 chan->sec_level = sec.level;
+
+                conn = chan->conn;
+                if (conn && chan->scid == L2CAP_CID_LE_DATA) {
+                        if (!conn->hcon->out) {
+                                err = -EINVAL;
+                                break;
+                        }
+
+                        if (smp_conn_security(conn, sec.level))
+                                break;
+
+                        err = 0;
+                        sk->sk_state = BT_CONFIG;
+                }
                 break;
 
         case BT_DEFER_SETUP:
@@ -661,6 +660,23 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                 chan->flushable = opt;
                 break;
 
+        case BT_POWER:
+                if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
+                                        chan->chan_type != L2CAP_CHAN_RAW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
+
+                len = min_t(unsigned int, sizeof(pwr), optlen);
+                if (copy_from_user((char *) &pwr, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+                chan->force_active = pwr.force_active;
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -674,8 +690,6 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
 {
         struct sock *sk = sock->sk;
         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
-        struct sk_buff *skb;
-        u16 control;
         int err;
 
         BT_DBG("sock %p, sk %p", sock, sk);
@@ -690,87 +704,12 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
         lock_sock(sk);
 
         if (sk->sk_state != BT_CONNECTED) {
-                err = -ENOTCONN;
-                goto done;
-        }
-
-        /* Connectionless channel */
-        if (sk->sk_type == SOCK_DGRAM) {
-                skb = l2cap_create_connless_pdu(chan, msg, len);
-                if (IS_ERR(skb)) {
-                        err = PTR_ERR(skb);
-                } else {
-                        l2cap_do_send(chan, skb);
-                        err = len;
-                }
-                goto done;
+                release_sock(sk);
+                return -ENOTCONN;
         }
 
-        switch (chan->mode) {
-        case L2CAP_MODE_BASIC:
-                /* Check outgoing MTU */
-                if (len > chan->omtu) {
-                        err = -EMSGSIZE;
-                        goto done;
-                }
-
-                /* Create a basic PDU */
-                skb = l2cap_create_basic_pdu(chan, msg, len);
-                if (IS_ERR(skb)) {
-                        err = PTR_ERR(skb);
-                        goto done;
-                }
-
-                l2cap_do_send(chan, skb);
-                err = len;
-                break;
-
-        case L2CAP_MODE_ERTM:
-        case L2CAP_MODE_STREAMING:
-                /* Entire SDU fits into one PDU */
-                if (len <= chan->remote_mps) {
-                        control = L2CAP_SDU_UNSEGMENTED;
-                        skb = l2cap_create_iframe_pdu(chan, msg, len, control,
-                                                                        0);
-                        if (IS_ERR(skb)) {
-                                err = PTR_ERR(skb);
-                                goto done;
-                        }
-                        __skb_queue_tail(&chan->tx_q, skb);
-
-                        if (chan->tx_send_head == NULL)
-                                chan->tx_send_head = skb;
-
-                } else {
-                /* Segment SDU into multiples PDUs */
-                        err = l2cap_sar_segment_sdu(chan, msg, len);
-                        if (err < 0)
-                                goto done;
-                }
-
-                if (chan->mode == L2CAP_MODE_STREAMING) {
-                        l2cap_streaming_send(chan);
-                        err = len;
-                        break;
-                }
-
-                if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                (chan->conn_state & L2CAP_CONN_WAIT_F)) {
-                        err = len;
-                        break;
-                }
-                err = l2cap_ertm_send(chan);
-
-                if (err >= 0)
-                        err = len;
-                break;
-
-        default:
-                BT_DBG("bad state %1.1x", chan->mode);
-                err = -EBADFD;
-        }
+        err = l2cap_chan_send(chan, msg, len);
 
-done:
         release_sock(sk);
         return err;
 }
@@ -778,13 +717,15 @@ done:
 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        int err;
 
         lock_sock(sk);
 
         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
                 sk->sk_state = BT_CONFIG;
 
-                __l2cap_connect_rsp_defer(l2cap_pi(sk)->chan);
+                __l2cap_connect_rsp_defer(pi->chan);
                 release_sock(sk);
                 return 0;
         }
@@ -792,15 +733,43 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct ms
         release_sock(sk);
 
         if (sock->type == SOCK_STREAM)
-                return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
+                err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
+        else
+                err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
+
+        if (pi->chan->mode != L2CAP_MODE_ERTM)
+                return err;
+
+        /* Attempt to put pending rx data in the socket buffer */
+
+        lock_sock(sk);
+
+        if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
+                goto done;
+
+        if (pi->rx_busy_skb) {
+                if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+                        pi->rx_busy_skb = NULL;
+                else
+                        goto done;
+        }
 
-        return bt_sock_recvmsg(iocb, sock, msg, len, flags);
+        /* Restore data flow when half of the receive buffer is
+         * available.  This avoids resending large numbers of
+         * frames.
+         */
+        if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
+                l2cap_chan_busy(pi->chan, 0);
+
+done:
+        release_sock(sk);
+        return err;
 }
 
 /* Kill socket (only if zapped and orphan)
  * Must be called on unlocked socket.
  */
-void l2cap_sock_kill(struct sock *sk)
+static void l2cap_sock_kill(struct sock *sk)
 {
         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
                 return;
@@ -814,87 +783,6 @@ void l2cap_sock_kill(struct sock *sk)
         sock_put(sk);
 }
 
-/* Must be called on unlocked socket. */
-static void l2cap_sock_close(struct sock *sk)
-{
-        l2cap_sock_clear_timer(sk);
-        lock_sock(sk);
-        __l2cap_sock_close(sk, ECONNRESET);
-        release_sock(sk);
-        l2cap_sock_kill(sk);
-}
-
-static void l2cap_sock_cleanup_listen(struct sock *parent)
-{
-        struct sock *sk;
-
-        BT_DBG("parent %p", parent);
-
-        /* Close not yet accepted channels */
-        while ((sk = bt_accept_dequeue(parent, NULL)))
-                l2cap_sock_close(sk);
-
-        parent->sk_state = BT_CLOSED;
-        sock_set_flag(parent, SOCK_ZAPPED);
-}
-
-void __l2cap_sock_close(struct sock *sk, int reason)
-{
-        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
-        struct l2cap_conn *conn = chan->conn;
-
-        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
-
-        switch (sk->sk_state) {
-        case BT_LISTEN:
-                l2cap_sock_cleanup_listen(sk);
-                break;
-
-        case BT_CONNECTED:
-        case BT_CONFIG:
-                if ((sk->sk_type == SOCK_SEQPACKET ||
-                                        sk->sk_type == SOCK_STREAM) &&
-                                        conn->hcon->type == ACL_LINK) {
-                        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
-                        l2cap_send_disconn_req(conn, chan, reason);
-                } else
-                        l2cap_chan_del(chan, reason);
-                break;
-
-        case BT_CONNECT2:
-                if ((sk->sk_type == SOCK_SEQPACKET ||
-                                        sk->sk_type == SOCK_STREAM) &&
-                                        conn->hcon->type == ACL_LINK) {
-                        struct l2cap_conn_rsp rsp;
-                        __u16 result;
-
-                        if (bt_sk(sk)->defer_setup)
-                                result = L2CAP_CR_SEC_BLOCK;
-                        else
-                                result = L2CAP_CR_BAD_PSM;
-
-                        rsp.scid   = cpu_to_le16(chan->dcid);
-                        rsp.dcid   = cpu_to_le16(chan->scid);
-                        rsp.result = cpu_to_le16(result);
-                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
-                                                        sizeof(rsp), &rsp);
-                }
-
-                l2cap_chan_del(chan, reason);
-                break;
-
-        case BT_CONNECT:
-        case BT_DISCONN:
-                l2cap_chan_del(chan, reason);
-                break;
-
-        default:
-                sock_set_flag(sk, SOCK_ZAPPED);
-                break;
-        }
-}
-
 static int l2cap_sock_shutdown(struct socket *sock, int how)
 {
         struct sock *sk = sock->sk;
@@ -912,8 +800,7 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
                         err = __l2cap_wait_ack(sk);
 
                 sk->sk_shutdown = SHUTDOWN_MASK;
-                l2cap_sock_clear_timer(sk);
-                __l2cap_sock_close(sk, 0);
+                l2cap_chan_close(chan, 0);
 
                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
                         err = bt_sock_wait_state(sk, BT_CLOSED,
@@ -944,15 +831,85 @@ static int l2cap_sock_release(struct socket *sock)
         return err;
 }
 
+static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
+{
+        struct sock *sk, *parent = data;
+
+        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
+                                                                GFP_ATOMIC);
+        if (!sk)
+                return NULL;
+
+        l2cap_sock_init(sk, parent);
+
+        return l2cap_pi(sk)->chan;
+}
+
+static int l2cap_sock_recv_cb(void *data, struct sk_buff *skb)
+{
+        int err;
+        struct sock *sk = data;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+
+        if (pi->rx_busy_skb)
+                return -ENOMEM;
+
+        err = sock_queue_rcv_skb(sk, skb);
+
+        /* For ERTM, handle one skb that doesn't fit into the recv
+         * buffer.  This is important to do because the data frames
+         * have already been acked, so the skb cannot be discarded.
+         *
+         * Notify the l2cap core that the buffer is full, so the
+         * LOCAL_BUSY state is entered and no more frames are
+         * acked and reassembled until there is buffer space
+         * available.
+         */
+        if (err < 0 && pi->chan->mode == L2CAP_MODE_ERTM) {
+                pi->rx_busy_skb = skb;
+                l2cap_chan_busy(pi->chan, 1);
+                err = 0;
+        }
+
+        return err;
+}
+
+static void l2cap_sock_close_cb(void *data)
+{
+        struct sock *sk = data;
+
+        l2cap_sock_kill(sk);
+}
+
+static void l2cap_sock_state_change_cb(void *data, int state)
+{
+        struct sock *sk = data;
+
+        sk->sk_state = state;
+}
+
+static struct l2cap_ops l2cap_chan_ops = {
+        .name           = "L2CAP Socket Interface",
+        .new_connection = l2cap_sock_new_connection_cb,
+        .recv           = l2cap_sock_recv_cb,
+        .close          = l2cap_sock_close_cb,
+        .state_change   = l2cap_sock_state_change_cb,
+};
+
 static void l2cap_sock_destruct(struct sock *sk)
 {
         BT_DBG("sk %p", sk);
 
+        if (l2cap_pi(sk)->rx_busy_skb) {
+                kfree_skb(l2cap_pi(sk)->rx_busy_skb);
+                l2cap_pi(sk)->rx_busy_skb = NULL;
+        }
+
         skb_queue_purge(&sk->sk_receive_queue);
         skb_queue_purge(&sk->sk_write_queue);
 }
 
-void l2cap_sock_init(struct sock *sk, struct sock *parent)
+static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct l2cap_chan *chan = pi->chan;
@@ -965,6 +922,7 @@ void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 sk->sk_type = parent->sk_type;
                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 
+                chan->chan_type = pchan->chan_type;
                 chan->imtu = pchan->imtu;
                 chan->omtu = pchan->omtu;
                 chan->conf_state = pchan->conf_state;
@@ -976,12 +934,29 @@ void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 chan->role_switch = pchan->role_switch;
                 chan->force_reliable = pchan->force_reliable;
                 chan->flushable = pchan->flushable;
+                chan->force_active = pchan->force_active;
+
+                security_sk_clone(parent, sk);
         } else {
+
+                switch (sk->sk_type) {
+                case SOCK_RAW:
+                        chan->chan_type = L2CAP_CHAN_RAW;
+                        break;
+                case SOCK_DGRAM:
+                        chan->chan_type = L2CAP_CHAN_CONN_LESS;
+                        break;
+                case SOCK_SEQPACKET:
+                case SOCK_STREAM:
+                        chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
+                        break;
+                }
+
                 chan->imtu = L2CAP_DEFAULT_MTU;
                 chan->omtu = 0;
                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
                         chan->mode = L2CAP_MODE_ERTM;
-                        chan->conf_state |= L2CAP_CONF_STATE2_DEVICE;
+                        set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
                 } else {
                         chan->mode = L2CAP_MODE_BASIC;
                 }
@@ -992,10 +967,15 @@ void l2cap_sock_init(struct sock *sk, struct sock *parent)
                 chan->role_switch = 0;
                 chan->force_reliable = 0;
                 chan->flushable = BT_FLUSHABLE_OFF;
+                chan->force_active = BT_POWER_FORCE_ACTIVE_ON;
+
         }
 
         /* Default config options */
         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+
+        chan->data = sk;
+        chan->ops = &l2cap_chan_ops;
 }
 
 static struct proto l2cap_proto = {
@@ -1004,9 +984,10 @@ static struct proto l2cap_proto = {
         .obj_size       = sizeof(struct l2cap_pinfo)
 };
 
-struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
+static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 {
         struct sock *sk;
+        struct l2cap_chan *chan;
 
         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
         if (!sk)
@@ -1016,14 +997,20 @@ struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, g
         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 
         sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
+        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
 
         sock_reset_flag(sk, SOCK_ZAPPED);
 
         sk->sk_protocol = proto;
         sk->sk_state = BT_OPEN;
 
-        setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
+        chan = l2cap_chan_create(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                return NULL;
+        }
+
+        l2cap_pi(sk)->chan = chan;
 
         return sk;
 }
@@ -1032,7 +1019,6 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
                              int kern)
 {
         struct sock *sk;
-        struct l2cap_chan *chan;
 
         BT_DBG("sock %p", sock);
 
@@ -1051,14 +1037,6 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
         if (!sk)
                 return -ENOMEM;
 
-        chan = l2cap_chan_create(sk);
-        if (!chan) {
-                l2cap_sock_kill(sk);
-                return -ENOMEM;
-        }
-
-        l2cap_pi(sk)->chan = chan;
-
         l2cap_sock_init(sk, NULL);
         return 0;
 }