iso.c

// SPDX-License-Identifier: GPL-2.0
/*
 * BlueZ - Bluetooth protocol stack for Linux
 *
 * Copyright (C) 2022 Intel Corporation
 * Copyright 2023-2024 NXP
 */

#include <linux/module.h>
#include <linux/debugfs.h>
#include <linux/seq_file.h>
#include <linux/sched/signal.h>
#include <linux/uio.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
#include <net/bluetooth/iso.h>
#include "eir.h"

static const struct proto_ops iso_sock_ops;

static struct bt_sock_list iso_sk_list = {
	.lock = __RW_LOCK_UNLOCKED(iso_sk_list.lock)
};

/* ---- ISO connections ---- */
enum {
	ISO_CONN_DROPPED,
	__ISO_CONN_NUM_FLAGS
};

struct iso_conn {
	struct hci_conn	*hcon;
	DECLARE_BITMAP(flags, __ISO_CONN_NUM_FLAGS);

	/* @lock: spinlock protecting changes to iso_conn fields */
	spinlock_t	lock;
	struct sock	*sk;

	struct sk_buff	*rx_skb;
	__u32		rx_len;
	__u16		tx_sn;
	struct kref	ref;
};

#define iso_conn_lock(c)	spin_lock(&(c)->lock)
#define iso_conn_unlock(c)	spin_unlock(&(c)->lock)

static void iso_sock_close(struct sock *sk);
static void iso_sock_kill(struct sock *sk);

/* ----- ISO socket info ----- */
#define iso_pi(sk) ((struct iso_pinfo *)sk)

#define EIR_SERVICE_DATA_LENGTH 4
#define BASE_MAX_LENGTH (HCI_MAX_PER_AD_LENGTH - EIR_SERVICE_DATA_LENGTH)
#define EIR_BAA_SERVICE_UUID	0x1851

/* iso_pinfo flags values */
enum {
	BT_SK_BIG_SYNC,
	BT_SK_PA_SYNC,
	BT_SK_KILLED,
};

struct iso_pinfo {
	struct bt_sock		bt;
	bdaddr_t		src;
	__u8			src_type;
	bdaddr_t		dst;
	__u8			dst_type;
	__u8			bc_sid;
	__u8			bc_num_bis;
	__u8			bc_bis[ISO_MAX_NUM_BIS];
	__u16			sync_handle;
	unsigned long		flags;
	struct bt_iso_qos	qos;
	bool			qos_user_set;
	__u8			base_len;
	__u8			base[BASE_MAX_LENGTH];
	struct iso_conn		*conn;
	struct delayed_work	timeout_work;
};

static struct bt_iso_qos default_qos;

static bool check_ucast_qos(struct bt_iso_qos *qos);
static bool check_bcast_qos(struct bt_iso_qos *qos);
static bool iso_match_sid(struct sock *sk, void *data);
static bool iso_match_sid_past(struct sock *sk, void *data);
static bool iso_match_sync_handle(struct sock *sk, void *data);
static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data);
static void iso_sock_disconn(struct sock *sk);

typedef bool (*iso_sock_match_t)(struct sock *sk, void *data);

static struct sock *iso_get_sock(struct hci_dev *hdev, bdaddr_t *src,
				 bdaddr_t *dst, enum bt_sock_state state,
				 iso_sock_match_t match, void *data);

/* ---- ISO timers ---- */
#define ISO_CONN_TIMEOUT	secs_to_jiffies(20)
#define ISO_DISCONN_TIMEOUT	secs_to_jiffies(2)

static void iso_conn_free(struct kref *ref)
{
	struct iso_conn *conn = container_of(ref, struct iso_conn, ref);

	BT_DBG("conn %p", conn);

	if (conn->hcon) {
		spin_lock(&conn->hcon->proto_lock);

		/* Check we are not racing with iso_conn_add */
		if (conn->hcon->iso_data == conn) {
			conn->hcon->iso_data = NULL;
			if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags))
				hci_conn_drop(conn->hcon);
		}

		spin_unlock(&conn->hcon->proto_lock);
	}

	kfree_skb(conn->rx_skb);

	kfree(conn);
}

static void iso_conn_put(struct iso_conn *conn)
{
	if (!conn)
		return;

	BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));

	/* The following race vs. iso_conn_del() is possible:
	 *
	 * 1. conn->hcon != NULL here
	 * 2. kref_put puts the last reference
	 * 3. concurrent iso_conn_del() gets iso_conn_hold_unless_zero() -> NULL
	 *    and returns immediately, so conn->hcon is not cleared
	 * 4. iso_conn_free() dereferences conn->hcon
	 *
	 * To avoid UAF in step 4, take RCU before decrementing the refcount.
	 */
	rcu_read_lock();

	kref_put(&conn->ref, iso_conn_free);

	rcu_read_unlock();
}

static struct iso_conn *iso_conn_hold_unless_zero(struct iso_conn *conn)
{
	if (!conn)
		return NULL;

	BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));

	if (!kref_get_unless_zero(&conn->ref))
		return NULL;

	return conn;
}

static struct iso_conn *iso_conn_hold(struct iso_conn *conn)
{
	BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));

	kref_get(&conn->ref);
	return conn;
}

static struct sock *iso_sock_hold(struct iso_conn *conn)
{
	if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk))
		return NULL;

	sock_hold(conn->sk);

	return conn->sk;
}

static void iso_sock_timeout(struct work_struct *work)
{
	struct iso_pinfo *pi = container_of(work, struct iso_pinfo,
					    timeout_work.work);
	struct sock *sk = &pi->bt.sk;

	BT_DBG("sock %p state %d", sk, sk->sk_state);

	lock_sock(sk);
	if (!sock_flag(sk, SOCK_ZAPPED)) {
		sk->sk_err = ETIMEDOUT;
		sk->sk_state_change(sk);
	}
	release_sock(sk);
}

static void iso_sock_set_timer(struct sock *sk, long timeout)
{
	lockdep_assert(lockdep_sock_is_held(sk));

	cancel_delayed_work(&iso_pi(sk)->timeout_work);

	if (!iso_pi(sk)->conn)
		return;

	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
	schedule_delayed_work(&iso_pi(sk)->timeout_work, timeout);
}

static void iso_sock_clear_timer(struct sock *sk)
{
	BT_DBG("sock %p state %d", sk, sk->sk_state);
	cancel_delayed_work(&iso_pi(sk)->timeout_work);
}

static void iso_sock_disable_timer(struct sock *sk)
{
	lockdep_assert(!lockdep_sock_is_held(sk));

	BT_DBG("sock %p state %d", sk, sk->sk_state);
	disable_delayed_work_sync(&iso_pi(sk)->timeout_work);
}

/* ---- ISO connections ---- */
static struct iso_conn *iso_conn_add(struct hci_conn *hcon)
	__must_hold(&hcon->hdev->lock)
{
	struct iso_conn *conn;

	spin_lock(&hcon->proto_lock);

	conn = iso_conn_hold_unless_zero(hcon->iso_data);
	if (conn) {
		if (!conn->hcon) {
			iso_conn_lock(conn);
			conn->hcon = hcon;
			iso_conn_unlock(conn);
		}
		spin_unlock(&hcon->proto_lock);
		return conn;
	}

	conn = kzalloc_obj(*conn, GFP_ATOMIC);
	if (!conn) {
		spin_unlock(&hcon->proto_lock);
		return NULL;
	}

	kref_init(&conn->ref);
	spin_lock_init(&conn->lock);

	hcon->iso_data = conn;
	conn->hcon = hcon;
	conn->tx_sn = 0;

	spin_unlock(&hcon->proto_lock);

	BT_DBG("hcon %p conn %p", hcon, conn);

	return conn;
}

/* Delete channel. Must be called on the locked socket. */
static void iso_chan_del(struct sock *sk, int err)
{
	struct iso_conn *conn;
	struct sock *parent;

	conn = iso_pi(sk)->conn;
	iso_pi(sk)->conn = NULL;

	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);

	if (conn) {
		iso_conn_lock(conn);
		conn->sk = NULL;
		iso_conn_unlock(conn);
		iso_conn_put(conn);
	}

	sk->sk_state = BT_CLOSED;
	sk->sk_err   = err;

	parent = bt_sk(sk)->parent;
	if (parent) {
		bt_accept_unlink(sk);
		parent->sk_data_ready(parent);
	} else {
		sk->sk_state_change(sk);
	}

	sock_set_flag(sk, SOCK_ZAPPED);
}

static void iso_conn_del(struct hci_conn *hcon, int err)
	__must_hold(&hcon->hdev->lock)
{
	struct iso_conn *conn;
	struct sock *sk;

	spin_lock(&hcon->proto_lock);
	conn = iso_conn_hold_unless_zero(hcon->iso_data);
	spin_unlock(&hcon->proto_lock);
	if (!conn)
		return;

	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);

	/* Kill socket */
	iso_conn_lock(conn);
	sk = iso_sock_hold(conn);
	iso_conn_unlock(conn);

	if (!sk)
		goto done;

	iso_sock_disable_timer(sk);

	lock_sock(sk);
	iso_chan_del(sk, err);
	release_sock(sk);
	iso_sock_kill(sk);
	sock_put(sk);

done:
	/* No sk access to conn->hcon any more (lock_sock + hdev->lock) */
	spin_lock(&hcon->proto_lock);
	iso_conn_lock(conn);
	conn->hcon = NULL;
	hcon->iso_data = NULL;
	iso_conn_unlock(conn);
	spin_unlock(&hcon->proto_lock);

	iso_conn_put(conn);
}

static int __iso_chan_add(struct iso_conn *conn, struct sock *sk,
			  struct sock *parent)
{
	BT_DBG("conn %p", conn);

	if (iso_pi(sk)->conn == conn && conn->sk == sk)
		return 0;

	if (conn->sk) {
		BT_ERR("conn->sk already set");
		return -EBUSY;
	}

	if (!conn->hcon) {
		BT_ERR("conn->hcon missing");
		return -EIO;
	}

	iso_pi(sk)->conn = iso_conn_hold(conn);
	conn->sk = sk;
	clear_bit(ISO_CONN_DROPPED, conn->flags);

	if (parent)
		bt_accept_enqueue(parent, sk, true);

	return 0;
}

static int iso_chan_add(struct iso_conn *conn, struct sock *sk,
			struct sock *parent)
{
	int err;

	iso_conn_lock(conn);
	err = __iso_chan_add(conn, sk, parent);
	iso_conn_unlock(conn);

	return err;
}

static inline u8 le_addr_type(u8 bdaddr_type)
{
	if (bdaddr_type == BDADDR_LE_PUBLIC)
		return ADDR_LE_DEV_PUBLIC;
	else
		return ADDR_LE_DEV_RANDOM;
}

static int iso_connect_bis(struct sock *sk)
{
	struct iso_conn *conn;
	struct hci_conn *hcon;
	struct hci_dev  *hdev;
	bdaddr_t src, dst;
	u8 src_type, bc_sid;
	int err;

	lock_sock(sk);
	bacpy(&src, &iso_pi(sk)->src);
	bacpy(&dst, &iso_pi(sk)->dst);
	src_type = iso_pi(sk)->src_type;
	bc_sid = iso_pi(sk)->bc_sid;
	release_sock(sk);

	BT_DBG("%pMR (SID 0x%2.2x)", &src, bc_sid);

	hdev = hci_get_route(&dst, &src, src_type);
	if (!hdev)
		return -EHOSTUNREACH;

	hci_dev_lock(hdev);
	lock_sock(sk);

	if (!bis_capable(hdev)) {
		err = -EOPNOTSUPP;
		goto unlock;
	}

	/* Fail if user set invalid QoS */
	if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {
		iso_pi(sk)->qos = default_qos;
		err = -EINVAL;
		goto unlock;
	}

	/* Fail if out PHYs are marked as disabled */
	if (!iso_pi(sk)->qos.bcast.out.phys) {
		err = -EINVAL;
		goto unlock;
	}

	/* Just bind if DEFER_SETUP has been set */
	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
		hcon = hci_bind_bis(hdev, &iso_pi(sk)->dst, iso_pi(sk)->bc_sid,
				    &iso_pi(sk)->qos, iso_pi(sk)->base_len,
				    iso_pi(sk)->base,
				    READ_ONCE(sk->sk_sndtimeo));
		if (IS_ERR(hcon)) {
			err = PTR_ERR(hcon);
			goto unlock;
		}
	} else {
		hcon = hci_connect_bis(hdev, &iso_pi(sk)->dst,
				       le_addr_type(iso_pi(sk)->dst_type),
				       iso_pi(sk)->bc_sid, &iso_pi(sk)->qos,
				       iso_pi(sk)->base_len, iso_pi(sk)->base,
				       READ_ONCE(sk->sk_sndtimeo));
		if (IS_ERR(hcon)) {
			err = PTR_ERR(hcon);
			goto unlock;
		}

		/* Update SID if it was not set */
		if (iso_pi(sk)->bc_sid == HCI_SID_INVALID)
			iso_pi(sk)->bc_sid = hcon->sid;
	}

	lockdep_assert_held(&hcon->hdev->lock);

	conn = iso_conn_add(hcon);
	if (!conn) {
		hci_conn_drop(hcon);
		err = -ENOMEM;
		goto unlock;
	}

	err = iso_chan_add(conn, sk, NULL);
	iso_conn_put(conn);
	if (err)
		goto unlock;

	/* Update source addr of the socket */
	bacpy(&iso_pi(sk)->src, &hcon->src);

	if (hcon->state == BT_CONNECTED) {
		iso_sock_clear_timer(sk);
		sk->sk_state = BT_CONNECTED;
	} else if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
		iso_sock_clear_timer(sk);
		sk->sk_state = BT_CONNECT;
	} else {
		sk->sk_state = BT_CONNECT;
		iso_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));
	}

unlock:
	release_sock(sk);
	hci_dev_unlock(hdev);
	hci_dev_put(hdev);
	return err;
}

static int iso_connect_cis(struct sock *sk)
{
	struct iso_conn *conn;
	struct hci_conn *hcon;
	struct hci_dev  *hdev;
	bdaddr_t src, dst;
	u8 src_type;
	int err;

	lock_sock(sk);
	bacpy(&src, &iso_pi(sk)->src);
	bacpy(&dst, &iso_pi(sk)->dst);
	src_type = iso_pi(sk)->src_type;
	release_sock(sk);

	BT_DBG("%pMR -> %pMR", &src, &dst);

	hdev = hci_get_route(&dst, &src, src_type);
	if (!hdev)
		return -EHOSTUNREACH;

	hci_dev_lock(hdev);
	lock_sock(sk);

	if (!cis_central_capable(hdev)) {
		err = -EOPNOTSUPP;
		goto unlock;
	}

	/* Fail if user set invalid QoS */
	if (iso_pi(sk)->qos_user_set && !check_ucast_qos(&iso_pi(sk)->qos)) {
		iso_pi(sk)->qos = default_qos;
		err = -EINVAL;
		goto unlock;
	}

	/* Fail if either PHYs are marked as disabled */
	if (!iso_pi(sk)->qos.ucast.in.phys && !iso_pi(sk)->qos.ucast.out.phys) {
		err = -EINVAL;
		goto unlock;
	}

	/* Check if there are available buffers for output/TX. */
	if (iso_pi(sk)->qos.ucast.out.sdu && !hci_iso_count(hdev) &&
	    (hdev->iso_pkts && !hdev->iso_cnt)) {
		err = -ENOBUFS;
		goto unlock;
	}

	/* Just bind if DEFER_SETUP has been set */
	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
		hcon = hci_bind_cis(hdev, &iso_pi(sk)->dst,
				    le_addr_type(iso_pi(sk)->dst_type),
				    &iso_pi(sk)->qos,
				    READ_ONCE(sk->sk_sndtimeo));
		if (IS_ERR(hcon)) {
			err = PTR_ERR(hcon);
			goto unlock;
		}
	} else {
		hcon = hci_connect_cis(hdev, &iso_pi(sk)->dst,
				       le_addr_type(iso_pi(sk)->dst_type),
				       &iso_pi(sk)->qos,
				       READ_ONCE(sk->sk_sndtimeo));
		if (IS_ERR(hcon)) {
			err = PTR_ERR(hcon);
			goto unlock;
		}
	}

	lockdep_assert_held(&hcon->hdev->lock);

	conn = iso_conn_add(hcon);
	if (!conn) {
		hci_conn_drop(hcon);
		err = -ENOMEM;
		goto unlock;
	}

	err = iso_chan_add(conn, sk, NULL);
	iso_conn_put(conn);
	if (err)
		goto unlock;

	/* Update source addr of the socket */
	bacpy(&iso_pi(sk)->src, &hcon->src);

	if (hcon->state == BT_CONNECTED) {
		iso_sock_clear_timer(sk);
		sk->sk_state = BT_CONNECTED;
	} else if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
		iso_sock_clear_timer(sk);
		sk->sk_state = BT_CONNECT;
	} else {
		sk->sk_state = BT_CONNECT;
		iso_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));
	}

unlock:
	release_sock(sk);
	hci_dev_unlock(hdev);
	hci_dev_put(hdev);
	return err;
}

static struct bt_iso_qos *iso_sock_get_qos(struct sock *sk)
{
	if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONNECT2)
		return &iso_pi(sk)->conn->hcon->iso_qos;

	return &iso_pi(sk)->qos;
}

static int iso_send_frame(struct sock *sk, struct sk_buff *skb,
			  const struct sockcm_cookie *sockc)
{
	struct iso_conn *conn = iso_pi(sk)->conn;
	struct bt_iso_qos *qos = iso_sock_get_qos(sk);
	struct hci_iso_data_hdr *hdr;
	int len = 0;

	BT_DBG("sk %p len %d", sk, skb->len);

	if (skb->len > qos->ucast.out.sdu)
		return -EMSGSIZE;

	len = skb->len;

	/* Push ISO data header */
	hdr = skb_push(skb, HCI_ISO_DATA_HDR_SIZE);
	hdr->sn = cpu_to_le16(conn->tx_sn++);
	hdr->slen = cpu_to_le16(hci_iso_data_len_pack(len,
						      HCI_ISO_STATUS_VALID));

	if (sk->sk_state == BT_CONNECTED) {
		hci_setup_tx_timestamp(skb, 1, sockc);
		hci_send_iso(conn->hcon, skb);
	} else {
		len = -ENOTCONN;
	}

	return len;
}

static void iso_recv_frame(struct iso_conn *conn, struct sk_buff *skb)
{
	struct sock *sk;

	iso_conn_lock(conn);
	sk = iso_sock_hold(conn);
	iso_conn_unlock(conn);

	if (!sk)
		goto drop;

	BT_DBG("sk %p len %d", sk, skb->len);

	if (sk->sk_state != BT_CONNECTED)
		goto drop_put;

	if (!sock_queue_rcv_skb(sk, skb)) {
		sock_put(sk);
		return;
	}

drop_put:
	sock_put(sk);
drop:
	kfree_skb(skb);
}

/* -------- Socket interface ---------- */
static struct sock *__iso_get_sock_listen_by_addr(bdaddr_t *src, bdaddr_t *dst)
{
	struct sock *sk;

	sk_for_each(sk, &iso_sk_list.head) {
		if (sk->sk_state != BT_LISTEN)
			continue;

		if (bacmp(&iso_pi(sk)->dst, dst))
			continue;

		if (!bacmp(&iso_pi(sk)->src, src))
			return sk;
	}

	return NULL;
}

static struct sock *__iso_get_sock_listen_by_sid(bdaddr_t *ba, bdaddr_t *bc,
						 __u8 sid)
{
	struct sock *sk;

	sk_for_each(sk, &iso_sk_list.head) {
		if (sk->sk_state != BT_LISTEN)
			continue;

		if (bacmp(&iso_pi(sk)->src, ba))
			continue;

		if (bacmp(&iso_pi(sk)->dst, bc))
			continue;

		if (iso_pi(sk)->bc_sid == sid)
			return sk;
	}

	return NULL;
}

/* Find socket in given state:
 * source bdaddr (Unicast)
 * destination bdaddr (Broadcast only)
 * match func - pass NULL to ignore
 * match func data - pass -1 to ignore
 * Returns closest match.
 */
static struct sock *iso_get_sock(struct hci_dev *hdev, bdaddr_t *src,
				 bdaddr_t *dst, enum bt_sock_state state,
				 iso_sock_match_t match, void *data)
{
	struct sock *sk = NULL, *sk1 = NULL;

	read_lock(&iso_sk_list.lock);

	sk_for_each(sk, &iso_sk_list.head) {
		if (sk->sk_state != state)
			continue;

		/* Match Broadcast destination */
		if (bacmp(dst, BDADDR_ANY) && bacmp(&iso_pi(sk)->dst, dst)) {
			struct smp_irk *irk1, *irk2;

			/* Check if destination is an RPA that we can resolve */
			irk1 = hci_find_irk_by_rpa(hdev, dst);
			if (!irk1)
				continue;

			/* Match with identity address */
			if (bacmp(&iso_pi(sk)->dst, &irk1->bdaddr)) {
				/* Check if socket destination address is also
				 * an RPA and if the IRK matches.
				 */
				irk2 = hci_find_irk_by_rpa(hdev,
							   &iso_pi(sk)->dst);
				if (!irk2 || irk1 != irk2)
					continue;
			}
		}

		/* Use Match function if provided */
		if (match && !match(sk, data))
			continue;

		/* Exact match. */
		if (!bacmp(&iso_pi(sk)->src, src)) {
			sock_hold(sk);
			break;
		}

		/* Closest match */
		if (!bacmp(&iso_pi(sk)->src, BDADDR_ANY)) {
			if (sk1)
				sock_put(sk1);

			sk1 = sk;
			sock_hold(sk1);
		}
	}

	if (sk && sk1)
		sock_put(sk1);

	read_unlock(&iso_sk_list.lock);

	return sk ? sk : sk1;
}

static struct sock *iso_get_sock_big(struct sock *match_sk, bdaddr_t *src,
				     bdaddr_t *dst, uint8_t big)
{
	struct sock *sk = NULL;

	read_lock(&iso_sk_list.lock);

	sk_for_each(sk, &iso_sk_list.head) {
		if (match_sk == sk)
			continue;

		/* Look for sockets that have already been
		 * connected to the BIG
		 */
		if (sk->sk_state != BT_CONNECTED &&
		    sk->sk_state != BT_CONNECT)
			continue;

		/* Match Broadcast destination */
		if (bacmp(&iso_pi(sk)->dst, dst))
			continue;

		/* Match BIG handle */
		if (iso_pi(sk)->qos.bcast.big != big)
			continue;

		/* Match source address */
		if (bacmp(&iso_pi(sk)->src, src))
			continue;

		sock_hold(sk);
		break;
	}

	read_unlock(&iso_sk_list.lock);

	return sk;
}

static void iso_sock_destruct(struct sock *sk)
{
	BT_DBG("sk %p", sk);

	iso_conn_put(iso_pi(sk)->conn);

	skb_queue_purge(&sk->sk_receive_queue);
	skb_queue_purge(&sk->sk_write_queue);
	skb_queue_purge(&sk->sk_error_queue);
}

static void iso_sock_cleanup_listen(struct sock *parent)
{
	struct sock *sk;

	BT_DBG("parent %p", parent);

	/* Close not yet accepted channels */
	while ((sk = bt_accept_dequeue(parent, NULL))) {
		iso_sock_close(sk);
		iso_sock_kill(sk);
		/* Drop the reference handed back by bt_accept_dequeue(). */
		sock_put(sk);
	}

	/* If listening socket has a hcon, properly disconnect it */
	if (iso_pi(parent)->conn && iso_pi(parent)->conn->hcon) {
		iso_sock_disconn(parent);
		return;
	}

	parent->sk_state  = BT_CLOSED;
	sock_set_flag(parent, SOCK_ZAPPED);
}

/* Kill socket (only if zapped and orphan)
 * Must be called on unlocked socket.
 */
static void iso_sock_kill(struct sock *sk)
{
	iso_sock_disable_timer(sk);

	lock_sock(sk);

	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
	    test_bit(BT_SK_KILLED, &iso_pi(sk)->flags)) {
		release_sock(sk);
		return;
	}

	BT_DBG("sk %p state %d", sk, sk->sk_state);

	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
	if (iso_pi(sk)->conn) {
		iso_conn_lock(iso_pi(sk)->conn);
		iso_pi(sk)->conn->sk = NULL;
		iso_conn_unlock(iso_pi(sk)->conn);
	}

	/* Kill poor orphan */
	bt_sock_unlink(&iso_sk_list, sk);
	sock_set_flag(sk, SOCK_DEAD);
	set_bit(BT_SK_KILLED, &iso_pi(sk)->flags);

	release_sock(sk);
	sock_put(sk);
}

static void iso_sock_disconn(struct sock *sk)
{
	struct sock *bis_sk;
	struct hci_conn *hcon = iso_pi(sk)->conn->hcon;

	if (test_bit(HCI_CONN_BIG_CREATED, &hcon->flags)) {
		bis_sk = iso_get_sock_big(sk, &iso_pi(sk)->src,
					  &iso_pi(sk)->dst,
					  iso_pi(sk)->qos.bcast.big);

		/* If there are any other connected sockets for the
		 * same BIG, just delete the sk and leave the bis
		 * hcon active, in case later rebinding is needed.
		 */
		if (bis_sk) {
			hcon->state = BT_OPEN;
			set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags);

			iso_sock_clear_timer(sk);
			iso_chan_del(sk, bt_to_errno(hcon->abort_reason));
			sock_put(bis_sk);
			return;
		}
	}

	sk->sk_state = BT_DISCONN;
	if (!test_and_set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags))
		hci_conn_drop(iso_pi(sk)->conn->hcon);
}

static void __iso_sock_close(struct sock *sk)
{
	BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);

	switch (sk->sk_state) {
	case BT_LISTEN:
		iso_sock_cleanup_listen(sk);
		break;

	case BT_CONNECT:
	case BT_CONNECTED:
	case BT_CONFIG:
		if (iso_pi(sk)->conn->hcon)
			iso_sock_disconn(sk);
		else
			iso_chan_del(sk, ECONNRESET);
		break;

	case BT_CONNECT2:
		if (iso_pi(sk)->conn->hcon &&
		    (test_bit(HCI_CONN_PA_SYNC, &iso_pi(sk)->conn->hcon->flags) ||
		    test_bit(HCI_CONN_PA_SYNC_FAILED, &iso_pi(sk)->conn->hcon->flags)))
			iso_sock_disconn(sk);
		else
			iso_chan_del(sk, ECONNRESET);
		break;
	case BT_DISCONN:
		iso_chan_del(sk, ECONNRESET);
		break;

	default:
		sock_set_flag(sk, SOCK_ZAPPED);
		break;
	}
}

/* Must be called on unlocked socket. */
static void iso_sock_close(struct sock *sk)
{
	iso_sock_disable_timer(sk);

	lock_sock(sk);
	__iso_sock_close(sk);
	release_sock(sk);
}

static void iso_sock_init(struct sock *sk, struct sock *parent)
{
	BT_DBG("sk %p", sk);

	if (parent) {
		sk->sk_type = parent->sk_type;
		bt_sk(sk)->flags = bt_sk(parent)->flags;
		security_sk_clone(parent, sk);
	}
}

static struct proto iso_proto = {
	.name		= "ISO",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct iso_pinfo)
};

#define DEFAULT_IO_QOS \
{ \
	.interval	= 10000u, \
	.latency	= 10u, \
	.sdu		= 40u, \
	.phys		= BT_ISO_PHY_2M, \
	.rtn		= 2u, \
}

static struct bt_iso_qos default_qos = {
	.bcast = {
		.big			= BT_ISO_QOS_BIG_UNSET,
		.bis			= BT_ISO_QOS_BIS_UNSET,
		.sync_factor		= 0x01,
		.packing		= 0x00,
		.framing		= 0x00,
		.in			= DEFAULT_IO_QOS,
		.out			= DEFAULT_IO_QOS,
		.encryption		= 0x00,
		.bcode			= {0x00},
		.options		= 0x00,
		.skip			= 0x0000,
		.sync_timeout		= BT_ISO_SYNC_TIMEOUT,
		.sync_cte_type		= 0x00,
		.mse			= 0x00,
		.timeout		= BT_ISO_SYNC_TIMEOUT,
	},
};