[linux-block.git] / net / bridge / br_ioctl.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *	Ioctl handler
 *	Linux ethernet bridge
 *
 *	Authors:
 *	Lennert Buytenhek		<buytenh@gnu.org>
 */

#include <linux/capability.h>
#include <linux/compat.h>
#include <linux/kernel.h>
#include <linux/if_bridge.h>
#include <linux/netdevice.h>
#include <linux/slab.h>
#include <linux/times.h>
#include <net/net_namespace.h>
#include <linux/uaccess.h>
#include "br_private.h"

static int get_bridge_ifindices(struct net *net, int *indices, int num)
{
	struct net_device *dev;
	int i = 0;

	rcu_read_lock();
	for_each_netdev_rcu(net, dev) {
		if (i >= num)
			break;
		if (netif_is_bridge_master(dev))
			indices[i++] = dev->ifindex;
	}
	rcu_read_unlock();

	return i;
}

/* called with RTNL */
static void get_port_ifindices(struct net_bridge *br, int *ifindices, int num)
{
	struct net_bridge_port *p;

	list_for_each_entry(p, &br->port_list, list) {
		if (p->port_no < num)
			ifindices[p->port_no] = p->dev->ifindex;
	}
}

/*
 * Format up to a page worth of forwarding table entries
 * userbuf -- where to copy result
 * maxnum  -- maximum number of entries desired
 *            (limited to a page for sanity)
 * offset  -- number of records to skip
 */
static int get_fdb_entries(struct net_bridge *br, void __user *userbuf,
			   unsigned long maxnum, unsigned long offset)
{
	int num;
	void *buf;
	size_t size;

	/* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
	if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
		maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);

	size = maxnum * sizeof(struct __fdb_entry);

	buf = kmalloc(size, GFP_USER);
	if (!buf)
		return -ENOMEM;

	num = br_fdb_fillbuf(br, buf, maxnum, offset);
	if (num > 0) {
		if (copy_to_user(userbuf, buf,
				 array_size(num, sizeof(struct __fdb_entry))))
			num = -EFAULT;
	}
	kfree(buf);

	return num;
}

/* called with RTNL */
static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
{
	struct net *net = dev_net(br->dev);
	struct net_device *dev;
	int ret;

	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		return -EPERM;

	dev = __dev_get_by_index(net, ifindex);
	if (dev == NULL)
		return -EINVAL;

	if (isadd)
		ret = br_add_if(br, dev, NULL);
	else
		ret = br_del_if(br, dev);

	return ret;
}

#define BR_UARGS_MAX 4
static int br_dev_read_uargs(unsigned long *args, size_t nr_args,
			     void __user **argp, void __user *data)
{
	int ret;

	if (nr_args < 2 || nr_args > BR_UARGS_MAX)
		return -EINVAL;

	if (in_compat_syscall()) {
		unsigned int cargs[BR_UARGS_MAX];
		int i;

		ret = copy_from_user(cargs, data, nr_args * sizeof(*cargs));
		if (ret)
			goto fault;

		for (i = 0; i < nr_args; ++i)
			args[i] = cargs[i];

		*argp = compat_ptr(args[1]);
	} else {
		ret = copy_from_user(args, data, nr_args * sizeof(*args));
		if (ret)
			goto fault;
		*argp = (void __user *)args[1];
	}

	return 0;
fault:
	return -EFAULT;
}

/*
 * Legacy ioctl's through SIOCDEVPRIVATE
 * This interface is deprecated because it was too difficult
 * to do the translation for 32/64bit ioctl compatibility.
 */
int br_dev_siocdevprivate(struct net_device *dev, struct ifreq *rq,
			  void __user *data, int cmd)
{
	struct net_bridge *br = netdev_priv(dev);
	struct net_bridge_port *p = NULL;
	unsigned long args[4];
	void __user *argp;
	int ret;

	ret = br_dev_read_uargs(args, ARRAY_SIZE(args), &argp, data);
	if (ret)
		return ret;

	switch (args[0]) {
	case BRCTL_ADD_IF:
	case BRCTL_DEL_IF:
		return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);

	case BRCTL_GET_BRIDGE_INFO:
	{
		struct __bridge_info b;

		memset(&b, 0, sizeof(struct __bridge_info));
		rcu_read_lock();
		memcpy(&b.designated_root, &br->designated_root, 8);
		memcpy(&b.bridge_id, &br->bridge_id, 8);
		b.root_path_cost = br->root_path_cost;
		b.max_age = jiffies_to_clock_t(br->max_age);
		b.hello_time = jiffies_to_clock_t(br->hello_time);
		b.forward_delay = br->forward_delay;
		b.bridge_max_age = br->bridge_max_age;
		b.bridge_hello_time = br->bridge_hello_time;
		b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
		b.topology_change = br->topology_change;
		b.topology_change_detected = br->topology_change_detected;
		b.root_port = br->root_port;

		b.stp_enabled = (br->stp_enabled != BR_NO_STP);
		b.ageing_time = jiffies_to_clock_t(br->ageing_time);
		b.hello_timer_value = br_timer_value(&br->hello_timer);
		b.tcn_timer_value = br_timer_value(&br->tcn_timer);
		b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
		b.gc_timer_value = br_timer_value(&br->gc_work.timer);
		rcu_read_unlock();

		if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
			return -EFAULT;

		return 0;
	}

	case BRCTL_GET_PORT_LIST:
	{
		int num, *indices;

		num = args[2];
		if (num < 0)
			return -EINVAL;
		if (num == 0)
			num = 256;
		if (num > BR_MAX_PORTS)
			num = BR_MAX_PORTS;

		indices = kcalloc(num, sizeof(int), GFP_KERNEL);
		if (indices == NULL)
			return -ENOMEM;

		get_port_ifindices(br, indices, num);
		if (copy_to_user(argp, indices, array_size(num, sizeof(int))))
			num =  -EFAULT;
		kfree(indices);
		return num;
	}

	case BRCTL_SET_BRIDGE_FORWARD_DELAY:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_forward_delay(br, args[1]);
		break;

	case BRCTL_SET_BRIDGE_HELLO_TIME:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_hello_time(br, args[1]);
		break;

	case BRCTL_SET_BRIDGE_MAX_AGE:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_max_age(br, args[1]);
		break;

	case BRCTL_SET_AGEING_TIME:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_ageing_time(br, args[1]);
		break;

	case BRCTL_GET_PORT_INFO:
	{
		struct __port_info p;
		struct net_bridge_port *pt;

		rcu_read_lock();
		if ((pt = br_get_port(br, args[2])) == NULL) {
			rcu_read_unlock();
			return -EINVAL;
		}

		memset(&p, 0, sizeof(struct __port_info));
		memcpy(&p.designated_root, &pt->designated_root, 8);
		memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
		p.port_id = pt->port_id;
		p.designated_port = pt->designated_port;
		p.path_cost = pt->path_cost;
		p.designated_cost = pt->designated_cost;
		p.state = pt->state;
		p.top_change_ack = pt->topology_change_ack;
		p.config_pending = pt->config_pending;
		p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
		p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
		p.hold_timer_value = br_timer_value(&pt->hold_timer);

		rcu_read_unlock();

		if (copy_to_user(argp, &p, sizeof(p)))
			return -EFAULT;

		return 0;
	}

	case BRCTL_SET_BRIDGE_STP_STATE:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_stp_set_enabled(br, args[1], NULL);
		break;

	case BRCTL_SET_BRIDGE_PRIORITY:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		br_stp_set_bridge_priority(br, args[1]);
		ret = 0;
		break;

	case BRCTL_SET_PORT_PRIORITY:
	{
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		spin_lock_bh(&br->lock);
		if ((p = br_get_port(br, args[1])) == NULL)
			ret = -EINVAL;
		else
			ret = br_stp_set_port_priority(p, args[2]);
		spin_unlock_bh(&br->lock);
		break;
	}

	case BRCTL_SET_PATH_COST:
	{
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		spin_lock_bh(&br->lock);
		if ((p = br_get_port(br, args[1])) == NULL)
			ret = -EINVAL;
		else
			ret = br_stp_set_path_cost(p, args[2]);
		spin_unlock_bh(&br->lock);
		break;
	}

	case BRCTL_GET_FDB_ENTRIES:
		return get_fdb_entries(br, argp, args[2], args[3]);

	default:
		ret = -EOPNOTSUPP;
	}

	if (!ret) {
		if (p)
			br_ifinfo_notify(RTM_NEWLINK, NULL, p);
		else
			netdev_state_change(br->dev);
	}

	return ret;
}

static int old_deviceless(struct net *net, void __user *data)
{
	unsigned long args[3];
	void __user *argp;
	int ret;

	ret = br_dev_read_uargs(args, ARRAY_SIZE(args), &argp, data);
	if (ret)
		return ret;

	switch (args[0]) {
	case BRCTL_GET_VERSION:
		return BRCTL_VERSION;

	case BRCTL_GET_BRIDGES:
	{
		int *indices;
		int ret = 0;

		if (args[2] >= 2048)
			return -ENOMEM;
		indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
		if (indices == NULL)
			return -ENOMEM;

		args[2] = get_bridge_ifindices(net, indices, args[2]);

		ret = copy_to_user(argp, indices,
				   array_size(args[2], sizeof(int)))
			? -EFAULT : args[2];

		kfree(indices);
		return ret;
	}

	case BRCTL_ADD_BRIDGE:
	case BRCTL_DEL_BRIDGE:
	{
		char buf[IFNAMSIZ];

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		if (copy_from_user(buf, argp, IFNAMSIZ))
			return -EFAULT;

		buf[IFNAMSIZ-1] = 0;

		if (args[0] == BRCTL_ADD_BRIDGE)
			return br_add_bridge(net, buf);

		return br_del_bridge(net, buf);
	}
	}

	return -EOPNOTSUPP;
}

int br_ioctl_stub(struct net *net, struct net_bridge *br, unsigned int cmd,
		  struct ifreq *ifr, void __user *uarg)
{
	int ret = -EOPNOTSUPP;

	rtnl_lock();

	switch (cmd) {
	case SIOCGIFBR:
	case SIOCSIFBR:
		ret = old_deviceless(net, uarg);
		break;
	case SIOCBRADDBR:
	case SIOCBRDELBR:
	{
		char buf[IFNAMSIZ];

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
			ret = -EPERM;
			break;
		}

		if (copy_from_user(buf, uarg, IFNAMSIZ)) {
			ret = -EFAULT;
			break;
		}

		buf[IFNAMSIZ-1] = 0;
		if (cmd == SIOCBRADDBR)
			ret = br_add_bridge(net, buf);
		else
			ret = br_del_bridge(net, buf);
	}
		break;
	case SIOCBRADDIF:
	case SIOCBRDELIF:
		ret = add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF);
		break;
	}

	rtnl_unlock();

	return ret;
}
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 LT	2	/*
	3	* Ioctl handler
	4	* Linux ethernet bridge
	5	*
	6	* Authors:
	7	* Lennert Buytenhek <buytenh@gnu.org>
1da177e4 LT	8	*/
1da177e4 LT	9
4fc268d2	10	#include <linux/capability.h>
b6459415	11	#include <linux/compat.h>
1da177e4 LT	12	#include <linux/kernel.h>
	13	#include <linux/if_bridge.h>
	14	#include <linux/netdevice.h>
5a0e3ad6	15	#include <linux/slab.h>
1da177e4	16	#include <linux/times.h>
881d966b	17	#include <net/net_namespace.h>
7c0f6ba6	18	#include <linux/uaccess.h>
1da177e4 LT	19	#include "br_private.h"
1da177e4 LT	20
4aa678ba	21	static int get_bridge_ifindices(struct net net, int indices, int num)
1da177e4 LT	22	{
	23	struct net_device *dev;
	24	int i = 0;
	25
31ca0458 NA	26	rcu_read_lock();
31ca0458 NA	27	for_each_netdev_rcu(net, dev) {
7562f876 PE	28	if (i >= num)
7562f876 PE	29	break;
254ec036	30	if (netif_is_bridge_master(dev))
1da177e4 LT	31	indices[i++] = dev->ifindex;
1da177e4 LT	32	}
31ca0458	33	rcu_read_unlock();
1da177e4 LT	34
	35	return i;
	36	}
	37
	38	/* called with RTNL */
	39	static void get_port_ifindices(struct net_bridge br, int ifindices, int num)
	40	{
	41	struct net_bridge_port *p;
	42
	43	list_for_each_entry(p, &br->port_list, list) {
	44	if (p->port_no < num)
	45	ifindices[p->port_no] = p->dev->ifindex;
	46	}
	47	}
	48
	49	/*
	50	* Format up to a page worth of forwarding table entries
	51	* userbuf -- where to copy result
	52	* maxnum -- maximum number of entries desired
	53	* (limited to a page for sanity)
	54	* offset -- number of records to skip
	55	*/
9d6f229f	56	static int get_fdb_entries(struct net_bridge br, void __user userbuf,
1da177e4 LT	57	unsigned long maxnum, unsigned long offset)
	58	{
	59	int num;
	60	void *buf;
ba8379b2	61	size_t size;
1da177e4	62
ba8379b2 CW	63	/* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
ba8379b2 CW	64	if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
1da177e4	65	maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);
ba8379b2 CW	66
ba8379b2 CW	67	size = maxnum * sizeof(struct __fdb_entry);
1da177e4 LT	68
	69	buf = kmalloc(size, GFP_USER);
	70	if (!buf)
	71	return -ENOMEM;
9d6f229f	72
1da177e4 LT	73	num = br_fdb_fillbuf(br, buf, maxnum, offset);
1da177e4 LT	74	if (num > 0) {
865bfb2a GS	75	if (copy_to_user(userbuf, buf,
865bfb2a GS	76	array_size(num, sizeof(struct __fdb_entry))))
1da177e4 LT	77	num = -EFAULT;
	78	}
	79	kfree(buf);
	80
	81	return num;
	82	}
	83
31ef30c7	84	/* called with RTNL */
1da177e4 LT	85	static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
1da177e4 LT	86	{
cb990503	87	struct net *net = dev_net(br->dev);
1da177e4 LT	88	struct net_device *dev;
	89	int ret;
	90
cb990503	91	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1da177e4 LT	92	return -EPERM;
1da177e4 LT	93
cb990503	94	dev = __dev_get_by_index(net, ifindex);
1da177e4 LT	95	if (dev == NULL)
1da177e4 LT	96	return -EINVAL;
9d6f229f	97
1da177e4	98	if (isadd)
ca752be0	99	ret = br_add_if(br, dev, NULL);
eccaa9e5	100	else
1da177e4 LT	101	ret = br_del_if(br, dev);
1da177e4 LT	102
1da177e4 LT	103	return ret;
	104	}
	105
fd3a4590 RP	106	#define BR_UARGS_MAX 4
	107	static int br_dev_read_uargs(unsigned long *args, size_t nr_args,
	108	void __user *argp, void __user data)
	109	{
	110	int ret;
	111
	112	if (nr_args < 2 \|\| nr_args > BR_UARGS_MAX)
	113	return -EINVAL;
	114
	115	if (in_compat_syscall()) {
	116	unsigned int cargs[BR_UARGS_MAX];
	117	int i;
	118
	119	ret = copy_from_user(cargs, data, nr_args * sizeof(*cargs));
	120	if (ret)
	121	goto fault;
	122
	123	for (i = 0; i < nr_args; ++i)
	124	args[i] = cargs[i];
	125
	126	*argp = compat_ptr(args[1]);
	127	} else {
	128	ret = copy_from_user(args, data, nr_args * sizeof(*args));
	129	if (ret)
	130	goto fault;
	131	argp = (void __user )args[1];
	132	}
	133
	134	return 0;
	135	fault:
	136	return -EFAULT;
	137	}
	138
1da177e4 LT	139	/*
1da177e4 LT	140	* Legacy ioctl's through SIOCDEVPRIVATE
4bbd026c	141	* This interface is deprecated because it was too difficult
25985edc	142	* to do the translation for 32/64bit ioctl compatibility.
1da177e4	143	*/
fd3a4590 RP	144	int br_dev_siocdevprivate(struct net_device dev, struct ifreq rq,
fd3a4590 RP	145	void __user *data, int cmd)
1da177e4 LT	146	{
1da177e4 LT	147	struct net_bridge *br = netdev_priv(dev);
bf871ad7	148	struct net_bridge_port *p = NULL;
1da177e4	149	unsigned long args[4];
561d8352	150	void __user *argp;
fd3a4590	151	int ret;
561d8352	152
fd3a4590 RP	153	ret = br_dev_read_uargs(args, ARRAY_SIZE(args), &argp, data);
	154	if (ret)
	155	return ret;
1da177e4 LT	156
	157	switch (args[0]) {
	158	case BRCTL_ADD_IF:
	159	case BRCTL_DEL_IF:
	160	return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);
	161
	162	case BRCTL_GET_BRIDGE_INFO:
	163	{
	164	struct __bridge_info b;
	165
	166	memset(&b, 0, sizeof(struct __bridge_info));
	167	rcu_read_lock();
	168	memcpy(&b.designated_root, &br->designated_root, 8);
	169	memcpy(&b.bridge_id, &br->bridge_id, 8);
	170	b.root_path_cost = br->root_path_cost;
	171	b.max_age = jiffies_to_clock_t(br->max_age);
	172	b.hello_time = jiffies_to_clock_t(br->hello_time);
	173	b.forward_delay = br->forward_delay;
	174	b.bridge_max_age = br->bridge_max_age;
	175	b.bridge_hello_time = br->bridge_hello_time;
	176	b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
	177	b.topology_change = br->topology_change;
	178	b.topology_change_detected = br->topology_change_detected;
	179	b.root_port = br->root_port;
9cde0708 SH	180
9cde0708 SH	181	b.stp_enabled = (br->stp_enabled != BR_NO_STP);
1da177e4 LT	182	b.ageing_time = jiffies_to_clock_t(br->ageing_time);
	183	b.hello_timer_value = br_timer_value(&br->hello_timer);
	184	b.tcn_timer_value = br_timer_value(&br->tcn_timer);
	185	b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
f7cdee8a	186	b.gc_timer_value = br_timer_value(&br->gc_work.timer);
9d6f229f	187	rcu_read_unlock();
1da177e4 LT	188
	189	if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
	190	return -EFAULT;
	191
	192	return 0;
	193	}
	194
	195	case BRCTL_GET_PORT_LIST:
	196	{
	197	int num, *indices;
	198
	199	num = args[2];
	200	if (num < 0)
	201	return -EINVAL;
	202	if (num == 0)
	203	num = 256;
	204	if (num > BR_MAX_PORTS)
	205	num = BR_MAX_PORTS;
	206
0da974f4	207	indices = kcalloc(num, sizeof(int), GFP_KERNEL);
1da177e4 LT	208	if (indices == NULL)
	209	return -ENOMEM;
	210
1da177e4	211	get_port_ifindices(br, indices, num);
865bfb2a	212	if (copy_to_user(argp, indices, array_size(num, sizeof(int))))
1da177e4 LT	213	num = -EFAULT;
	214	kfree(indices);
	215	return num;
	216	}
	217
	218	case BRCTL_SET_BRIDGE_FORWARD_DELAY:
cb990503	219	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	220	return -EPERM;
1da177e4 LT	221
bf871ad7 XL	222	ret = br_set_forward_delay(br, args[1]);
bf871ad7 XL	223	break;
1da177e4 LT	224
1da177e4 LT	225	case BRCTL_SET_BRIDGE_HELLO_TIME:
cb990503	226	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	227	return -EPERM;
1da177e4 LT	228
bf871ad7 XL	229	ret = br_set_hello_time(br, args[1]);
bf871ad7 XL	230	break;
1da177e4 LT	231
1da177e4 LT	232	case BRCTL_SET_BRIDGE_MAX_AGE:
cb990503	233	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	234	return -EPERM;
1da177e4 LT	235
bf871ad7 XL	236	ret = br_set_max_age(br, args[1]);
bf871ad7 XL	237	break;
1da177e4 LT	238
1da177e4 LT	239	case BRCTL_SET_AGEING_TIME:
cb990503	240	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	241	return -EPERM;
1da177e4 LT	242
bf871ad7 XL	243	ret = br_set_ageing_time(br, args[1]);
bf871ad7 XL	244	break;
1da177e4 LT	245
	246	case BRCTL_GET_PORT_INFO:
	247	{
	248	struct __port_info p;
	249	struct net_bridge_port *pt;
	250
	251	rcu_read_lock();
	252	if ((pt = br_get_port(br, args[2])) == NULL) {
	253	rcu_read_unlock();
	254	return -EINVAL;
	255	}
	256
	257	memset(&p, 0, sizeof(struct __port_info));
	258	memcpy(&p.designated_root, &pt->designated_root, 8);
	259	memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
	260	p.port_id = pt->port_id;
	261	p.designated_port = pt->designated_port;
	262	p.path_cost = pt->path_cost;
	263	p.designated_cost = pt->designated_cost;
	264	p.state = pt->state;
	265	p.top_change_ack = pt->topology_change_ack;
	266	p.config_pending = pt->config_pending;
	267	p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
	268	p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
	269	p.hold_timer_value = br_timer_value(&pt->hold_timer);
	270
	271	rcu_read_unlock();
	272
561d8352	273	if (copy_to_user(argp, &p, sizeof(p)))
1da177e4 LT	274	return -EFAULT;
	275
	276	return 0;
	277	}
	278
	279	case BRCTL_SET_BRIDGE_STP_STATE:
cb990503	280	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	281	return -EPERM;
1da177e4 LT	282
419dba8a	283	ret = br_stp_set_enabled(br, args[1], NULL);
bf871ad7	284	break;
1da177e4 LT	285
1da177e4 LT	286	case BRCTL_SET_BRIDGE_PRIORITY:
cb990503	287	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	288	return -EPERM;
1da177e4 LT	289
1da177e4	290	br_stp_set_bridge_priority(br, args[1]);
bf871ad7 XL	291	ret = 0;
bf871ad7 XL	292	break;
1da177e4 LT	293
	294	case BRCTL_SET_PORT_PRIORITY:
	295	{
cb990503	296	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	297	return -EPERM;
1da177e4 LT	298
1da177e4	299	spin_lock_bh(&br->lock);
9d6f229f	300	if ((p = br_get_port(br, args[1])) == NULL)
1da177e4 LT	301	ret = -EINVAL;
1da177e4 LT	302	else
14f98f25	303	ret = br_stp_set_port_priority(p, args[2]);
1da177e4	304	spin_unlock_bh(&br->lock);
bf871ad7	305	break;
1da177e4 LT	306	}
	307
	308	case BRCTL_SET_PATH_COST:
	309	{
cb990503	310	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	311	return -EPERM;
1da177e4 LT	312
14f98f25	313	spin_lock_bh(&br->lock);
1da177e4 LT	314	if ((p = br_get_port(br, args[1])) == NULL)
	315	ret = -EINVAL;
	316	else
14f98f25	317	ret = br_stp_set_path_cost(p, args[2]);
14f98f25	318	spin_unlock_bh(&br->lock);
bf871ad7	319	break;
1da177e4 LT	320	}
	321
	322	case BRCTL_GET_FDB_ENTRIES:
561d8352	323	return get_fdb_entries(br, argp, args[2], args[3]);
fd3a4590 RP	324
	325	default:
	326	ret = -EOPNOTSUPP;
1da177e4 LT	327	}
1da177e4 LT	328
bf871ad7 XL	329	if (!ret) {
bf871ad7 XL	330	if (p)
92899063	331	br_ifinfo_notify(RTM_NEWLINK, NULL, p);
bf871ad7 XL	332	else
	333	netdev_state_change(br->dev);
	334	}
	335
	336	return ret;
1da177e4 LT	337	}
1da177e4 LT	338
fd3a4590	339	static int old_deviceless(struct net net, void __user data)
1da177e4 LT	340	{
1da177e4 LT	341	unsigned long args[3];
fd3a4590 RP	342	void __user *argp;
fd3a4590 RP	343	int ret;
1da177e4	344
fd3a4590 RP	345	ret = br_dev_read_uargs(args, ARRAY_SIZE(args), &argp, data);
	346	if (ret)
	347	return ret;
1da177e4 LT	348
	349	switch (args[0]) {
	350	case BRCTL_GET_VERSION:
	351	return BRCTL_VERSION;
	352
	353	case BRCTL_GET_BRIDGES:
	354	{
	355	int *indices;
	356	int ret = 0;
	357
	358	if (args[2] >= 2048)
	359	return -ENOMEM;
0da974f4	360	indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
1da177e4 LT	361	if (indices == NULL)
	362	return -ENOMEM;
	363
4aa678ba	364	args[2] = get_bridge_ifindices(net, indices, args[2]);
1da177e4	365
fd3a4590	366	ret = copy_to_user(argp, indices,
865bfb2a	367	array_size(args[2], sizeof(int)))
1da177e4 LT	368	? -EFAULT : args[2];
	369
	370	kfree(indices);
	371	return ret;
	372	}
	373
	374	case BRCTL_ADD_BRIDGE:
	375	case BRCTL_DEL_BRIDGE:
	376	{
	377	char buf[IFNAMSIZ];
	378
cb990503	379	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1da177e4 LT	380	return -EPERM;
1da177e4 LT	381
fd3a4590	382	if (copy_from_user(buf, argp, IFNAMSIZ))
1da177e4 LT	383	return -EFAULT;
	384
	385	buf[IFNAMSIZ-1] = 0;
	386
	387	if (args[0] == BRCTL_ADD_BRIDGE)
4aa678ba	388	return br_add_bridge(net, buf);
1da177e4	389
4aa678ba	390	return br_del_bridge(net, buf);
1da177e4 LT	391	}
	392	}
	393
	394	return -EOPNOTSUPP;
	395	}
	396
ad2f99ae AB	397	int br_ioctl_stub(struct net net, struct net_bridge br, unsigned int cmd,
ad2f99ae AB	398	struct ifreq ifr, void __user uarg)
1da177e4	399	{
893b1958 NA	400	int ret = -EOPNOTSUPP;
	401
	402	rtnl_lock();
	403
1da177e4 LT	404	switch (cmd) {
	405	case SIOCGIFBR:
	406	case SIOCSIFBR:
893b1958 NA	407	ret = old_deviceless(net, uarg);
893b1958 NA	408	break;
1da177e4 LT	409	case SIOCBRADDBR:
	410	case SIOCBRDELBR:
	411	{
	412	char buf[IFNAMSIZ];
	413
893b1958 NA	414	if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
	415	ret = -EPERM;
	416	break;
	417	}
1da177e4	418
893b1958 NA	419	if (copy_from_user(buf, uarg, IFNAMSIZ)) {
	420	ret = -EFAULT;
	421	break;
	422	}
1da177e4 LT	423
	424	buf[IFNAMSIZ-1] = 0;
	425	if (cmd == SIOCBRADDBR)
893b1958 NA	426	ret = br_add_bridge(net, buf);
	427	else
	428	ret = br_del_bridge(net, buf);
1da177e4	429	}
893b1958	430	break;
1da177e4 LT	431	case SIOCBRADDIF:
1da177e4 LT	432	case SIOCBRDELIF:
893b1958 NA	433	ret = add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF);
893b1958 NA	434	break;
1da177e4	435	}
893b1958 NA	436
	437	rtnl_unlock();
	438
	439	return ret;
1da177e4	440	}