[linux-block.git] / net / bridge / br_ioctl.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *	Ioctl handler
 *	Linux ethernet bridge
 *
 *	Authors:
 *	Lennert Buytenhek		<buytenh@gnu.org>
 */

#include <linux/capability.h>
#include <linux/kernel.h>
#include <linux/if_bridge.h>
#include <linux/netdevice.h>
#include <linux/slab.h>
#include <linux/times.h>
#include <net/net_namespace.h>
#include <linux/uaccess.h>
#include "br_private.h"

static int get_bridge_ifindices(struct net *net, int *indices, int num)
{
	struct net_device *dev;
	int i = 0;

	rcu_read_lock();
	for_each_netdev_rcu(net, dev) {
		if (i >= num)
			break;
		if (dev->priv_flags & IFF_EBRIDGE)
			indices[i++] = dev->ifindex;
	}
	rcu_read_unlock();

	return i;
}

/* called with RTNL */
static void get_port_ifindices(struct net_bridge *br, int *ifindices, int num)
{
	struct net_bridge_port *p;

	list_for_each_entry(p, &br->port_list, list) {
		if (p->port_no < num)
			ifindices[p->port_no] = p->dev->ifindex;
	}
}

/*
 * Format up to a page worth of forwarding table entries
 * userbuf -- where to copy result
 * maxnum  -- maximum number of entries desired
 *            (limited to a page for sanity)
 * offset  -- number of records to skip
 */
static int get_fdb_entries(struct net_bridge *br, void __user *userbuf,
			   unsigned long maxnum, unsigned long offset)
{
	int num;
	void *buf;
	size_t size;

	/* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
	if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
		maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);

	size = maxnum * sizeof(struct __fdb_entry);

	buf = kmalloc(size, GFP_USER);
	if (!buf)
		return -ENOMEM;

	num = br_fdb_fillbuf(br, buf, maxnum, offset);
	if (num > 0) {
		if (copy_to_user(userbuf, buf,
				 array_size(num, sizeof(struct __fdb_entry))))
			num = -EFAULT;
	}
	kfree(buf);

	return num;
}

/* called with RTNL */
static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
{
	struct net *net = dev_net(br->dev);
	struct net_device *dev;
	int ret;

	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		return -EPERM;

	dev = __dev_get_by_index(net, ifindex);
	if (dev == NULL)
		return -EINVAL;

	if (isadd)
		ret = br_add_if(br, dev, NULL);
	else
		ret = br_del_if(br, dev);

	return ret;
}

/*
 * Legacy ioctl's through SIOCDEVPRIVATE
 * This interface is deprecated because it was too difficult
 * to do the translation for 32/64bit ioctl compatibility.
 */
int br_dev_siocdevprivate(struct net_device *dev, struct ifreq *rq, void __user *data, int cmd)
{
	struct net_bridge *br = netdev_priv(dev);
	struct net_bridge_port *p = NULL;
	unsigned long args[4];
	void __user *argp;
	int ret = -EOPNOTSUPP;

	if (in_compat_syscall()) {
		unsigned int cargs[4];

		if (copy_from_user(cargs, data, sizeof(cargs)))
			return -EFAULT;

		args[0] = cargs[0];
		args[1] = cargs[1];
		args[2] = cargs[2];
		args[3] = cargs[3];

		argp = compat_ptr(args[1]);
	} else {
		if (copy_from_user(args, data, sizeof(args)))
			return -EFAULT;

		argp = (void __user *)args[1];
	}

	switch (args[0]) {
	case BRCTL_ADD_IF:
	case BRCTL_DEL_IF:
		return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);

	case BRCTL_GET_BRIDGE_INFO:
	{
		struct __bridge_info b;

		memset(&b, 0, sizeof(struct __bridge_info));
		rcu_read_lock();
		memcpy(&b.designated_root, &br->designated_root, 8);
		memcpy(&b.bridge_id, &br->bridge_id, 8);
		b.root_path_cost = br->root_path_cost;
		b.max_age = jiffies_to_clock_t(br->max_age);
		b.hello_time = jiffies_to_clock_t(br->hello_time);
		b.forward_delay = br->forward_delay;
		b.bridge_max_age = br->bridge_max_age;
		b.bridge_hello_time = br->bridge_hello_time;
		b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
		b.topology_change = br->topology_change;
		b.topology_change_detected = br->topology_change_detected;
		b.root_port = br->root_port;

		b.stp_enabled = (br->stp_enabled != BR_NO_STP);
		b.ageing_time = jiffies_to_clock_t(br->ageing_time);
		b.hello_timer_value = br_timer_value(&br->hello_timer);
		b.tcn_timer_value = br_timer_value(&br->tcn_timer);
		b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
		b.gc_timer_value = br_timer_value(&br->gc_work.timer);
		rcu_read_unlock();

		if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
			return -EFAULT;

		return 0;
	}

	case BRCTL_GET_PORT_LIST:
	{
		int num, *indices;

		num = args[2];
		if (num < 0)
			return -EINVAL;
		if (num == 0)
			num = 256;
		if (num > BR_MAX_PORTS)
			num = BR_MAX_PORTS;

		indices = kcalloc(num, sizeof(int), GFP_KERNEL);
		if (indices == NULL)
			return -ENOMEM;

		get_port_ifindices(br, indices, num);
		if (copy_to_user(argp, indices, array_size(num, sizeof(int))))
			num =  -EFAULT;
		kfree(indices);
		return num;
	}

	case BRCTL_SET_BRIDGE_FORWARD_DELAY:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_forward_delay(br, args[1]);
		break;

	case BRCTL_SET_BRIDGE_HELLO_TIME:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_hello_time(br, args[1]);
		break;

	case BRCTL_SET_BRIDGE_MAX_AGE:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_max_age(br, args[1]);
		break;

	case BRCTL_SET_AGEING_TIME:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_ageing_time(br, args[1]);
		break;

	case BRCTL_GET_PORT_INFO:
	{
		struct __port_info p;
		struct net_bridge_port *pt;

		rcu_read_lock();
		if ((pt = br_get_port(br, args[2])) == NULL) {
			rcu_read_unlock();
			return -EINVAL;
		}

		memset(&p, 0, sizeof(struct __port_info));
		memcpy(&p.designated_root, &pt->designated_root, 8);
		memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
		p.port_id = pt->port_id;
		p.designated_port = pt->designated_port;
		p.path_cost = pt->path_cost;
		p.designated_cost = pt->designated_cost;
		p.state = pt->state;
		p.top_change_ack = pt->topology_change_ack;
		p.config_pending = pt->config_pending;
		p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
		p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
		p.hold_timer_value = br_timer_value(&pt->hold_timer);

		rcu_read_unlock();

		if (copy_to_user(argp, &p, sizeof(p)))
			return -EFAULT;

		return 0;
	}

	case BRCTL_SET_BRIDGE_STP_STATE:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_stp_set_enabled(br, args[1], NULL);
		break;

	case BRCTL_SET_BRIDGE_PRIORITY:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		br_stp_set_bridge_priority(br, args[1]);
		ret = 0;
		break;

	case BRCTL_SET_PORT_PRIORITY:
	{
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		spin_lock_bh(&br->lock);
		if ((p = br_get_port(br, args[1])) == NULL)
			ret = -EINVAL;
		else
			ret = br_stp_set_port_priority(p, args[2]);
		spin_unlock_bh(&br->lock);
		break;
	}

	case BRCTL_SET_PATH_COST:
	{
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		spin_lock_bh(&br->lock);
		if ((p = br_get_port(br, args[1])) == NULL)
			ret = -EINVAL;
		else
			ret = br_stp_set_path_cost(p, args[2]);
		spin_unlock_bh(&br->lock);
		break;
	}

	case BRCTL_GET_FDB_ENTRIES:
		return get_fdb_entries(br, argp, args[2], args[3]);
	}

	if (!ret) {
		if (p)
			br_ifinfo_notify(RTM_NEWLINK, NULL, p);
		else
			netdev_state_change(br->dev);
	}

	return ret;
}

static int old_deviceless(struct net *net, void __user *uarg)
{
	unsigned long args[3];

	if (copy_from_user(args, uarg, sizeof(args)))
		return -EFAULT;

	switch (args[0]) {
	case BRCTL_GET_VERSION:
		return BRCTL_VERSION;

	case BRCTL_GET_BRIDGES:
	{
		int *indices;
		int ret = 0;

		if (args[2] >= 2048)
			return -ENOMEM;
		indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
		if (indices == NULL)
			return -ENOMEM;

		args[2] = get_bridge_ifindices(net, indices, args[2]);

		ret = copy_to_user(uarg, indices,
				   array_size(args[2], sizeof(int)))
			? -EFAULT : args[2];

		kfree(indices);
		return ret;
	}

	case BRCTL_ADD_BRIDGE:
	case BRCTL_DEL_BRIDGE:
	{
		char buf[IFNAMSIZ];

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
			return -EFAULT;

		buf[IFNAMSIZ-1] = 0;

		if (args[0] == BRCTL_ADD_BRIDGE)
			return br_add_bridge(net, buf);

		return br_del_bridge(net, buf);
	}
	}

	return -EOPNOTSUPP;
}

int br_ioctl_stub(struct net *net, struct net_bridge *br, unsigned int cmd,
		  struct ifreq *ifr, void __user *uarg)
{
	int ret = -EOPNOTSUPP;

	rtnl_lock();

	switch (cmd) {
	case SIOCGIFBR:
	case SIOCSIFBR:
		ret = old_deviceless(net, uarg);
		break;
	case SIOCBRADDBR:
	case SIOCBRDELBR:
	{
		char buf[IFNAMSIZ];

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
			ret = -EPERM;
			break;
		}

		if (copy_from_user(buf, uarg, IFNAMSIZ)) {
			ret = -EFAULT;
			break;
		}

		buf[IFNAMSIZ-1] = 0;
		if (cmd == SIOCBRADDBR)
			ret = br_add_bridge(net, buf);
		else
			ret = br_del_bridge(net, buf);
	}
		break;
	case SIOCBRADDIF:
	case SIOCBRDELIF:
		ret = add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF);
		break;
	}

	rtnl_unlock();

	return ret;
}
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 LT	2	/*
	3	* Ioctl handler
	4	* Linux ethernet bridge
	5	*
	6	* Authors:
	7	* Lennert Buytenhek <buytenh@gnu.org>
1da177e4 LT	8	*/
1da177e4 LT	9
4fc268d2	10	#include <linux/capability.h>
1da177e4 LT	11	#include <linux/kernel.h>
	12	#include <linux/if_bridge.h>
	13	#include <linux/netdevice.h>
5a0e3ad6	14	#include <linux/slab.h>
1da177e4	15	#include <linux/times.h>
881d966b	16	#include <net/net_namespace.h>
7c0f6ba6	17	#include <linux/uaccess.h>
1da177e4 LT	18	#include "br_private.h"
1da177e4 LT	19
4aa678ba	20	static int get_bridge_ifindices(struct net net, int indices, int num)
1da177e4 LT	21	{
	22	struct net_device *dev;
	23	int i = 0;
	24
31ca0458 NA	25	rcu_read_lock();
31ca0458 NA	26	for_each_netdev_rcu(net, dev) {
7562f876 PE	27	if (i >= num)
7562f876 PE	28	break;
9d6f229f	29	if (dev->priv_flags & IFF_EBRIDGE)
1da177e4 LT	30	indices[i++] = dev->ifindex;
1da177e4 LT	31	}
31ca0458	32	rcu_read_unlock();
1da177e4 LT	33
	34	return i;
	35	}
	36
	37	/* called with RTNL */
	38	static void get_port_ifindices(struct net_bridge br, int ifindices, int num)
	39	{
	40	struct net_bridge_port *p;
	41
	42	list_for_each_entry(p, &br->port_list, list) {
	43	if (p->port_no < num)
	44	ifindices[p->port_no] = p->dev->ifindex;
	45	}
	46	}
	47
	48	/*
	49	* Format up to a page worth of forwarding table entries
	50	* userbuf -- where to copy result
	51	* maxnum -- maximum number of entries desired
	52	* (limited to a page for sanity)
	53	* offset -- number of records to skip
	54	*/
9d6f229f	55	static int get_fdb_entries(struct net_bridge br, void __user userbuf,
1da177e4 LT	56	unsigned long maxnum, unsigned long offset)
	57	{
	58	int num;
	59	void *buf;
ba8379b2	60	size_t size;
1da177e4	61
ba8379b2 CW	62	/* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
ba8379b2 CW	63	if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
1da177e4	64	maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);
ba8379b2 CW	65
ba8379b2 CW	66	size = maxnum * sizeof(struct __fdb_entry);
1da177e4 LT	67
	68	buf = kmalloc(size, GFP_USER);
	69	if (!buf)
	70	return -ENOMEM;
9d6f229f	71
1da177e4 LT	72	num = br_fdb_fillbuf(br, buf, maxnum, offset);
1da177e4 LT	73	if (num > 0) {
865bfb2a GS	74	if (copy_to_user(userbuf, buf,
865bfb2a GS	75	array_size(num, sizeof(struct __fdb_entry))))
1da177e4 LT	76	num = -EFAULT;
	77	}
	78	kfree(buf);
	79
	80	return num;
	81	}
	82
31ef30c7	83	/* called with RTNL */
1da177e4 LT	84	static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
1da177e4 LT	85	{
cb990503	86	struct net *net = dev_net(br->dev);
1da177e4 LT	87	struct net_device *dev;
	88	int ret;
	89
cb990503	90	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1da177e4 LT	91	return -EPERM;
1da177e4 LT	92
cb990503	93	dev = __dev_get_by_index(net, ifindex);
1da177e4 LT	94	if (dev == NULL)
1da177e4 LT	95	return -EINVAL;
9d6f229f	96
1da177e4	97	if (isadd)
ca752be0	98	ret = br_add_if(br, dev, NULL);
eccaa9e5	99	else
1da177e4 LT	100	ret = br_del_if(br, dev);
1da177e4 LT	101
1da177e4 LT	102	return ret;
	103	}
	104
	105	/*
	106	* Legacy ioctl's through SIOCDEVPRIVATE
4bbd026c	107	* This interface is deprecated because it was too difficult
25985edc	108	* to do the translation for 32/64bit ioctl compatibility.
1da177e4	109	*/
561d8352	110	int br_dev_siocdevprivate(struct net_device dev, struct ifreq rq, void __user *data, int cmd)
1da177e4 LT	111	{
1da177e4 LT	112	struct net_bridge *br = netdev_priv(dev);
bf871ad7	113	struct net_bridge_port *p = NULL;
1da177e4	114	unsigned long args[4];
561d8352	115	void __user *argp;
bf871ad7	116	int ret = -EOPNOTSUPP;
9d6f229f	117
561d8352 AB	118	if (in_compat_syscall()) {
	119	unsigned int cargs[4];
	120
	121	if (copy_from_user(cargs, data, sizeof(cargs)))
	122	return -EFAULT;
	123
	124	args[0] = cargs[0];
	125	args[1] = cargs[1];
	126	args[2] = cargs[2];
	127	args[3] = cargs[3];
	128
	129	argp = compat_ptr(args[1]);
	130	} else {
	131	if (copy_from_user(args, data, sizeof(args)))
	132	return -EFAULT;
	133
	134	argp = (void __user *)args[1];
	135	}
1da177e4 LT	136
	137	switch (args[0]) {
	138	case BRCTL_ADD_IF:
	139	case BRCTL_DEL_IF:
	140	return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);
	141
	142	case BRCTL_GET_BRIDGE_INFO:
	143	{
	144	struct __bridge_info b;
	145
	146	memset(&b, 0, sizeof(struct __bridge_info));
	147	rcu_read_lock();
	148	memcpy(&b.designated_root, &br->designated_root, 8);
	149	memcpy(&b.bridge_id, &br->bridge_id, 8);
	150	b.root_path_cost = br->root_path_cost;
	151	b.max_age = jiffies_to_clock_t(br->max_age);
	152	b.hello_time = jiffies_to_clock_t(br->hello_time);
	153	b.forward_delay = br->forward_delay;
	154	b.bridge_max_age = br->bridge_max_age;
	155	b.bridge_hello_time = br->bridge_hello_time;
	156	b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
	157	b.topology_change = br->topology_change;
	158	b.topology_change_detected = br->topology_change_detected;
	159	b.root_port = br->root_port;
9cde0708 SH	160
9cde0708 SH	161	b.stp_enabled = (br->stp_enabled != BR_NO_STP);
1da177e4 LT	162	b.ageing_time = jiffies_to_clock_t(br->ageing_time);
	163	b.hello_timer_value = br_timer_value(&br->hello_timer);
	164	b.tcn_timer_value = br_timer_value(&br->tcn_timer);
	165	b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
f7cdee8a	166	b.gc_timer_value = br_timer_value(&br->gc_work.timer);
9d6f229f	167	rcu_read_unlock();
1da177e4 LT	168
	169	if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
	170	return -EFAULT;
	171
	172	return 0;
	173	}
	174
	175	case BRCTL_GET_PORT_LIST:
	176	{
	177	int num, *indices;
	178
	179	num = args[2];
	180	if (num < 0)
	181	return -EINVAL;
	182	if (num == 0)
	183	num = 256;
	184	if (num > BR_MAX_PORTS)
	185	num = BR_MAX_PORTS;
	186
0da974f4	187	indices = kcalloc(num, sizeof(int), GFP_KERNEL);
1da177e4 LT	188	if (indices == NULL)
	189	return -ENOMEM;
	190
1da177e4	191	get_port_ifindices(br, indices, num);
865bfb2a	192	if (copy_to_user(argp, indices, array_size(num, sizeof(int))))
1da177e4 LT	193	num = -EFAULT;
	194	kfree(indices);
	195	return num;
	196	}
	197
	198	case BRCTL_SET_BRIDGE_FORWARD_DELAY:
cb990503	199	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	200	return -EPERM;
1da177e4 LT	201
bf871ad7 XL	202	ret = br_set_forward_delay(br, args[1]);
bf871ad7 XL	203	break;
1da177e4 LT	204
1da177e4 LT	205	case BRCTL_SET_BRIDGE_HELLO_TIME:
cb990503	206	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	207	return -EPERM;
1da177e4 LT	208
bf871ad7 XL	209	ret = br_set_hello_time(br, args[1]);
bf871ad7 XL	210	break;
1da177e4 LT	211
1da177e4 LT	212	case BRCTL_SET_BRIDGE_MAX_AGE:
cb990503	213	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	214	return -EPERM;
1da177e4 LT	215
bf871ad7 XL	216	ret = br_set_max_age(br, args[1]);
bf871ad7 XL	217	break;
1da177e4 LT	218
1da177e4 LT	219	case BRCTL_SET_AGEING_TIME:
cb990503	220	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	221	return -EPERM;
1da177e4 LT	222
bf871ad7 XL	223	ret = br_set_ageing_time(br, args[1]);
bf871ad7 XL	224	break;
1da177e4 LT	225
	226	case BRCTL_GET_PORT_INFO:
	227	{
	228	struct __port_info p;
	229	struct net_bridge_port *pt;
	230
	231	rcu_read_lock();
	232	if ((pt = br_get_port(br, args[2])) == NULL) {
	233	rcu_read_unlock();
	234	return -EINVAL;
	235	}
	236
	237	memset(&p, 0, sizeof(struct __port_info));
	238	memcpy(&p.designated_root, &pt->designated_root, 8);
	239	memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
	240	p.port_id = pt->port_id;
	241	p.designated_port = pt->designated_port;
	242	p.path_cost = pt->path_cost;
	243	p.designated_cost = pt->designated_cost;
	244	p.state = pt->state;
	245	p.top_change_ack = pt->topology_change_ack;
	246	p.config_pending = pt->config_pending;
	247	p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
	248	p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
	249	p.hold_timer_value = br_timer_value(&pt->hold_timer);
	250
	251	rcu_read_unlock();
	252
561d8352	253	if (copy_to_user(argp, &p, sizeof(p)))
1da177e4 LT	254	return -EFAULT;
	255
	256	return 0;
	257	}
	258
	259	case BRCTL_SET_BRIDGE_STP_STATE:
cb990503	260	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	261	return -EPERM;
1da177e4 LT	262
419dba8a	263	ret = br_stp_set_enabled(br, args[1], NULL);
bf871ad7	264	break;
1da177e4 LT	265
1da177e4 LT	266	case BRCTL_SET_BRIDGE_PRIORITY:
cb990503	267	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	268	return -EPERM;
1da177e4 LT	269
1da177e4	270	br_stp_set_bridge_priority(br, args[1]);
bf871ad7 XL	271	ret = 0;
bf871ad7 XL	272	break;
1da177e4 LT	273
	274	case BRCTL_SET_PORT_PRIORITY:
	275	{
cb990503	276	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	277	return -EPERM;
1da177e4 LT	278
1da177e4	279	spin_lock_bh(&br->lock);
9d6f229f	280	if ((p = br_get_port(br, args[1])) == NULL)
1da177e4 LT	281	ret = -EINVAL;
1da177e4 LT	282	else
14f98f25	283	ret = br_stp_set_port_priority(p, args[2]);
1da177e4	284	spin_unlock_bh(&br->lock);
bf871ad7	285	break;
1da177e4 LT	286	}
	287
	288	case BRCTL_SET_PATH_COST:
	289	{
cb990503	290	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	291	return -EPERM;
1da177e4 LT	292
14f98f25	293	spin_lock_bh(&br->lock);
1da177e4 LT	294	if ((p = br_get_port(br, args[1])) == NULL)
	295	ret = -EINVAL;
	296	else
14f98f25	297	ret = br_stp_set_path_cost(p, args[2]);
14f98f25	298	spin_unlock_bh(&br->lock);
bf871ad7	299	break;
1da177e4 LT	300	}
	301
	302	case BRCTL_GET_FDB_ENTRIES:
561d8352	303	return get_fdb_entries(br, argp, args[2], args[3]);
1da177e4 LT	304	}
1da177e4 LT	305
bf871ad7 XL	306	if (!ret) {
bf871ad7 XL	307	if (p)
92899063	308	br_ifinfo_notify(RTM_NEWLINK, NULL, p);
bf871ad7 XL	309	else
	310	netdev_state_change(br->dev);
	311	}
	312
	313	return ret;
1da177e4 LT	314	}
1da177e4 LT	315
4aa678ba	316	static int old_deviceless(struct net net, void __user uarg)
1da177e4 LT	317	{
	318	unsigned long args[3];
	319
	320	if (copy_from_user(args, uarg, sizeof(args)))
	321	return -EFAULT;
	322
	323	switch (args[0]) {
	324	case BRCTL_GET_VERSION:
	325	return BRCTL_VERSION;
	326
	327	case BRCTL_GET_BRIDGES:
	328	{
	329	int *indices;
	330	int ret = 0;
	331
	332	if (args[2] >= 2048)
	333	return -ENOMEM;
0da974f4	334	indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
1da177e4 LT	335	if (indices == NULL)
	336	return -ENOMEM;
	337
4aa678ba	338	args[2] = get_bridge_ifindices(net, indices, args[2]);
1da177e4	339
865bfb2a GS	340	ret = copy_to_user(uarg, indices,
865bfb2a GS	341	array_size(args[2], sizeof(int)))
1da177e4 LT	342	? -EFAULT : args[2];
	343
	344	kfree(indices);
	345	return ret;
	346	}
	347
	348	case BRCTL_ADD_BRIDGE:
	349	case BRCTL_DEL_BRIDGE:
	350	{
	351	char buf[IFNAMSIZ];
	352
cb990503	353	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1da177e4 LT	354	return -EPERM;
1da177e4 LT	355
cbd7ad29	356	if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
1da177e4 LT	357	return -EFAULT;
	358
	359	buf[IFNAMSIZ-1] = 0;
	360
	361	if (args[0] == BRCTL_ADD_BRIDGE)
4aa678ba	362	return br_add_bridge(net, buf);
1da177e4	363
4aa678ba	364	return br_del_bridge(net, buf);
1da177e4 LT	365	}
	366	}
	367
	368	return -EOPNOTSUPP;
	369	}
	370
ad2f99ae AB	371	int br_ioctl_stub(struct net net, struct net_bridge br, unsigned int cmd,
ad2f99ae AB	372	struct ifreq ifr, void __user uarg)
1da177e4	373	{
893b1958 NA	374	int ret = -EOPNOTSUPP;
	375
	376	rtnl_lock();
	377
1da177e4 LT	378	switch (cmd) {
	379	case SIOCGIFBR:
	380	case SIOCSIFBR:
893b1958 NA	381	ret = old_deviceless(net, uarg);
893b1958 NA	382	break;
1da177e4 LT	383	case SIOCBRADDBR:
	384	case SIOCBRDELBR:
	385	{
	386	char buf[IFNAMSIZ];
	387
893b1958 NA	388	if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
	389	ret = -EPERM;
	390	break;
	391	}
1da177e4	392
893b1958 NA	393	if (copy_from_user(buf, uarg, IFNAMSIZ)) {
	394	ret = -EFAULT;
	395	break;
	396	}
1da177e4 LT	397
	398	buf[IFNAMSIZ-1] = 0;
	399	if (cmd == SIOCBRADDBR)
893b1958 NA	400	ret = br_add_bridge(net, buf);
	401	else
	402	ret = br_del_bridge(net, buf);
1da177e4	403	}
893b1958	404	break;
1da177e4 LT	405	case SIOCBRADDIF:
1da177e4 LT	406	case SIOCBRDELIF:
893b1958 NA	407	ret = add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF);
893b1958 NA	408	break;
1da177e4	409	}
893b1958 NA	410
	411	rtnl_unlock();
	412
	413	return ret;
1da177e4	414	}