[mirror_ubuntu-bionic-kernel.git] / net / bridge / br_ioctl.c

/*
 *	Ioctl handler
 *	Linux ethernet bridge
 *
 *	Authors:
 *	Lennert Buytenhek		<buytenh@gnu.org>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	as published by the Free Software Foundation; either version
 *	2 of the License, or (at your option) any later version.
 */

#include <linux/capability.h>
#include <linux/kernel.h>
#include <linux/if_bridge.h>
#include <linux/netdevice.h>
#include <linux/slab.h>
#include <linux/times.h>
#include <net/net_namespace.h>
#include <linux/uaccess.h>
#include "br_private.h"

static int get_bridge_ifindices(struct net *net, int *indices, int num)
{
	struct net_device *dev;
	int i = 0;

	rcu_read_lock();
	for_each_netdev_rcu(net, dev) {
		if (i >= num)
			break;
		if (dev->priv_flags & IFF_EBRIDGE)
			indices[i++] = dev->ifindex;
	}
	rcu_read_unlock();

	return i;
}

/* called with RTNL */
static void get_port_ifindices(struct net_bridge *br, int *ifindices, int num)
{
	struct net_bridge_port *p;

	list_for_each_entry(p, &br->port_list, list) {
		if (p->port_no < num)
			ifindices[p->port_no] = p->dev->ifindex;
	}
}

/*
 * Format up to a page worth of forwarding table entries
 * userbuf -- where to copy result
 * maxnum  -- maximum number of entries desired
 *            (limited to a page for sanity)
 * offset  -- number of records to skip
 */
static int get_fdb_entries(struct net_bridge *br, void __user *userbuf,
			   unsigned long maxnum, unsigned long offset)
{
	int num;
	void *buf;
	size_t size;

	/* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
	if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
		maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);

	size = maxnum * sizeof(struct __fdb_entry);

	buf = kmalloc(size, GFP_USER);
	if (!buf)
		return -ENOMEM;

	num = br_fdb_fillbuf(br, buf, maxnum, offset);
	if (num > 0) {
		if (copy_to_user(userbuf, buf, num*sizeof(struct __fdb_entry)))
			num = -EFAULT;
	}
	kfree(buf);

	return num;
}

/* called with RTNL */
static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
{
	struct net *net = dev_net(br->dev);
	struct net_device *dev;
	int ret;

	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		return -EPERM;

	dev = __dev_get_by_index(net, ifindex);
	if (dev == NULL)
		return -EINVAL;

	if (isadd)
		ret = br_add_if(br, dev);
	else {
		ret = br_del_if(br, dev);
		rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_MASTER, GFP_KERNEL);
	}

	return ret;
}

/*
 * Legacy ioctl's through SIOCDEVPRIVATE
 * This interface is deprecated because it was too difficult to
 * to do the translation for 32/64bit ioctl compatibility.
 */
static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
{
	struct net_bridge *br = netdev_priv(dev);
	struct net_bridge_port *p = NULL;
	unsigned long args[4];
	int ret = -EOPNOTSUPP;

	if (copy_from_user(args, rq->ifr_data, sizeof(args)))
		return -EFAULT;

	switch (args[0]) {
	case BRCTL_ADD_IF:
	case BRCTL_DEL_IF:
		return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);

	case BRCTL_GET_BRIDGE_INFO:
	{
		struct __bridge_info b;

		memset(&b, 0, sizeof(struct __bridge_info));
		rcu_read_lock();
		memcpy(&b.designated_root, &br->designated_root, 8);
		memcpy(&b.bridge_id, &br->bridge_id, 8);
		b.root_path_cost = br->root_path_cost;
		b.max_age = jiffies_to_clock_t(br->max_age);
		b.hello_time = jiffies_to_clock_t(br->hello_time);
		b.forward_delay = br->forward_delay;
		b.bridge_max_age = br->bridge_max_age;
		b.bridge_hello_time = br->bridge_hello_time;
		b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
		b.topology_change = br->topology_change;
		b.topology_change_detected = br->topology_change_detected;
		b.root_port = br->root_port;

		b.stp_enabled = (br->stp_enabled != BR_NO_STP);
		b.ageing_time = jiffies_to_clock_t(br->ageing_time);
		b.hello_timer_value = br_timer_value(&br->hello_timer);
		b.tcn_timer_value = br_timer_value(&br->tcn_timer);
		b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
		b.gc_timer_value = br_timer_value(&br->gc_work.timer);
		rcu_read_unlock();

		if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
			return -EFAULT;

		return 0;
	}

	case BRCTL_GET_PORT_LIST:
	{
		int num, *indices;

		num = args[2];
		if (num < 0)
			return -EINVAL;
		if (num == 0)
			num = 256;
		if (num > BR_MAX_PORTS)
			num = BR_MAX_PORTS;

		indices = kcalloc(num, sizeof(int), GFP_KERNEL);
		if (indices == NULL)
			return -ENOMEM;

		get_port_ifindices(br, indices, num);
		if (copy_to_user((void __user *)args[1], indices, num*sizeof(int)))
			num =  -EFAULT;
		kfree(indices);
		return num;
	}

	case BRCTL_SET_BRIDGE_FORWARD_DELAY:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_forward_delay(br, args[1]);
		break;

	case BRCTL_SET_BRIDGE_HELLO_TIME:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_hello_time(br, args[1]);
		break;

	case BRCTL_SET_BRIDGE_MAX_AGE:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_max_age(br, args[1]);
		break;

	case BRCTL_SET_AGEING_TIME:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		ret = br_set_ageing_time(br, args[1]);
		break;

	case BRCTL_GET_PORT_INFO:
	{
		struct __port_info p;
		struct net_bridge_port *pt;

		rcu_read_lock();
		if ((pt = br_get_port(br, args[2])) == NULL) {
			rcu_read_unlock();
			return -EINVAL;
		}

		memset(&p, 0, sizeof(struct __port_info));
		memcpy(&p.designated_root, &pt->designated_root, 8);
		memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
		p.port_id = pt->port_id;
		p.designated_port = pt->designated_port;
		p.path_cost = pt->path_cost;
		p.designated_cost = pt->designated_cost;
		p.state = pt->state;
		p.top_change_ack = pt->topology_change_ack;
		p.config_pending = pt->config_pending;
		p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
		p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
		p.hold_timer_value = br_timer_value(&pt->hold_timer);

		rcu_read_unlock();

		if (copy_to_user((void __user *)args[1], &p, sizeof(p)))
			return -EFAULT;

		return 0;
	}

	case BRCTL_SET_BRIDGE_STP_STATE:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		br_stp_set_enabled(br, args[1]);
		ret = 0;
		break;

	case BRCTL_SET_BRIDGE_PRIORITY:
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		br_stp_set_bridge_priority(br, args[1]);
		ret = 0;
		break;

	case BRCTL_SET_PORT_PRIORITY:
	{
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		spin_lock_bh(&br->lock);
		if ((p = br_get_port(br, args[1])) == NULL)
			ret = -EINVAL;
		else
			ret = br_stp_set_port_priority(p, args[2]);
		spin_unlock_bh(&br->lock);
		break;
	}

	case BRCTL_SET_PATH_COST:
	{
		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		spin_lock_bh(&br->lock);
		if ((p = br_get_port(br, args[1])) == NULL)
			ret = -EINVAL;
		else
			ret = br_stp_set_path_cost(p, args[2]);
		spin_unlock_bh(&br->lock);
		break;
	}

	case BRCTL_GET_FDB_ENTRIES:
		return get_fdb_entries(br, (void __user *)args[1],
				       args[2], args[3]);
	}

	if (!ret) {
		if (p)
			br_ifinfo_notify(RTM_NEWLINK, p);
		else
			netdev_state_change(br->dev);
	}

	return ret;
}

static int old_deviceless(struct net *net, void __user *uarg)
{
	unsigned long args[3];

	if (copy_from_user(args, uarg, sizeof(args)))
		return -EFAULT;

	switch (args[0]) {
	case BRCTL_GET_VERSION:
		return BRCTL_VERSION;

	case BRCTL_GET_BRIDGES:
	{
		int *indices;
		int ret = 0;

		if (args[2] >= 2048)
			return -ENOMEM;
		indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
		if (indices == NULL)
			return -ENOMEM;

		args[2] = get_bridge_ifindices(net, indices, args[2]);

		ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
			? -EFAULT : args[2];

		kfree(indices);
		return ret;
	}

	case BRCTL_ADD_BRIDGE:
	case BRCTL_DEL_BRIDGE:
	{
		char buf[IFNAMSIZ];

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
			return -EFAULT;

		buf[IFNAMSIZ-1] = 0;

		if (args[0] == BRCTL_ADD_BRIDGE)
			return br_add_bridge(net, buf);

		return br_del_bridge(net, buf);
	}
	}

	return -EOPNOTSUPP;
}

int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *uarg)
{
	switch (cmd) {
	case SIOCGIFBR:
	case SIOCSIFBR:
		return old_deviceless(net, uarg);

	case SIOCBRADDBR:
	case SIOCBRDELBR:
	{
		char buf[IFNAMSIZ];

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
			return -EPERM;

		if (copy_from_user(buf, uarg, IFNAMSIZ))
			return -EFAULT;

		buf[IFNAMSIZ-1] = 0;
		if (cmd == SIOCBRADDBR)
			return br_add_bridge(net, buf);

		return br_del_bridge(net, buf);
	}
	}
	return -EOPNOTSUPP;
}

int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
{
	struct net_bridge *br = netdev_priv(dev);

	switch (cmd) {
	case SIOCDEVPRIVATE:
		return old_dev_ioctl(dev, rq, cmd);

	case SIOCBRADDIF:
	case SIOCBRDELIF:
		return add_del_if(br, rq->ifr_ifindex, cmd == SIOCBRADDIF);

	}

	br_debug(br, "Bridge does not support ioctl 0x%x\n", cmd);
	return -EOPNOTSUPP;
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Ioctl handler
	3	* Linux ethernet bridge
	4	*
	5	* Authors:
	6	* Lennert Buytenhek <buytenh@gnu.org>
	7	*
1da177e4 LT	8	* This program is free software; you can redistribute it and/or
	9	* modify it under the terms of the GNU General Public License
	10	* as published by the Free Software Foundation; either version
	11	* 2 of the License, or (at your option) any later version.
	12	*/
	13
4fc268d2	14	#include <linux/capability.h>
1da177e4 LT	15	#include <linux/kernel.h>
	16	#include <linux/if_bridge.h>
	17	#include <linux/netdevice.h>
5a0e3ad6	18	#include <linux/slab.h>
1da177e4	19	#include <linux/times.h>
881d966b	20	#include <net/net_namespace.h>
7c0f6ba6	21	#include <linux/uaccess.h>
1da177e4 LT	22	#include "br_private.h"
1da177e4 LT	23
4aa678ba	24	static int get_bridge_ifindices(struct net net, int indices, int num)
1da177e4 LT	25	{
	26	struct net_device *dev;
	27	int i = 0;
	28
31ca0458 NA	29	rcu_read_lock();
31ca0458 NA	30	for_each_netdev_rcu(net, dev) {
7562f876 PE	31	if (i >= num)
7562f876 PE	32	break;
9d6f229f	33	if (dev->priv_flags & IFF_EBRIDGE)
1da177e4 LT	34	indices[i++] = dev->ifindex;
1da177e4 LT	35	}
31ca0458	36	rcu_read_unlock();
1da177e4 LT	37
	38	return i;
	39	}
	40
	41	/* called with RTNL */
	42	static void get_port_ifindices(struct net_bridge br, int ifindices, int num)
	43	{
	44	struct net_bridge_port *p;
	45
	46	list_for_each_entry(p, &br->port_list, list) {
	47	if (p->port_no < num)
	48	ifindices[p->port_no] = p->dev->ifindex;
	49	}
	50	}
	51
	52	/*
	53	* Format up to a page worth of forwarding table entries
	54	* userbuf -- where to copy result
	55	* maxnum -- maximum number of entries desired
	56	* (limited to a page for sanity)
	57	* offset -- number of records to skip
	58	*/
9d6f229f	59	static int get_fdb_entries(struct net_bridge br, void __user userbuf,
1da177e4 LT	60	unsigned long maxnum, unsigned long offset)
	61	{
	62	int num;
	63	void *buf;
ba8379b2	64	size_t size;
1da177e4	65
ba8379b2 CW	66	/* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
ba8379b2 CW	67	if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
1da177e4	68	maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);
ba8379b2 CW	69
ba8379b2 CW	70	size = maxnum * sizeof(struct __fdb_entry);
1da177e4 LT	71
	72	buf = kmalloc(size, GFP_USER);
	73	if (!buf)
	74	return -ENOMEM;
9d6f229f	75
1da177e4 LT	76	num = br_fdb_fillbuf(br, buf, maxnum, offset);
	77	if (num > 0) {
	78	if (copy_to_user(userbuf, buf, num*sizeof(struct __fdb_entry)))
	79	num = -EFAULT;
	80	}
	81	kfree(buf);
	82
	83	return num;
	84	}
	85
31ef30c7	86	/* called with RTNL */
1da177e4 LT	87	static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
1da177e4 LT	88	{
cb990503	89	struct net *net = dev_net(br->dev);
1da177e4 LT	90	struct net_device *dev;
	91	int ret;
	92
cb990503	93	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1da177e4 LT	94	return -EPERM;
1da177e4 LT	95
cb990503	96	dev = __dev_get_by_index(net, ifindex);
1da177e4 LT	97	if (dev == NULL)
1da177e4 LT	98	return -EINVAL;
9d6f229f	99
1da177e4 LT	100	if (isadd)
1da177e4 LT	101	ret = br_add_if(br, dev);
00ba4cb3	102	else {
1da177e4	103	ret = br_del_if(br, dev);
00ba4cb3 VB	104	rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_MASTER, GFP_KERNEL);
00ba4cb3 VB	105	}
1da177e4	106
1da177e4 LT	107	return ret;
	108	}
	109
	110	/*
	111	* Legacy ioctl's through SIOCDEVPRIVATE
	112	* This interface is deprecated because it was too difficult to
25985edc	113	* to do the translation for 32/64bit ioctl compatibility.
1da177e4 LT	114	*/
	115	static int old_dev_ioctl(struct net_device dev, struct ifreq rq, int cmd)
	116	{
	117	struct net_bridge *br = netdev_priv(dev);
bf871ad7	118	struct net_bridge_port *p = NULL;
1da177e4	119	unsigned long args[4];
bf871ad7	120	int ret = -EOPNOTSUPP;
9d6f229f	121
1da177e4 LT	122	if (copy_from_user(args, rq->ifr_data, sizeof(args)))
	123	return -EFAULT;
	124
	125	switch (args[0]) {
	126	case BRCTL_ADD_IF:
	127	case BRCTL_DEL_IF:
	128	return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);
	129
	130	case BRCTL_GET_BRIDGE_INFO:
	131	{
	132	struct __bridge_info b;
	133
	134	memset(&b, 0, sizeof(struct __bridge_info));
	135	rcu_read_lock();
	136	memcpy(&b.designated_root, &br->designated_root, 8);
	137	memcpy(&b.bridge_id, &br->bridge_id, 8);
	138	b.root_path_cost = br->root_path_cost;
	139	b.max_age = jiffies_to_clock_t(br->max_age);
	140	b.hello_time = jiffies_to_clock_t(br->hello_time);
	141	b.forward_delay = br->forward_delay;
	142	b.bridge_max_age = br->bridge_max_age;
	143	b.bridge_hello_time = br->bridge_hello_time;
	144	b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
	145	b.topology_change = br->topology_change;
	146	b.topology_change_detected = br->topology_change_detected;
	147	b.root_port = br->root_port;
9cde0708 SH	148
9cde0708 SH	149	b.stp_enabled = (br->stp_enabled != BR_NO_STP);
1da177e4 LT	150	b.ageing_time = jiffies_to_clock_t(br->ageing_time);
	151	b.hello_timer_value = br_timer_value(&br->hello_timer);
	152	b.tcn_timer_value = br_timer_value(&br->tcn_timer);
	153	b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
f7cdee8a	154	b.gc_timer_value = br_timer_value(&br->gc_work.timer);
9d6f229f	155	rcu_read_unlock();
1da177e4 LT	156
	157	if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
	158	return -EFAULT;
	159
	160	return 0;
	161	}
	162
	163	case BRCTL_GET_PORT_LIST:
	164	{
	165	int num, *indices;
	166
	167	num = args[2];
	168	if (num < 0)
	169	return -EINVAL;
	170	if (num == 0)
	171	num = 256;
	172	if (num > BR_MAX_PORTS)
	173	num = BR_MAX_PORTS;
	174
0da974f4	175	indices = kcalloc(num, sizeof(int), GFP_KERNEL);
1da177e4 LT	176	if (indices == NULL)
	177	return -ENOMEM;
	178
1da177e4 LT	179	get_port_ifindices(br, indices, num);
	180	if (copy_to_user((void __user )args[1], indices, numsizeof(int)))
	181	num = -EFAULT;
	182	kfree(indices);
	183	return num;
	184	}
	185
	186	case BRCTL_SET_BRIDGE_FORWARD_DELAY:
cb990503	187	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	188	return -EPERM;
1da177e4 LT	189
bf871ad7 XL	190	ret = br_set_forward_delay(br, args[1]);
bf871ad7 XL	191	break;
1da177e4 LT	192
1da177e4 LT	193	case BRCTL_SET_BRIDGE_HELLO_TIME:
cb990503	194	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	195	return -EPERM;
1da177e4 LT	196
bf871ad7 XL	197	ret = br_set_hello_time(br, args[1]);
bf871ad7 XL	198	break;
1da177e4 LT	199
1da177e4 LT	200	case BRCTL_SET_BRIDGE_MAX_AGE:
cb990503	201	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	202	return -EPERM;
1da177e4 LT	203
bf871ad7 XL	204	ret = br_set_max_age(br, args[1]);
bf871ad7 XL	205	break;
1da177e4 LT	206
1da177e4 LT	207	case BRCTL_SET_AGEING_TIME:
cb990503	208	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	209	return -EPERM;
1da177e4 LT	210
bf871ad7 XL	211	ret = br_set_ageing_time(br, args[1]);
bf871ad7 XL	212	break;
1da177e4 LT	213
	214	case BRCTL_GET_PORT_INFO:
	215	{
	216	struct __port_info p;
	217	struct net_bridge_port *pt;
	218
	219	rcu_read_lock();
	220	if ((pt = br_get_port(br, args[2])) == NULL) {
	221	rcu_read_unlock();
	222	return -EINVAL;
	223	}
	224
	225	memset(&p, 0, sizeof(struct __port_info));
	226	memcpy(&p.designated_root, &pt->designated_root, 8);
	227	memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
	228	p.port_id = pt->port_id;
	229	p.designated_port = pt->designated_port;
	230	p.path_cost = pt->path_cost;
	231	p.designated_cost = pt->designated_cost;
	232	p.state = pt->state;
	233	p.top_change_ack = pt->topology_change_ack;
	234	p.config_pending = pt->config_pending;
	235	p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
	236	p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
	237	p.hold_timer_value = br_timer_value(&pt->hold_timer);
	238
	239	rcu_read_unlock();
	240
	241	if (copy_to_user((void __user *)args[1], &p, sizeof(p)))
	242	return -EFAULT;
	243
	244	return 0;
	245	}
	246
	247	case BRCTL_SET_BRIDGE_STP_STATE:
cb990503	248	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	249	return -EPERM;
1da177e4 LT	250
9cde0708	251	br_stp_set_enabled(br, args[1]);
bf871ad7 XL	252	ret = 0;
bf871ad7 XL	253	break;
1da177e4 LT	254
1da177e4 LT	255	case BRCTL_SET_BRIDGE_PRIORITY:
cb990503	256	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	257	return -EPERM;
1da177e4 LT	258
1da177e4	259	br_stp_set_bridge_priority(br, args[1]);
bf871ad7 XL	260	ret = 0;
bf871ad7 XL	261	break;
1da177e4 LT	262
	263	case BRCTL_SET_PORT_PRIORITY:
	264	{
cb990503	265	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	266	return -EPERM;
1da177e4 LT	267
1da177e4	268	spin_lock_bh(&br->lock);
9d6f229f	269	if ((p = br_get_port(br, args[1])) == NULL)
1da177e4 LT	270	ret = -EINVAL;
1da177e4 LT	271	else
14f98f25	272	ret = br_stp_set_port_priority(p, args[2]);
1da177e4	273	spin_unlock_bh(&br->lock);
bf871ad7	274	break;
1da177e4 LT	275	}
	276
	277	case BRCTL_SET_PATH_COST:
	278	{
cb990503	279	if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
1da177e4 LT	280	return -EPERM;
1da177e4 LT	281
14f98f25	282	spin_lock_bh(&br->lock);
1da177e4 LT	283	if ((p = br_get_port(br, args[1])) == NULL)
	284	ret = -EINVAL;
	285	else
14f98f25	286	ret = br_stp_set_path_cost(p, args[2]);
14f98f25	287	spin_unlock_bh(&br->lock);
bf871ad7	288	break;
1da177e4 LT	289	}
	290
	291	case BRCTL_GET_FDB_ENTRIES:
9d6f229f	292	return get_fdb_entries(br, (void __user *)args[1],
1da177e4 LT	293	args[2], args[3]);
	294	}
	295
bf871ad7 XL	296	if (!ret) {
	297	if (p)
	298	br_ifinfo_notify(RTM_NEWLINK, p);
	299	else
	300	netdev_state_change(br->dev);
	301	}
	302
	303	return ret;
1da177e4 LT	304	}
1da177e4 LT	305
4aa678ba	306	static int old_deviceless(struct net net, void __user uarg)
1da177e4 LT	307	{
	308	unsigned long args[3];
	309
	310	if (copy_from_user(args, uarg, sizeof(args)))
	311	return -EFAULT;
	312
	313	switch (args[0]) {
	314	case BRCTL_GET_VERSION:
	315	return BRCTL_VERSION;
	316
	317	case BRCTL_GET_BRIDGES:
	318	{
	319	int *indices;
	320	int ret = 0;
	321
	322	if (args[2] >= 2048)
	323	return -ENOMEM;
0da974f4	324	indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
1da177e4 LT	325	if (indices == NULL)
	326	return -ENOMEM;
	327
4aa678ba	328	args[2] = get_bridge_ifindices(net, indices, args[2]);
1da177e4 LT	329
	330	ret = copy_to_user((void __user )args[1], indices, args[2]sizeof(int))
	331	? -EFAULT : args[2];
	332
	333	kfree(indices);
	334	return ret;
	335	}
	336
	337	case BRCTL_ADD_BRIDGE:
	338	case BRCTL_DEL_BRIDGE:
	339	{
	340	char buf[IFNAMSIZ];
	341
cb990503	342	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1da177e4 LT	343	return -EPERM;
	344
	345	if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
	346	return -EFAULT;
	347
	348	buf[IFNAMSIZ-1] = 0;
	349
	350	if (args[0] == BRCTL_ADD_BRIDGE)
4aa678ba	351	return br_add_bridge(net, buf);
1da177e4	352
4aa678ba	353	return br_del_bridge(net, buf);
1da177e4 LT	354	}
	355	}
	356
	357	return -EOPNOTSUPP;
	358	}
	359
881d966b	360	int br_ioctl_deviceless_stub(struct net net, unsigned int cmd, void __user uarg)
1da177e4 LT	361	{
	362	switch (cmd) {
	363	case SIOCGIFBR:
	364	case SIOCSIFBR:
4aa678ba	365	return old_deviceless(net, uarg);
9d6f229f	366
1da177e4 LT	367	case SIOCBRADDBR:
	368	case SIOCBRDELBR:
	369	{
	370	char buf[IFNAMSIZ];
	371
cb990503	372	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1da177e4 LT	373	return -EPERM;
	374
	375	if (copy_from_user(buf, uarg, IFNAMSIZ))
	376	return -EFAULT;
	377
	378	buf[IFNAMSIZ-1] = 0;
	379	if (cmd == SIOCBRADDBR)
4aa678ba	380	return br_add_bridge(net, buf);
1da177e4	381
4aa678ba	382	return br_del_bridge(net, buf);
1da177e4 LT	383	}
	384	}
	385	return -EOPNOTSUPP;
	386	}
	387
	388	int br_dev_ioctl(struct net_device dev, struct ifreq rq, int cmd)
	389	{
	390	struct net_bridge *br = netdev_priv(dev);
	391
31a5b837	392	switch (cmd) {
1da177e4 LT	393	case SIOCDEVPRIVATE:
	394	return old_dev_ioctl(dev, rq, cmd);
	395
	396	case SIOCBRADDIF:
	397	case SIOCBRDELIF:
	398	return add_del_if(br, rq->ifr_ifindex, cmd == SIOCBRADDIF);
	399
	400	}
	401
28a16c97	402	br_debug(br, "Bridge does not support ioctl 0x%x\n", cmd);
1da177e4 LT	403	return -EOPNOTSUPP;
1da177e4 LT	404	}