[DCCP]: Fix leak in net/dccp/ipv4.c
[linux-2.6.git] / net / bridge / br_ioctl.c
1 /*
2  *      Ioctl handler
3  *      Linux ethernet bridge
4  *
5  *      Authors:
6  *      Lennert Buytenhek               <buytenh@gnu.org>
7  *
8  *      $Id: br_ioctl.c,v 1.4 2000/11/08 05:16:40 davem Exp $
9  *
10  *      This program is free software; you can redistribute it and/or
11  *      modify it under the terms of the GNU General Public License
12  *      as published by the Free Software Foundation; either version
13  *      2 of the License, or (at your option) any later version.
14  */
15
16 #include <linux/capability.h>
17 #include <linux/kernel.h>
18 #include <linux/if_bridge.h>
19 #include <linux/netdevice.h>
20 #include <linux/times.h>
21 #include <asm/uaccess.h>
22 #include "br_private.h"
23
24 /* called with RTNL */
25 static int get_bridge_ifindices(int *indices, int num)
26 {
27         struct net_device *dev;
28         int i = 0;
29
30         for (dev = dev_base; dev && i < num; dev = dev->next) {
31                 if (dev->priv_flags & IFF_EBRIDGE) 
32                         indices[i++] = dev->ifindex;
33         }
34
35         return i;
36 }
37
38 /* called with RTNL */
39 static void get_port_ifindices(struct net_bridge *br, int *ifindices, int num)
40 {
41         struct net_bridge_port *p;
42
43         list_for_each_entry(p, &br->port_list, list) {
44                 if (p->port_no < num)
45                         ifindices[p->port_no] = p->dev->ifindex;
46         }
47 }
48
49 /*
50  * Format up to a page worth of forwarding table entries
51  * userbuf -- where to copy result
52  * maxnum  -- maximum number of entries desired
53  *            (limited to a page for sanity)
54  * offset  -- number of records to skip
55  */
56 static int get_fdb_entries(struct net_bridge *br, void __user *userbuf, 
57                            unsigned long maxnum, unsigned long offset)
58 {
59         int num;
60         void *buf;
61         size_t size = maxnum * sizeof(struct __fdb_entry);
62
63         if (size > PAGE_SIZE) {
64                 size = PAGE_SIZE;
65                 maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);
66         }
67
68         buf = kmalloc(size, GFP_USER);
69         if (!buf)
70                 return -ENOMEM;
71         
72         num = br_fdb_fillbuf(br, buf, maxnum, offset);
73         if (num > 0) {
74                 if (copy_to_user(userbuf, buf, num*sizeof(struct __fdb_entry)))
75                         num = -EFAULT;
76         }
77         kfree(buf);
78
79         return num;
80 }
81
82 static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
83 {
84         struct net_device *dev;
85         int ret;
86
87         if (!capable(CAP_NET_ADMIN))
88                 return -EPERM;
89
90         dev = dev_get_by_index(ifindex);
91         if (dev == NULL)
92                 return -EINVAL;
93         
94         if (isadd)
95                 ret = br_add_if(br, dev);
96         else
97                 ret = br_del_if(br, dev);
98
99         dev_put(dev);
100         return ret;
101 }
102
103 /*
104  * Legacy ioctl's through SIOCDEVPRIVATE
105  * This interface is deprecated because it was too difficult to
106  * to do the translation for 32/64bit ioctl compatability.
107  */
108 static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
109 {
110         struct net_bridge *br = netdev_priv(dev);
111         unsigned long args[4];
112         
113         if (copy_from_user(args, rq->ifr_data, sizeof(args)))
114                 return -EFAULT;
115
116         switch (args[0]) {
117         case BRCTL_ADD_IF:
118         case BRCTL_DEL_IF:
119                 return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);
120
121         case BRCTL_GET_BRIDGE_INFO:
122         {
123                 struct __bridge_info b;
124
125                 memset(&b, 0, sizeof(struct __bridge_info));
126                 rcu_read_lock();
127                 memcpy(&b.designated_root, &br->designated_root, 8);
128                 memcpy(&b.bridge_id, &br->bridge_id, 8);
129                 b.root_path_cost = br->root_path_cost;
130                 b.max_age = jiffies_to_clock_t(br->max_age);
131                 b.hello_time = jiffies_to_clock_t(br->hello_time);
132                 b.forward_delay = br->forward_delay;
133                 b.bridge_max_age = br->bridge_max_age;
134                 b.bridge_hello_time = br->bridge_hello_time;
135                 b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
136                 b.topology_change = br->topology_change;
137                 b.topology_change_detected = br->topology_change_detected;
138                 b.root_port = br->root_port;
139                 b.stp_enabled = br->stp_enabled;
140                 b.ageing_time = jiffies_to_clock_t(br->ageing_time);
141                 b.hello_timer_value = br_timer_value(&br->hello_timer);
142                 b.tcn_timer_value = br_timer_value(&br->tcn_timer);
143                 b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
144                 b.gc_timer_value = br_timer_value(&br->gc_timer);
145                 rcu_read_unlock();
146
147                 if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
148                         return -EFAULT;
149
150                 return 0;
151         }
152
153         case BRCTL_GET_PORT_LIST:
154         {
155                 int num, *indices;
156
157                 num = args[2];
158                 if (num < 0)
159                         return -EINVAL;
160                 if (num == 0)
161                         num = 256;
162                 if (num > BR_MAX_PORTS)
163                         num = BR_MAX_PORTS;
164
165                 indices = kmalloc(num*sizeof(int), GFP_KERNEL);
166                 if (indices == NULL)
167                         return -ENOMEM;
168
169                 memset(indices, 0, num*sizeof(int));
170
171                 get_port_ifindices(br, indices, num);
172                 if (copy_to_user((void __user *)args[1], indices, num*sizeof(int)))
173                         num =  -EFAULT;
174                 kfree(indices);
175                 return num;
176         }
177
178         case BRCTL_SET_BRIDGE_FORWARD_DELAY:
179                 if (!capable(CAP_NET_ADMIN))
180                         return -EPERM;
181
182                 spin_lock_bh(&br->lock);
183                 br->bridge_forward_delay = clock_t_to_jiffies(args[1]);
184                 if (br_is_root_bridge(br))
185                         br->forward_delay = br->bridge_forward_delay;
186                 spin_unlock_bh(&br->lock);
187                 return 0;
188
189         case BRCTL_SET_BRIDGE_HELLO_TIME:
190                 if (!capable(CAP_NET_ADMIN))
191                         return -EPERM;
192
193                 spin_lock_bh(&br->lock);
194                 br->bridge_hello_time = clock_t_to_jiffies(args[1]);
195                 if (br_is_root_bridge(br))
196                         br->hello_time = br->bridge_hello_time;
197                 spin_unlock_bh(&br->lock);
198                 return 0;
199
200         case BRCTL_SET_BRIDGE_MAX_AGE:
201                 if (!capable(CAP_NET_ADMIN))
202                         return -EPERM;
203
204                 spin_lock_bh(&br->lock);
205                 br->bridge_max_age = clock_t_to_jiffies(args[1]);
206                 if (br_is_root_bridge(br))
207                         br->max_age = br->bridge_max_age;
208                 spin_unlock_bh(&br->lock);
209                 return 0;
210
211         case BRCTL_SET_AGEING_TIME:
212                 if (!capable(CAP_NET_ADMIN))
213                         return -EPERM;
214
215                 br->ageing_time = clock_t_to_jiffies(args[1]);
216                 return 0;
217
218         case BRCTL_GET_PORT_INFO:
219         {
220                 struct __port_info p;
221                 struct net_bridge_port *pt;
222
223                 rcu_read_lock();
224                 if ((pt = br_get_port(br, args[2])) == NULL) {
225                         rcu_read_unlock();
226                         return -EINVAL;
227                 }
228
229                 memset(&p, 0, sizeof(struct __port_info));
230                 memcpy(&p.designated_root, &pt->designated_root, 8);
231                 memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
232                 p.port_id = pt->port_id;
233                 p.designated_port = pt->designated_port;
234                 p.path_cost = pt->path_cost;
235                 p.designated_cost = pt->designated_cost;
236                 p.state = pt->state;
237                 p.top_change_ack = pt->topology_change_ack;
238                 p.config_pending = pt->config_pending;
239                 p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
240                 p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
241                 p.hold_timer_value = br_timer_value(&pt->hold_timer);
242
243                 rcu_read_unlock();
244
245                 if (copy_to_user((void __user *)args[1], &p, sizeof(p)))
246                         return -EFAULT;
247
248                 return 0;
249         }
250
251         case BRCTL_SET_BRIDGE_STP_STATE:
252                 if (!capable(CAP_NET_ADMIN))
253                         return -EPERM;
254
255                 br->stp_enabled = args[1]?1:0;
256                 return 0;
257
258         case BRCTL_SET_BRIDGE_PRIORITY:
259                 if (!capable(CAP_NET_ADMIN))
260                         return -EPERM;
261
262                 spin_lock_bh(&br->lock);
263                 br_stp_set_bridge_priority(br, args[1]);
264                 spin_unlock_bh(&br->lock);
265                 return 0;
266
267         case BRCTL_SET_PORT_PRIORITY:
268         {
269                 struct net_bridge_port *p;
270                 int ret = 0;
271
272                 if (!capable(CAP_NET_ADMIN))
273                         return -EPERM;
274
275                 if (args[2] >= (1<<(16-BR_PORT_BITS)))
276                         return -ERANGE;
277
278                 spin_lock_bh(&br->lock);
279                 if ((p = br_get_port(br, args[1])) == NULL) 
280                         ret = -EINVAL;
281                 else
282                         br_stp_set_port_priority(p, args[2]);
283                 spin_unlock_bh(&br->lock);
284                 return ret;
285         }
286
287         case BRCTL_SET_PATH_COST:
288         {
289                 struct net_bridge_port *p;
290                 int ret = 0;
291
292                 if (!capable(CAP_NET_ADMIN))
293                         return -EPERM;
294
295                 spin_lock_bh(&br->lock);
296                 if ((p = br_get_port(br, args[1])) == NULL)
297                         ret = -EINVAL;
298                 else
299                         br_stp_set_path_cost(p, args[2]);
300                 spin_unlock_bh(&br->lock);
301                 return ret;
302         }
303
304         case BRCTL_GET_FDB_ENTRIES:
305                 return get_fdb_entries(br, (void __user *)args[1], 
306                                        args[2], args[3]);
307         }
308
309         return -EOPNOTSUPP;
310 }
311
312 static int old_deviceless(void __user *uarg)
313 {
314         unsigned long args[3];
315
316         if (copy_from_user(args, uarg, sizeof(args)))
317                 return -EFAULT;
318
319         switch (args[0]) {
320         case BRCTL_GET_VERSION:
321                 return BRCTL_VERSION;
322
323         case BRCTL_GET_BRIDGES:
324         {
325                 int *indices;
326                 int ret = 0;
327
328                 if (args[2] >= 2048)
329                         return -ENOMEM;
330                 indices = kmalloc(args[2]*sizeof(int), GFP_KERNEL);
331                 if (indices == NULL)
332                         return -ENOMEM;
333
334                 memset(indices, 0, args[2]*sizeof(int));
335                 args[2] = get_bridge_ifindices(indices, args[2]);
336
337                 ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
338                         ? -EFAULT : args[2];
339
340                 kfree(indices);
341                 return ret;
342         }
343
344         case BRCTL_ADD_BRIDGE:
345         case BRCTL_DEL_BRIDGE:
346         {
347                 char buf[IFNAMSIZ];
348
349                 if (!capable(CAP_NET_ADMIN))
350                         return -EPERM;
351
352                 if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
353                         return -EFAULT;
354
355                 buf[IFNAMSIZ-1] = 0;
356
357                 if (args[0] == BRCTL_ADD_BRIDGE)
358                         return br_add_bridge(buf);
359
360                 return br_del_bridge(buf);
361         }
362         }
363
364         return -EOPNOTSUPP;
365 }
366
367 int br_ioctl_deviceless_stub(unsigned int cmd, void __user *uarg)
368 {
369         switch (cmd) {
370         case SIOCGIFBR:
371         case SIOCSIFBR:
372                 return old_deviceless(uarg);
373                 
374         case SIOCBRADDBR:
375         case SIOCBRDELBR:
376         {
377                 char buf[IFNAMSIZ];
378
379                 if (!capable(CAP_NET_ADMIN))
380                         return -EPERM;
381
382                 if (copy_from_user(buf, uarg, IFNAMSIZ))
383                         return -EFAULT;
384
385                 buf[IFNAMSIZ-1] = 0;
386                 if (cmd == SIOCBRADDBR)
387                         return br_add_bridge(buf);
388
389                 return br_del_bridge(buf);
390         }
391         }
392         return -EOPNOTSUPP;
393 }
394
395 int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
396 {
397         struct net_bridge *br = netdev_priv(dev);
398
399         switch(cmd) {
400         case SIOCDEVPRIVATE:
401                 return old_dev_ioctl(dev, rq, cmd);
402
403         case SIOCBRADDIF:
404         case SIOCBRDELIF:
405                 return add_del_if(br, rq->ifr_ifindex, cmd == SIOCBRADDIF);
406
407         }
408
409         pr_debug("Bridge does not support ioctl 0x%x\n", cmd);
410         return -EOPNOTSUPP;
411 }