iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'bridge-ioctl-fixes'

Browse Source 
Nikolay Aleksandrov says:

====================
net: bridge: fix recent ioctl changes

These are three fixes for the recent bridge removal of ndo_do_ioctl
done by commit ad2f99aedf8f ("net: bridge: move bridge ioctls out of
.ndo_do_ioctl"). Patch 01 fixes a deadlock of the new bridge ioctl
hook lock and rtnl by taking a netdev reference and always taking the
bridge ioctl lock first then rtnl from within the bridge hook.
Patch 02 fixes old_deviceless() bridge calls device name argument, and
patch 03 checks in dev_ifsioc()'s SIOCBRADD/DELIF cases if the netdevice is
actually a bridge before interpreting its private ptr as net_bridge.

Patch 01 was tested by running old bridge-utils commands with lockdep
enabled. Patch 02 was tested again by using bridge-utils and using the
respective ioctl calls on a "up" bridge device. Patch 03 was tested by
using the addif ioctl on a non-bridge device (e.g. loopback).
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2021-08-05 11:36:59 +01:00
commit d15040a338
3 changed files with 34 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/bridge/br_if.c
View File

@ -456,7 +456,7 @@ int br_add_bridge(struct net *net, const char *name)
dev_net_set(dev, net);
dev->rtnl_link_ops = &br_link_ops;
res = register_netdev(dev);
res = register_netdevice(dev);
if (res)
free_netdev(dev);
return res;
@ -467,7 +467,6 @@ int br_del_bridge(struct net *net, const char *name)
struct net_device *dev;
int ret = 0;
rtnl_lock();
dev = __dev_get_by_name(net, name);
if (dev == NULL)
ret = -ENXIO; /* Could not find device */
@ -485,7 +484,6 @@ int br_del_bridge(struct net *net, const char *name)
else
br_dev_delete(dev, NULL);
rtnl_unlock();
return ret;
}

39
net/bridge/br_ioctl.c
View File

@ -351,7 +351,7 @@ static int old_deviceless(struct net *net, void __user *uarg)
if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (copy_from_user(buf, uarg, IFNAMSIZ))
if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
return -EFAULT;
buf[IFNAMSIZ-1] = 0;
@ -369,33 +369,44 @@ static int old_deviceless(struct net *net, void __user *uarg)
int br_ioctl_stub(struct net *net, struct net_bridge *br, unsigned int cmd,
struct ifreq *ifr, void __user *uarg)
{
int ret = -EOPNOTSUPP;
rtnl_lock();
switch (cmd) {
case SIOCGIFBR:
case SIOCSIFBR:
return old_deviceless(net, uarg);
ret = old_deviceless(net, uarg);
break;
case SIOCBRADDBR:
case SIOCBRDELBR:
{
char buf[IFNAMSIZ];
if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
ret = -EPERM;
break;
}
if (copy_from_user(buf, uarg, IFNAMSIZ))
return -EFAULT;
if (copy_from_user(buf, uarg, IFNAMSIZ)) {
ret = -EFAULT;
break;
}
buf[IFNAMSIZ-1] = 0;
if (cmd == SIOCBRADDBR)
return br_add_bridge(net, buf);
return br_del_bridge(net, buf);
ret = br_add_bridge(net, buf);
else
ret = br_del_bridge(net, buf);
}
break;
case SIOCBRADDIF:
case SIOCBRDELIF:
return add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF);
ret = add_del_if(br, ifr->ifr_ifindex, cmd == SIOCBRADDIF);
break;
}
return -EOPNOTSUPP;
rtnl_unlock();
return ret;
}

9
net/core/dev_ioctl.c
View File

@ -379,7 +379,14 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data,
case SIOCBRDELIF:
if (!netif_device_present(dev))
return -ENODEV;
return br_ioctl_call(net, netdev_priv(dev), cmd, ifr, NULL);
if (!netif_is_bridge_master(dev))
return -EOPNOTSUPP;
dev_hold(dev);
rtnl_unlock();
err = br_ioctl_call(net, netdev_priv(dev), cmd, ifr, NULL);
dev_put(dev);
rtnl_lock();
return err;
case SIOCSHWTSTAMP:
err = net_hwtstamp_validate(ifr);