1 files changed, 17 insertions, 11 deletions

diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index eeee218eed80..6a6433daaf27 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -21,12 +21,12 @@
 #include "br_private.h"
 
 /* called with RTNL */
-static int get_bridge_ifindices(int *indices, int num)
+static int get_bridge_ifindices(struct net *net, int *indices, int num)
 {
         struct net_device *dev;
         int i = 0;
 
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 if (i >= num)
                         break;
                 if (dev->priv_flags & IFF_EBRIDGE)
@@ -89,7 +89,7 @@ static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        dev = dev_get_by_index(&init_net, ifindex);
+        dev = dev_get_by_index(dev_net(br->dev), ifindex);
         if (dev == NULL)
                 return -EINVAL;
 
@@ -188,15 +188,21 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 return 0;
 
         case BRCTL_SET_BRIDGE_HELLO_TIME:
+        {
+                unsigned long t = clock_t_to_jiffies(args[1]);
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
+                if (t < HZ)
+                        return -EINVAL;
+
                 spin_lock_bh(&br->lock);
-                br->bridge_hello_time = clock_t_to_jiffies(args[1]);
+                br->bridge_hello_time = t;
                 if (br_is_root_bridge(br))
                         br->hello_time = br->bridge_hello_time;
                 spin_unlock_bh(&br->lock);
                 return 0;
+        }
 
         case BRCTL_SET_BRIDGE_MAX_AGE:
                 if (!capable(CAP_NET_ADMIN))
@@ -309,7 +315,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         return -EOPNOTSUPP;
 }
 
-static int old_deviceless(void __user *uarg)
+static int old_deviceless(struct net *net, void __user *uarg)
 {
         unsigned long args[3];
 
@@ -331,7 +337,7 @@ static int old_deviceless(void __user *uarg)
                 if (indices == NULL)
                         return -ENOMEM;
 
-                args[2] = get_bridge_ifindices(indices, args[2]);
+                args[2] = get_bridge_ifindices(net, indices, args[2]);
 
                 ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
                         ? -EFAULT : args[2];
@@ -354,9 +360,9 @@ static int old_deviceless(void __user *uarg)
                 buf[IFNAMSIZ-1] = 0;
 
                 if (args[0] == BRCTL_ADD_BRIDGE)
-                        return br_add_bridge(buf);
+                        return br_add_bridge(net, buf);
 
-                return br_del_bridge(buf);
+                return br_del_bridge(net, buf);
         }
         }
 
@@ -368,7 +374,7 @@ int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *uar
         switch (cmd) {
         case SIOCGIFBR:
         case SIOCSIFBR:
-                return old_deviceless(uarg);
+                return old_deviceless(net, uarg);
 
         case SIOCBRADDBR:
         case SIOCBRDELBR:
@@ -383,9 +389,9 @@ int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *uar
 
                 buf[IFNAMSIZ-1] = 0;
                 if (cmd == SIOCBRADDBR)
-                        return br_add_bridge(buf);
+                        return br_add_bridge(net, buf);
 
-                return br_del_bridge(buf);
+                return br_del_bridge(net, buf);
         }
         }
         return -EOPNOTSUPP;