1 files changed, 53 insertions, 60 deletions

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 8f661195d09d..a9139682c49b 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -15,6 +15,18 @@
 #include <net/netlink.h>
 #include "br_private.h"
 
+static inline size_t br_nlmsg_size(void)
+{
+        return NLMSG_ALIGN(sizeof(struct ifinfomsg))
+               + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
+               + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
+               + nla_total_size(4) /* IFLA_MASTER */
+               + nla_total_size(4) /* IFLA_MTU */
+               + nla_total_size(4) /* IFLA_LINK */
+               + nla_total_size(1) /* IFLA_OPERSTATE */
+               + nla_total_size(1); /* IFLA_PROTINFO */
+}
+
 /*
  * Create one netlink message for one interface
  * Contains port and master info as well as carrier and bridge state.
@@ -24,51 +36,43 @@ static int br_fill_ifinfo(struct sk_buff *skb, const struct net_bridge_port *por
 {
         const struct net_bridge *br = port->br;
         const struct net_device *dev = port->dev;
-        struct ifinfomsg *r;
+        struct ifinfomsg *hdr;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
-        u32 mtu = dev->mtu;
         u8 operstate = netif_running(dev) ? dev->operstate : IF_OPER_DOWN;
-        u8 portstate = port->state;
 
         pr_debug("br_fill_info event %d port %s master %s\n",
                  event, dev->name, br->dev->name);
 
-        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
-        r = NLMSG_DATA(nlh);
-        r->ifi_family = AF_BRIDGE;
-        r->__ifi_pad = 0;
-        r->ifi_type = dev->type;
-        r->ifi_index = dev->ifindex;
-        r->ifi_flags = dev_get_flags(dev);
-        r->ifi_change = 0;
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
+        if (nlh == NULL)
+                return -ENOBUFS;
 
-        RTA_PUT(skb, IFLA_IFNAME, strlen(dev->name)+1, dev->name);
+        hdr = nlmsg_data(nlh);
+        hdr->ifi_family = AF_BRIDGE;
+        hdr->__ifi_pad = 0;
+        hdr->ifi_type = dev->type;
+        hdr->ifi_index = dev->ifindex;
+        hdr->ifi_flags = dev_get_flags(dev);
+        hdr->ifi_change = 0;
 
-        RTA_PUT(skb, IFLA_MASTER, sizeof(int), &br->dev->ifindex);
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
+        NLA_PUT_U32(skb, IFLA_MASTER, br->dev->ifindex);
+        NLA_PUT_U32(skb, IFLA_MTU, dev->mtu);
+        NLA_PUT_U8(skb, IFLA_OPERSTATE, operstate);
 
         if (dev->addr_len)
-                RTA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
+                NLA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
 
-        RTA_PUT(skb, IFLA_MTU, sizeof(mtu), &mtu);
         if (dev->ifindex != dev->iflink)
-                RTA_PUT(skb, IFLA_LINK, sizeof(int), &dev->iflink);
-
-
-        RTA_PUT(skb, IFLA_OPERSTATE, sizeof(operstate), &operstate);
+                NLA_PUT_U32(skb, IFLA_LINK, dev->iflink);
 
         if (event == RTM_NEWLINK)
-                RTA_PUT(skb, IFLA_PROTINFO, sizeof(portstate), &portstate);
-
-        nlh->nlmsg_len = skb->tail - b;
-
-        return skb->len;
+                NLA_PUT_U8(skb, IFLA_PROTINFO, port->state);
 
-nlmsg_failure:
-rtattr_failure:
+        return nlmsg_end(skb, nlh);
 
-        skb_trim(skb, b - skb->data);
-        return -EINVAL;
+nla_put_failure:
+        return nlmsg_cancel(skb, nlh);
 }
 
 /*
@@ -77,19 +81,16 @@ rtattr_failure:
 void br_ifinfo_notify(int event, struct net_bridge_port *port)
 {
         struct sk_buff *skb;
-        int payload = sizeof(struct ifinfomsg) + 128;
         int err = -ENOBUFS;
 
         pr_debug("bridge notify event=%d\n", event);
-        skb = nlmsg_new(nlmsg_total_size(payload), GFP_ATOMIC);
+        skb = nlmsg_new(br_nlmsg_size(), GFP_ATOMIC);
         if (skb == NULL)
                 goto errout;
 
         err = br_fill_ifinfo(skb, port, 0, 0, event, 0);
-        if (err < 0) {
-                kfree_skb(skb);
-                goto errout;
-        }
+        /* failure implies BUG in br_nlmsg_size() */
+        BUG_ON(err < 0);
 
         err = rtnl_notify(skb, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
 errout:
@@ -104,25 +105,18 @@ static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net_device *dev;
         int idx;
-        int s_idx = cb->args[0];
-        int err = 0;
 
         read_lock(&dev_base_lock);
         for (dev = dev_base, idx = 0; dev; dev = dev->next) {
-                struct net_bridge_port *p = dev->br_port;
-
                 /* not a bridge port */
-                if (!p)
-                        continue;
-
-                if (idx < s_idx)
-                        goto cont;
+                if (dev->br_port == NULL || idx < cb->args[0])
+                        goto skip;
 
-                err = br_fill_ifinfo(skb, p, NETLINK_CB(cb->skb).pid,
-                                     cb->nlh->nlmsg_seq, RTM_NEWLINK, NLM_F_MULTI);
-                if (err <= 0)
+                if (br_fill_ifinfo(skb, dev->br_port, NETLINK_CB(cb->skb).pid,
+                                   cb->nlh->nlmsg_seq, RTM_NEWLINK,
+                                   NLM_F_MULTI) < 0)
                         break;
-cont:
+skip:
                 ++idx;
         }
         read_unlock(&dev_base_lock);
@@ -138,26 +132,27 @@ cont:
  */
 static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
 {
-        struct rtattr  **rta = arg;
-        struct ifinfomsg *ifm = NLMSG_DATA(nlh);
+        struct ifinfomsg *ifm;
+        struct nlattr *protinfo;
         struct net_device *dev;
         struct net_bridge_port *p;
         u8 new_state;
 
+        if (nlmsg_len(nlh) < sizeof(*ifm))
+                return -EINVAL;
+
+        ifm = nlmsg_data(nlh);
         if (ifm->ifi_family != AF_BRIDGE)
                 return -EPFNOSUPPORT;
 
-        /* Must pass valid state as PROTINFO */
-        if (rta[IFLA_PROTINFO-1]) {
-                u8 *pstate = RTA_DATA(rta[IFLA_PROTINFO-1]);
-                new_state = *pstate;
-        } else
+        protinfo = nlmsg_find_attr(nlh, sizeof(*ifm), IFLA_PROTINFO);
+        if (!protinfo || nla_len(protinfo) < sizeof(u8))
                 return -EINVAL;
 
+        new_state = nla_get_u8(protinfo);
         if (new_state > BR_STATE_BLOCKING)
                 return -EINVAL;
 
-        /* Find bridge port */
         dev = __dev_get_by_index(ifm->ifi_index);
         if (!dev)
                 return -ENODEV;
@@ -170,10 +165,8 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
         if (p->br->stp_enabled)
                 return -EBUSY;
 
-        if (!netif_running(dev))
-                return -ENETDOWN;
-
-        if (!netif_carrier_ok(dev) && new_state != BR_STATE_DISABLED)
+        if (!netif_running(dev) ||
+            (!netif_carrier_ok(dev) && new_state != BR_STATE_DISABLED))
                 return -ENETDOWN;
 
         p->state = new_state;