net: qrtr: fix usage of idr in port assignment to socket (8dfddfb7) · Commits · 戴 / test

Passing large uint32 sockaddr_qrtr.port numbers for port allocation triggers a warning within idr_alloc() since the port number is cast to int, and thus interpreted as a negative number. This leads to the rejection of such valid port numbers in qrtr_port_assign() as idr_alloc() fails. To avoid the problem, switch to idr_alloc_u32() instead. Fixes: ("net: Add Qualcomm IPC router") Reported-by:

<syzbot+f31428628ef672716ea8@syzkaller.appspotmail.com> Signed-off-by:

Necip Fazil Yildiran <necip@google.com> Reviewed-by:

Dmitry Vyukov <dvyukov@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/qrtr/qrtr.c

+11 −9

Original line number	Diff line number	Diff line
		@@ -692,23 +692,25 @@ static void qrtr_port_remove(struct qrtr_sock *ipc)
		*/
		static int qrtr_port_assign(struct qrtr_sock ipc, int port)
		{
		u32 min_port;
		int rc;

		mutex_lock(&qrtr_port_lock);
		if (!*port) {
		rc = idr_alloc(&qrtr_ports, ipc,
		QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1,
		GFP_ATOMIC);
		if (rc >= 0)
		*port = rc;
		min_port = QRTR_MIN_EPH_SOCKET;
		rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
		if (!rc)
		*port = min_port;
		} else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {
		rc = -EACCES;
		} else if (*port == QRTR_PORT_CTRL) {
		rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC);
		min_port = 0;
		rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC);
		} else {
		rc = idr_alloc(&qrtr_ports, ipc, port, port + 1, GFP_ATOMIC);
		if (rc >= 0)
		*port = rc;
		min_port = *port;
		rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, GFP_ATOMIC);
		if (!rc)
		*port = min_port;
		}
		mutex_unlock(&qrtr_port_lock);

Admin message