netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] net: qrtr: fix usage of idr in port assignment to socket
@ 2020-08-14 10:10 Necip Fazil Yildiran
  2020-08-14 20:55 ` David Miller
  0 siblings, 1 reply; 3+ messages in thread
From: Necip Fazil Yildiran @ 2020-08-14 10:10 UTC (permalink / raw)
  To: davem, kuba
  Cc: courtney.cavin, bjorn.andersson, netdev, linux-kernel, dvyukov,
	elver, andreyknvl, glider, necip, syzbot+f31428628ef672716ea8

From: Necip Fazil Yildiran <necip@google.com>

Passing large uint32 sockaddr_qrtr.port numbers for port allocation
triggers a warning within idr_alloc() since the port number is cast
to int, and thus interpreted as a negative number. This leads to
the rejection of such valid port numbers in qrtr_port_assign() as
idr_alloc() fails.

To avoid the problem, switch to idr_alloc_u32() instead.

Fixes: bdabad3e36 ("net: Add Qualcomm IPC router")
Reported-by: syzbot+f31428628ef672716ea8@syzkaller.appspotmail.com
Signed-off-by: Necip Fazil Yildiran <necip@google.com>
---
 net/qrtr/qrtr.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index b4c0db0b7d31..52d0707df776 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -693,22 +693,24 @@ static void qrtr_port_remove(struct qrtr_sock *ipc)
 static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
 {
 	int rc;
+	u32 min_port;
 
 	mutex_lock(&qrtr_port_lock);
 	if (!*port) {
-		rc = idr_alloc(&qrtr_ports, ipc,
-			       QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1,
-			       GFP_ATOMIC);
-		if (rc >= 0)
-			*port = rc;
+		min_port = QRTR_MIN_EPH_SOCKET;
+		rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
+		if (!rc)
+			*port = min_port;
 	} else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {
 		rc = -EACCES;
 	} else if (*port == QRTR_PORT_CTRL) {
-		rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC);
+		min_port = 0;
+		rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC);
 	} else {
-		rc = idr_alloc(&qrtr_ports, ipc, *port, *port + 1, GFP_ATOMIC);
-		if (rc >= 0)
-			*port = rc;
+		min_port = *port;
+		rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, GFP_ATOMIC);
+		if (!rc)
+			*port = min_port;
 	}
 	mutex_unlock(&qrtr_port_lock);
 
-- 
2.28.0.220.ged08abb693-goog


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] net: qrtr: fix usage of idr in port assignment to socket
  2020-08-14 10:10 [PATCH] net: qrtr: fix usage of idr in port assignment to socket Necip Fazil Yildiran
@ 2020-08-14 20:55 ` David Miller
  2020-08-16 15:36   ` Dmitry Vyukov
  0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2020-08-14 20:55 UTC (permalink / raw)
  To: fazilyildiran
  Cc: kuba, courtney.cavin, bjorn.andersson, netdev, linux-kernel,
	dvyukov, elver, andreyknvl, glider, necip,
	syzbot+f31428628ef672716ea8

From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Date: Fri, 14 Aug 2020 10:10:00 +0000

> diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
> index b4c0db0b7d31..52d0707df776 100644
> --- a/net/qrtr/qrtr.c
> +++ b/net/qrtr/qrtr.c
> @@ -693,22 +693,24 @@ static void qrtr_port_remove(struct qrtr_sock *ipc)
>  static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
>  {
>  	int rc;
> +	u32 min_port;

Please use reverse christmas tree ordering for local variables.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] net: qrtr: fix usage of idr in port assignment to socket
  2020-08-14 20:55 ` David Miller
@ 2020-08-16 15:36   ` Dmitry Vyukov
  0 siblings, 0 replies; 3+ messages in thread
From: Dmitry Vyukov @ 2020-08-16 15:36 UTC (permalink / raw)
  To: David Miller
  Cc: Necip F. Yıldıran, Jakub Kicinski, courtney.cavin,
	Bjorn Andersson, netdev, LKML, Marco Elver, Andrey Konovalov,
	Alexander Potapenko, Necip Fazil Yildiran,
	syzbot+f31428628ef672716ea8

On Fri, Aug 14, 2020 at 10:55 PM David Miller <davem@davemloft.net> wrote:
>
> From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
> Date: Fri, 14 Aug 2020 10:10:00 +0000
>
> > diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
> > index b4c0db0b7d31..52d0707df776 100644
> > --- a/net/qrtr/qrtr.c
> > +++ b/net/qrtr/qrtr.c
> > @@ -693,22 +693,24 @@ static void qrtr_port_remove(struct qrtr_sock *ipc)
> >  static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
> >  {
> >       int rc;
> > +     u32 min_port;
>
> Please use reverse christmas tree ordering for local variables.

If Dave's comment is fixed:

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>

(add this tag to the v2 of this patch).

Just in case: "reverse christmas tree" is when variable declarations
are sorted by line length (longest first).

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2020-08-16 15:36 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-14 10:10 [PATCH] net: qrtr: fix usage of idr in port assignment to socket Necip Fazil Yildiran
2020-08-14 20:55 ` David Miller
2020-08-16 15:36   ` Dmitry Vyukov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).