ip_local_port_range low > high check

index 53ef0f4..686c0a4 100644
@@ -186,6 +186,61 @@ static int strategy_allowed_congestion_control(ctl_table *table, int __user *nam
 
 }
 
+static int proc_port_range(ctl_table *table, int write, struct file *filp,
+		    void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	int ret;
+	ctl_table tbl = {
+		.maxlen		= sizeof(sysctl_local_port_range),
+		.extra1		= ip_local_port_range_min,
+		.extra2		= ip_local_port_range_max
+	};
+	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
+	if (tbl.data == NULL)
+		return -ENOMEM;
+	memcpy(tbl.data, sysctl_local_port_range, tbl.maxlen);
+
+	ret = proc_dointvec_minmax(&tbl, write, filp, buffer, lenp, ppos);
+	if (write && ret == 0) {
+		int *data = (int *)tbl.data;
+		if (data[0] > data[1])
+			ret = -EINVAL;
+		else
+			memcpy(sysctl_local_port_range, data,
+					sizeof(sysctl_local_port_range));
+	}
+	kfree(tbl.data);
+	return ret;
+}
+
+int sysctl_strategy_port_range(ctl_table *table, int __user *name, int nlen,
+		void __user *oldval, size_t __user *oldlenp,
+		void __user *newval, size_t newlen)
+{
+	int ret;
+	ctl_table tbl = {
+		.maxlen		= sizeof(sysctl_local_port_range),
+		.extra1		= ip_local_port_range_min,
+		.extra2		= ip_local_port_range_max
+	};
+	tbl.data = kmalloc(tbl.maxlen, GFP_USER);
+	if (tbl.data == NULL)
+		return -ENOMEM;
+	memcpy(tbl.data, sysctl_local_port_range, tbl.maxlen);
+
+	ret = sysctl_intvec(&tbl, name, nlen, oldval, oldlenp, newval, newlen);
+	if (ret == 0 && newval && newlen) {
+		int *data = (int *)tbl.data;
+		if (data[0] > data[1])
+			ret = -EINVAL;
+		else
+			memcpy(sysctl_local_port_range, data,
+					sizeof(sysctl_local_port_range));
+	}
+	kfree(tbl.data);
+	return ret;
+}
+
 ctl_table ipv4_table[] = {
 	{
 		.ctl_name	= NET_IPV4_TCP_TIMESTAMPS,

@@ -427,8 +482,8 @@ ctl_table ipv4_table[] = {
 		.data		= &sysctl_local_port_range,
 		.maxlen		= sizeof(sysctl_local_port_range),
 		.mode		= 0644,
-		.proc_handler	= &proc_dointvec_minmax,
-		.strategy	= &sysctl_intvec,
+		.proc_handler	= &proc_port_range,
+		.strategy	= &sysctl_strategy_port_range,
 		.extra1		= ip_local_port_range_min,
 		.extra2		= ip_local_port_range_max
 	},

@@ -171,7 +171,8 @@ extern unsigned long snmp_fold_field(voi
 extern int snmp_mib_init(void *ptr[2], size_t mibsize, size_t mibalign);
 extern void snmp_mib_free(void *ptr[2]);
 
-extern int sysctl_local_port_range[2];
+extern void inet_get_local_port_range(int range[2]);
+
 extern int sysctl_ip_default_ttl;
 extern int sysctl_ip_nonlocal_bind;
 

@@ -33,6 +33,19 @@ EXPORT_SYMBOL(inet_csk_timer_bug_msg);
  * This array holds the first and last local port number.
  */
 int sysctl_local_port_range[2] = { 32768, 61000 };
+DEFINE_SEQLOCK(sysctl_port_range_lock);
+
+void inet_get_local_port_range(int range[2])
+{
+	unsigned seq;
+	do {
+		seq = read_seqbegin(&sysctl_port_range_lock);
+
+		range[0] = sysctl_local_port_range[0];
+		range[1] = sysctl_local_port_range[1];
+	} while (read_seqretry(&sysctl_port_range_lock, seq));
+}
+EXPORT_SYMBOL(inet_get_local_port_range);
 
 int inet_csk_bind_conflict(const struct sock *sk,
 			   const struct inet_bind_bucket *tb)

@@ -77,10 +90,11 @@ int inet_csk_get_port(struct inet_hashin
 
 	local_bh_disable();
 	if (!snum) {
-		int low = sysctl_local_port_range[0];
-		int high = sysctl_local_port_range[1];
-		int remaining = (high - low) + 1;
-		int rover = net_random() % (high - low) + low;
+		int remaining, range[2], rover;
+
+		inet_get_local_port_range(range);
+		remaining = range[1] - range[0];
+		rover = net_random() % (range[1] - range[0]) + range[0];
 
 		do {
 			head = &hashinfo->bhash[inet_bhashfn(rover, hashinfo->bhash_size)];

@@ -91,8 +105,8 @@ int inet_csk_get_port(struct inet_hashin
 			break;
 		next:
 			spin_unlock(&head->lock);
-			if (++rover > high)
-				rover = low;
+			if (++rover > range[1])
+				rover = range[0];
 		} while (--remaining > 0);
 
 		/* Exhausted local port range during search?  It is not

@@ -279,19 +279,18 @@ int inet_hash_connect(struct inet_timewa
 	int ret;
 
 	if (!snum) {
-		int low = sysctl_local_port_range[0];
-		int high = sysctl_local_port_range[1];
-		int range = high - low;
-		int i;
-		int port;
+		int i, count, range[2], port;
 		static u32 hint;
 		u32 offset = hint + inet_sk_port_offset(sk);
 		struct hlist_node *node;
 		struct inet_timewait_sock *tw = NULL;
 
+		inet_get_local_port_range(range);
+		count = range[1] - range[0];
+
 		local_bh_disable();
-		for (i = 1; i <= range; i++) {
-			port = low + (i + offset) % range;
+		for (i = 1; i <= count; i++) {
+			port = range[0] + (i + offset) % count;
 			head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)];
 			spin_lock(&head->lock);
 

101 lines not on this page · raw message

@@ -2470,6 +2470,5 @@ EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
 EXPORT_SYMBOL(tcp_proc_register);
 EXPORT_SYMBOL(tcp_proc_unregister);
 #endif
-EXPORT_SYMBOL(sysctl_local_port_range);
 EXPORT_SYMBOL(sysctl_tcp_low_latency);
 

@@ -147,13 +147,13 @@ int __udp_lib_get_port(struct sock *sk, 
 	write_lock_bh(&udp_hash_lock);
 
 	if (!snum) {
-		int i;
-		int low = sysctl_local_port_range[0];
-		int high = sysctl_local_port_range[1];
+		int i, range[2];
 		unsigned rover, best, best_size_so_far;
 
+		inet_get_local_port_range(range);
+
 		best_size_so_far = UINT_MAX;
-		best = rover = net_random() % (high - low) + low;
+		best = rover = net_random() % (range[1] - range[0]) + range[0];
 
 		/* 1st pass: look for empty (or shortest) hash chain */
 		for (i = 0; i < UDP_HTABLE_SIZE; i++) {

@@ -171,11 +171,9 @@ int __udp_lib_get_port(struct sock *sk, 
 			best = rover;
 		next:
 			/* fold back if end of range */
-			if (++rover > high)
-				rover = low + ((rover - low)
+			if (++rover > range[1])
+				rover = range[0] + ((rover - range[0])
 					       & (UDP_HTABLE_SIZE - 1));
-
-
 		}
 
 		/* 2nd pass: find hole in shortest hash chain */

@@ -184,8 +182,8 @@ int __udp_lib_get_port(struct sock *sk, 
 			if (! __udp_lib_lport_inuse(rover, udptable))
 				goto gotit;
 			rover += UDP_HTABLE_SIZE;
-			if (rover > high)
-				rover = low + ((rover - low)
+			if (rover > range[1])
+				rover = range[0] + ((rover - range[0])
 					       & (UDP_HTABLE_SIZE - 1));
 		}
 

@@ -254,18 +254,19 @@ int inet6_hash_connect(struct inet_timew
 	int ret;
 
 	if (snum == 0) {
-		const int low = sysctl_local_port_range[0];
-		const int high = sysctl_local_port_range[1];
-		const int range = high - low;
-		int i, port;
+		int range[2];
+		int i, port, count;
 		static u32 hint;
 		const u32 offset = hint + inet6_sk_port_offset(sk);
 		struct hlist_node *node;
 		struct inet_timewait_sock *tw = NULL;
 
+		inet_get_local_port_range(range);
+		count = range[1] - range[0];
+
 		local_bh_disable();
-		for (i = 1; i <= range; i++) {
-			port = low + (i + offset) % range;
+		for (i = 1; i <= count; i++) {
+			port = range[0] + (i + offset) % count;
 			head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)];
 			spin_lock(&head->lock);
 

@@ -3232,8 +3232,6 @@ static int selinux_socket_post_create(st
 /* Range of port numbers used to automatically bind.
    Need to determine whether we should perform a name_bind
    permission check between the socket and the port number. */
-#define ip_local_port_range_0 sysctl_local_port_range[0]
-#define ip_local_port_range_1 sysctl_local_port_range[1]
 
 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 {

@@ -3276,20 +3274,27 @@ static int selinux_socket_bind(struct so
 			addrp = (char *)&addr6->sin6_addr.s6_addr;
 		}
 
-		if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
-			   snum > ip_local_port_range_1)) {
-			err = security_port_sid(sk->sk_family, sk->sk_type,
-						sk->sk_protocol, snum, &sid);
-			if (err)
-				goto out;
-			AVC_AUDIT_DATA_INIT(&ad,NET);
-			ad.u.net.sport = htons(snum);
-			ad.u.net.family = family;
-			err = avc_has_perm(isec->sid, sid,
-					   isec->sclass,
-					   SOCKET__NAME_BIND, &ad);
-			if (err)
-				goto out;
+		if (snum) {
+			int range[2];
+
+			inet_get_local_port_range(range);
+
+			if (snum < max(PROT_SOCK, range[0]) || snum > range[1]) {
+				err = security_port_sid(sk->sk_family,
+							sk->sk_type,
+							sk->sk_protocol, snum,
+							&sid);
+				if (err)
+					goto out;
+				AVC_AUDIT_DATA_INIT(&ad,NET);
+				ad.u.net.sport = htons(snum);
+				ad.u.net.family = family;
+				err = avc_has_perm(isec->sid, sid,
+						   isec->sclass,
+						   SOCKET__NAME_BIND, &ad);
+				if (err)
+					goto out;
+			}
 		}
 		
 		switch(isec->sclass) {

@@ -1866,13 +1866,14 @@ err1:
 static int cma_alloc_any_port(struct idr *ps, struct rdma_id_private *id_priv)
 {
 	struct rdma_bind_list *bind_list;
-	int port, ret;
+	int port, ret, range[2];
 
 	bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
 	if (!bind_list)
 		return -ENOMEM;
 
 retry:
+	/* FIXME: add proper port randomization */
 	do {
 		ret = idr_get_new_above(ps, bind_list, next_port, &port);
 	} while ((ret == -EAGAIN) && idr_pre_get(ps, GFP_KERNEL));

@@ -1880,18 +1881,20 @@ retry:
 	if (ret)
 		goto err1;
 
-	if (port > sysctl_local_port_range[1]) {
-		if (next_port != sysctl_local_port_range[0]) {
+	inet_get_local_port_range(range);
+
+	if (port > range[1]) {
+		if (next_port != range[0]) {
 			idr_remove(ps, port);
-			next_port = sysctl_local_port_range[0];
+			next_port = range[0];
 			goto retry;
 		}
 		ret = -EADDRNOTAVAIL;
 		goto err2;
 	}
 
-	if (port == sysctl_local_port_range[1])
-		next_port = sysctl_local_port_range[0];
+	if (port == range[1])
+		next_port = range[0];
 	else
 		next_port = port + 1;
 

@@ -2769,12 +2772,11 @@ static void cma_remove_one(struct ib_dev
 
 static int cma_init(void)
 {
-	int ret;
+	int ret, range[2];
+
+	inet_get_local_port_range(range);
+	next_port = net_random() % (range[1] - range[0]) + range[0];
 
-	get_random_bytes(&next_port, sizeof next_port);
-	next_port = ((unsigned int) next_port %
-		    (sysctl_local_port_range[1] - sysctl_local_port_range[0])) +
-		    sysctl_local_port_range[0];
 	cma_wq = create_singlethread_workqueue("rdma_cm");
 	if (!cma_wq)
 		return -ENOMEM;

@@ -1173,7 +1173,6 @@ SCTP_STATIC __init int sctp_init(void)
 	}
 
 	spin_lock_init(&sctp_port_alloc_lock);
-	sctp_port_rover = sysctl_local_port_range[0] - 1;
 
 	printk(KERN_INFO "SCTP: Hash tables configured "
 			 "(established %d bind %d)\n",

@@ -5314,26 +5314,19 @@ static long sctp_get_port_local(struct s
 	sctp_local_bh_disable();
 
 	if (snum == 0) {
-		/* Search for an available port.
-		 *
-		 * 'sctp_port_rover' was the last port assigned, so
-		 * we start to search from 'sctp_port_rover +
-		 * 1'. What we do is first check if port 'rover' is
-		 * already in the hash table; if not, we use that; if
-		 * it is, we try next.
-		 */
-		int low = sysctl_local_port_range[0];
-		int high = sysctl_local_port_range[1];
-		int remaining = (high - low) + 1;
-		int rover;
-		int index;
+		/* Search for an available port. */
+		int index, rover, remaining, range[2];
+
+		inet_get_local_port_range(range);
+		remaining = range[1] - range[0];
+		rover = net_random() % remaining + range[0];
 
 		sctp_spin_lock(&sctp_port_alloc_lock);
-		rover = sctp_port_rover;
 		do {
 			rover++;
-			if ((rover < low) || (rover > high))
-				rover = low;
+			if ((rover < range[0]) || (rover > range[1]))
+				rover = range[0];
+
 			index = sctp_phashfn(rover);
 			head = &sctp_port_hashtable[index];
 			sctp_spin_lock(&head->lock);

@@ -5344,7 +5337,6 @@ static long sctp_get_port_local(struct s
 		next:
 			sctp_spin_unlock(&head->lock);
 		} while (--remaining > 0);
-		sctp_port_rover = rover;
 		sctp_spin_unlock(&sctp_port_alloc_lock);
 
 		/* Exhausted local port range during search? */