[PATCH 4.19 004/125] net: qrtr: fix usage of idr in port assignment to socket

[Greg Kroah-Hartman]

From: Necip Fazil Yildiran <ne...@google.com>

[ Upstream commit 8dfddfb79653df7c38a9c8c4c034f242a36acee9 ]

Passing large uint32 sockaddr_qrtr.port numbers for port allocation
triggers a warning within idr_alloc() since the port number is cast
to int, and thus interpreted as a negative number. This leads to
the rejection of such valid port numbers in qrtr_port_assign() as
idr_alloc() fails.

To avoid the problem, switch to idr_alloc_u32() instead.

Fixes: bdabad3e363d ("net: Add Qualcomm IPC router")
Reported-by: syzbot+f31428628ef672716...@syzkaller.appspotmail.com
Signed-off-by: Necip Fazil Yildiran <ne...@google.com>
Reviewed-by: Dmitry Vyukov <dvyu...@google.com>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 net/qrtr/qrtr.c |   20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -554,23 +554,25 @@ static void qrtr_port_remove(struct qrtr
  */
 static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
 {
+       u32 min_port;
        int rc;
 
        mutex_lock(&qrtr_port_lock);
        if (!*port) {
-               rc = idr_alloc(&qrtr_ports, ipc,
-                              QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1,
-                              GFP_ATOMIC);
-               if (rc >= 0)
-                       *port = rc;
+               min_port = QRTR_MIN_EPH_SOCKET;
+               rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 
QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
+               if (!rc)
+                       *port = min_port;
        } else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {
                rc = -EACCES;
        } else if (*port == QRTR_PORT_CTRL) {
-               rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC);
+               min_port = 0;
+               rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC);
        } else {
-               rc = idr_alloc(&qrtr_ports, ipc, *port, *port + 1, GFP_ATOMIC);
-               if (rc >= 0)
-                       *port = rc;
+               min_port = *port;
+               rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, 
GFP_ATOMIC);
+               if (!rc)
+                       *port = min_port;
        }
        mutex_unlock(&qrtr_port_lock);