@@ -744,7 +744,8 @@ static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
mutex_lock(&qrtr_port_lock);
if (!*port) {
min_port = QRTR_MIN_EPH_SOCKET;
- rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
+ rc = idr_alloc_cyclic(&qrtr_ports, ipc, &min_port,
+ QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
if (!rc)
*port = min_port;
} else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {
@@ -754,7 +755,8 @@ static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC);
} else {
min_port = *port;
- rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, GFP_ATOMIC);
+ rc = idr_alloc_cyclic(&qrtr_ports, ipc, &min_port,
+ *port, GFP_ATOMIC);
if (!rc)
*port = min_port;
}
From: Chris Lew <clew@codeaurora.org> There is a race for clients that open sockets before the control port is bound. If a client gets an idr that was allocated before the control port is bound, there is a chance the previous address owner sent lookup packets to the control port. The new address owner will get residual responses to this the lookup packets. Change the idr_alloc to idr_alloc_cyclic so new idr's are allocated instead of trying to reuse the freed idrs. --- net/qrtr/qrtr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)