inet: Fix get port to handle zero port number with soreuseport set

A user may call listen with binding an explicit port with the intent
that the kernel will assign an available port to the socket. In this
case inet_csk_get_port does a port scan. For such sockets, the user may
also set soreuseport with the intent a creating more sockets for the
port that is selected. The problem is that the initial socket being
opened could inadvertently choose an existing and unreleated port
number that was already created with soreuseport.

This patch adds a boolean parameter to inet_bind_conflict that indicates
rather soreuseport is allowed for the check (in addition to
sk->sk_reuseport). In calls to inet_bind_conflict from inet_csk_get_port
the argument is set to true if an explicit port is being looked up (snum
argument is nonzero), and is false if port scan is done.

Signed-off-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/inet6_connection_sock.h b/include/net/inet6_connection_sock.h
index 954ad6bfb56a2c0dd90abb1c559c2990ce8596e5..3212b39b5bfcb543fff0f1cd174f2124e3b9cc45 100644 (file)
--- a/include/net/inet6_connection_sock.h
+++ b/include/net/inet6_connection_sock.h
@@ -22,7 +22,8 @@ struct sock;
 struct sockaddr;
 
 int inet6_csk_bind_conflict(const struct sock *sk,
-                           const struct inet_bind_bucket *tb, bool relax);
+                           const struct inet_bind_bucket *tb, bool relax,
+                           bool soreuseport_ok);
 
 struct dst_entry *inet6_csk_route_req(const struct sock *sk, struct flowi6 *fl6,
                                      const struct request_sock *req, u8 proto);

diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 146054ceea8e0566f79739b1ed115dea53423258..85ee3879499ebc4ebd63a59b2c425918858154c6 100644 (file)
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -63,7 +63,8 @@ struct inet_connection_sock_af_ops {
 #endif
        void        (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
        int         (*bind_conflict)(const struct sock *sk,
-                                    const struct inet_bind_bucket *tb, bool relax);
+                                    const struct inet_bind_bucket *tb,
+                                    bool relax, bool soreuseport_ok);
        void        (*mtu_reduced)(struct sock *sk);
 };
 
@@ -261,7 +262,8 @@ inet_csk_rto_backoff(const struct inet_connection_sock *icsk,
 struct sock *inet_csk_accept(struct sock *sk, int flags, int *err);
 
 int inet_csk_bind_conflict(const struct sock *sk,
-                          const struct inet_bind_bucket *tb, bool relax);
+                          const struct inet_bind_bucket *tb, bool relax,
+                          bool soreuseport_ok);
 int inet_csk_get_port(struct sock *sk, unsigned short snum);
 
 struct dst_entry *inet_csk_route_req(const struct sock *sk, struct flowi4 *fl4,

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index f59838a60ea593849d76758e60033d1339732f4d..19ea045c50ed7d9bfc885e13a67f6bca6075674c 100644 (file)
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -45,11 +45,12 @@ void inet_get_local_port_range(struct net *net, int *low, int *high)
 EXPORT_SYMBOL(inet_get_local_port_range);
 
 int inet_csk_bind_conflict(const struct sock *sk,
-                          const struct inet_bind_bucket *tb, bool relax)
+                          const struct inet_bind_bucket *tb, bool relax,
+                          bool reuseport_ok)
 {
        struct sock *sk2;
-       int reuse = sk->sk_reuse;
-       int reuseport = sk->sk_reuseport;
+       bool reuse = sk->sk_reuse;
+       bool reuseport = !!sk->sk_reuseport && reuseport_ok;
        kuid_t uid = sock_i_uid((struct sock *)sk);
 
        /*
@@ -105,6 +106,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
        struct inet_bind_bucket *tb;
        kuid_t uid = sock_i_uid(sk);
        u32 remaining, offset;
+       bool reuseport_ok = !!snum;
 
        if (port) {
 have_port:
@@ -165,7 +167,8 @@ other_parity_scan:
                                        smallest_size = tb->num_owners;
                                        smallest_port = port;
                                }
-                               if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false))
+                               if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, false,
+                                                                             reuseport_ok))
                                        goto tb_found;
                                goto next_port;
                        }
@@ -206,7 +209,8 @@ tb_found:
                      sk->sk_reuseport && uid_eq(tb->fastuid, uid))) &&
                    smallest_size == -1)
                        goto success;
-               if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, true)) {
+               if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb, true,
+                                                            reuseport_ok)) {
                        if ((reuse ||
                             (tb->fastreuseport > 0 &&
                              sk->sk_reuseport &&

diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 1c86c478f578b49373e61a4c397f23f3dc7f3fc6..7396e75e161b83ee2b8a426bce0eb770884960dd 100644 (file)
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -29,11 +29,12 @@
 #include <net/sock_reuseport.h>
 
 int inet6_csk_bind_conflict(const struct sock *sk,
-                           const struct inet_bind_bucket *tb, bool relax)
+                           const struct inet_bind_bucket *tb, bool relax,
+                           bool reuseport_ok)
 {
        const struct sock *sk2;
-       int reuse = sk->sk_reuse;
-       int reuseport = sk->sk_reuseport;
+       bool reuse = !!sk->sk_reuse;
+       bool reuseport = !!sk->sk_reuseport && reuseport_ok;
        kuid_t uid = sock_i_uid((struct sock *)sk);
 
        /* We must walk the whole port owner list in this case. -DaveM */