Netdev List
 help / color / mirror / Atom feed
From: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
To: linux-arm-msm@vger.kernel.org, Manivannan Sadhasivam <mani@kernel.org>
Cc: Eric Dumazet <edumazet@google.com>,
	Kuniyuki Iwashima <kuniyu@google.com>,
	Paolo Abeni <pabeni@redhat.com>,
	Willem de Bruijn <willemb@google.com>,
	"David S . Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>, Simon Horman <horms@kernel.org>,
	Marcel Holtmann <marcel@holtmann.org>,
	Andy Gross <agross@kernel.org>, Mihai Moldovan <ionic@ionic.de>,
	Denis Kenzior <denkenz@gmail.com>,
	Juha-Matti Tilli <juha-matti.tilli@iki.fi>,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH v6 04/15] net: qrtr: use only low 16 bits of node/port in 32-bit systems
Date: Tue,  1 Sep 2026 16:19:23 +0300	[thread overview]
Message-ID: <20260901131934.225991-5-juha-matti.tilli@iki.fi> (raw)
In-Reply-To: <20260901131934.225991-1-juha-matti.tilli@iki.fi>

The node id is generally a single fixed value hardcoded into device
firmware. If it happens to be larger than 16 bits on a 32-bit system,
using the value modulo 65536 is enough. It is not necessary to check it
for being in range. Evidence of this is a prior implementation that fit
node_id (u32) and port (u32) into unsigned long in 32-bit systems, in a
manner that completely discarded all bits of node_id. Do the same for
port: don't check for it being in range.

This arguably creates a bug where node_id could clash with a node_id
that has the same low-order 16 bits, or a port could clash with a port
that has the same low-order 16 bits. But it's probably better than
discarding all bits of node and using only bits from port. It's probably
also better than failing if either node or port is out-of-range.

Signed-off-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
---
 net/qrtr/af_qrtr.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index f2edbd2e9dea9..b2cb05f2480e0 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -252,9 +252,9 @@ static int qrtr_tx_resume(struct qrtr_node *node, struct sk_buff *skb)
 	struct qrtr_tx_flow *flow;
 	unsigned long key = 0;
 
-	if (remote_node > QRTR_INDEX_HALF_UNSIGNED_MAX ||
-	    remote_port > QRTR_INDEX_HALF_UNSIGNED_MAX)
-		return -EINVAL;
+	/* Don't check node/port for the valid range, use only low
+	 * 16 bits on 32-bit architectures.
+	 */
 
 	key = ((unsigned long)(remote_node) << QRTR_INDEX_HALF_BITS) |
 	      ((unsigned long)(remote_port) & QRTR_INDEX_HALF_UNSIGNED_MAX);
@@ -295,11 +295,9 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
 	int confirm_rx = 0;
 	int ret;
 
-	if (dest_node < QRTR_INDEX_HALF_SIGNED_MIN ||
-	    dest_node > QRTR_INDEX_HALF_SIGNED_MAX ||
-	    dest_port < QRTR_INDEX_HALF_SIGNED_MIN ||
-	    dest_port > QRTR_INDEX_HALF_SIGNED_MAX)
-		return -EINVAL;
+	/* Don't check node/port for the valid range, use only low
+	 * 16 bits on 32-bit architectures.
+	 */
 
 	key = ((unsigned long)(dest_node) << QRTR_INDEX_HALF_BITS) |
 	      ((unsigned long)(dest_port) & QRTR_INDEX_HALF_UNSIGNED_MAX);
@@ -369,11 +367,9 @@ static int qrtr_tx_flow_failed(struct qrtr_node *node, int dest_node,
 	unsigned long key = 0;
 	struct qrtr_tx_flow *flow;
 
-	if (dest_node < QRTR_INDEX_HALF_SIGNED_MIN ||
-	    dest_node > QRTR_INDEX_HALF_SIGNED_MAX ||
-	    dest_port < QRTR_INDEX_HALF_SIGNED_MIN ||
-	    dest_port > QRTR_INDEX_HALF_SIGNED_MAX)
-		return -EINVAL;
+	/* Don't check node/port for the valid range, use only low
+	 * 16 bits on 32-bit architectures.
+	 */
 
 	key = ((unsigned long)(dest_node) << QRTR_INDEX_HALF_BITS) |
 	      ((unsigned long)(dest_port) & QRTR_INDEX_HALF_UNSIGNED_MAX);
-- 
2.34.1


  parent reply	other threads:[~2026-09-01 13:21 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-01 13:19 [PATCH v6 00/15] QRTR Multi-endpoint support Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 01/15] net: qrtr: ns: validate msglen before ctrl_pkt use Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 02/15] net: qrtr: allocate and track endpoint ids Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 03/15] net: qrtr: fit node ID + port number combination into unsigned long Juha-Matti Tilli
2026-09-01 13:19 ` Juha-Matti Tilli [this message]
2026-09-01 13:19 ` [PATCH v6 05/15] net: qrtr: support identical node ids Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 06/15] net: qrtr: Report sender endpoint in aux data Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 07/15] net: qrtr: Report endpoint for locally generated messages Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 08/15] net: qrtr: Allow sendmsg to target an endpoint Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 09/15] net: qrtr: allow socket endpoint binding Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 10/15] net: qrtr: Drop remote {NEW|DEL}_LOOKUP messages Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 11/15] net: qrtr: ns: support multiple endpoints Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 12/15] net: qrtr: mhi: Report endpoint id in sysfs Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 13/15] net: qrtr: limit endpoint range to 16 bits on 32-bit machines Juha-Matti Tilli
2026-09-05  1:40   ` Jakub Kicinski
2026-09-05  4:21     ` Juha-Matti Tilli
2026-09-05 10:07       ` David Laight
2026-09-05 10:55         ` Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 14/15] net: qrtr: use nid modulo 65536 in 32-bit lookups Juha-Matti Tilli
2026-09-01 13:19 ` [PATCH v6 15/15] net: qrtr: solve the 32-bit unsafe use in endpoints Juha-Matti Tilli

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260901131934.225991-5-juha-matti.tilli@iki.fi \
    --to=juha-matti.tilli@iki.fi \
    --cc=agross@kernel.org \
    --cc=davem@davemloft.net \
    --cc=denkenz@gmail.com \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=ionic@ionic.de \
    --cc=kuba@kernel.org \
    --cc=kuniyu@google.com \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mani@kernel.org \
    --cc=marcel@holtmann.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=willemb@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox