6 files changed, 11 insertions, 9 deletions

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 93644f82592c..d08fb30768bc 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2797,11 +2797,12 @@ static void cma_remove_one(struct ib_device *device)
 
 static int cma_init(void)
 {
-        int ret, low, high;
+        int ret, low, high, remaining;
 
         get_random_bytes(&next_port, sizeof next_port);
         inet_get_local_port_range(&low, &high);
-        next_port = ((unsigned int) next_port % (high - low)) + low;
+        remaining = (high - low) + 1;
+        next_port = ((unsigned int) next_port % remaining) + low;
 
         cma_wq = create_singlethread_workqueue("rdma_cm");
         if (!cma_wq)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 3cef12835c4b..8fb6ca23700a 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -93,7 +93,7 @@ int inet_csk_get_port(struct inet_hashinfo *hashinfo,
                 int remaining, rover, low, high;
 
                 inet_get_local_port_range(&low, &high);
-                remaining = high - low;
+                remaining = (high - low) + 1;
                 rover = net_random() % remaining + low;
 
                 do {
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index fac6398e4367..16eecc7046a3 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -286,7 +286,7 @@ int inet_hash_connect(struct inet_timewait_death_row *death_row,
                 struct inet_timewait_sock *tw = NULL;
 
                 inet_get_local_port_range(&low, &high);
-                remaining = high - low;
+                remaining = (high - low) + 1;
 
                 local_bh_disable();
                 for (i = 1; i <= remaining; i++) {
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index c78acc1a7f11..ffddd2b45352 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -122,7 +122,7 @@ static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
         ret = proc_dointvec_minmax(&tmp, write, filp, buffer, lenp, ppos);
 
         if (write && ret == 0) {
-                if (range[1] <= range[0])
+                if (range[1] < range[0])
                         ret = -EINVAL;
                 else
                         set_local_port_range(range);
@@ -150,7 +150,7 @@ static int ipv4_sysctl_local_port_range(ctl_table *table, int __user *name,
 
         ret = sysctl_intvec(&tmp, name, nlen, oldval, oldlenp, newval, newlen);
         if (ret == 0 && newval && newlen) {
-                if (range[1] <= range[0])
+                if (range[1] < range[0])
                         ret = -EINVAL;
                 else
                         set_local_port_range(range);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cb9fc58efb2f..35d2b0e9e10b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -147,13 +147,14 @@ int __udp_lib_get_port(struct sock *sk, unsigned short snum,
         write_lock_bh(&udp_hash_lock);
 
         if (!snum) {
-                int i, low, high;
+                int i, low, high, remaining;
                 unsigned rover, best, best_size_so_far;
 
                 inet_get_local_port_range(&low, &high);
+                remaining = (high - low) + 1;
 
                 best_size_so_far = UINT_MAX;
-                best = rover = net_random() % (high - low) + low;
+                best = rover = net_random() % remaining + low;
 
                 /* 1st pass: look for empty (or shortest) hash chain */
                 for (i = 0; i < UDP_HTABLE_SIZE; i++) {
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1c2c27655435..d6f1026f1943 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -261,7 +261,7 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row,
                 struct inet_timewait_sock *tw = NULL;
 
                 inet_get_local_port_range(&low, &high);
-                remaining = high - low;
+                remaining = (high - low) + 1;
 
                 local_bh_disable();
                 for (i = 1; i <= remaining; i++) {