6 files changed, 36 insertions, 2 deletions

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index c6c43bcd1c6f..551ce564b035 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1573,9 +1573,13 @@ static int __init inet_init(void)
 
         BUILD_BUG_ON(sizeof(struct inet_skb_parm) > sizeof(dummy_skb->cb));
 
+        sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL);
+        if (!sysctl_local_reserved_ports)
+                goto out;
+
         rc = proto_register(&tcp_prot, 1);
         if (rc)
-                goto out;
+                goto out_free_reserved_ports;
 
         rc = proto_register(&udp_prot, 1);
         if (rc)
@@ -1674,6 +1678,8 @@ out_unregister_udp_proto:
         proto_unregister(&udp_prot);
 out_unregister_tcp_proto:
         proto_unregister(&tcp_prot);
+out_free_reserved_ports:
+        kfree(sysctl_local_reserved_ports);
         goto out;
 }
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index e0a3e3537b14..70eb3507c406 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -37,6 +37,9 @@ struct local_ports sysctl_local_ports __read_mostly = {
         .range = { 32768, 61000 },
 };
 
+unsigned long *sysctl_local_reserved_ports;
+EXPORT_SYMBOL(sysctl_local_reserved_ports);
+
 void inet_get_local_port_range(int *low, int *high)
 {
         unsigned seq;
@@ -108,6 +111,8 @@ again:
 
                 smallest_size = -1;
                 do {
+                        if (inet_is_reserved_local_port(rover))
+                                goto next_nolock;
                         head = &hashinfo->bhash[inet_bhashfn(net, rover,
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
@@ -130,6 +135,7 @@ again:
                         break;
                 next:
                         spin_unlock(&head->lock);
+                next_nolock:
                         if (++rover > high)
                                 rover = low;
                 } while (--remaining > 0);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 2b79377b468d..d3e160a88219 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -456,6 +456,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 local_bh_disable();
                 for (i = 1; i <= remaining; i++) {
                         port = low + (i + offset) % remaining;
+                        if (inet_is_reserved_local_port(port))
+                                continue;
                         head = &hinfo->bhash[inet_bhashfn(net, port,
                                         hinfo->bhash_size)];
                         spin_lock(&head->lock);
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 1cd5c15174b8..d96c1da4b17c 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -299,6 +299,13 @@ static struct ctl_table ipv4_table[] = {
                 .mode           = 0644,
                 .proc_handler   = ipv4_local_port_range,
         },
+        {
+                .procname       = "ip_local_reserved_ports",
+                .data           = NULL, /* initialized in sysctl_ipv4_init */
+                .maxlen         = 65536,
+                .mode           = 0644,
+                .proc_handler   = proc_do_large_bitmap,
+        },
 #ifdef CONFIG_IP_MULTICAST
         {
                 .procname       = "igmp_max_memberships",
@@ -736,6 +743,16 @@ static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
 static __init int sysctl_ipv4_init(void)
 {
         struct ctl_table_header *hdr;
+        struct ctl_table *i;
+
+        for (i = ipv4_table; i->procname; i++) {
+                if (strcmp(i->procname, "ip_local_reserved_ports") == 0) {
+                        i->data = sysctl_local_reserved_ports;
+                        break;
+                }
+        }
+        if (!i->procname)
+                return -EINVAL;
 
         hdr = register_sysctl_paths(net_ipv4_ctl_path, ipv4_table);
         if (hdr == NULL)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f3e00c5cd1ed..9de6a698f91d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -233,7 +233,8 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                          */
                         do {
                                 if (low <= snum && snum <= high &&
-                                    !test_bit(snum >> udptable->log, bitmap))
+                                    !test_bit(snum >> udptable->log, bitmap) &&
+                                    !inet_is_reserved_local_port(snum))
                                         goto found;
                                 snum += rand;
                         } while (snum != first);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ba1add0b13c3..ca44917872d2 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5433,6 +5433,8 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                         rover++;
                         if ((rover < low) || (rover > high))
                                 rover = low;
+                        if (inet_is_reserved_local_port(rover))
+                                continue;
                         index = sctp_phashfn(rover);
                         head = &sctp_port_hashtable[index];
                         sctp_spin_lock(&head->lock);