lkml.org 
[lkml]   [2022]   [Jan]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 59/64] ipv4: raw: lock the socket in raw_bind()
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit 153a0d187e767c68733b8e9f46218eb1f41ab902 ]

    For some reason, raw_bind() forgot to lock the socket.

    BUG: KCSAN: data-race in __ip4_datagram_connect / raw_bind

    write to 0xffff8881170d4308 of 4 bytes by task 5466 on cpu 0:
    raw_bind+0x1b0/0x250 net/ipv4/raw.c:739
    inet_bind+0x56/0xa0 net/ipv4/af_inet.c:443
    __sys_bind+0x14b/0x1b0 net/socket.c:1697
    __do_sys_bind net/socket.c:1708 [inline]
    __se_sys_bind net/socket.c:1706 [inline]
    __x64_sys_bind+0x3d/0x50 net/socket.c:1706
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    read to 0xffff8881170d4308 of 4 bytes by task 5468 on cpu 1:
    __ip4_datagram_connect+0xb7/0x7b0 net/ipv4/datagram.c:39
    ip4_datagram_connect+0x2a/0x40 net/ipv4/datagram.c:89
    inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576
    __sys_connect_file net/socket.c:1900 [inline]
    __sys_connect+0x197/0x1b0 net/socket.c:1917
    __do_sys_connect net/socket.c:1927 [inline]
    __se_sys_connect net/socket.c:1924 [inline]
    __x64_sys_connect+0x3d/0x50 net/socket.c:1924
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    value changed: 0x00000000 -> 0x0003007f

    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 5468 Comm: syz-executor.5 Not tainted 5.17.0-rc1-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ipv4/raw.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
    index 3183413ebc6c2..ddc24e57dc555 100644
    --- a/net/ipv4/raw.c
    +++ b/net/ipv4/raw.c
    @@ -720,6 +720,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
    int ret = -EINVAL;
    int chk_addr_ret;

    + lock_sock(sk);
    if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in))
    goto out;

    @@ -739,7 +740,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
    inet->inet_saddr = 0; /* Use device */
    sk_dst_reset(sk);
    ret = 0;
    -out: return ret;
    +out:
    + release_sock(sk);
    + return ret;
    }

    /*
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-31 12:03    [W:4.525 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site