Patch "ipv4: raw: lock the socket in raw_bind()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ipv4: raw: lock the socket in raw_bind()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ipv4-raw-lock-the-socket-in-raw_bind.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3ec23775ced46061472d84cea9d2459571158fbd
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Wed Jan 26 16:51:16 2022 -0800

    ipv4: raw: lock the socket in raw_bind()
    
    [ Upstream commit 153a0d187e767c68733b8e9f46218eb1f41ab902 ]
    
    For some reason, raw_bind() forgot to lock the socket.
    
    BUG: KCSAN: data-race in __ip4_datagram_connect / raw_bind
    
    write to 0xffff8881170d4308 of 4 bytes by task 5466 on cpu 0:
     raw_bind+0x1b0/0x250 net/ipv4/raw.c:739
     inet_bind+0x56/0xa0 net/ipv4/af_inet.c:443
     __sys_bind+0x14b/0x1b0 net/socket.c:1697
     __do_sys_bind net/socket.c:1708 [inline]
     __se_sys_bind net/socket.c:1706 [inline]
     __x64_sys_bind+0x3d/0x50 net/socket.c:1706
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    read to 0xffff8881170d4308 of 4 bytes by task 5468 on cpu 1:
     __ip4_datagram_connect+0xb7/0x7b0 net/ipv4/datagram.c:39
     ip4_datagram_connect+0x2a/0x40 net/ipv4/datagram.c:89
     inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576
     __sys_connect_file net/socket.c:1900 [inline]
     __sys_connect+0x197/0x1b0 net/socket.c:1917
     __do_sys_connect net/socket.c:1927 [inline]
     __se_sys_connect net/socket.c:1924 [inline]
     __x64_sys_connect+0x3d/0x50 net/socket.c:1924
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    value changed: 0x00000000 -> 0x0003007f
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 5468 Comm: syz-executor.5 Not tainted 5.17.0-rc1-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Reported-by: syzbot <syzkaller@xxxxxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bb446e60cf580..b8689052079cd 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -721,6 +721,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	int ret = -EINVAL;
 	int chk_addr_ret;
 
+	lock_sock(sk);
 	if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in))
 		goto out;
 
@@ -740,7 +741,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 		inet->inet_saddr = 0;  /* Use device */
 	sk_dst_reset(sk);
 	ret = 0;
-out:	return ret;
+out:
+	release_sock(sk);
+	return ret;
 }
 
 /*