Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 978b92ff authored by Paolo Abeni's avatar Paolo Abeni Committed by Sean Tranchetti
Browse files

udp: fix jump label misuse 



The commit 60fb9567bf30 ("udp: implement complete book-keeping for
encap_needed") introduced a severe misuse of jump label APIs, which
syzbot, as reported by Eric, was able to exploit.

When multiple sockets/process can concurrently request (and than
disable) the udp encap, we need to track the activation counter with
*_inc()/*_dec() jump label variants, or we can experience bad things
at disable time.

Change-Id: Iaf106558736233b0c09a99d0275d8713b532bec6
Fixes: 60fb9567bf30 ("udp: implement complete book-keeping for encap_needed")
Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git


Git-commit: 9c48060141bd937497774546e4bb89b8992be383
Signed-off-by: default avatarSean Tranchetti <stranche@codeaurora.org>
parent 276fe83f

net/ipv4/udp.c

+2 −2
Original line number Diff line number Diff line
@@ -1902,7 +1902,7 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 
static DEFINE_STATIC_KEY_FALSE(udp_encap_needed_key);

void udp_encap_enable(void)

{

	static_branch_enable(&udp_encap_needed_key);

	static_branch_inc(&udp_encap_needed_key);

}

EXPORT_SYMBOL(udp_encap_enable);
@@ -2437,7 +2437,7 @@ void udp_destroy_sock(struct sock *sk) 
				encap_destroy(sk);

		}

		if (up->encap_enabled)

			static_branch_disable(&udp_encap_needed_key);

			static_branch_dec(&udp_encap_needed_key);

	}

}

net/ipv6/udp.c

+2 −2
Original line number Diff line number Diff line
@@ -554,7 +554,7 @@ static __inline__ void udpv6_err(struct sk_buff *skb, 
static DEFINE_STATIC_KEY_FALSE(udpv6_encap_needed_key);

void udpv6_encap_enable(void)

{

	static_branch_enable(&udpv6_encap_needed_key);

	static_branch_inc(&udpv6_encap_needed_key);

}

EXPORT_SYMBOL(udpv6_encap_enable);
@@ -1491,7 +1491,7 @@ void udpv6_destroy_sock(struct sock *sk) 
				encap_destroy(sk);

		}

		if (up->encap_enabled)

			static_branch_disable(&udpv6_encap_needed_key);

			static_branch_dec(&udpv6_encap_needed_key);

	}



	inet6_destroy_sock(sk);