diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2018-11-15 04:34:50 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-11-17 10:01:56 +0300 |
| commit | 9c48060141bd937497774546e4bb89b8992be383 (patch) | |
| tree | b62996434ab3d9776fe3b5197c38ca6939452434 /net | |
| parent | 37342bdaf5b363cf2e1bd170ce7d1de34ecf57e7 (diff) | |
| download | linux-9c48060141bd937497774546e4bb89b8992be383.tar.xz | |
udp: fix jump label misuse
The commit 60fb9567bf30 ("udp: implement complete book-keeping for
encap_needed") introduced a severe misuse of jump label APIs, which
syzbot, as reported by Eric, was able to exploit.
When multiple sockets/process can concurrently request (and than
disable) the udp encap, we need to track the activation counter with
*_inc()/*_dec() jump label variants, or we can experience bad things
at disable time.
Fixes: 60fb9567bf30 ("udp: implement complete book-keeping for encap_needed")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/udp.c | 4 | ||||
| -rw-r--r-- | net/ipv6/udp.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 6f8890c5bc7e..aff2a8e99e01 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -587,7 +587,7 @@ static inline bool __udp_is_mcast_sock(struct net *net, struct sock *sk, DEFINE_STATIC_KEY_FALSE(udp_encap_needed_key); void udp_encap_enable(void) { - static_branch_enable(&udp_encap_needed_key); + static_branch_inc(&udp_encap_needed_key); } EXPORT_SYMBOL(udp_encap_enable); @@ -2524,7 +2524,7 @@ void udp_destroy_sock(struct sock *sk) encap_destroy(sk); } if (up->encap_enabled) - static_branch_disable(&udp_encap_needed_key); + static_branch_dec(&udp_encap_needed_key); } } diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index dde51fc7ac16..09cba4cfe31f 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -448,7 +448,7 @@ csum_copy_err: DEFINE_STATIC_KEY_FALSE(udpv6_encap_needed_key); void udpv6_encap_enable(void) { - static_branch_enable(&udpv6_encap_needed_key); + static_branch_inc(&udpv6_encap_needed_key); } EXPORT_SYMBOL(udpv6_encap_enable); @@ -1579,7 +1579,7 @@ void udpv6_destroy_sock(struct sock *sk) encap_destroy(sk); } if (up->encap_enabled) - static_branch_disable(&udpv6_encap_needed_key); + static_branch_dec(&udpv6_encap_needed_key); } inet6_destroy_sock(sk); |