tree b62996434ab3d9776fe3b5197c38ca6939452434
parent 37342bdaf5b363cf2e1bd170ce7d1de34ecf57e7
author Paolo Abeni <pabeni@redhat.com> 1542245690 +0100
committer David S. Miller <davem@davemloft.net> 1542438116 -0800

udp: fix jump label misuse

The commit 60fb9567bf30 ("udp: implement complete book-keeping for
encap_needed") introduced a severe misuse of jump label APIs, which
syzbot, as reported by Eric, was able to exploit.

When multiple sockets/process can concurrently request (and than
disable) the udp encap, we need to track the activation counter with
*_inc()/*_dec() jump label variants, or we can experience bad things
at disable time.

Fixes: 60fb9567bf30 ("udp: implement complete book-keeping for encap_needed")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>