Commit 747b6708 authored by Sabrina Dubroca's avatar Sabrina Dubroca Committed by Steffen Klassert
Browse files

xfrm: ipcomp: remove unnecessary get_cpu() 

While testing ipcomp on a realtime kernel, Xiumei reported a "sleeping
in atomic" bug, caused by a memory allocation while preemption is
disabled (ipcomp_decompress -> alloc_page -> ... get_page_from_freelist).

As Sebastian noted [1], this get_cpu() isn't actually needed, since
ipcomp_decompress() is called in napi context anyway, so BH is already
disabled.

This patch replaces get_cpu + per_cpu_ptr with this_cpu_ptr, then
simplifies the error returns, since there isn't any common operation
left.

[1] https://lore.kernel.org/lkml/20190820082810.ixkmi56fp7u7eyn2@linutronix.de/



Cc: Juri Lelli <jlelli@redhat.com>
Reported-by: default avatarXiumei Mu <xmu@redhat.com>
Suggested-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 6218fe18

net/xfrm/xfrm_ipcomp.c

+8 −17
Original line number Diff line number Diff line
@@ -41,19 +41,16 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb) 
	const int plen = skb->len;

	int dlen = IPCOMP_SCRATCH_SIZE;

	const u8 *start = skb->data;

	const int cpu = get_cpu();

	u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);

	struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);

	u8 *scratch = *this_cpu_ptr(ipcomp_scratches);

	struct crypto_comp *tfm = *this_cpu_ptr(ipcd->tfms);

	int err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);

	int len;



	if (err)

		goto out;

		return err;



	if (dlen < (plen + sizeof(struct ip_comp_hdr))) {

		err = -EINVAL;

		goto out;

	}

	if (dlen < (plen + sizeof(struct ip_comp_hdr)))

		return -EINVAL;



	len = dlen - plen;

	if (len > skb_tailroom(skb))
@@ -68,16 +65,14 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb) 
		skb_frag_t *frag;

		struct page *page;



		err = -EMSGSIZE;

		if (WARN_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS))

			goto out;

			return -EMSGSIZE;



		frag = skb_shinfo(skb)->frags + skb_shinfo(skb)->nr_frags;

		page = alloc_page(GFP_ATOMIC);



		err = -ENOMEM;

		if (!page)

			goto out;

			return -ENOMEM;



		__skb_frag_set_page(frag, page);
@@ -96,11 +91,7 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb) 
		skb_shinfo(skb)->nr_frags++;

	}



	err = 0;



out:

	put_cpu();

	return err;

	return 0;

}



int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)