tipc_mon_create() is never called in atomic context.
The call chain ending up at dn_route_init() is:
[1] tipc_mon_create() <- tipc_enable_bearer() <- tipc_nl_bearer_enable()
tipc_nl_bearer_enable() calls rtnl_lock(), which indicates this function
is not called in atomic context.
Despite never getting called from atomic context,
tipc_mon_create() calls kzalloc() with GFP_ATOMIC,
which does not sleep for allocation.
GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL,
which can sleep and improve the possibility of sucessful allocation.
This is found by a static analysis tool named DCNS written by myself.
And I also manually check it.
Signed-off-by: Jia-Ju Bai <[email protected]>
---
v2:
* Modify the description of GFP_ATOMIC in v1.
Thank Eric for good advice.
---
net/tipc/monitor.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index 9e109bb..9714d80 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -604,9 +604,9 @@ int tipc_mon_create(struct net *net, int bearer_id)
if (tn->monitors[bearer_id])
return 0;
- mon = kzalloc(sizeof(*mon), GFP_ATOMIC);
- self = kzalloc(sizeof(*self), GFP_ATOMIC);
- dom = kzalloc(sizeof(*dom), GFP_ATOMIC);
+ mon = kzalloc(sizeof(*mon), GFP_KERNEL);
+ self = kzalloc(sizeof(*self), GFP_KERNEL);
+ dom = kzalloc(sizeof(*dom), GFP_KERNEL);
if (!mon || !self || !dom) {
kfree(mon);
kfree(self);
--
1.9.1
On 2018/4/11 18:11, Ying Xue wrote:
> On 04/10/2018 09:17 AM, Jia-Ju Bai wrote:
>> tipc_mon_create() is never called in atomic context.
>>
>> The call chain ending up at dn_route_init() is:
> Sorry, I don't think there is any relationship between the following
> call chain with dn_route_init().
>
>> [1] tipc_mon_create() <- tipc_enable_bearer() <- tipc_nl_bearer_enable()
>> tipc_nl_bearer_enable() calls rtnl_lock(), which indicates this function
>> is not called in atomic context.
>>
>> Despite never getting called from atomic context,
>> tipc_mon_create() calls kzalloc() with GFP_ATOMIC,
>> which does not sleep for allocation.
>> GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL,
>> which can sleep and improve the possibility of sucessful allocation.
> s/sucessful/successful
Thanks for your reply.
I am sorry for my mistakes.
I will revised the text and send a V3.
Jia-Ju Bai
On 04/10/2018 09:17 AM, Jia-Ju Bai wrote:
> tipc_mon_create() is never called in atomic context.
>
> The call chain ending up at dn_route_init() is:
Sorry, I don't think there is any relationship between the following
call chain with dn_route_init().
> [1] tipc_mon_create() <- tipc_enable_bearer() <- tipc_nl_bearer_enable()
> tipc_nl_bearer_enable() calls rtnl_lock(), which indicates this function
> is not called in atomic context.
>
> Despite never getting called from atomic context,
> tipc_mon_create() calls kzalloc() with GFP_ATOMIC,
> which does not sleep for allocation.
> GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL,
> which can sleep and improve the possibility of sucessful allocation.
s/sucessful/successful
>
> This is found by a static analysis tool named DCNS written by myself.
> And I also manually check it.
>
> Signed-off-by: Jia-Ju Bai <[email protected]>> ---
> v2:
> * Modify the description of GFP_ATOMIC in v1.
> Thank Eric for good advice.
> ---
> net/tipc/monitor.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
> index 9e109bb..9714d80 100644
> --- a/net/tipc/monitor.c
> +++ b/net/tipc/monitor.c
> @@ -604,9 +604,9 @@ int tipc_mon_create(struct net *net, int bearer_id)
> if (tn->monitors[bearer_id])
> return 0;
>
> - mon = kzalloc(sizeof(*mon), GFP_ATOMIC);
> - self = kzalloc(sizeof(*self), GFP_ATOMIC);
> - dom = kzalloc(sizeof(*dom), GFP_ATOMIC);
> + mon = kzalloc(sizeof(*mon), GFP_KERNEL);
> + self = kzalloc(sizeof(*self), GFP_KERNEL);
> + dom = kzalloc(sizeof(*dom), GFP_KERNEL);
> if (!mon || !self || !dom) {
> kfree(mon);
> kfree(self);
>