[PATCH] xfrm: Don't increase scratch users if allocation fails

Khalid Masum
2022-08-31T01:42:43Z

ipcomp_alloc_scratches() routine increases ipcomp_scratch_users count
even if it fails to allocate memory. Therefore, ipcomp_free_scratches()
routine, when triggered, tries to vfree() non existent percpu
ipcomp_scratches.

To fix this breakage, do not increase scratch users count if
ipcomp_alloc_scratches() fails to allocate scratches.

Reported-and-tested-by: syzbot+5ec9bb042ddfe9644773@syzkaller.appspotmail.com
Signed-off-by: Khalid Masum <khalid.masum.92@gmail.com>

---
net/xfrm/xfrm_ipcomp.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index cb40ff0ff28d..af9097983139 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -210,13 +210,15 @@ static void * __percpu *ipcomp_alloc_scratches(void)
void * __percpu *scratches;
int i;

- if (ipcomp_scratch_users++)
+ if (ipcomp_scratch_users) {
+ ipcomp_scratch_users++;
return ipcomp_scratches;
-
+ }
scratches = alloc_percpu(void *);
if (!scratches)
return NULL;

+ ipcomp_scratch_users++;
ipcomp_scratches = scratches;

for_each_possible_cpu(i) {
--
2.37.1