Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fb74107 authored by Kees Cook's avatar Kees Cook Committed by Darren Hart (VMware)
Browse files

platform/x86: wmi: Do not mix pages and kmalloc 



The probe handler_data was being allocated with __get_free_pages()
for no reason I could find. The error path was using kfree(). Since
other things are happily using kmalloc() in the probe path, switch to
kmalloc() entirely. This fixes the error path mismatch and will avoid
issues with CONFIG_HARDENED_USERCOPY_PAGESPAN=y.

Reported-by: default avatarMihai Donțu <mihai.dontu@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarMario Limonciello <Mario.limonciello@dell.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDarren Hart (VMware) <dvhart@infradead.org>
parent f193f798

drivers/platform/x86/wmi.c

+3 −6
Original line number Diff line number Diff line
@@ -895,7 +895,6 @@ static int wmi_dev_probe(struct device *dev) 
	struct wmi_driver *wdriver =

		container_of(dev->driver, struct wmi_driver, driver);

	int ret = 0;

	int count;

	char *buf;



	if (ACPI_FAILURE(wmi_method_enable(wblock, 1)))
@@ -917,9 +916,8 @@ static int wmi_dev_probe(struct device *dev) 
			goto probe_failure;

		}



		count = get_order(wblock->req_buf_size);

		wblock->handler_data = (void *)__get_free_pages(GFP_KERNEL,

								count);

		wblock->handler_data = kmalloc(wblock->req_buf_size,

					       GFP_KERNEL);

		if (!wblock->handler_data) {

			ret = -ENOMEM;

			goto probe_failure;
@@ -964,8 +962,7 @@ static int wmi_dev_remove(struct device *dev) 
	if (wdriver->filter_callback) {

		misc_deregister(&wblock->char_dev);

		kfree(wblock->char_dev.name);

		free_pages((unsigned long)wblock->handler_data,

			   get_order(wblock->req_buf_size));

		kfree(wblock->handler_data);

	}



	if (wdriver->remove)