Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b8830a4e authored by Pali Rohár's avatar Pali Rohár Committed by Darren Hart
Browse files

dell-laptop: Fix allocating & freeing SMI buffer page 



This commit fix kernel crash when probing for rfkill devices in dell-laptop
driver failed. Function free_page() was incorrectly used on struct page *
instead of virtual address of SMI buffer.

This commit also simplify allocating page for SMI buffer by using
__get_free_page() function instead of sequential call of functions
alloc_page() and page_address().

Signed-off-by: default avatarPali Rohár <pali.rohar@gmail.com>
Acked-by: default avatarMichal Hocko <mhocko@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDarren Hart <dvhart@linux.intel.com>
parent 2e19f93f

drivers/platform/x86/dell-laptop.c

+3 −5
Original line number Original line Diff line number Diff line
@@ -306,7 +306,6 @@ static const struct dmi_system_id dell_quirks[] __initconst = { 
};

};





static struct calling_interface_buffer *buffer;

static struct calling_interface_buffer *buffer;

static struct page *bufferpage;

static DEFINE_MUTEX(buffer_mutex);

static DEFINE_MUTEX(buffer_mutex);





static int hwswitch_state;

static int hwswitch_state;
@@ -2068,12 +2067,11 @@ static int __init dell_init(void) 
	 * Allocate buffer below 4GB for SMI data--only 32-bit physical addr

	 * Allocate buffer below 4GB for SMI data--only 32-bit physical addr

	 * is passed to SMI handler.

	 * is passed to SMI handler.

	 */

	 */

	bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);

	buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);

	if (!bufferpage) {

	if (!buffer) {

		ret = -ENOMEM;

		ret = -ENOMEM;

		goto fail_buffer;

		goto fail_buffer;

	}

	}

	buffer = page_address(bufferpage);





	ret = dell_setup_rfkill();

	ret = dell_setup_rfkill();
@@ -2135,7 +2133,7 @@ static int __init dell_init(void) 
fail_backlight:

fail_backlight:

	dell_cleanup_rfkill();

	dell_cleanup_rfkill();

fail_rfkill:

fail_rfkill:

	free_page((unsigned long)bufferpage);

	free_page((unsigned long)buffer);

fail_buffer:

fail_buffer:

	platform_device_del(platform_device);

	platform_device_del(platform_device);

fail_platform_device2:

fail_platform_device2: