leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

platform/x86: wmi: Do not mix pages and kmalloc

Browse Source 
The probe handler_data was being allocated with __get_free_pages()
for no reason I could find. The error path was using kfree(). Since
other things are happily using kmalloc() in the probe path, switch to
kmalloc() entirely. This fixes the error path mismatch and will avoid
issues with CONFIG_HARDENED_USERCOPY_PAGESPAN=y.

Reported-by: Mihai Donțu <mihai.dontu@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Mario Limonciello <Mario.limonciello@dell.com>
Cc: stable@vger.kernel.org
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
This commit is contained in:
Kees Cook 2018-06-20 14:31:41 -07:00 committed by Darren Hart (VMware)
parent f193f7985f
commit 6fb741076a
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/platform/x86/wmi.c
View File

@ -895,7 +895,6 @@ static int wmi_dev_probe(struct device *dev)
struct wmi_driver *wdriver =
container_of(dev->driver, struct wmi_driver, driver);
int ret = 0;
int count;
char *buf;
if (ACPI_FAILURE(wmi_method_enable(wblock, 1)))
@ -917,9 +916,8 @@ static int wmi_dev_probe(struct device *dev)
goto probe_failure;
}
count = get_order(wblock->req_buf_size);
wblock->handler_data = (void *)__get_free_pages(GFP_KERNEL,
count);
wblock->handler_data = kmalloc(wblock->req_buf_size,
GFP_KERNEL);
if (!wblock->handler_data) {
ret = -ENOMEM;
goto probe_failure;
@ -964,8 +962,7 @@ static int wmi_dev_remove(struct device *dev)
if (wdriver->filter_callback) {
misc_deregister(&wblock->char_dev);
kfree(wblock->char_dev.name);
free_pages((unsigned long)wblock->handler_data,
get_order(wblock->req_buf_size));
kfree(wblock->handler_data);
}
if (wdriver->remove)