From patchwork Wed Jun 20 21:31:41 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10478745 X-Patchwork-Delegate: dvhart@infradead.org Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E761E600F6 for ; Wed, 20 Jun 2018 21:31:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D6E1028DBC for ; Wed, 20 Jun 2018 21:31:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CB627290B9; Wed, 20 Jun 2018 21:31:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D3B5428DBC for ; Wed, 20 Jun 2018 21:31:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933370AbeFTVbp (ORCPT ); Wed, 20 Jun 2018 17:31:45 -0400 Received: from mail-pl0-f65.google.com ([209.85.160.65]:43654 "EHLO mail-pl0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933326AbeFTVbo (ORCPT ); Wed, 20 Jun 2018 17:31:44 -0400 Received: by mail-pl0-f65.google.com with SMTP id c41-v6so450143plj.10 for ; Wed, 20 Jun 2018 14:31:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :content-transfer-encoding; bh=UhpVuMgoqVvFrbt0HrzAdI5S1YVDUhT5oNJIYqoXqEo=; b=bS2m9YSfWGmFLdD7DZ6sP29UK3lusNpm8aYZDLcMYdyIQuHrOJWVaYgjfqk7AuUkIN ZtfXrq6sXV6o9d1zaZgrxBowBvVFtqkaL+fD8dom+A7f8EvimVKhXEBQhUCc1HJeFB/4 XEaIZ5LCT+L4LzgpVMRyPuzhDMpOsIf7lF6gQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:content-transfer-encoding; bh=UhpVuMgoqVvFrbt0HrzAdI5S1YVDUhT5oNJIYqoXqEo=; b=k5idZixu6v7XBuf40Ig58pJ4mF1vuTj71E5b8evEkdoOQtuS2EBlrbzqdq3zYR9FqG QnhmFBCnlFkBJY2lvgFJ384EnSEOZUdMVzhZEDaduIYqm+IXIUI8W8qXKzys0Howni2M 9OQqrL+bJ44GcTFlPNvE4YhD9NtDoK4fXc5ZR/9oW0T8yoRpcPJyYv8/W8/S2i2dgjTc nLXMwa19k//8DhKS6tknQ5COgFrdA2TYGUTTCr9pTzvoKOt02Nv++cNBalN4wtaiiO7I dSdmqVP8g1dqpe8sryBzO9i+jTBC42SXWMN43QxzG8PYw8StGsp150DPdu/adS5uoQny yBYA== X-Gm-Message-State: APt69E09spdBQtHZEM3rkcMzmLIsR8b0Tjtr4wOIAuKiygiPG4uKt+NO 1oHB8CaAFjIt31AJJA28a0TSQA== X-Google-Smtp-Source: ADUXVKJSD50TbCkGrrEzgYofXo9NhiQKOX3+KV88Z/pNyXeeYkrwURid4AU2MBMJJPCf2bf5w3/cUg== X-Received: by 2002:a17:902:aa98:: with SMTP id d24-v6mr25974409plr.185.1529530303833; Wed, 20 Jun 2018 14:31:43 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id j21-v6sm4780258pfn.121.2018.06.20.14.31.42 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 20 Jun 2018 14:31:42 -0700 (PDT) Date: Wed, 20 Jun 2018 14:31:41 -0700 From: Kees Cook To: Darren Hart Cc: linux-kernel@vger.kernel.org, Andy Shevchenko , platform-driver-x86@vger.kernel.org, Mihai =?utf-8?B?RG9uyJt1?= , Mario.Limonciello@dell.com Subject: [PATCH] platform/x86: wmi: Do not mix pages and kmalloc Message-ID: <20180620213141.GA8957@beast> MIME-Version: 1.0 Content-Disposition: inline Sender: platform-driver-x86-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: platform-driver-x86@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since other things are happily using kmalloc() in the probe path, switch to kmalloc() entirely. This fixes the error path mismatch and will avoid issues with CONFIG_HARDENED_USERCOPY_PAGESPAN=y. Reported-by: Mihai Donțu Signed-off-by: Kees Cook Acked-by: Mario Limonciello --- drivers/platform/x86/wmi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 8e3d0146ff8c..04791ea5d97b 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -895,7 +895,6 @@ static int wmi_dev_probe(struct device *dev) struct wmi_driver *wdriver = container_of(dev->driver, struct wmi_driver, driver); int ret = 0; - int count; char *buf; if (ACPI_FAILURE(wmi_method_enable(wblock, 1))) @@ -917,9 +916,8 @@ static int wmi_dev_probe(struct device *dev) goto probe_failure; } - count = get_order(wblock->req_buf_size); - wblock->handler_data = (void *)__get_free_pages(GFP_KERNEL, - count); + wblock->handler_data = kmalloc(wblock->req_buf_size, + GFP_KERNEL); if (!wblock->handler_data) { ret = -ENOMEM; goto probe_failure; @@ -964,8 +962,7 @@ static int wmi_dev_remove(struct device *dev) if (wdriver->filter_callback) { misc_deregister(&wblock->char_dev); kfree(wblock->char_dev.name); - free_pages((unsigned long)wblock->handler_data, - get_order(wblock->req_buf_size)); + kfree(wblock->handler_data); } if (wdriver->remove)