platform/x86: wmi: Do not mix pages and kmalloc

BugLink: https://bugs.launchpad.net/bugs/1835972
commit 6fb741076a9fc53355e56dff2e2b46782b3a46d3 upstream.

The probe handler_data was being allocated with __get_free_pages()
for no reason I could find. The error path was using kfree(). Since
other things are happily using kmalloc() in the probe path, switch to
kmalloc() entirely. This fixes the error path mismatch and will avoid
issues with CONFIG_HARDENED_USERCOPY_PAGESPAN=y.

Reported-by: Mihai Donțu <mihai.dontu@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Mario Limonciello <Mario.limonciello@dell.com>
Cc: stable@vger.kernel.org
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index c0c8945603cbbdd6284ff60b5df4d118502305d5..c9d86572713b2ba59b03a0442e15876a53c021a0 100644 (file)
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -903,7 +903,6 @@ static int wmi_dev_probe(struct device *dev)
        struct wmi_driver *wdriver =
                container_of(dev->driver, struct wmi_driver, driver);
        int ret = 0;
-       int count;
        char *buf;
 
        if (ACPI_FAILURE(wmi_method_enable(wblock, 1)))
@@ -925,9 +924,8 @@ static int wmi_dev_probe(struct device *dev)
                        goto probe_failure;
                }
 
-               count = get_order(wblock->req_buf_size);
-               wblock->handler_data = (void *)__get_free_pages(GFP_KERNEL,
-                                                               count);
+               wblock->handler_data = kmalloc(wblock->req_buf_size,
+                                              GFP_KERNEL);
                if (!wblock->handler_data) {
                        ret = -ENOMEM;
                        goto probe_failure;
@@ -973,8 +971,7 @@ static int wmi_dev_remove(struct device *dev)
        if (wdriver->filter_callback) {
                misc_deregister(&wblock->char_dev);
                kfree(wblock->char_dev.name);
-               free_pages((unsigned long)wblock->handler_data,
-                          get_order(wblock->req_buf_size));
+               kfree(wblock->handler_data);
        }
 
        if (wdriver->remove)