platform/x86: wmi: Do not mix pages and kmalloc

PATCH Applied Kees Cook 4 participants 7 messages Jun 20, 2018 – Aug 6, 2018 x86 platform drivers

Share & tools

Kees Cook

author

2018-06-20 21:31 UTC #0 lore raw

PATCH 1/1 platform/x86: wmi: Do not mix pages and kmalloc

The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since other things are happily using kmalloc() in the probe path, switch to kmalloc() entirely. This fixes the error path mismatch and will avoid issues with CONFIG_HARDENED_USERCOPY_PAGESPAN=y.

Reported-by Mihai Donțu <[email protected]>

Signed-off-by Kees Cook <[email protected]>

---
 drivers/platform/x86/wmi.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

drivers/platform/x86/wmi.c +3 -6

index 8e3d0146ff8c..04791ea5d97b 100644
@@ -895,7 +895,6 @@ static int wmi_dev_probe(struct device *dev)
 	struct wmi_driver *wdriver =
 		container_of(dev->driver, struct wmi_driver, driver);
 	int ret = 0;
-	int count;
 	char *buf;
 
 	if (ACPI_FAILURE(wmi_method_enable(wblock, 1)))

@@ -917,9 +916,8 @@ static int wmi_dev_probe(struct device *dev)
 			goto probe_failure;
 		}
 
-		count = get_order(wblock->req_buf_size);
-		wblock->handler_data = (void *)__get_free_pages(GFP_KERNEL,
-								count);
+		wblock->handler_data = kmalloc(wblock->req_buf_size,
+					       GFP_KERNEL);
 		if (!wblock->handler_data) {
 			ret = -ENOMEM;
 			goto probe_failure;

@@ -964,8 +962,7 @@ static int wmi_dev_remove(struct device *dev)
 	if (wdriver->filter_callback) {
 		misc_deregister(&wblock->char_dev);
 		kfree(wblock->char_dev.name);
-		free_pages((unsigned long)wblock->handler_data,
-			   get_order(wblock->req_buf_size));
+		kfree(wblock->handler_data);
 	}
 
 	if (wdriver->remove)

Signature · 6 lines

2.17.1


-- 
Kees Cook
Pixel Security

Darren Hart

2018-06-20 23:37 UTC #1 lore raw

Quoted 2 lines · Kees Cook

The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since

v4 of Mario's series used kmalloc:
https://patchwork.kernel.org/patch/9985827/

This was changed in v10 to use __get_free_pages:
https://patchwork.kernel.org/patch/10018023/

But... I'm not finding the discussion that led to this change.... Mario, do you recall? Something about contiguous memory? We had a similar discussion on an earlier series:

https://patchwork.kernel.org/patch/9975277/

Quoted 52 lines

other things are happily using kmalloc() in the probe path, switch to kmalloc() entirely. This fixes the error path mismatch and will avoid issues with CONFIG_HARDENED_USERCOPY_PAGESPAN=y.

Reported-by Mihai Donțu <[email protected]>

Signed-off-by Kees Cook <[email protected]>

---
 drivers/platform/x86/wmi.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

drivers/platform/x86/wmi.c +3 -6

index 8e3d0146ff8c..04791ea5d97b 100644
@@ -895,7 +895,6 @@ static int wmi_dev_probe(struct device *dev)
 	struct wmi_driver *wdriver =
 		container_of(dev->driver, struct wmi_driver, driver);
 	int ret = 0;
-	int count;
 	char *buf;
 
 	if (ACPI_FAILURE(wmi_method_enable(wblock, 1)))

@@ -917,9 +916,8 @@ static int wmi_dev_probe(struct device *dev)
 			goto probe_failure;
 		}
 
-		count = get_order(wblock->req_buf_size);
-		wblock->handler_data = (void *)__get_free_pages(GFP_KERNEL,
-								count);
+		wblock->handler_data = kmalloc(wblock->req_buf_size,
+					       GFP_KERNEL);
 		if (!wblock->handler_data) {
 			ret = -ENOMEM;
 			goto probe_failure;

@@ -964,8 +962,7 @@ static int wmi_dev_remove(struct device *dev)
 	if (wdriver->filter_callback) {
 		misc_deregister(&wblock->char_dev);
 		kfree(wblock->char_dev.name);
-		free_pages((unsigned long)wblock->handler_data,
-			   get_order(wblock->req_buf_size));
+		kfree(wblock->handler_data);
 	}
 
 	if (wdriver->remove)

Signature · 6 lines

2.17.1


-- 
Kees Cook
Pixel Security

Signature · 2 lines

Darren Hart
VMware Open Source Technology Center

Kees Cook

author

2018-06-20 23:43 UTC #2 lore raw

Quoted 7 lines · Darren Hart

Quoted 2 lines · Kees Cook
The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since
v4 of Mario's series used kmalloc:
https://patchwork.kernel.org/patch/9985827/

Quoted 8 lines

This was changed in v10 to use __get_free_pages:
https://patchwork.kernel.org/patch/10018023/
But... I'm not finding the discussion that led to this change.... Mario, do you recall? Something about contiguous memory? We had a similar discussion on an earlier series:
https://patchwork.kernel.org/patch/9975277/

FWIW, kmalloc gets you contiguous memory...

But if the reason is found and needs to stay, the probe error path's kfree() needs to be fixed, and __GFP_COMP needs to be added to the free page flags.

-Kees

Signature · 2 lines

Kees Cook
Pixel Security

Darren Hart

2018-06-21 00:17 UTC #3 lore raw

Quoted 11 lines · Kees Cook

Quoted 10 lines · Darren Hart
Quoted 2 lines · Kees Cook
The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since
v4 of Mario's series used kmalloc:
https://patchwork.kernel.org/patch/9985827/
This was changed in v10 to use __get_free_pages:
https://patchwork.kernel.org/patch/10018023/

Quoted 7 lines

Quoted 5 lines
But... I'm not finding the discussion that led to this change.... Mario, do you recall? Something about contiguous memory? We had a similar discussion on an earlier series:
https://patchwork.kernel.org/patch/9975277/
FWIW, kmalloc gets you contiguous memory...

Yeah, I'm not finding a valid reason to use __get_free_pages over kmalloc in this case. I'll give Mario a chance to respond in case I'm just missing something, but otherwise will plan to apply this patch.

Quoted 4 lines

But if the reason is found and needs to stay, the probe error path's kfree() needs to be fixed, and __GFP_COMP needs to be added to the free page flags.

Got it, thanks Kees.

Signature · 2 lines

Darren Hart
VMware Open Source Technology Center

[email protected]

Acked-by

2018-06-21 01:24 UTC #4 lore raw

Quoted 23 lines

-----Original Message-----
From: Darren Hart [mailto:[email protected]]
Sent: Wednesday, June 20, 2018 7:17 PM
To: Kees Cook
Cc: LKML; Andy Shevchenko; Platform Driver; Mihai Donțu; Limonciello, Mario
Subject: Re: [PATCH] platform/x86: wmi: Do not mix pages and kmalloc
Quoted 15 lines · Kees Cook
Quoted 14 lines · Darren Hart
Quoted 2 lines · Kees Cook
The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since
v4 of Mario's series used kmalloc:
https://patchwork.kernel.org/patch/9985827/
This was changed in v10 to use __get_free_pages:
https://patchwork.kernel.org/patch/10018023/
But... I'm not finding the discussion that led to this change.... Mario, do you recall? Something about contiguous memory? We had a similar discussion on an earlier series:

Quoted 7 lines

Quoted 3 lines
Quoted 1 line
https://patchwork.kernel.org/patch/9975277/
FWIW, kmalloc gets you contiguous memory...
Yeah, I'm not finding a valid reason to use __get_free_pages over kmalloc in this case. I'll give Mario a chance to respond in case I'm just missing something, but otherwise will plan to apply this patch.

I think it was for contiguous memory, so if kmalloc is giving that I agree no need to keep __get_free_pages instead.

Acked-by Mario Limonciello <[email protected]>

Thanks,

Quoted 11 lines

Quoted 5 lines
But if the reason is found and needs to stay, the probe error path's kfree() needs to be fixed, and __GFP_COMP needs to be added to the free page flags.
Got it, thanks Kees.
--
Darren Hart
VMware Open Source Technology Center

Darren Hart

Applied

2018-06-22 23:27 UTC #5 lore raw

Quoted 27 lines · On Thu, Jun 21, 2018 at 01:24:34AM +0000, [email protected] wrote:

Quoted 27 lines
-----Original Message-----
From: Darren Hart [mailto:[email protected]]
Sent: Wednesday, June 20, 2018 7:17 PM
To: Kees Cook
Cc: LKML; Andy Shevchenko; Platform Driver; Mihai Donțu; Limonciello, Mario
Subject: Re: [PATCH] platform/x86: wmi: Do not mix pages and kmalloc
Quoted 18 lines · Kees Cook
Quoted 7 lines · Darren Hart
Quoted 2 lines · Kees Cook
The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since
v4 of Mario's series used kmalloc:
https://patchwork.kernel.org/patch/9985827/
Quoted 8 lines
This was changed in v10 to use __get_free_pages:
https://patchwork.kernel.org/patch/10018023/
But... I'm not finding the discussion that led to this change.... Mario, do you recall? Something about contiguous memory? We had a similar discussion on an earlier series:
https://patchwork.kernel.org/patch/9975277/
FWIW, kmalloc gets you contiguous memory...

Quoted 8 lines

Quoted 3 lines
Yeah, I'm not finding a valid reason to use __get_free_pages over kmalloc in this case. I'll give Mario a chance to respond in case I'm just missing something, but otherwise will plan to apply this patch.
I think it was for contiguous memory, so if kmalloc is giving that I agree no need to keep __get_free_pages instead.
Acked-by Mario Limonciello <[email protected]>

Confirmed, kmalloc in physically contiguous.

Queued up, and tagged for stable. Thanks everyone.

Signature · 2 lines

Darren Hart
VMware Open Source Technology Center

Mihai Donțu

2018-08-06 11:36 UTC #6 lore raw

Hi Darren,

Quoted 32 lines · Darren Hart

Quoted 31 lines · On Thu, Jun 21, 2018 at 01:24:34AM +0000, [email protected] wrote:
Quoted 30 lines
-----Original Message-----
From: Darren Hart [mailto:[email protected]]
Sent: Wednesday, June 20, 2018 7:17 PM
To: Kees Cook
Cc: LKML; Andy Shevchenko; Platform Driver; Mihai Donțu; Limonciello, Mario
Subject: Re: [PATCH] platform/x86: wmi: Do not mix pages and kmalloc
Quoted 11 lines · Kees Cook
Quoted 10 lines · Darren Hart
Quoted 2 lines · Kees Cook
The probe handler_data was being allocated with __get_free_pages() for no reason I could find. The error path was using kfree(). Since
v4 of Mario's series used kmalloc:
https://patchwork.kernel.org/patch/9985827/
This was changed in v10 to use __get_free_pages:
https://patchwork.kernel.org/patch/10018023/
Quoted 7 lines
Quoted 5 lines
But... I'm not finding the discussion that led to this change.... Mario, do you recall? Something about contiguous memory? We had a similar discussion on an earlier series:
https://patchwork.kernel.org/patch/9975277/
FWIW, kmalloc gets you contiguous memory...
Yeah, I'm not finding a valid reason to use __get_free_pages over kmalloc in this case. I'll give Mario a chance to respond in case I'm just missing something, but otherwise will plan to apply this patch.

Quoted 9 lines

Quoted 4 lines
I think it was for contiguous memory, so if kmalloc is giving that I agree no need to keep __get_free_pages instead.
Acked-by Mario Limonciello <[email protected]>
Confirmed, kmalloc in physically contiguous.
Queued up, and tagged for stable. Thanks everyone.

Would it be possible to queue this for 4.18 or is it too late? I just noticed it has not reached 4.17.12 either.

Thanks,

Signature · 1 line

Mihai Donțu