Possible broken MM code in dell-laptop.c?

Pali Rohár
2015-06-14T09:05:19Z

[-- Attachment #1: Type: text/plain, Size: 1919 bytes --]

Hello,

in drivers/platform/x86/dell-laptop.c is this part of code:

static int __init dell_init(void)
{
...
/*
* Allocate buffer below 4GB for SMI data--only 32-bit physical addr
* is passed to SMI handler.
*/
bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
if (!bufferpage) {
ret = -ENOMEM;
goto fail_buffer;
}
buffer = page_address(bufferpage);

ret = dell_setup_rfkill();

if (ret) {
pr_warn("Unable to setup rfkill\n");
goto fail_rfkill;
}
...
fail_rfkill:
free_page((unsigned long)bufferpage);
fail_buffer:
...
}

Then there is another part:

static void __exit dell_exit(void)
{
...
free_page((unsigned long)buffer);
}

I suspect that there is some problem with free_page() call. In dell_init
is called free_page() on bufferpage and in dell_exit() on buffer.

Matthew and Stuart, you introduced this inconsistency in commit:

-------------------------------------------------
commit 116ee77b2858d9c89c0327f3a47c8ba864bf4a96
Author: Stuart Hayes <stuart_hayes@dell.com>
Committer: Matthew Garrett <mjg@redhat.com>
Date: Wed Feb 10 14:12:13 2010 -0500

dell-laptop: Use buffer with 32-bit physical address

Calls to communicate with system firmware via a SMI (using dcdbas)
need to use a buffer that has a physical address of 4GB or less.
Currently the dell-laptop driver does not guarantee this, and when
the
buffer address is higher than 4GB, the address is truncated to 32
bits
and the SMI handler writes to the wrong memory address.

Signed-off-by: Stuart Hayes <stuart_hayes@dell.com>
Acked-by: Matthew Garrett <mjg@redhat.com>
-------------------------------------------------

Can you or somebody else (CCed linux-mm) look at this page related code?
I think it is wrong, but somebody authoritative should provide answer.

Thanks.

--
Pali Rohár
pali.rohar@gmail.com

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]