[SRU][N][PATCH 0/1] CVE-2025-38421

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-38421

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd: pmf: Use device managed allocations

If setting up smart PC fails for any reason then this can lead to a double free
when unloading amd-pmf. This is because dev->buf was freed but never set to
NULL and is again freed in amd_pmf_remove().

To avoid subtle allocation bugs in failures leading to a double free change all
allocations into device managed allocations.

[ Fix ]

noble/linux: backported from d9db3a941270

The backport converts the affected allocations in the amd-pmf driver from
kzalloc()/kfree() to the device managed devm_kzalloc()/devm_kfree() variants
(dev->buf, policy_buf, prev_data and new_policy_buf), so the memory is freed
automatically when the device goes away. The explicit kfree(dev->buf) in
amd_pmf_remove() is dropped, and the smart PC setup error paths are adjusted
to no longer perform manual frees, removing the double free window.

This tree lacks upstream's mtable_size/cpu_id switch, cb_mutex, and the
err_pmf_remove_pb error block, and uses devm_ioremap(dev->policy_addr) rather
than devm_ioremap_resource(dev->res), so only the device managed allocation
conversion from d9db3a941270 was applied and the surrounding error handling
was retargeted to match this tree.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would primarily affect AMD laptops and platforms that load the
amd-pmf driver and enable its smart PC / policy functionality, where the
converted allocations and reworked error handling are exercised; regressions
could show up as memory being freed too early or too late, or as failures in
the smart PC setup and teardown paths. Systems without AMD PMF hardware, and
those where the amd-pmf driver is not loaded, are not affected.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: cae35cbc/v1