[SRU][N][PATCH 1/1] platform/x86/amd: pmf: Use device managed allocations
Cengiz Can
cengiz.can at canonical.com
Fri Sep 11 01:53:42 UTC 2026
From: Mario Limonciello <mario.limonciello at amd.com>
If setting up smart PC fails for any reason then this can lead to
a double free when unloading amd-pmf. This is because dev->buf was
freed but never set to NULL and is again freed in amd_pmf_remove().
To avoid subtle allocation bugs in failures leading to a double free
change all allocations into device managed allocations.
Fixes: 5b1122fc4995f ("platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()")
Link: https://lore.kernel.org/r/20250512211154.2510397-2-superm1@kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello at amd.com>
Link: https://lore.kernel.org/r/20250522003457.1516679-2-superm1@kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen at linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen at linux.intel.com>
(backported from commit d9db3a941270d92bbd1a6a6b54a10324484f2f2d)
[bot_kybele: This tree lacks upstream's mtable_size/cpu_id switch, cb_mutex, and
the err_pmf_remove_pb error block, and uses devm_ioremap(dev->policy_addr) not
devm_ioremap_resource(dev->res); so I applied only the devm allocation
conversion (kzalloc->devm_kzalloc for dev->buf sizeof(m_table), policy_buf,
prev_data, new_policy_buf; kfree->devm_kfree), dropped the kfree(dev->buf) in
amd_pmf_remove, retargeted the policy_base goto to err_cancel_work, and removed
the err_free_* kfree labels without adding the...]
CVE-2025-38421
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
drivers/platform/x86/amd/pmf/core.c | 3 +-
drivers/platform/x86/amd/pmf/tee-if.c | 51 +++++++++------------------
2 files changed, 17 insertions(+), 37 deletions(-)
diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c
index 634ebdd05cce..02d8611d9962 100644
--- a/drivers/platform/x86/amd/pmf/core.c
+++ b/drivers/platform/x86/amd/pmf/core.c
@@ -273,7 +273,7 @@ int amd_pmf_set_dram_addr(struct amd_pmf_dev *dev, bool alloc_buffer)
/* Get Metrics Table Address */
if (alloc_buffer) {
- dev->buf = kzalloc(sizeof(dev->m_table), GFP_KERNEL);
+ dev->buf = devm_kzalloc(dev->dev, sizeof(dev->m_table), GFP_KERNEL);
if (!dev->buf)
return -ENOMEM;
}
@@ -543,7 +543,6 @@ static void amd_pmf_remove(struct platform_device *pdev)
amd_pmf_dbgfs_unregister(dev);
mutex_destroy(&dev->lock);
mutex_destroy(&dev->update_mutex);
- kfree(dev->buf);
}
static const struct attribute_group *amd_pmf_driver_groups[] = {
diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
index 5c322adabbb3..f5006fa879f5 100644
--- a/drivers/platform/x86/amd/pmf/tee-if.c
+++ b/drivers/platform/x86/amd/pmf/tee-if.c
@@ -300,35 +300,28 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf,
return -EINVAL;
/* re-alloc to the new buffer length of the policy binary */
- new_policy_buf = kzalloc(length, GFP_KERNEL);
+ new_policy_buf = devm_kzalloc(dev->dev, length, GFP_KERNEL);
if (!new_policy_buf)
return -ENOMEM;
if (copy_from_user(new_policy_buf, buf, length)) {
- kfree(new_policy_buf);
+ devm_kfree(dev->dev, new_policy_buf);
return -EFAULT;
}
- kfree(dev->policy_buf);
+ devm_kfree(dev->dev, dev->policy_buf);
dev->policy_buf = new_policy_buf;
dev->policy_sz = length;
- if (!amd_pmf_pb_valid(dev)) {
- ret = -EINVAL;
- goto cleanup;
- }
+ if (!amd_pmf_pb_valid(dev))
+ return -EINVAL;
amd_pmf_hex_dump_pb(dev);
ret = amd_pmf_start_policy_engine(dev);
- if (ret)
- goto cleanup;
+ if (ret < 0)
+ return ret;
return length;
-
-cleanup:
- kfree(dev->policy_buf);
- dev->policy_buf = NULL;
- return ret;
}
static const struct file_operations pb_fops = {
@@ -460,13 +453,13 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
dev->policy_base = devm_ioremap(dev->dev, dev->policy_addr, dev->policy_sz);
if (!dev->policy_base) {
ret = -ENOMEM;
- goto err_free_dram_buf;
+ goto err_cancel_work;
}
- dev->policy_buf = kzalloc(dev->policy_sz, GFP_KERNEL);
+ dev->policy_buf = devm_kzalloc(dev->dev, dev->policy_sz, GFP_KERNEL);
if (!dev->policy_buf) {
ret = -ENOMEM;
- goto err_free_dram_buf;
+ goto err_cancel_work;
}
memcpy(dev->policy_buf, dev->policy_base, dev->policy_sz);
@@ -474,21 +467,21 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
if (!amd_pmf_pb_valid(dev)) {
dev_info(dev->dev, "No Smart PC policy present\n");
ret = -EINVAL;
- goto err_free_policy;
+ goto err_cancel_work;
}
amd_pmf_hex_dump_pb(dev);
- dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL);
+ dev->prev_data = devm_kzalloc(dev->dev, sizeof(*dev->prev_data), GFP_KERNEL);
if (!dev->prev_data) {
ret = -ENOMEM;
- goto err_free_policy;
+ goto err_cancel_work;
}
for (i = 0; i < ARRAY_SIZE(amd_pmf_ta_uuid); i++) {
ret = amd_pmf_tee_init(dev, &amd_pmf_ta_uuid[i]);
if (ret)
- goto err_free_prev_data;
+ goto err_cancel_work;
ret = amd_pmf_start_policy_engine(dev);
switch (ret) {
@@ -503,7 +496,7 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
default:
ret = -EINVAL;
amd_pmf_tee_deinit(dev);
- goto err_free_prev_data;
+ goto err_cancel_work;
}
if (status)
@@ -512,7 +505,7 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
if (!status && !pb_side_load) {
ret = -EINVAL;
- goto err_free_prev_data;
+ goto err_cancel_work;
}
if (pb_side_load)
@@ -520,12 +513,6 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
return 0;
-err_free_prev_data:
- kfree(dev->prev_data);
-err_free_policy:
- kfree(dev->policy_buf);
-err_free_dram_buf:
- kfree(dev->buf);
err_cancel_work:
cancel_delayed_work_sync(&dev->pb_work);
@@ -538,11 +525,5 @@ void amd_pmf_deinit_smart_pc(struct amd_pmf_dev *dev)
amd_pmf_remove_pb(dev);
cancel_delayed_work_sync(&dev->pb_work);
- kfree(dev->prev_data);
- dev->prev_data = NULL;
- kfree(dev->policy_buf);
- dev->policy_buf = NULL;
- kfree(dev->buf);
- dev->buf = NULL;
amd_pmf_tee_deinit(dev);
}
--
2.53.0
More information about the kernel-team
mailing list