ACK: [SRU][N][PATCH 0/1] CVE-2025-38421

[Andrei Gherzan]

On 26/09/11 01:53AM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-38421
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> platform/x86/amd: pmf: Use device managed allocations
> 
> If setting up smart PC fails for any reason then this can lead to a double free
> when unloading amd-pmf. This is because dev->buf was freed but never set to
> NULL and is again freed in amd_pmf_remove().
> 
> To avoid subtle allocation bugs in failures leading to a double free change all
> allocations into device managed allocations.
> 
> [ Fix ]
> 
> noble/linux: backported from d9db3a941270
> 
> The backport converts the affected allocations in the amd-pmf driver from
> kzalloc()/kfree() to the device managed devm_kzalloc()/devm_kfree() variants
> (dev->buf, policy_buf, prev_data and new_policy_buf), so the memory is freed
> automatically when the device goes away. The explicit kfree(dev->buf) in
> amd_pmf_remove() is dropped, and the smart PC setup error paths are adjusted
> to no longer perform manual frees, removing the double free window.
> 
> This tree lacks upstream's mtable_size/cpu_id switch, cb_mutex, and the
> err_pmf_remove_pb error block, and uses devm_ioremap(dev->policy_addr) rather
> than devm_ioremap_resource(dev->res), so only the device managed allocation
> conversion from d9db3a941270 was applied and the surrounding error handling
> was retargeted to match this tree.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix would primarily affect AMD laptops and platforms that load the
> amd-pmf driver and enable its smart PC / policy functionality, where the
> converted allocations and reworked error handling are exercised; regressions
> could show up as memory being freed too early or too late, or as failures in
> the smart PC setup and teardown paths. Systems without AMD PMF hardware, and
> those where the amd-pmf driver is not loaded, are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v11-25-ga27c0fa6. Reference: cae35cbc/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/bb7be1de/attachment.sig>