NACK/Cmnt: [SRU][N][PATCH 0/1] CVE-2025-38421

[Edoardo Canepa]

Rejected for the following reasons:

the devm conversion itself is fine and does close the double
free, but the patch also silently changes "if (ret)" to "if (ret < 0)"
in amd_pmf_get_pb_data(), which is not part of d9db3a941270: it is
context there because upstream already carried d1e33cd66670 ("pmf: Fix
return value of amd_pmf_start_policy_engine()"), whose other half made
that function return -EIO instead of the raw TA code.

Noble has neither half - amd_pmf_start_policy_engine() still ends
"return res;" - so "ret < 0" stops catching the positive TA errors
(TA_ERROR_CRYPTO_INVALID_PARAM, TA_ERROR_CRYPTO_BIN_TOO_LARGE), and
with the cleanup label gone a rejected policy now makes write() return
length as if it had succeeded, policy_buf still installed and
smart_pc_enabled false.
Backporting d1e33cd66670 is not the answer either: 9ba93cb8212d later
restored "return res;" upstream precisely so the TA_ERROR_CRYPTO_* arms
of the switch in amd_pmf_init_smart_pc() would see the raw code, and
noble already has that switch, so -EIO would break the per-UUID retry.
Please just keep the existing condition - "if (ret) return -EINVAL;",
as upstream had it before d1e33cd66670 - and note the deviation in
[Fix]; with that the rest of the patch is good.

On 9/11/26 03:53, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-38421
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> platform/x86/amd: pmf: Use device managed allocations
>
> If setting up smart PC fails for any reason then this can lead to a double free
> when unloading amd-pmf. This is because dev->buf was freed but never set to
> NULL and is again freed in amd_pmf_remove().
>
> To avoid subtle allocation bugs in failures leading to a double free change all
> allocations into device managed allocations.
>
> [ Fix ]
>
> noble/linux: backported from d9db3a941270
>
> The backport converts the affected allocations in the amd-pmf driver from
> kzalloc()/kfree() to the device managed devm_kzalloc()/devm_kfree() variants
> (dev->buf, policy_buf, prev_data and new_policy_buf), so the memory is freed
> automatically when the device goes away. The explicit kfree(dev->buf) in
> amd_pmf_remove() is dropped, and the smart PC setup error paths are adjusted
> to no longer perform manual frees, removing the double free window.
>
> This tree lacks upstream's mtable_size/cpu_id switch, cb_mutex, and the
> err_pmf_remove_pb error block, and uses devm_ioremap(dev->policy_addr) rather
> than devm_ioremap_resource(dev->res), so only the device managed allocation
> conversion from d9db3a941270 was applied and the surrounding error handling
> was retargeted to match this tree.
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> A bad fix would primarily affect AMD laptops and platforms that load the
> amd-pmf driver and enable its smart PC / policy functionality, where the
> converted allocations and reworked error handling are exercised; regressions
> could show up as memory being freed too early or too late, or as failures in
> the smart PC setup and teardown paths. Systems without AMD PMF hardware, and
> those where the amd-pmf driver is not loaded, are not affected.
>
> [ Other Info ]
>
> Kybele flow-v11-25-ga27c0fa6. Reference: cae35cbc/v1
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/7cb3c0eb/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/7cb3c0eb/attachment-0001.sig>