Unverified Commit d9db3a94 authored by Mario Limonciello's avatar Mario Limonciello Committed by Ilpo Järvinen
Browse files

platform/x86/amd: pmf: Use device managed allocations 

If setting up smart PC fails for any reason then this can lead to
a double free when unloading amd-pmf.  This is because dev->buf was
freed but never set to NULL and is again freed in amd_pmf_remove().

To avoid subtle allocation bugs in failures leading to a double free
change all allocations into device managed allocations.

Fixes: 5b1122fc ("platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()")
Link: https://lore.kernel.org/r/20250512211154.2510397-2-superm1@kernel.org


Signed-off-by: default avatarMario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20250522003457.1516679-2-superm1@kernel.org


Reviewed-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: default avatarIlpo Järvinen <ilpo.jarvinen@linux.intel.com>
parent 784e48a8

drivers/platform/x86/amd/pmf/core.c

+1 −2
Original line number Diff line number Diff line
@@ -280,7 +280,7 @@ int amd_pmf_set_dram_addr(struct amd_pmf_dev *dev, bool alloc_buffer) 
			dev_err(dev->dev, "Invalid CPU id: 0x%x", dev->cpu_id);

		}



		dev->buf = kzalloc(dev->mtable_size, GFP_KERNEL);

		dev->buf = devm_kzalloc(dev->dev, dev->mtable_size, GFP_KERNEL);

		if (!dev->buf)

			return -ENOMEM;

	}
@@ -493,7 +493,6 @@ static void amd_pmf_remove(struct platform_device *pdev) 
	mutex_destroy(&dev->lock);

	mutex_destroy(&dev->update_mutex);

	mutex_destroy(&dev->cb_mutex);

	kfree(dev->buf);

}



static const struct attribute_group *amd_pmf_driver_groups[] = {

drivers/platform/x86/amd/pmf/tee-if.c

+21 −35
Original line number Diff line number Diff line
@@ -358,30 +358,28 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf, 
		return -EINVAL;



	/* re-alloc to the new buffer length of the policy binary */

	new_policy_buf = memdup_user(buf, length);

	if (IS_ERR(new_policy_buf))

		return PTR_ERR(new_policy_buf);

	new_policy_buf = devm_kzalloc(dev->dev, length, GFP_KERNEL);

	if (!new_policy_buf)

		return -ENOMEM;



	if (copy_from_user(new_policy_buf, buf, length)) {

		devm_kfree(dev->dev, new_policy_buf);

		return -EFAULT;

	}



	kfree(dev->policy_buf);

	devm_kfree(dev->dev, dev->policy_buf);

	dev->policy_buf = new_policy_buf;

	dev->policy_sz = length;



	if (!amd_pmf_pb_valid(dev)) {

		ret = -EINVAL;

		goto cleanup;

	}

	if (!amd_pmf_pb_valid(dev))

		return -EINVAL;



	amd_pmf_hex_dump_pb(dev);

	ret = amd_pmf_start_policy_engine(dev);

	if (ret < 0)

		goto cleanup;

		return ret;



	return length;



cleanup:

	kfree(dev->policy_buf);

	dev->policy_buf = NULL;

	return ret;

}



static const struct file_operations pb_fops = {
@@ -532,13 +530,13 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) 
	dev->policy_base = devm_ioremap_resource(dev->dev, dev->res);

	if (IS_ERR(dev->policy_base)) {

		ret = PTR_ERR(dev->policy_base);

		goto err_free_dram_buf;

		goto err_cancel_work;

	}



	dev->policy_buf = kzalloc(dev->policy_sz, GFP_KERNEL);

	dev->policy_buf = devm_kzalloc(dev->dev, dev->policy_sz, GFP_KERNEL);

	if (!dev->policy_buf) {

		ret = -ENOMEM;

		goto err_free_dram_buf;

		goto err_cancel_work;

	}



	memcpy_fromio(dev->policy_buf, dev->policy_base, dev->policy_sz);
@@ -546,21 +544,21 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) 
	if (!amd_pmf_pb_valid(dev)) {

		dev_info(dev->dev, "No Smart PC policy present\n");

		ret = -EINVAL;

		goto err_free_policy;

		goto err_cancel_work;

	}



	amd_pmf_hex_dump_pb(dev);



	dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL);

	dev->prev_data = devm_kzalloc(dev->dev, sizeof(*dev->prev_data), GFP_KERNEL);

	if (!dev->prev_data) {

		ret = -ENOMEM;

		goto err_free_policy;

		goto err_cancel_work;

	}



	for (i = 0; i < ARRAY_SIZE(amd_pmf_ta_uuid); i++) {

		ret = amd_pmf_tee_init(dev, &amd_pmf_ta_uuid[i]);

		if (ret)

			goto err_free_prev_data;

			goto err_cancel_work;



		ret = amd_pmf_start_policy_engine(dev);

		switch (ret) {
@@ -575,7 +573,7 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) 
		default:

			ret = -EINVAL;

			amd_pmf_tee_deinit(dev);

			goto err_free_prev_data;

			goto err_cancel_work;

		}



		if (status)
@@ -584,7 +582,7 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) 


	if (!status && !pb_side_load) {

		ret = -EINVAL;

		goto err_free_prev_data;

		goto err_cancel_work;

	}



	if (pb_side_load)
@@ -600,12 +598,6 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) 
	if (pb_side_load && dev->esbin)

		amd_pmf_remove_pb(dev);

	amd_pmf_tee_deinit(dev);

err_free_prev_data:

	kfree(dev->prev_data);

err_free_policy:

	kfree(dev->policy_buf);

err_free_dram_buf:

	kfree(dev->buf);

err_cancel_work:

	cancel_delayed_work_sync(&dev->pb_work);
@@ -621,11 +613,5 @@ void amd_pmf_deinit_smart_pc(struct amd_pmf_dev *dev) 
		amd_pmf_remove_pb(dev);



	cancel_delayed_work_sync(&dev->pb_work);

	kfree(dev->prev_data);

	dev->prev_data = NULL;

	kfree(dev->policy_buf);

	dev->policy_buf = NULL;

	kfree(dev->buf);

	dev->buf = NULL;

	amd_pmf_tee_deinit(dev);

}