kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers/platform
History
Dan Carpenter e70b4b8f93 platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() 
commit 5b1122fc49 upstream.

There are a few problems in this code:

First, if amd_pmf_tee_init() fails then the function returns directly
instead of cleaning up.  We cannot simply do a "goto error;" because
the amd_pmf_tee_init() cleanup calls tee_shm_free(dev->fw_shm_pool);
and amd_pmf_tee_deinit() calls it as well leading to a double free.
I have re-written this code to use an unwind ladder to free the
allocations.

Second, if amd_pmf_start_policy_engine() fails on every iteration though
the loop then the code calls amd_pmf_tee_deinit() twice which is also a
double free.  Call amd_pmf_tee_deinit() inside the loop for each failed
iteration.  Also on that path the error codes are not necessarily
negative kernel error codes.  Set the error code to -EINVAL.

There is a very subtle third bug which is that if the call to
input_register_device() in amd_pmf_register_input_device() fails then
we call input_unregister_device() on an input device that wasn't
registered.  This will lead to a reference counting underflow
because of the device_del(&dev->dev) in __input_unregister_device().
It's unlikely that anyone would ever hit this bug in real life.

Fixes: 376a8c2a14 ("platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/232231fc-6a71-495e-971b-be2a76f6db4c@stanley.mountain
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-04-10 14:39:41 +02:00
..
arm64 move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
chrome platform/chrome: cros_ec_lpc: fix product identity for early Framework Laptops 2025-01-02 10:34:14 +01:00
cznic platform: cznic: CZNIC_PLATFORMS should depend on ARCH_MVEBU 2025-02-27 04:30:20 -08:00
goldfish platform/goldfish: goldfish_pipe: add missing MODULE_DESCRIPTION() macro 2024-07-03 16:40:46 +02:00
loongarch platform/loongarch: laptop: Fix possible UAF and simplify generic_acpi_laptop_init() 2022-10-29 16:29:31 +08:00
mellanox platform/mellanox: mlxbf-pmc: incorrect type in assignment 2025-02-08 09:57:26 +01:00
mips platform: mips: cpu_hwmon: Disable driver on unsupported hardware 2024-06-21 10:22:10 +02:00
olpc platform-drivers-x86 for v6.12-1 2024-09-19 09:16:04 +02:00
surface move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
x86 platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc() 2025-04-10 14:39:41 +02:00
Kconfig platform: cznic: Add preliminary support for Turris Omnia MCU 2024-07-01 15:46:36 +02:00
Makefile platform-drivers-x86 for v6.11-1 2024-07-17 17:05:21 -07:00