Skip to content

Commit 5b1122f

Browse files
Dan Carpenterij-intel
authored andcommitted
platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()
There are a few problems in this code: First, if amd_pmf_tee_init() fails then the function returns directly instead of cleaning up. We cannot simply do a "goto error;" because the amd_pmf_tee_init() cleanup calls tee_shm_free(dev->fw_shm_pool); and amd_pmf_tee_deinit() calls it as well leading to a double free. I have re-written this code to use an unwind ladder to free the allocations. Second, if amd_pmf_start_policy_engine() fails on every iteration though the loop then the code calls amd_pmf_tee_deinit() twice which is also a double free. Call amd_pmf_tee_deinit() inside the loop for each failed iteration. Also on that path the error codes are not necessarily negative kernel error codes. Set the error code to -EINVAL. There is a very subtle third bug which is that if the call to input_register_device() in amd_pmf_register_input_device() fails then we call input_unregister_device() on an input device that wasn't registered. This will lead to a reference counting underflow because of the device_del(&dev->dev) in __input_unregister_device(). It's unlikely that anyone would ever hit this bug in real life. Fixes: 376a8c2 ("platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/232231fc-6a71-495e-971b-be2a76f6db4c@stanley.mountain Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
1 parent 376a8c2 commit 5b1122f

File tree

1 file changed

+25
-11
lines changed

1 file changed

+25
-11
lines changed

drivers/platform/x86/amd/pmf/tee-if.c

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -510,18 +510,18 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
510510

511511
ret = amd_pmf_set_dram_addr(dev, true);
512512
if (ret)
513-
goto error;
513+
goto err_cancel_work;
514514

515515
dev->policy_base = devm_ioremap_resource(dev->dev, dev->res);
516516
if (IS_ERR(dev->policy_base)) {
517517
ret = PTR_ERR(dev->policy_base);
518-
goto error;
518+
goto err_free_dram_buf;
519519
}
520520

521521
dev->policy_buf = kzalloc(dev->policy_sz, GFP_KERNEL);
522522
if (!dev->policy_buf) {
523523
ret = -ENOMEM;
524-
goto error;
524+
goto err_free_dram_buf;
525525
}
526526

527527
memcpy_fromio(dev->policy_buf, dev->policy_base, dev->policy_sz);
@@ -531,13 +531,13 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
531531
dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL);
532532
if (!dev->prev_data) {
533533
ret = -ENOMEM;
534-
goto error;
534+
goto err_free_policy;
535535
}
536536

537537
for (i = 0; i < ARRAY_SIZE(amd_pmf_ta_uuid); i++) {
538538
ret = amd_pmf_tee_init(dev, &amd_pmf_ta_uuid[i]);
539539
if (ret)
540-
return ret;
540+
goto err_free_prev_data;
541541

542542
ret = amd_pmf_start_policy_engine(dev);
543543
switch (ret) {
@@ -550,27 +550,41 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
550550
status = false;
551551
break;
552552
default:
553-
goto error;
553+
ret = -EINVAL;
554+
amd_pmf_tee_deinit(dev);
555+
goto err_free_prev_data;
554556
}
555557

556558
if (status)
557559
break;
558560
}
559561

560-
if (!status && !pb_side_load)
561-
goto error;
562+
if (!status && !pb_side_load) {
563+
ret = -EINVAL;
564+
goto err_free_prev_data;
565+
}
562566

563567
if (pb_side_load)
564568
amd_pmf_open_pb(dev, dev->dbgfs_dir);
565569

566570
ret = amd_pmf_register_input_device(dev);
567571
if (ret)
568-
goto error;
572+
goto err_pmf_remove_pb;
569573

570574
return 0;
571575

572-
error:
573-
amd_pmf_deinit_smart_pc(dev);
576+
err_pmf_remove_pb:
577+
if (pb_side_load && dev->esbin)
578+
amd_pmf_remove_pb(dev);
579+
amd_pmf_tee_deinit(dev);
580+
err_free_prev_data:
581+
kfree(dev->prev_data);
582+
err_free_policy:
583+
kfree(dev->policy_buf);
584+
err_free_dram_buf:
585+
kfree(dev->buf);
586+
err_cancel_work:
587+
cancel_delayed_work_sync(&dev->pb_work);
574588

575589
return ret;
576590
}

0 commit comments

Comments
 (0)