6.12-stable patches

added patches:
	platform-x86-amd-pmf-fix-cleanup-in-amd_pmf_init_smart_pc.patch

diff --git a/queue-6.12/platform-x86-amd-pmf-fix-cleanup-in-amd_pmf_init_smart_pc.patch b/queue-6.12/platform-x86-amd-pmf-fix-cleanup-in-amd_pmf_init_smart_pc.patch
new file mode 100644 (file)
index 0000000..17e591c
--- /dev/null
+++ b/queue-6.12/platform-x86-amd-pmf-fix-cleanup-in-amd_pmf_init_smart_pc.patch
@@ -0,0 +1,132 @@
+From 5b1122fc4995f308b21d7cfc64ef9880ac834d20 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Mon, 10 Mar 2025 22:48:29 +0300
+Subject: platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 5b1122fc4995f308b21d7cfc64ef9880ac834d20 upstream.
+
+There are a few problems in this code:
+
+First, if amd_pmf_tee_init() fails then the function returns directly
+instead of cleaning up.  We cannot simply do a "goto error;" because
+the amd_pmf_tee_init() cleanup calls tee_shm_free(dev->fw_shm_pool);
+and amd_pmf_tee_deinit() calls it as well leading to a double free.
+I have re-written this code to use an unwind ladder to free the
+allocations.
+
+Second, if amd_pmf_start_policy_engine() fails on every iteration though
+the loop then the code calls amd_pmf_tee_deinit() twice which is also a
+double free.  Call amd_pmf_tee_deinit() inside the loop for each failed
+iteration.  Also on that path the error codes are not necessarily
+negative kernel error codes.  Set the error code to -EINVAL.
+
+There is a very subtle third bug which is that if the call to
+input_register_device() in amd_pmf_register_input_device() fails then
+we call input_unregister_device() on an input device that wasn't
+registered.  This will lead to a reference counting underflow
+because of the device_del(&dev->dev) in __input_unregister_device().
+It's unlikely that anyone would ever hit this bug in real life.
+
+Fixes: 376a8c2a1443 ("platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/232231fc-6a71-495e-971b-be2a76f6db4c@stanley.mountain
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmf/tee-if.c |   36 +++++++++++++++++++++++-----------
+ 1 file changed, 25 insertions(+), 11 deletions(-)
+
+--- a/drivers/platform/x86/amd/pmf/tee-if.c
++++ b/drivers/platform/x86/amd/pmf/tee-if.c
+@@ -510,18 +510,18 @@ int amd_pmf_init_smart_pc(struct amd_pmf
+ 
+       ret = amd_pmf_set_dram_addr(dev, true);
+       if (ret)
+-              goto error;
++              goto err_cancel_work;
+ 
+       dev->policy_base = devm_ioremap(dev->dev, dev->policy_addr, dev->policy_sz);
+       if (!dev->policy_base) {
+               ret = -ENOMEM;
+-              goto error;
++              goto err_free_dram_buf;
+       }
+ 
+       dev->policy_buf = kzalloc(dev->policy_sz, GFP_KERNEL);
+       if (!dev->policy_buf) {
+               ret = -ENOMEM;
+-              goto error;
++              goto err_free_dram_buf;
+       }
+ 
+       memcpy_fromio(dev->policy_buf, dev->policy_base, dev->policy_sz);
+@@ -531,13 +531,13 @@ int amd_pmf_init_smart_pc(struct amd_pmf
+       dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL);
+       if (!dev->prev_data) {
+               ret = -ENOMEM;
+-              goto error;
++              goto err_free_policy;
+       }
+ 
+       for (i = 0; i < ARRAY_SIZE(amd_pmf_ta_uuid); i++) {
+               ret = amd_pmf_tee_init(dev, &amd_pmf_ta_uuid[i]);
+               if (ret)
+-                      return ret;
++                      goto err_free_prev_data;
+ 
+               ret = amd_pmf_start_policy_engine(dev);
+               switch (ret) {
+@@ -550,27 +550,41 @@ int amd_pmf_init_smart_pc(struct amd_pmf
+                       status = false;
+                       break;
+               default:
+-                      goto error;
++                      ret = -EINVAL;
++                      amd_pmf_tee_deinit(dev);
++                      goto err_free_prev_data;
+               }
+ 
+               if (status)
+                       break;
+       }
+ 
+-      if (!status && !pb_side_load)
+-              goto error;
++      if (!status && !pb_side_load) {
++              ret = -EINVAL;
++              goto err_free_prev_data;
++      }
+ 
+       if (pb_side_load)
+               amd_pmf_open_pb(dev, dev->dbgfs_dir);
+ 
+       ret = amd_pmf_register_input_device(dev);
+       if (ret)
+-              goto error;
++              goto err_pmf_remove_pb;
+ 
+       return 0;
+ 
+-error:
+-      amd_pmf_deinit_smart_pc(dev);
++err_pmf_remove_pb:
++      if (pb_side_load && dev->esbin)
++              amd_pmf_remove_pb(dev);
++      amd_pmf_tee_deinit(dev);
++err_free_prev_data:
++      kfree(dev->prev_data);
++err_free_policy:
++      kfree(dev->policy_buf);
++err_free_dram_buf:
++      kfree(dev->buf);
++err_cancel_work:
++      cancel_delayed_work_sync(&dev->pb_work);
+ 
+       return ret;
+ }

diff --git a/queue-6.12/series b/queue-6.12/series
index fb6db2fafd4eb91da3d10df041a6c235469c41e3..018c214b72d7c2c069652a04abbc68b4bbe7587e 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -423,3 +423,4 @@ nfsd-never-return-nfs4err_file_open-when-removing-a-directory.patch
 nfsd-skip-sending-cb_recall_any-when-the-backchannel-isn-t-up.patch
 arm-9443-1-require-linker-to-support-keep-within-overlay-for-dce.patch
 tracing-do-not-use-perf-enums-when-perf-is-not-defined.patch
+platform-x86-amd-pmf-fix-cleanup-in-amd_pmf_init_smart_pc.patch