[PATCH] platform/x86/intel/vsec: free ACPI discovery data on early errors

[PATCH] platform/x86/intel/vsec: free ACPI discovery data on early errors

[Yousef Alhouseen]

intel_vsec_add_dev() may attach an ACPI discovery table copy to the
intel_vsec_device before passing ownership to intel_vsec_add_aux(). The
normal auxiliary-device release path frees that copy, but the earliest
intel_vsec_add_aux() failures free only the outer structure directly.

Route those direct frees through a common helper so acpi_disc is
released consistently on the parent, xarray, and ID allocation failure
paths.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 drivers/platform/x86/intel/vsec.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
index 3ae4557b32b4..5ab2215fdd7f 100644
--- a/drivers/platform/x86/intel/vsec.c
+++ b/drivers/platform/x86/intel/vsec.c
@@ -103,6 +103,12 @@ static void intel_vsec_remove_aux(void *data)
 	auxiliary_device_uninit(data);
 }
 
+static void intel_vsec_dev_free(struct intel_vsec_device *intel_vsec_dev)
+{
+	kfree(intel_vsec_dev->acpi_disc);
+	kfree(intel_vsec_dev);
+}
+
 static void intel_vsec_dev_release(struct device *dev)
 {
 	struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev);
@@ -111,8 +117,7 @@ static void intel_vsec_dev_release(struct device *dev)
 
 	ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id);
 
-	kfree(intel_vsec_dev->acpi_disc);
-	kfree(intel_vsec_dev);
+	intel_vsec_dev_free(intel_vsec_dev);
 }
 
 static const struct vsec_feature_dependency *
@@ -218,20 +223,22 @@ int intel_vsec_add_aux(struct device *parent,
 	struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev;
 	int ret, id;
 
-	if (!parent)
+	if (!parent) {
+		intel_vsec_dev_free(intel_vsec_dev);
 		return -EINVAL;
+	}
 
 	ret = xa_alloc(&auxdev_array, &intel_vsec_dev->id, intel_vsec_dev,
 		       PMT_XA_LIMIT, GFP_KERNEL);
 	if (ret < 0) {
-		kfree(intel_vsec_dev);
+		intel_vsec_dev_free(intel_vsec_dev);
 		return ret;
 	}
 
 	id = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
 	if (id < 0) {
 		xa_erase(&auxdev_array, intel_vsec_dev->id);
-		kfree(intel_vsec_dev);
+		intel_vsec_dev_free(intel_vsec_dev);
 		return id;
 	}
 
-- 
2.54.0

Re: [PATCH] platform/x86/intel/vsec: free ACPI discovery data on early errors

[Ilpo Järvinen]

On Mon, 29 Jun 2026, Yousef Alhouseen wrote:

> intel_vsec_add_dev() may attach an ACPI discovery table copy to the
> intel_vsec_device before passing ownership to intel_vsec_add_aux(). The
> normal auxiliary-device release path frees that copy, but the earliest
> intel_vsec_add_aux() failures free only the outer structure directly.
> 
> Route those direct frees through a common helper so acpi_disc is
> released consistently on the parent, xarray, and ID allocation failure
> paths.
> 
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>

Shouldn't this have a Fixes tag?

--
 i.

> ---
>  drivers/platform/x86/intel/vsec.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
> index 3ae4557b32b4..5ab2215fdd7f 100644
> --- a/drivers/platform/x86/intel/vsec.c
> +++ b/drivers/platform/x86/intel/vsec.c
> @@ -103,6 +103,12 @@ static void intel_vsec_remove_aux(void *data)
>  	auxiliary_device_uninit(data);
>  }
>  
> +static void intel_vsec_dev_free(struct intel_vsec_device *intel_vsec_dev)
> +{
> +	kfree(intel_vsec_dev->acpi_disc);
> +	kfree(intel_vsec_dev);
> +}
> +
>  static void intel_vsec_dev_release(struct device *dev)
>  {
>  	struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev);
> @@ -111,8 +117,7 @@ static void intel_vsec_dev_release(struct device *dev)
>  
>  	ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id);
>  
> -	kfree(intel_vsec_dev->acpi_disc);
> -	kfree(intel_vsec_dev);
> +	intel_vsec_dev_free(intel_vsec_dev);
>  }
>  
>  static const struct vsec_feature_dependency *
> @@ -218,20 +223,22 @@ int intel_vsec_add_aux(struct device *parent,
>  	struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev;
>  	int ret, id;
>  
> -	if (!parent)
> +	if (!parent) {
> +		intel_vsec_dev_free(intel_vsec_dev);
>  		return -EINVAL;
> +	}
>  
>  	ret = xa_alloc(&auxdev_array, &intel_vsec_dev->id, intel_vsec_dev,
>  		       PMT_XA_LIMIT, GFP_KERNEL);
>  	if (ret < 0) {
> -		kfree(intel_vsec_dev);
> +		intel_vsec_dev_free(intel_vsec_dev);
>  		return ret;
>  	}
>  
>  	id = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
>  	if (id < 0) {
>  		xa_erase(&auxdev_array, intel_vsec_dev->id);
> -		kfree(intel_vsec_dev);
> +		intel_vsec_dev_free(intel_vsec_dev);
>  		return id;
>  	}
>  
>