Re: [PATCH 2/2] drivers/platform/x86/amd: pmf: Handle bad policies in amd_pmf_get_pb_data()

["Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>]

On Wed, 23 Apr 2025, Mario Limonciello wrote:

> From: Mario Limonciello <mario.limonciello@amd.com>
> 
> If a policy is passed into amd_pmf_get_pb_data() that causes the engine
> to fail to start there is a memory leak. Check for invalid policies as
> well as an error in amd_pmf_start_policy_engine() and free the memory in
> the failure path.
> 
> Fixes: 10817f28e5337 ("platform/x86/amd/pmf: Add capability to sideload of policy binary")
> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
> ---
>  drivers/platform/x86/amd/pmf/tee-if.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
> index 41ab9eca5ff13..3c399dc1bfcca 100644
> --- a/drivers/platform/x86/amd/pmf/tee-if.c
> +++ b/drivers/platform/x86/amd/pmf/tee-if.c
> @@ -377,12 +377,23 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf,
>  	dev->policy_buf = new_policy_buf;
>  	dev->policy_sz = length;
>  
> +	/* Check if the policy binary is valid */
> +	if (!memchr_inv(dev->policy_buf, 0xff, dev->policy_sz)) {

Since you're adding an explaning comment into two places, it very much 
looks you want a reasonably named helper instead for this so there's no 
need for such comments.

> +		ret = -EINVAL;
> +		goto cleanup;
> +	}
> +
>  	amd_pmf_hex_dump_pb(dev);
>  	ret = amd_pmf_start_policy_engine(dev);
>  	if (ret < 0)
> -		return ret;
> +		goto cleanup;

Isn't this an independent fix that should be in its own patch?

>  
>  	return length;
> +
> +cleanup:
> +	kfree(dev->policy_buf);
> +	dev->policy_buf = NULL;
> +	return ret;
>  }
>  
>  static const struct file_operations pb_fops = {
> 

-- 
 i.