[PATCH 2/2] drivers/platform/x86/amd: pmf: Handle bad policies in amd_pmf_get_pb_data()

[Mario Limonciello <superm1@kernel.org>]

From: Mario Limonciello <mario.limonciello@amd.com>

If a policy is passed into amd_pmf_get_pb_data() that causes the engine
to fail to start there is a memory leak. Check for invalid policies as
well as an error in amd_pmf_start_policy_engine() and free the memory in
the failure path.

Fixes: 10817f28e5337 ("platform/x86/amd/pmf: Add capability to sideload of policy binary")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
---
 drivers/platform/x86/amd/pmf/tee-if.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
index 41ab9eca5ff13..3c399dc1bfcca 100644
--- a/drivers/platform/x86/amd/pmf/tee-if.c
+++ b/drivers/platform/x86/amd/pmf/tee-if.c
@@ -377,12 +377,23 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf,
 	dev->policy_buf = new_policy_buf;
 	dev->policy_sz = length;
 
+	/* Check if the policy binary is valid */
+	if (!memchr_inv(dev->policy_buf, 0xff, dev->policy_sz)) {
+		ret = -EINVAL;
+		goto cleanup;
+	}
+
 	amd_pmf_hex_dump_pb(dev);
 	ret = amd_pmf_start_policy_engine(dev);
 	if (ret < 0)
-		return ret;
+		goto cleanup;
 
 	return length;
+
+cleanup:
+	kfree(dev->policy_buf);
+	dev->policy_buf = NULL;
+	return ret;
 }
 
 static const struct file_operations pb_fops = {
-- 
2.43.0