Re: [PATCH 2/2] drivers/platform/x86/amd: pmf: Handle bad policies in amd_pmf_get_pb_data()

[Mario Limonciello <superm1@kernel.org>]

On 4/23/25 07:19, Ilpo Järvinen wrote:
> On Wed, 23 Apr 2025, Mario Limonciello wrote:
> 
>> From: Mario Limonciello <mario.limonciello@amd.com>
>>
>> If a policy is passed into amd_pmf_get_pb_data() that causes the engine
>> to fail to start there is a memory leak. Check for invalid policies as
>> well as an error in amd_pmf_start_policy_engine() and free the memory in
>> the failure path.
>>
>> Fixes: 10817f28e5337 ("platform/x86/amd/pmf: Add capability to sideload of policy binary")
>> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
>> ---
>>   drivers/platform/x86/amd/pmf/tee-if.c | 13 ++++++++++++-
>>   1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
>> index 41ab9eca5ff13..3c399dc1bfcca 100644
>> --- a/drivers/platform/x86/amd/pmf/tee-if.c
>> +++ b/drivers/platform/x86/amd/pmf/tee-if.c
>> @@ -377,12 +377,23 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf,
>>   	dev->policy_buf = new_policy_buf;
>>   	dev->policy_sz = length;
>>   
>> +	/* Check if the policy binary is valid */
>> +	if (!memchr_inv(dev->policy_buf, 0xff, dev->policy_sz)) {
> 
> Since you're adding an explaning comment into two places, it very much
> looks you want a reasonably named helper instead for this so there's no
> need for such comments.

OK; I was initially hesitant since it was a single call to memchr_inv() 
but I'll switch it to an inline helper instead.

> 
>> +		ret = -EINVAL;
>> +		goto cleanup;
>> +	}
>> +
>>   	amd_pmf_hex_dump_pb(dev);
>>   	ret = amd_pmf_start_policy_engine(dev);
>>   	if (ret < 0)
>> -		return ret;
>> +		goto cleanup;
> 
> Isn't this an independent fix that should be in its own patch?

Ack; will split into it's own patch.

> 
>>   
>>   	return length;
>> +
>> +cleanup:
>> +	kfree(dev->policy_buf);
>> +	dev->policy_buf = NULL;
>> +	return ret;
>>   }
>>   
>>   static const struct file_operations pb_fops = {
>>
>