platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()

JIRA: https://issues.redhat.com/browse/RHEL-104142

commit 5b1122f
Author: Dan Carpenter <dan.carpenter@linaro.org>
Date:   Mon Mar 10 22:48:29 2025 +0300

    platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()

    There are a few problems in this code:

    First, if amd_pmf_tee_init() fails then the function returns directly
    instead of cleaning up.  We cannot simply do a "goto error;" because
    the amd_pmf_tee_init() cleanup calls tee_shm_free(dev->fw_shm_pool);
    and amd_pmf_tee_deinit() calls it as well leading to a double free.
    I have re-written this code to use an unwind ladder to free the
    allocations.

    Second, if amd_pmf_start_policy_engine() fails on every iteration though
    the loop then the code calls amd_pmf_tee_deinit() twice which is also a
    double free.  Call amd_pmf_tee_deinit() inside the loop for each failed
    iteration.  Also on that path the error codes are not necessarily
    negative kernel error codes.  Set the error code to -EINVAL.

    There is a very subtle third bug which is that if the call to
    input_register_device() in amd_pmf_register_input_device() fails then
    we call input_unregister_device() on an input device that wasn't
    registered.  This will lead to a reference counting underflow
    because of the device_del(&dev->dev) in __input_unregister_device().
    It's unlikely that anyone would ever hit this bug in real life.

    Fixes: 376a8c2 ("platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA")
    Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
    Link: https://lore.kernel.org/r/232231fc-6a71-495e-971b-be2a76f6db4c@stanley.mountain
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

Signed-off-by: Steve Best <sbest@redhat.com>

Author: sfbest

drivers/platform/x86/amd/pmf/tee-if.c

@@ -510,18 +510,18 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
 
 	ret = amd_pmf_set_dram_addr(dev, true);
 	if (ret)
-		goto error;
+		goto err_cancel_work;
 
 	dev->policy_base = devm_ioremap_resource(dev->dev, dev->res);
 	if (IS_ERR(dev->policy_base)) {
 		ret = PTR_ERR(dev->policy_base);
-		goto error;
+		goto err_free_dram_buf;
 	}
 
 	dev->policy_buf = kzalloc(dev->policy_sz, GFP_KERNEL);
 	if (!dev->policy_buf) {
 		ret = -ENOMEM;
-		goto error;
+		goto err_free_dram_buf;
 	}
 
 	memcpy_fromio(dev->policy_buf, dev->policy_base, dev->policy_sz);
@@ -531,13 +531,13 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
 	dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL);
 	if (!dev->prev_data) {
 		ret = -ENOMEM;
-		goto error;
+		goto err_free_policy;
 	}
 
 	for (i = 0; i < ARRAY_SIZE(amd_pmf_ta_uuid); i++) {
 		ret = amd_pmf_tee_init(dev, &amd_pmf_ta_uuid[i]);
 		if (ret)
-			return ret;
+			goto err_free_prev_data;
 
 		ret = amd_pmf_start_policy_engine(dev);
 		switch (ret) {
@@ -550,27 +550,41 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev)
 			status = false;
 			break;
 		default:
-			goto error;
+			ret = -EINVAL;
+			amd_pmf_tee_deinit(dev);
+			goto err_free_prev_data;
 		}
 
 		if (status)
 			break;
 	}
 
-	if (!status && !pb_side_load)
-		goto error;
+	if (!status && !pb_side_load) {
+		ret = -EINVAL;
+		goto err_free_prev_data;
+	}
 
 	if (pb_side_load)
 		amd_pmf_open_pb(dev, dev->dbgfs_dir);
 
 	ret = amd_pmf_register_input_device(dev);
 	if (ret)
-		goto error;
+		goto err_pmf_remove_pb;
 
 	return 0;
 
-error:
-	amd_pmf_deinit_smart_pc(dev);
+err_pmf_remove_pb:
+	if (pb_side_load && dev->esbin)
+		amd_pmf_remove_pb(dev);
+	amd_pmf_tee_deinit(dev);
+err_free_prev_data:
+	kfree(dev->prev_data);
+err_free_policy:
+	kfree(dev->policy_buf);
+err_free_dram_buf:
+	kfree(dev->buf);
+err_cancel_work:
+	cancel_delayed_work_sync(&dev->pb_work);
 
 	return ret;
 }