Re: [PATCH] platform/x86/intel/vsec: free ACPI discovery data on early errors

[Ilpo Järvinen]

On Mon, 29 Jun 2026, Yousef Alhouseen wrote:

> intel_vsec_add_dev() may attach an ACPI discovery table copy to the
> intel_vsec_device before passing ownership to intel_vsec_add_aux(). The
> normal auxiliary-device release path frees that copy, but the earliest
> intel_vsec_add_aux() failures free only the outer structure directly.
> 
> Route those direct frees through a common helper so acpi_disc is
> released consistently on the parent, xarray, and ID allocation failure
> paths.
> 
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>

Shouldn't this have a Fixes tag?

--
 i.

> ---
>  drivers/platform/x86/intel/vsec.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
> index 3ae4557b32b4..5ab2215fdd7f 100644
> --- a/drivers/platform/x86/intel/vsec.c
> +++ b/drivers/platform/x86/intel/vsec.c
> @@ -103,6 +103,12 @@ static void intel_vsec_remove_aux(void *data)
>  	auxiliary_device_uninit(data);
>  }
>  
> +static void intel_vsec_dev_free(struct intel_vsec_device *intel_vsec_dev)
> +{
> +	kfree(intel_vsec_dev->acpi_disc);
> +	kfree(intel_vsec_dev);
> +}
> +
>  static void intel_vsec_dev_release(struct device *dev)
>  {
>  	struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev);
> @@ -111,8 +117,7 @@ static void intel_vsec_dev_release(struct device *dev)
>  
>  	ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id);
>  
> -	kfree(intel_vsec_dev->acpi_disc);
> -	kfree(intel_vsec_dev);
> +	intel_vsec_dev_free(intel_vsec_dev);
>  }
>  
>  static const struct vsec_feature_dependency *
> @@ -218,20 +223,22 @@ int intel_vsec_add_aux(struct device *parent,
>  	struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev;
>  	int ret, id;
>  
> -	if (!parent)
> +	if (!parent) {
> +		intel_vsec_dev_free(intel_vsec_dev);
>  		return -EINVAL;
> +	}
>  
>  	ret = xa_alloc(&auxdev_array, &intel_vsec_dev->id, intel_vsec_dev,
>  		       PMT_XA_LIMIT, GFP_KERNEL);
>  	if (ret < 0) {
> -		kfree(intel_vsec_dev);
> +		intel_vsec_dev_free(intel_vsec_dev);
>  		return ret;
>  	}
>  
>  	id = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
>  	if (id < 0) {
>  		xa_erase(&auxdev_array, intel_vsec_dev->id);
> -		kfree(intel_vsec_dev);
> +		intel_vsec_dev_free(intel_vsec_dev);
>  		return id;
>  	}
>  
>