1. Patchew
  2. linux
  3. View series

[PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

Yuho Choi posted 1 patch 1 month, 3 weeks ago 
drivers/cpufreq/pcc-cpufreq.c | 2 ++
1 file changed, 2 insertions(+)
[PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Posted by Yuho Choi 1 month, 3 weeks ago 
pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
two-phase _OSC negotiation. Between the two calls it freed
output.pointer but left output.length unchanged. Since
acpi_evaluate_object() treats a non-zero length with a non-NULL
pointer as an existing buffer to write into, the second call wrote
into freed memory (use-after-free). The subsequent kfree(output.pointer)
at out_free then freed the same pointer a second time (double free).

Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
after freeing the first result, so ACPICA allocates a fresh buffer for
each phase independently.

Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---

Changes in v1:
  - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
  - Keep kfree() between the two calls and reset output.pointer = NULL
    and output.length = ACPI_ALLOCATE_BUFFER

 drivers/cpufreq/pcc-cpufreq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
index ac2e90a65f0c4..a355ec4f3dd4c 100644
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
 	}
 
 	kfree(output.pointer);
+	output.pointer = NULL;
+	output.length = ACPI_ALLOCATE_BUFFER;
 	capabilities[0] = 0x0;
 	capabilities[1] = 0x1;
 
-- 
2.50.1 (Apple Git-155)
Re: [PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Posted by Zhongqiu Han 1 month, 3 weeks ago 
On 4/16/2026 10:46 PM, Yuho Choi wrote:
> pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
> two-phase _OSC negotiation. Between the two calls it freed
> output.pointer but left output.length unchanged. Since
> acpi_evaluate_object() treats a non-zero length with a non-NULL
> pointer as an existing buffer to write into, the second call wrote
> into freed memory (use-after-free). The subsequent kfree(output.pointer)
> at out_free then freed the same pointer a second time (double free).
> 
> Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
> after freeing the first result, so ACPICA allocates a fresh buffer for
> each phase independently.
> 
> Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>


Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>

> ---
> 
> Changes in v1:
>    - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
>    - Keep kfree() between the two calls and reset output.pointer = NULL
>      and output.length = ACPI_ALLOCATE_BUFFER
> 
>   drivers/cpufreq/pcc-cpufreq.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
> index ac2e90a65f0c4..a355ec4f3dd4c 100644
> --- a/drivers/cpufreq/pcc-cpufreq.c
> +++ b/drivers/cpufreq/pcc-cpufreq.c
> @@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
>   	}
>   
>   	kfree(output.pointer);
> +	output.pointer = NULL;
> +	output.length = ACPI_ALLOCATE_BUFFER;
>   	capabilities[0] = 0x0;
>   	capabilities[1] = 0x1;
>   


-- 
Thx and BRs,
Zhongqiu Han
Re: [PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Posted by Rafael J. Wysocki 3 weeks, 1 day ago 
On Fri, Apr 17, 2026 at 5:29 AM Zhongqiu Han
<zhongqiu.han@oss.qualcomm.com> wrote:
>
> On 4/16/2026 10:46 PM, Yuho Choi wrote:
> > pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
> > two-phase _OSC negotiation. Between the two calls it freed
> > output.pointer but left output.length unchanged. Since
> > acpi_evaluate_object() treats a non-zero length with a non-NULL
> > pointer as an existing buffer to write into, the second call wrote
> > into freed memory (use-after-free). The subsequent kfree(output.pointer)
> > at out_free then freed the same pointer a second time (double free).
> >
> > Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
> > after freeing the first result, so ACPICA allocates a fresh buffer for
> > each phase independently.
> >
> > Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
> > Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
>
>
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
>
> > ---
> >
> > Changes in v1:
> >    - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
> >    - Keep kfree() between the two calls and reset output.pointer = NULL
> >      and output.length = ACPI_ALLOCATE_BUFFER
> >
> >   drivers/cpufreq/pcc-cpufreq.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
> > index ac2e90a65f0c4..a355ec4f3dd4c 100644
> > --- a/drivers/cpufreq/pcc-cpufreq.c
> > +++ b/drivers/cpufreq/pcc-cpufreq.c
> > @@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
> >       }
> >
> >       kfree(output.pointer);
> > +     output.pointer = NULL;
> > +     output.length = ACPI_ALLOCATE_BUFFER;
> >       capabilities[0] = 0x0;
> >       capabilities[1] = 0x1;
> >
>
>
> --

Applied as 7.1-rc material, thanks!
Re: [PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Posted by 최유호 1 month, 3 weeks ago 
Dear Zhongqiu,

I appreciate your review.

Best regards,
Yuho Choi

On Thu, 16 Apr 2026 at 23:29, Zhongqiu Han
<zhongqiu.han@oss.qualcomm.com> wrote:
>
> On 4/16/2026 10:46 PM, Yuho Choi wrote:
> > pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
> > two-phase _OSC negotiation. Between the two calls it freed
> > output.pointer but left output.length unchanged. Since
> > acpi_evaluate_object() treats a non-zero length with a non-NULL
> > pointer as an existing buffer to write into, the second call wrote
> > into freed memory (use-after-free). The subsequent kfree(output.pointer)
> > at out_free then freed the same pointer a second time (double free).
> >
> > Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
> > after freeing the first result, so ACPICA allocates a fresh buffer for
> > each phase independently.
> >
> > Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
> > Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
>
>
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
>
> > ---
> >
> > Changes in v1:
> >    - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
> >    - Keep kfree() between the two calls and reset output.pointer = NULL
> >      and output.length = ACPI_ALLOCATE_BUFFER
> >
> >   drivers/cpufreq/pcc-cpufreq.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
> > index ac2e90a65f0c4..a355ec4f3dd4c 100644
> > --- a/drivers/cpufreq/pcc-cpufreq.c
> > +++ b/drivers/cpufreq/pcc-cpufreq.c
> > @@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
> >       }
> >
> >       kfree(output.pointer);
> > +     output.pointer = NULL;
> > +     output.length = ACPI_ALLOCATE_BUFFER;
> >       capabilities[0] = 0x0;
> >       capabilities[1] = 0x1;
> >
>
>
> --
> Thx and BRs,
> Zhongqiu Han

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.