Re: [PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

[최유호]

Dear Zhongqiu,

I appreciate your review.

Best regards,
Yuho Choi

On Thu, 16 Apr 2026 at 23:29, Zhongqiu Han
<zhongqiu.han@xxxxxxxxxxxxxxxx> wrote:
>
> On 4/16/2026 10:46 PM, Yuho Choi wrote:
> > pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
> > two-phase _OSC negotiation. Between the two calls it freed
> > output.pointer but left output.length unchanged. Since
> > acpi_evaluate_object() treats a non-zero length with a non-NULL
> > pointer as an existing buffer to write into, the second call wrote
> > into freed memory (use-after-free). The subsequent kfree(output.pointer)
> > at out_free then freed the same pointer a second time (double free).
> >
> > Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
> > after freeing the first result, so ACPICA allocates a fresh buffer for
> > each phase independently.
> >
> > Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
> > Signed-off-by: Yuho Choi <dbgh9129@xxxxxxxxx>
>
>
> Reviewed-by: Zhongqiu Han <zhongqiu.han@xxxxxxxxxxxxxxxx>
>
> > ---
> >
> > Changes in v1:
> >    - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
> >    - Keep kfree() between the two calls and reset output.pointer = NULL
> >      and output.length = ACPI_ALLOCATE_BUFFER
> >
> >   drivers/cpufreq/pcc-cpufreq.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
> > index ac2e90a65f0c4..a355ec4f3dd4c 100644
> > --- a/drivers/cpufreq/pcc-cpufreq.c
> > +++ b/drivers/cpufreq/pcc-cpufreq.c
> > @@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
> >       }
> >
> >       kfree(output.pointer);
> > +     output.pointer = NULL;
> > +     output.length = ACPI_ALLOCATE_BUFFER;
> >       capabilities[0] = 0x0;
> >       capabilities[1] = 0x1;
> >
>
>
> --
> Thx and BRs,
> Zhongqiu Han