[PATCH] ACPI: property: Fix leaked buffers after skipped properties

[raoxu]

From: Xu Rao <raoxu@xxxxxxxxxxxxx>

acpi_data_add_buffer_props() compacts successfully parsed buffer
properties into an output package, but stores their separately allocated
evaluation buffers in props->bufs using the original input index.
acpi_free_device_properties() only frees entries below the output
package's successful-property count.

If a property is skipped because of an invalid format, invalid types or
a failed object evaluation, later successful entries can be stored past
the range visited during cleanup. For example, a failed first entry and
a successful second entry leave the allocation in bufs[1] while cleanup
only visits bufs[0]. The evaluation buffer is then leaked when the
properties are destroyed. Lists with no skipped entries do not exhibit
this mismatch.

Store each evaluation buffer at the current output count before
incrementing it. This keeps the ownership array compact and aligned with
the cleanup bound without changing property order or buffer contents.

Fixes: 103e10c69c61 ("ACPI: property: Add support for parsing buffer property UUID")
Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
 drivers/acpi/property.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 8ee5a1f0eb48..fb6b214f2335 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -523,7 +523,7 @@ static void acpi_data_add_buffer_props(acpi_handle handle,
 		obj->buffer.length = buf_obj->buffer.length;
 		obj->buffer.pointer = buf_obj->buffer.pointer;

-		props->bufs[i] = buf.pointer;
+		props->bufs[*count] = buf.pointer;
 		package++;
 		(*count)++;
 	}
--
2.50.1