Re: [PATCH] ACPI: property: Fix leaked buffers after skipped properties

[Sakari Ailus]

Hi Rao,

Thanks for the patch.

On Thu, Nov 12, 2026 at 05:09:54PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@xxxxxxxxxxxxx>
> 
> acpi_data_add_buffer_props() compacts successfully parsed buffer
> properties into an output package, but stores their separately allocated
> evaluation buffers in props->bufs using the original input index.
> acpi_free_device_properties() only frees entries below the output
> package's successful-property count.
> 
> If a property is skipped because of an invalid format, invalid types or
> a failed object evaluation, later successful entries can be stored past
> the range visited during cleanup. For example, a failed first entry and
> a successful second entry leave the allocation in bufs[1] while cleanup
> only visits bufs[0]. The evaluation buffer is then leaked when the
> properties are destroyed. Lists with no skipped entries do not exhibit
> this mismatch.
> 
> Store each evaluation buffer at the current output count before
> incrementing it. This keeps the ownership array compact and aligned with
> the cleanup bound without changing property order or buffer contents.
> 
> Fixes: 103e10c69c61 ("ACPI: property: Add support for parsing buffer property UUID")
> Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx

Reviewed-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>

> ---
>  drivers/acpi/property.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
> index 8ee5a1f0eb48..fb6b214f2335 100644
> --- a/drivers/acpi/property.c
> +++ b/drivers/acpi/property.c
> @@ -523,7 +523,7 @@ static void acpi_data_add_buffer_props(acpi_handle handle,
>  		obj->buffer.length = buf_obj->buffer.length;
>  		obj->buffer.pointer = buf_obj->buffer.pointer;
> 
> -		props->bufs[i] = buf.pointer;
> +		props->bufs[*count] = buf.pointer;
>  		package++;
>  		(*count)++;
>  	}

-- 
Kind regards,

Sakari Ailus