Re: [PATCH] ACPI: property: Fix leaked buffers after skipped properties

[Rafael J. Wysocki (Intel)]

On Fri, Nov 13, 2026 at 1:10 PM Sakari Ailus
<sakari.ailus@xxxxxxxxxxxxxxx> wrote:
>
> Hi Rao,
>
> Thanks for the patch.
>
> On Thu, Nov 12, 2026 at 05:09:54PM +0800, raoxu wrote:
> > From: Xu Rao <raoxu@xxxxxxxxxxxxx>
> >
> > acpi_data_add_buffer_props() compacts successfully parsed buffer
> > properties into an output package, but stores their separately allocated
> > evaluation buffers in props->bufs using the original input index.
> > acpi_free_device_properties() only frees entries below the output
> > package's successful-property count.
> >
> > If a property is skipped because of an invalid format, invalid types or
> > a failed object evaluation, later successful entries can be stored past
> > the range visited during cleanup. For example, a failed first entry and
> > a successful second entry leave the allocation in bufs[1] while cleanup
> > only visits bufs[0]. The evaluation buffer is then leaked when the
> > properties are destroyed. Lists with no skipped entries do not exhibit
> > this mismatch.
> >
> > Store each evaluation buffer at the current output count before
> > incrementing it. This keeps the ownership array compact and aligned with
> > the cleanup bound without changing property order or buffer contents.
> >
> > Fixes: 103e10c69c61 ("ACPI: property: Add support for parsing buffer property UUID")
> > Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
> > Cc: stable@xxxxxxxxxxxxxxx
>
> Reviewed-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>

Applied as 7.5 material, thanks!

> > ---
> >  drivers/acpi/property.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
> > index 8ee5a1f0eb48..fb6b214f2335 100644
> > --- a/drivers/acpi/property.c
> > +++ b/drivers/acpi/property.c
> > @@ -523,7 +523,7 @@ static void acpi_data_add_buffer_props(acpi_handle handle,
> >               obj->buffer.length = buf_obj->buffer.length;
> >               obj->buffer.pointer = buf_obj->buffer.pointer;
> >
> > -             props->bufs[i] = buf.pointer;
> > +             props->bufs[*count] = buf.pointer;
> >               package++;
> >               (*count)++;
> >       }
>
> --
> Kind regards,
>
> Sakari Ailus