From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f197.google.com (mail-dy1-f197.google.com [74.125.82.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 159C956329E for ; Tue, 13 Oct 2026 22:40:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.197 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791931234; cv=none; b=HpoWtqtSAcKMS58i0kfNDDCRtK7rczxokELIBqDchH2yzf5w/+rOw33YSc0AmrQiHZVzH7pUBKnLLnSjlufCoOdxOuR37/ZJqEc0q46L5golpOl+0gHYpoKrvgz5HMPsNn2dNbWBcxZ8dwg+2JPnzDojAdnCBzOJUZgkrlkSJoE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791931234; c=relaxed/simple; bh=CtncMESqzMmhRbpylMpIrDVzOLt3AaDiHb77RK2NC2U=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=NS+NHLJ+kApXYPERVvj9reeQOoVKfwBOVyKGQwcZEDbGS1IFxSAlUYzaX+7vNNd4YbCCPGpnjxR5beC/Wv5Dps/KgJAtx3HddzTj661fwuhMPlYnl7DPgOuTSCmklmn3N9/10VPSuXUHUjp0uqT/uJqPb6N7Vyx86OuTqM1GDY8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=EWCieHRQ; arc=none smtp.client-ip=74.125.82.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="EWCieHRQ" Received: by mail-dy1-f197.google.com with SMTP id 5a478bee46e88-30bcb065bfdso6716194eec.0 for ; Tue, 13 Oct 2026 15:40:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1791931225; x=1792536025; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=wbjJdHqZPRkvVZnH2yPkFa6V1wQ6/MdT39yYoogCQX4=; b=EWCieHRQtnymQ01ZM5dQGmfVpMClRk5Qc66fvDBi9Jlm5G8pHSyW00uZOQdfugFnxQ k3DyNLSxPbj0F1x1KsCI64yTsOSYJ+0qVOSCYpH3psM1cd/mLdDFz0pw+gvUjPo4LyuL 5FhD/ytWCyR6ERSgmEh8skVWg7vI81QOUmrYraPHvcpit7EGlXx5VR+9oRyiUIa7CArE NVGTUVTLcGB5hDy1CL1duiUOhcSZZIw4YK8thK3hQ3EgdMbJxMlWg4Vb5X7AOntyf6Gd 0IC1+C+SqjgSL2D2IuIKD8SWyvULp+xavM8jWOo3gSCsBE+SZycld5TLgj8GrkY19yBl pgqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791931225; x=1792536025; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wbjJdHqZPRkvVZnH2yPkFa6V1wQ6/MdT39yYoogCQX4=; b=AU30e3F7gTO1wYsMfuDNbKyLLqUd+5Di6tqdOssu/74muCKnLvxGksIuwIG0YzLcIC sRLUKO5+yANdS4OV4DXubSUE0vMBUvBXXymjyK4Ke7MahUQOYPrBEZmryFMdl0Wv/0Ka pDdRnqNK8CBBWkI0/VM5JgKnfebWKodTOvsUI+jLwZhEJC1KyJk+FRVtv2f2yp2jiHCd twgEFbzdW9eVQJpLyM6KVGwVNBc4eZBZfhR76jNSHq0pq2VkdQRhrzeBBFgNfSllPUgk WYSLdrbSVtI8ka5QNYdCAFT00P8SaI6DwkXM5am6v17E1Ck50zS1iJXL2om8lG66Y0zQ itCQ== X-Forwarded-Encrypted: i=1; AKwUvBylB3d+UF+E0szN7h2gjPE3kuXAmCIQ415agPYG+cRejxo8kaH+iU6pdyhL4ZlcR4vuQ7SKUa18bqI=@vger.kernel.org X-Gm-Message-State: AFq9FYJCFIwz5bFjZ7/N6hycH1v4gVMqCxTG8kpSCHQN05JTmv+eR9KE Sv7WhSh+PQymYbNWZ7uu4eRxOGcjTn8rPwU3pcaBgXo+ngr2W8IeXf2kzEeCNYvJ0ir6ewPqIhh XZj1Is3M94Q== X-Received: from dyr27.prod.google.com ([2002:a05:693c:401b:b0:359:e5f1:14fb]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7301:470e:b0:35c:73ca:a1e0 with SMTP id 5a478bee46e88-35c73caae65mr4317399eec.15.1791931223446; Tue, 13 Oct 2026 15:40:23 -0700 (PDT) Date: Tue, 13 Oct 2026 15:39:40 -0700 In-Reply-To: <20261013223946.1836757-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-doc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20261013223946.1836757-1-irogers@google.com> X-Mailer: git-send-email 2.56.0.385.gd3acb90ef8-goog Message-ID: <20261013223946.1836757-6-irogers@google.com> Subject: [PATCH 05/11] ACPI: CPPC: Free cpc_desc in kobject release callback From: Ian Rogers To: Greg Kroah-Hartman , "Rafael J . Wysocki" , Danilo Krummrich , Miguel Ojeda , Kees Cook , Nathan Chancellor Cc: Nick Desaulniers , Bill Wendling , Justin Stitt , Jonathan Corbet , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Christophe Leroy , Nayna Jain , Yoshinori Sato , Rich Felker , John Paul Adrian Glaubitz , Viresh Kumar , David Teigland , Alexander Aring , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Richard Weinberger , Zhihao Cheng , Felix Kuehling , Alex Deucher , "=?UTF-8?q?Christian=20K=C3=B6nig?=" , driver-core@lists.linux.dev, llvm@lists.linux.dev, linux-hardening@vger.kernel.org, linux-doc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-sh@vger.kernel.org, linux-pm@vger.kernel.org, linux-acpi@vger.kernel.org, gfs2@lists.linux.dev, xen-devel@lists.xenproject.org, linux-s390@vger.kernel.org, linux-mtd@lists.infradead.org, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Ian Rogers Content-Type: text/plain; charset="UTF-8" cpc_desc_ptr embeds a struct kobject that is registered in sysfs via kobject_init_and_add(), but cppc_ktype lacked a .release callback and acpi_cppc_processor_exit() freed cpc_ptr immediately after kobject_put(). With CONFIG_DEBUG_KOBJECT_RELEASE=y, this causes a use-after-free when kobject_delayed_cleanup() runs on freed memory. Move the sys_mem_vaddr unmapping and kfree(cpc_ptr) into a new cppc_release() callback on cppc_ktype, and initialize the kobject on allocation so kobject_put() handles cleanup in all paths. Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance") Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Ian Rogers --- drivers/acpi/cppc_acpi.c | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c index fef54fcd00b7..2a80404f85d3 100644 --- a/drivers/acpi/cppc_acpi.c +++ b/drivers/acpi/cppc_acpi.c @@ -297,7 +297,22 @@ static struct attribute *cppc_attrs[] = { }; ATTRIBUTE_GROUPS(cppc); +static void cppc_release(struct kobject *kobj) +{ + struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); + unsigned int i; + + for (i = 2; i < cpc_ptr->num_entries; i++) { + void __iomem *addr = cpc_ptr->cpc_regs[i - 2].sys_mem_vaddr; + + if (addr) + iounmap(addr); + } + kfree(cpc_ptr); +} + static const struct kobj_type cppc_ktype = { + .release = cppc_release, .sysfs_ops = &kobj_sysfs_ops, .default_groups = cppc_groups, }; @@ -799,6 +814,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) ret = -ENOMEM; goto out_buf_free; } + kobject_init(&cpc_ptr->kobj, &cppc_ktype); /* First entry is NumEntries. */ cpc_obj = &out_obj->package.elements[0]; @@ -1001,11 +1017,9 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) /* Plug PSD data into this CPU's CPC descriptor. */ per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr; - ret = kobject_init_and_add(&cpc_ptr->kobj, &cppc_ktype, &cpu_dev->kobj, - "acpi_cppc"); + ret = kobject_add(&cpc_ptr->kobj, &cpu_dev->kobj, "acpi_cppc"); if (ret) { per_cpu(cpc_desc_ptr, pr->id) = NULL; - kobject_put(&cpc_ptr->kobj); goto out_free; } @@ -1013,14 +1027,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) return 0; out_free: - /* Free all the mapped sys mem areas for this CPU */ - for (i = 2; i < cpc_ptr->num_entries; i++) { - void __iomem *addr = cpc_ptr->cpc_regs[i-2].sys_mem_vaddr; - - if (addr) - iounmap(addr); - } - kfree(cpc_ptr); + kobject_put(&cpc_ptr->kobj); out_buf_free: kfree(output.pointer); @@ -1037,8 +1044,6 @@ EXPORT_SYMBOL_GPL(acpi_cppc_processor_probe); void acpi_cppc_processor_exit(struct acpi_processor *pr) { struct cpc_desc *cpc_ptr; - unsigned int i; - void __iomem *addr; int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, pr->id); if (pcc_ss_id >= 0 && pcc_data[pcc_ss_id]) { @@ -1056,15 +1061,7 @@ void acpi_cppc_processor_exit(struct acpi_processor *pr) if (!cpc_ptr) return; - /* Free all the mapped sys mem areas for this CPU */ - for (i = 2; i < cpc_ptr->num_entries; i++) { - addr = cpc_ptr->cpc_regs[i-2].sys_mem_vaddr; - if (addr) - iounmap(addr); - } - kobject_put(&cpc_ptr->kobj); - kfree(cpc_ptr); } EXPORT_SYMBOL_GPL(acpi_cppc_processor_exit); -- 2.56.0.385.gd3acb90ef8-goog