[PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

[PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

[Yuho Choi]

pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
two-phase _OSC negotiation. Between the two calls it freed
output.pointer but left output.length unchanged. Since
acpi_evaluate_object() treats a non-zero length with a non-NULL
pointer as an existing buffer to write into, the second call wrote
into freed memory (use-after-free). The subsequent kfree(output.pointer)
at out_free then freed the same pointer a second time (double free).

Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
after freeing the first result, so ACPICA allocates a fresh buffer for
each phase independently.

Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---

Changes in v1:
  - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
  - Keep kfree() between the two calls and reset output.pointer = NULL
    and output.length = ACPI_ALLOCATE_BUFFER

 drivers/cpufreq/pcc-cpufreq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
index ac2e90a65f0c4..a355ec4f3dd4c 100644
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
 	}
 
 	kfree(output.pointer);
+	output.pointer = NULL;
+	output.length = ACPI_ALLOCATE_BUFFER;
 	capabilities[0] = 0x0;
 	capabilities[1] = 0x1;
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

[Zhongqiu Han]

On 4/16/2026 10:46 PM, Yuho Choi wrote:
> pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
> two-phase _OSC negotiation. Between the two calls it freed
> output.pointer but left output.length unchanged. Since
> acpi_evaluate_object() treats a non-zero length with a non-NULL
> pointer as an existing buffer to write into, the second call wrote
> into freed memory (use-after-free). The subsequent kfree(output.pointer)
> at out_free then freed the same pointer a second time (double free).
> 
> Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
> after freeing the first result, so ACPICA allocates a fresh buffer for
> each phase independently.
> 
> Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>


Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>

> ---
> 
> Changes in v1:
>    - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
>    - Keep kfree() between the two calls and reset output.pointer = NULL
>      and output.length = ACPI_ALLOCATE_BUFFER
> 
>   drivers/cpufreq/pcc-cpufreq.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
> index ac2e90a65f0c4..a355ec4f3dd4c 100644
> --- a/drivers/cpufreq/pcc-cpufreq.c
> +++ b/drivers/cpufreq/pcc-cpufreq.c
> @@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
>   	}
>   
>   	kfree(output.pointer);
> +	output.pointer = NULL;
> +	output.length = ACPI_ALLOCATE_BUFFER;
>   	capabilities[0] = 0x0;
>   	capabilities[1] = 0x1;
>   


-- 
Thx and BRs,
Zhongqiu Han

Re: [PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

[최유호]

Dear Zhongqiu,

I appreciate your review.

Best regards,
Yuho Choi

On Thu, 16 Apr 2026 at 23:29, Zhongqiu Han
<zhongqiu.han@oss.qualcomm.com> wrote:
>
> On 4/16/2026 10:46 PM, Yuho Choi wrote:
> > pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
> > two-phase _OSC negotiation. Between the two calls it freed
> > output.pointer but left output.length unchanged. Since
> > acpi_evaluate_object() treats a non-zero length with a non-NULL
> > pointer as an existing buffer to write into, the second call wrote
> > into freed memory (use-after-free). The subsequent kfree(output.pointer)
> > at out_free then freed the same pointer a second time (double free).
> >
> > Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
> > after freeing the first result, so ACPICA allocates a fresh buffer for
> > each phase independently.
> >
> > Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
> > Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
>
>
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
>
> > ---
> >
> > Changes in v1:
> >    - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
> >    - Keep kfree() between the two calls and reset output.pointer = NULL
> >      and output.length = ACPI_ALLOCATE_BUFFER
> >
> >   drivers/cpufreq/pcc-cpufreq.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
> > index ac2e90a65f0c4..a355ec4f3dd4c 100644
> > --- a/drivers/cpufreq/pcc-cpufreq.c
> > +++ b/drivers/cpufreq/pcc-cpufreq.c
> > @@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
> >       }
> >
> >       kfree(output.pointer);
> > +     output.pointer = NULL;
> > +     output.length = ACPI_ALLOCATE_BUFFER;
> >       capabilities[0] = 0x0;
> >       capabilities[1] = 0x1;
> >
>
>
> --
> Thx and BRs,
> Zhongqiu Han