Re: [PATCH v2] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

[Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>]

On 4/16/2026 10:46 PM, Yuho Choi wrote:
> pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
> two-phase _OSC negotiation. Between the two calls it freed
> output.pointer but left output.length unchanged. Since
> acpi_evaluate_object() treats a non-zero length with a non-NULL
> pointer as an existing buffer to write into, the second call wrote
> into freed memory (use-after-free). The subsequent kfree(output.pointer)
> at out_free then freed the same pointer a second time (double free).
> 
> Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
> after freeing the first result, so ACPICA allocates a fresh buffer for
> each phase independently.
> 
> Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>


Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>

> ---
> 
> Changes in v1:
>    - Drop spurious #include "acpi/actypes.h" (Zhongqiu Han)
>    - Keep kfree() between the two calls and reset output.pointer = NULL
>      and output.length = ACPI_ALLOCATE_BUFFER
> 
>   drivers/cpufreq/pcc-cpufreq.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
> index ac2e90a65f0c4..a355ec4f3dd4c 100644
> --- a/drivers/cpufreq/pcc-cpufreq.c
> +++ b/drivers/cpufreq/pcc-cpufreq.c
> @@ -352,6 +352,8 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
>   	}
>   
>   	kfree(output.pointer);
> +	output.pointer = NULL;
> +	output.length = ACPI_ALLOCATE_BUFFER;
>   	capabilities[0] = 0x0;
>   	capabilities[1] = 0x1;
>   


-- 
Thx and BRs,
Zhongqiu Han