From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8709FCC6B15 for ; Tue, 13 Oct 2026 22:41:03 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4j48Rv3BKgz3c2t; Wed, 14 Oct 2026 09:40:27 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip="2607:f8b0:4864:20::1348" ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1791931227; cv=none; b=dHs0oCy6HOqmlhl055YDXF7bV897xTu00nJOhy1vyjnzg4/ag8Onm+E/bWARv462R0X2aPkLbiFATGsrOwyAna66dOE2KCRhmN0mCdtVwSYr20qlVgUCa1QTUhHitW0pY4BbMr31vc6aFpJBnTqnqD1KtMet10GVPnzkABe3Kbk9XYHnNY8ms/1MxVZefIsD9iNITt4yJovvxjzlJcOehzhz91dCNMCed51v1B0N1P3sfGX8yHDPtRIAsa3KBFPnpoL8MZvWQZ8yHHM3NSFC1oSsuE0aNa2ANu7TL8d3d4fgJu3pjJ9qqYzS7Mthce+SGfraZPk5x8HXHz6JfRyoJQ== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1791931227; c=relaxed/relaxed; bh=wbjJdHqZPRkvVZnH2yPkFa6V1wQ6/MdT39yYoogCQX4=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Tpnb1e+SgxLIroub+U4FM+jPW9HDkK9+twct+iPAvt8chX8OaLY1u160A7c2Ma/LeY8ecQaGGrVo+na0mcTCTKE6RiAisRDUmXFNeEKqxaa+Iw9iDt8AGmEo3dc4IeTPyfSHHl5QOA+pakkS9Ijt00df6I1tVCaaE81BT5eRWbei3PBMa1UatGux+BnDMBVmPwB7V+AtRHAP1sOmaXyZMGNYGk7k/HjSSOjlt1xovbRF0b+xH7g6HgQMMqgzRO9cKsiDfR14+2ZoMU95qVRiwSuwLUkekxgHnzo/ObL8XWhkyUg/kHWHhMsAM0Gv3JzwG+Bw13izMHdv8sShna0SVQ== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=reject dis=none) header.from=google.com; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=MZJSJezu; dkim-atps=neutral; spf=pass (client-ip=2607:f8b0:4864:20::1348; helo=mail-dy1-x1348.google.com; envelope-from=3v7poagckdfy6fc42fg4cc492.0ca96bildd0-12j96ghg.cn9yzg.cf4@flex--irogers.bounces.google.com; receiver=lists.ozlabs.org) smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: lists.ozlabs.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=MZJSJezu; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=flex--irogers.bounces.google.com (client-ip=2607:f8b0:4864:20::1348; helo=mail-dy1-x1348.google.com; envelope-from=3v7poagckdfy6fc42fg4cc492.0ca96bildd0-12j96ghg.cn9yzg.cf4@flex--irogers.bounces.google.com; receiver=lists.ozlabs.org) Received: from mail-dy1-x1348.google.com (mail-dy1-x1348.google.com [IPv6:2607:f8b0:4864:20::1348]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4j48Rt6D7fz3c13 for ; Wed, 14 Oct 2026 09:40:26 +1100 (AEDT) Received: by mail-dy1-x1348.google.com with SMTP id 5a478bee46e88-33c35f5ca6cso7840567eec.1 for ; Tue, 13 Oct 2026 15:40:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1791931225; x=1792536025; darn=lists.ozlabs.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=wbjJdHqZPRkvVZnH2yPkFa6V1wQ6/MdT39yYoogCQX4=; b=MZJSJezusSXMe2zvuy6mmBSOS26U3BpjLj65H66u/LqaoSSNDRMjW6bUzF7CovE3Yt Sd2lAaA9UVu2vuzNYRrwYVFHsompN3OMM/gWYXlNAKXeGBLz/MQFjfvQYaE1PayYp2CP gxAdXPb5tFV4zxZEzZJW+5VfeXQc4ITcrldE0eSavouVBPDroXXBfRUhhagrbBMmr8uH ClFXiSiI92nNyX6ch663ZkKQ2DqtqbbKwdflHHMNhkMNlaQuXMuWz6G8g8lxdd96F5qf unG5lRliUJ9K2Kg9icmNr3lEh0aBncH54Ap8y3wY5P8olMcV/AT7xjnlX4o5L9By8Rvf qhDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791931225; x=1792536025; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wbjJdHqZPRkvVZnH2yPkFa6V1wQ6/MdT39yYoogCQX4=; b=Emo6De7GTpjXA9cDnivTPsToLs8bZ8zmlQkqed7N79cphuvOBZOqJVJelfH6Ik0pJt gZ0BeSvciHTCvNA3gpK6NcjQDaOsdQqHrUrQ3IYkZFZB5fMAWxd0D9F0qZCGTIF36+oZ UlrXPIqt428Gt7crNjI1KTFBZj9PiPHI7SmSW9GpncRL+o5wOfadaFXtIk26/9d6n1dY FO7bwI24jn2J9nb6N4gZZbGDA5RsncY1ReTzyafCRm9ONnf/t/2CUbXXxvs5pMS2p3Ws CoaE2JNhRAGZaUCkCLtBdjn7PH8FNzvITGeeUNQ8HzJPDdFG6HDc8i1QSTZSXMP/6OHH MsrQ== X-Forwarded-Encrypted: i=1; AKwUvBzDdcLyJphM3B3KIjGSR+GAXutpJtyqHRCD/x3yKG4760QGJPrgKNBs51hJxaahHyN3IZdSh7PjR29hCXk=@lists.ozlabs.org X-Gm-Message-State: AFq9FYJ7PzFxjtPeuzlrtGKUCjomyQUlJuv+ajiHWFGMP4Mt7it3leI1 9GLZEYPHnVAQee+UHcK86IRKGXo1tEZzJmeYsl7HKpIzX0s7wTRW9CrYzASEeE1/T70i3WXVx3+ S4WCHTwmL3Q== X-Received: from dyr27.prod.google.com ([2002:a05:693c:401b:b0:359:e5f1:14fb]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7301:470e:b0:35c:73ca:a1e0 with SMTP id 5a478bee46e88-35c73caae65mr4317399eec.15.1791931223446; Tue, 13 Oct 2026 15:40:23 -0700 (PDT) Date: Tue, 13 Oct 2026 15:39:40 -0700 In-Reply-To: <20261013223946.1836757-1-irogers@google.com> X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list Mime-Version: 1.0 References: <20261013223946.1836757-1-irogers@google.com> X-Mailer: git-send-email 2.56.0.385.gd3acb90ef8-goog Message-ID: <20261013223946.1836757-6-irogers@google.com> Subject: [PATCH 05/11] ACPI: CPPC: Free cpc_desc in kobject release callback From: Ian Rogers To: Greg Kroah-Hartman , "Rafael J . Wysocki" , Danilo Krummrich , Miguel Ojeda , Kees Cook , Nathan Chancellor Cc: Nick Desaulniers , Bill Wendling , Justin Stitt , Jonathan Corbet , Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , Christophe Leroy , Nayna Jain , Yoshinori Sato , Rich Felker , John Paul Adrian Glaubitz , Viresh Kumar , David Teigland , Alexander Aring , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Richard Weinberger , Zhihao Cheng , Felix Kuehling , Alex Deucher , "=?UTF-8?q?Christian=20K=C3=B6nig?=" , driver-core@lists.linux.dev, llvm@lists.linux.dev, linux-hardening@vger.kernel.org, linux-doc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-sh@vger.kernel.org, linux-pm@vger.kernel.org, linux-acpi@vger.kernel.org, gfs2@lists.linux.dev, xen-devel@lists.xenproject.org, linux-s390@vger.kernel.org, linux-mtd@lists.infradead.org, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Ian Rogers Content-Type: text/plain; charset="UTF-8" cpc_desc_ptr embeds a struct kobject that is registered in sysfs via kobject_init_and_add(), but cppc_ktype lacked a .release callback and acpi_cppc_processor_exit() freed cpc_ptr immediately after kobject_put(). With CONFIG_DEBUG_KOBJECT_RELEASE=y, this causes a use-after-free when kobject_delayed_cleanup() runs on freed memory. Move the sys_mem_vaddr unmapping and kfree(cpc_ptr) into a new cppc_release() callback on cppc_ktype, and initialize the kobject on allocation so kobject_put() handles cleanup in all paths. Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance") Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Ian Rogers --- drivers/acpi/cppc_acpi.c | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c index fef54fcd00b7..2a80404f85d3 100644 --- a/drivers/acpi/cppc_acpi.c +++ b/drivers/acpi/cppc_acpi.c @@ -297,7 +297,22 @@ static struct attribute *cppc_attrs[] = { }; ATTRIBUTE_GROUPS(cppc); +static void cppc_release(struct kobject *kobj) +{ + struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); + unsigned int i; + + for (i = 2; i < cpc_ptr->num_entries; i++) { + void __iomem *addr = cpc_ptr->cpc_regs[i - 2].sys_mem_vaddr; + + if (addr) + iounmap(addr); + } + kfree(cpc_ptr); +} + static const struct kobj_type cppc_ktype = { + .release = cppc_release, .sysfs_ops = &kobj_sysfs_ops, .default_groups = cppc_groups, }; @@ -799,6 +814,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) ret = -ENOMEM; goto out_buf_free; } + kobject_init(&cpc_ptr->kobj, &cppc_ktype); /* First entry is NumEntries. */ cpc_obj = &out_obj->package.elements[0]; @@ -1001,11 +1017,9 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) /* Plug PSD data into this CPU's CPC descriptor. */ per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr; - ret = kobject_init_and_add(&cpc_ptr->kobj, &cppc_ktype, &cpu_dev->kobj, - "acpi_cppc"); + ret = kobject_add(&cpc_ptr->kobj, &cpu_dev->kobj, "acpi_cppc"); if (ret) { per_cpu(cpc_desc_ptr, pr->id) = NULL; - kobject_put(&cpc_ptr->kobj); goto out_free; } @@ -1013,14 +1027,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) return 0; out_free: - /* Free all the mapped sys mem areas for this CPU */ - for (i = 2; i < cpc_ptr->num_entries; i++) { - void __iomem *addr = cpc_ptr->cpc_regs[i-2].sys_mem_vaddr; - - if (addr) - iounmap(addr); - } - kfree(cpc_ptr); + kobject_put(&cpc_ptr->kobj); out_buf_free: kfree(output.pointer); @@ -1037,8 +1044,6 @@ EXPORT_SYMBOL_GPL(acpi_cppc_processor_probe); void acpi_cppc_processor_exit(struct acpi_processor *pr) { struct cpc_desc *cpc_ptr; - unsigned int i; - void __iomem *addr; int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, pr->id); if (pcc_ss_id >= 0 && pcc_data[pcc_ss_id]) { @@ -1056,15 +1061,7 @@ void acpi_cppc_processor_exit(struct acpi_processor *pr) if (!cpc_ptr) return; - /* Free all the mapped sys mem areas for this CPU */ - for (i = 2; i < cpc_ptr->num_entries; i++) { - addr = cpc_ptr->cpc_regs[i-2].sys_mem_vaddr; - if (addr) - iounmap(addr); - } - kobject_put(&cpc_ptr->kobj); - kfree(cpc_ptr); } EXPORT_SYMBOL_GPL(acpi_cppc_processor_exit); -- 2.56.0.385.gd3acb90ef8-goog