[PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

[PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

[yongxin.liu]

From: Yongxin Liu <yongxin.liu@windriver.com>

The intel_pmc_ipc() function uses ACPI_ALLOCATE_BUFFER to allocate memory
for the ACPI evaluation result but never frees it, causing a 192-byte
memory leak on each call.

This leak is triggered during network interface initialization when the
stmmac driver calls intel_mac_finish() -> intel_pmc_ipc().

  unreferenced object 0xffff96a848d6ea80 (size 192):
    comm "dhcpcd", pid 541, jiffies 4294684345
    hex dump (first 32 bytes):
      04 00 00 00 05 00 00 00 98 ea d6 48 a8 96 ff ff  ...........H....
      00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    backtrace (crc b1564374):
      kmemleak_alloc+0x2d/0x40
      __kmalloc_noprof+0x2fa/0x730
      acpi_ut_initialize_buffer+0x83/0xc0
      acpi_evaluate_object+0x29a/0x2f0
      intel_pmc_ipc+0xfd/0x170
      intel_mac_finish+0x168/0x230
      stmmac_mac_finish+0x3d/0x50
      phylink_major_config+0x22b/0x5b0
      phylink_mac_initial_config.constprop.0+0xf1/0x1b0
      phylink_start+0x8e/0x210
      __stmmac_open+0x12c/0x2b0
      stmmac_open+0x23c/0x380
      __dev_open+0x11d/0x2c0
      __dev_change_flags+0x1d2/0x250
      netif_change_flags+0x2b/0x70
      dev_change_flags+0x40/0xb0

Add kfree() to properly release the allocated buffer.

Cc: stable@vger.kernel.org
Fixes: 7e2f7e25f6ff ("arch: x86: add IPC mailbox accessor function and add SoC register access")
Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
V1->V2:

Cover all potential paths for kfree();

---
 include/linux/platform_data/x86/intel_pmc_ipc.h | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/include/linux/platform_data/x86/intel_pmc_ipc.h b/include/linux/platform_data/x86/intel_pmc_ipc.h
index 1d34435b7001..b65193b1e043 100644
--- a/include/linux/platform_data/x86/intel_pmc_ipc.h
+++ b/include/linux/platform_data/x86/intel_pmc_ipc.h
@@ -49,7 +49,7 @@ static inline int intel_pmc_ipc(struct pmc_ipc_cmd *ipc_cmd, struct pmc_ipc_rbuf
 	};
 	struct acpi_object_list arg_list = { PMC_IPCS_PARAM_COUNT, params };
 	union acpi_object *obj;
-	int status;
+	int status, ret = 0;
 
 	if (!ipc_cmd || !rbuf)
 		return -EINVAL;
@@ -78,18 +78,22 @@ static inline int intel_pmc_ipc(struct pmc_ipc_cmd *ipc_cmd, struct pmc_ipc_rbuf
 	    obj->package.count == VALID_IPC_RESPONSE) {
 		const union acpi_object *objs = obj->package.elements;
 
-		if ((u8)objs[0].integer.value != 0)
-			return -EINVAL;
+		if ((u8)objs[0].integer.value != 0) {
+			ret = -EINVAL;
+			goto out;
+		}
 
 		rbuf->buf[0] = objs[1].integer.value;
 		rbuf->buf[1] = objs[2].integer.value;
 		rbuf->buf[2] = objs[3].integer.value;
 		rbuf->buf[3] = objs[4].integer.value;
 	} else {
-		return -EINVAL;
+		ret = -EINVAL;
 	}
 
-	return 0;
+out:
+	kfree(buffer.pointer);
+	return ret;
 #else
 	return -ENODEV;
 #endif /* CONFIG_ACPI */
-- 
2.46.2

Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

[Jakub Kicinski]

On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
> Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

Presumably typo in the subject? Why would this go via netdev/net.. ?
-- 
pw-bot: nap

RE: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

[Liu, Yongxin]

> -----Original Message-----
> From: Jakub Kicinski <kuba@kernel.org>
> Sent: Tuesday, November 25, 2025 10:56
> To: Liu, Yongxin <Yongxin.Liu@windriver.com>
> Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org;
> david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch;
> platform-driver-x86@vger.kernel.org; stable@vger.kernel.org
> Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
> memory leak
> 
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and
> know the content is safe.
> 
> On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
> > Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
> memory leak
> 
> Presumably typo in the subject? Why would this go via netdev/net.. ?

Because the only caller of intel_pmc_ipc() is drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c.
I have sent both to the platform-driver-x86@vger.kernel.org and netdev@vger.kernel.org mailing lists.

If this is not network-related, please disregard it.
Apologies for any confusion.

Thanks,
Yongxin


> --
> pw-bot: nap

Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

[Jakub Kicinski]

On Tue, 25 Nov 2025 03:07:30 +0000 Liu, Yongxin wrote:
> > -----Original Message-----
> > From: Jakub Kicinski <kuba@kernel.org>
> > Sent: Tuesday, November 25, 2025 10:56
> > To: Liu, Yongxin <Yongxin.Liu@windriver.com>
> > Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org;
> > david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch;
> > platform-driver-x86@vger.kernel.org; stable@vger.kernel.org
> > Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
> > memory leak
> > 
> > CAUTION: This email comes from a non Wind River email account!
> > Do not click links or open attachments unless you recognize the sender and
> > know the content is safe.
> > 
> > On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
> > > Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
> > memory leak
> > 
> > Presumably typo in the subject? Why would this go via netdev/net.. ?
> 
> Because the only caller of intel_pmc_ipc() is drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c.
> I have sent both to the platform-driver-x86@vger.kernel.org and netdev@vger.kernel.org mailing lists.

Just to be clear -- the CC is fine, but given the code path - the
platform maintainer will likely take this via their tree. And the
subject designation is to indicate which maintainer you're expecting 
to process the patch.

RE: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

[Liu, Yongxin]

> -----Original Message-----
> From: Jakub Kicinski <kuba@kernel.org>
> Sent: Tuesday, November 25, 2025 11:15
> To: Liu, Yongxin <Yongxin.Liu@windriver.com>
> Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org;
> david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch;
> platform-driver-x86@vger.kernel.org; stable@vger.kernel.org
> Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
> memory leak
> 
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and
> know the content is safe.
> 
> On Tue, 25 Nov 2025 03:07:30 +0000 Liu, Yongxin wrote:
> > > -----Original Message-----
> > > From: Jakub Kicinski <kuba@kernel.org>
> > > Sent: Tuesday, November 25, 2025 10:56
> > > To: Liu, Yongxin <Yongxin.Liu@windriver.com>
> > > Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org;
> > > david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com;
> > > andrew@lunn.ch; platform-driver-x86@vger.kernel.org;
> > > stable@vger.kernel.org
> > > Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI
> > > buffer memory leak
> > >
> > > CAUTION: This email comes from a non Wind River email account!
> > > Do not click links or open attachments unless you recognize the
> > > sender and know the content is safe.
> > >
> > > On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
> > > > Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI
> > > > buffer
> > > memory leak
> > >
> > > Presumably typo in the subject? Why would this go via netdev/net.. ?
> >
> > Because the only caller of intel_pmc_ipc() is
> drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c.
> > I have sent both to the platform-driver-x86@vger.kernel.org and
> netdev@vger.kernel.org mailing lists.
> 
> Just to be clear -- the CC is fine, but given the code path - the platform
> maintainer will likely take this via their tree. And the subject
> designation is to indicate which maintainer you're expecting to process
> the patch.

Got it. If needed, I will resend with the correct subject.


Thanks,
Yongxin

RE: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak

[Ilpo Järvinen]

On Tue, 25 Nov 2025, Liu, Yongxin wrote:

> > -----Original Message-----
> > From: Jakub Kicinski <kuba@kernel.org>
> > Sent: Tuesday, November 25, 2025 11:15
> > To: Liu, Yongxin <Yongxin.Liu@windriver.com>
> > Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org;
> > david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch;
> > platform-driver-x86@vger.kernel.org; stable@vger.kernel.org
> > Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
> > memory leak
> > 
> > CAUTION: This email comes from a non Wind River email account!
> > Do not click links or open attachments unless you recognize the sender and
> > know the content is safe.
> > 
> > On Tue, 25 Nov 2025 03:07:30 +0000 Liu, Yongxin wrote:
> > > > -----Original Message-----
> > > > From: Jakub Kicinski <kuba@kernel.org>
> > > > Sent: Tuesday, November 25, 2025 10:56
> > > > To: Liu, Yongxin <Yongxin.Liu@windriver.com>
> > > > Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org;
> > > > david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com;
> > > > andrew@lunn.ch; platform-driver-x86@vger.kernel.org;
> > > > stable@vger.kernel.org
> > > > Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI
> > > > buffer memory leak
> > > >
> > > > CAUTION: This email comes from a non Wind River email account!
> > > > Do not click links or open attachments unless you recognize the
> > > > sender and know the content is safe.
> > > >
> > > > On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
> > > > > Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI
> > > > > buffer
> > > > memory leak
> > > >
> > > > Presumably typo in the subject? Why would this go via netdev/net.. ?
> > >
> > > Because the only caller of intel_pmc_ipc() is
> > drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c.
> > > I have sent both to the platform-driver-x86@vger.kernel.org and
> > netdev@vger.kernel.org mailing lists.
> > 
> > Just to be clear -- the CC is fine, but given the code path - the platform
> > maintainer will likely take this via their tree. And the subject
> > designation is to indicate which maintainer you're expecting to process
> > the patch.
> 
> Got it. If needed, I will resend with the correct subject.

Hi Yongxin,

As this code belongs to pdx86 domain, please ignore Andrew's feedback on 
not using __free() (which was given with the assumption this would fall 
under netdev's domain that applies a different rule).

Using cleanup.h helpers is required for new pdx86 code when it avoids 
error handling gotos.

-- 
 i.