Linux kernel -stable discussions
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] cpufreq: qcom-cpufreq-hw: Fix possible double free" failed to apply to 6.6-stable tree
@ 2026-07-14 14:49 gregkh
  2026-07-16 17:45 ` [PATCH 6.6.y 1/3] cpufreq: pcc: Remove empty exit() callback Sasha Levin
  0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2026-07-14 14:49 UTC (permalink / raw)
  To: lgs201920130244, viresh.kumar, zhongqiu.han; +Cc: stable


The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x bcb8889c4981fdde42d4fd2c29a77d510fe21da2
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026071413-devious-clay-8609@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From bcb8889c4981fdde42d4fd2c29a77d510fe21da2 Mon Sep 17 00:00:00 2001
From: Guangshuo Li <lgs201920130244@gmail.com>
Date: Sat, 2 May 2026 03:00:05 +0800
Subject: [PATCH] cpufreq: qcom-cpufreq-hw: Fix possible double free

qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an
array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to
one element of this array in policy->driver_data.

qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data.
This is not valid because the memory is devm-managed. For the first
domain, this can free the devm-managed allocation while the devres entry
is still active, leading to a possible double free when the platform
device is later detached. For other domains, the pointer may refer to an
element inside the array rather than the allocation base.

Remove the kfree(data) call and let devres release qcom_cpufreq.data.

This issue was found by a static analysis tool I am developing.

Fixes: 054a3ef683a1 ("cpufreq: qcom-hw: Allocate qcom_cpufreq_data during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>

diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
index ea9a20d27b8f..ef19faedbfec 100644
--- a/drivers/cpufreq/qcom-cpufreq-hw.c
+++ b/drivers/cpufreq/qcom-cpufreq-hw.c
@@ -578,7 +578,6 @@ static void qcom_cpufreq_hw_cpu_exit(struct cpufreq_policy *policy)
 	dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
 	qcom_cpufreq_hw_lmh_exit(data);
 	kfree(policy->freq_table);
-	kfree(data);
 }
 
 static void qcom_cpufreq_ready(struct cpufreq_policy *policy)


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-16 17:45 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-14 14:49 FAILED: patch "[PATCH] cpufreq: qcom-cpufreq-hw: Fix possible double free" failed to apply to 6.6-stable tree gregkh
2026-07-16 17:45 ` [PATCH 6.6.y 1/3] cpufreq: pcc: Remove empty exit() callback Sasha Levin
2026-07-16 17:45   ` [PATCH 6.6.y 2/3] cpufreq: Make cpufreq_driver->exit() return void Sasha Levin
2026-07-16 17:45   ` [PATCH 6.6.y 3/3] cpufreq: qcom-cpufreq-hw: Fix possible double free Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox