[PATCH] ACPI: property: Fix leaked buffers after skipped properties

[PATCH] ACPI: property: Fix leaked buffers after skipped properties

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

acpi_data_add_buffer_props() compacts successfully parsed buffer
properties into an output package, but stores their separately allocated
evaluation buffers in props->bufs using the original input index.
acpi_free_device_properties() only frees entries below the output
package's successful-property count.

If a property is skipped because of an invalid format, invalid types or
a failed object evaluation, later successful entries can be stored past
the range visited during cleanup. For example, a failed first entry and
a successful second entry leave the allocation in bufs[1] while cleanup
only visits bufs[0]. The evaluation buffer is then leaked when the
properties are destroyed. Lists with no skipped entries do not exhibit
this mismatch.

Store each evaluation buffer at the current output count before
incrementing it. This keeps the ownership array compact and aligned with
the cleanup bound without changing property order or buffer contents.

Fixes: 103e10c69c61 ("ACPI: property: Add support for parsing buffer property UUID")
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Cc: stable@vger.kernel.org
---
 drivers/acpi/property.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 8ee5a1f0eb48..fb6b214f2335 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -523,7 +523,7 @@ static void acpi_data_add_buffer_props(acpi_handle handle,
 		obj->buffer.length = buf_obj->buffer.length;
 		obj->buffer.pointer = buf_obj->buffer.pointer;

-		props->bufs[i] = buf.pointer;
+		props->bufs[*count] = buf.pointer;
 		package++;
 		(*count)++;
 	}
--
2.50.1

Re: [PATCH] ACPI: property: Fix leaked buffers after skipped properties

[Sakari Ailus]

Hi Rao,

Thanks for the patch.

On Thu, Nov 12, 2026 at 05:09:54PM +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> acpi_data_add_buffer_props() compacts successfully parsed buffer
> properties into an output package, but stores their separately allocated
> evaluation buffers in props->bufs using the original input index.
> acpi_free_device_properties() only frees entries below the output
> package's successful-property count.
> 
> If a property is skipped because of an invalid format, invalid types or
> a failed object evaluation, later successful entries can be stored past
> the range visited during cleanup. For example, a failed first entry and
> a successful second entry leave the allocation in bufs[1] while cleanup
> only visits bufs[0]. The evaluation buffer is then leaked when the
> properties are destroyed. Lists with no skipped entries do not exhibit
> this mismatch.
> 
> Store each evaluation buffer at the current output count before
> incrementing it. This keeps the ownership array compact and aligned with
> the cleanup bound without changing property order or buffer contents.
> 
> Fixes: 103e10c69c61 ("ACPI: property: Add support for parsing buffer property UUID")
> Signed-off-by: Xu Rao <raoxu@uniontech.com>
> Cc: stable@vger.kernel.org

Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>

> ---
>  drivers/acpi/property.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
> index 8ee5a1f0eb48..fb6b214f2335 100644
> --- a/drivers/acpi/property.c
> +++ b/drivers/acpi/property.c
> @@ -523,7 +523,7 @@ static void acpi_data_add_buffer_props(acpi_handle handle,
>  		obj->buffer.length = buf_obj->buffer.length;
>  		obj->buffer.pointer = buf_obj->buffer.pointer;
> 
> -		props->bufs[i] = buf.pointer;
> +		props->bufs[*count] = buf.pointer;
>  		package++;
>  		(*count)++;
>  	}

-- 
Kind regards,

Sakari Ailus