From: Yongxin Liu yongxin.liu@windriver.com
The intel_pmc_ipc() function uses ACPI_ALLOCATE_BUFFER to allocate memory for the ACPI evaluation result but never frees it, causing a 192-byte memory leak on each call.
This leak is triggered during network interface initialization when the stmmac driver calls intel_mac_finish() -> intel_pmc_ipc().
unreferenced object 0xffff96a848d6ea80 (size 192): comm "dhcpcd", pid 541, jiffies 4294684345 hex dump (first 32 bytes): 04 00 00 00 05 00 00 00 98 ea d6 48 a8 96 ff ff ...........H.... 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ backtrace (crc b1564374): kmemleak_alloc+0x2d/0x40 __kmalloc_noprof+0x2fa/0x730 acpi_ut_initialize_buffer+0x83/0xc0 acpi_evaluate_object+0x29a/0x2f0 intel_pmc_ipc+0xfd/0x170 intel_mac_finish+0x168/0x230 stmmac_mac_finish+0x3d/0x50 phylink_major_config+0x22b/0x5b0 phylink_mac_initial_config.constprop.0+0xf1/0x1b0 phylink_start+0x8e/0x210 __stmmac_open+0x12c/0x2b0 stmmac_open+0x23c/0x380 __dev_open+0x11d/0x2c0 __dev_change_flags+0x1d2/0x250 netif_change_flags+0x2b/0x70 dev_change_flags+0x40/0xb0
Add kfree() to properly release the allocated buffer.
Cc: stable@vger.kernel.org Fixes: 7e2f7e25f6ff ("arch: x86: add IPC mailbox accessor function and add SoC register access") Signed-off-by: Yongxin Liu yongxin.liu@windriver.com --- V1->V2:
Cover all potential paths for kfree();
--- include/linux/platform_data/x86/intel_pmc_ipc.h | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/include/linux/platform_data/x86/intel_pmc_ipc.h b/include/linux/platform_data/x86/intel_pmc_ipc.h index 1d34435b7001..b65193b1e043 100644 --- a/include/linux/platform_data/x86/intel_pmc_ipc.h +++ b/include/linux/platform_data/x86/intel_pmc_ipc.h @@ -49,7 +49,7 @@ static inline int intel_pmc_ipc(struct pmc_ipc_cmd *ipc_cmd, struct pmc_ipc_rbuf }; struct acpi_object_list arg_list = { PMC_IPCS_PARAM_COUNT, params }; union acpi_object *obj; - int status; + int status, ret = 0;
if (!ipc_cmd || !rbuf) return -EINVAL; @@ -78,18 +78,22 @@ static inline int intel_pmc_ipc(struct pmc_ipc_cmd *ipc_cmd, struct pmc_ipc_rbuf obj->package.count == VALID_IPC_RESPONSE) { const union acpi_object *objs = obj->package.elements;
- if ((u8)objs[0].integer.value != 0) - return -EINVAL; + if ((u8)objs[0].integer.value != 0) { + ret = -EINVAL; + goto out; + }
rbuf->buf[0] = objs[1].integer.value; rbuf->buf[1] = objs[2].integer.value; rbuf->buf[2] = objs[3].integer.value; rbuf->buf[3] = objs[4].integer.value; } else { - return -EINVAL; + ret = -EINVAL; }
- return 0; +out: + kfree(buffer.pointer); + return ret; #else return -ENODEV; #endif /* CONFIG_ACPI */
-----Original Message----- From: Jakub Kicinski kuba@kernel.org Sent: Tuesday, November 25, 2025 10:56 To: Liu, Yongxin Yongxin.Liu@windriver.com Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org; david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch; platform-driver-x86@vger.kernel.org; stable@vger.kernel.org Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
memory leak
Presumably typo in the subject? Why would this go via netdev/net.. ?
Because the only caller of intel_pmc_ipc() is drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c. I have sent both to the platform-driver-x86@vger.kernel.org and netdev@vger.kernel.org mailing lists.
If this is not network-related, please disregard it. Apologies for any confusion.
Thanks, Yongxin
-- pw-bot: nap
On Tue, 25 Nov 2025 03:07:30 +0000 Liu, Yongxin wrote:
-----Original Message----- From: Jakub Kicinski kuba@kernel.org Sent: Tuesday, November 25, 2025 10:56 To: Liu, Yongxin Yongxin.Liu@windriver.com Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org; david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch; platform-driver-x86@vger.kernel.org; stable@vger.kernel.org Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
memory leak
Presumably typo in the subject? Why would this go via netdev/net.. ?
Because the only caller of intel_pmc_ipc() is drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c. I have sent both to the platform-driver-x86@vger.kernel.org and netdev@vger.kernel.org mailing lists.
Just to be clear -- the CC is fine, but given the code path - the platform maintainer will likely take this via their tree. And the subject designation is to indicate which maintainer you're expecting to process the patch.
-----Original Message----- From: Jakub Kicinski kuba@kernel.org Sent: Tuesday, November 25, 2025 11:15 To: Liu, Yongxin Yongxin.Liu@windriver.com Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org; david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch; platform-driver-x86@vger.kernel.org; stable@vger.kernel.org Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
On Tue, 25 Nov 2025 03:07:30 +0000 Liu, Yongxin wrote:
-----Original Message----- From: Jakub Kicinski kuba@kernel.org Sent: Tuesday, November 25, 2025 10:56 To: Liu, Yongxin Yongxin.Liu@windriver.com Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org; david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch; platform-driver-x86@vger.kernel.org; stable@vger.kernel.org Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
memory leak
Presumably typo in the subject? Why would this go via netdev/net.. ?
Because the only caller of intel_pmc_ipc() is
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c.
I have sent both to the platform-driver-x86@vger.kernel.org and
netdev@vger.kernel.org mailing lists.
Just to be clear -- the CC is fine, but given the code path - the platform maintainer will likely take this via their tree. And the subject designation is to indicate which maintainer you're expecting to process the patch.
Got it. If needed, I will resend with the correct subject.
Thanks, Yongxin
On Tue, 25 Nov 2025, Liu, Yongxin wrote:
-----Original Message----- From: Jakub Kicinski kuba@kernel.org Sent: Tuesday, November 25, 2025 11:15 To: Liu, Yongxin Yongxin.Liu@windriver.com Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org; david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch; platform-driver-x86@vger.kernel.org; stable@vger.kernel.org Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
On Tue, 25 Nov 2025 03:07:30 +0000 Liu, Yongxin wrote:
-----Original Message----- From: Jakub Kicinski kuba@kernel.org Sent: Tuesday, November 25, 2025 10:56 To: Liu, Yongxin Yongxin.Liu@windriver.com Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org; david.e.box@linux.intel.com; ilpo.jarvinen@linux.intel.com; andrew@lunn.ch; platform-driver-x86@vger.kernel.org; stable@vger.kernel.org Subject: Re: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
On Tue, 25 Nov 2025 10:29:53 +0800 yongxin.liu@windriver.com wrote:
Subject: [PATCH net v2] platform/x86: intel_pmc_ipc: fix ACPI buffer
memory leak
Presumably typo in the subject? Why would this go via netdev/net.. ?
Because the only caller of intel_pmc_ipc() is
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c.
I have sent both to the platform-driver-x86@vger.kernel.org and
netdev@vger.kernel.org mailing lists.
Just to be clear -- the CC is fine, but given the code path - the platform maintainer will likely take this via their tree. And the subject designation is to indicate which maintainer you're expecting to process the patch.
Got it. If needed, I will resend with the correct subject.
Hi Yongxin,
As this code belongs to pdx86 domain, please ignore Andrew's feedback on not using __free() (which was given with the assumption this would fall under netdev's domain that applies a different rule).
Using cleanup.h helpers is required for new pdx86 code when it avoids error handling gotos.
linux-stable-mirror@lists.linaro.org
-
Ilpo Järvinen -
Jakub Kicinski -
Liu, Yongxin -
yongxin.liu＠windriver.com