mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
synced 2026-04-18 19:43:43 -04:00
611cf41ef6
The intel_pmc_ipc() function uses ACPI_ALLOCATE_BUFFER to allocate memory
for the ACPI evaluation result but never frees it, causing a 192-byte
memory leak on each call.
This leak is triggered during network interface initialization when the
stmmac driver calls intel_mac_finish() -> intel_pmc_ipc().
unreferenced object 0xffff96a848d6ea80 (size 192):
comm "dhcpcd", pid 541, jiffies 4294684345
hex dump (first 32 bytes):
04 00 00 00 05 00 00 00 98 ea d6 48 a8 96 ff ff ...........H....
00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
backtrace (crc b1564374):
kmemleak_alloc+0x2d/0x40
__kmalloc_noprof+0x2fa/0x730
acpi_ut_initialize_buffer+0x83/0xc0
acpi_evaluate_object+0x29a/0x2f0
intel_pmc_ipc+0xfd/0x170
intel_mac_finish+0x168/0x230
stmmac_mac_finish+0x3d/0x50
phylink_major_config+0x22b/0x5b0
phylink_mac_initial_config.constprop.0+0xf1/0x1b0
phylink_start+0x8e/0x210
__stmmac_open+0x12c/0x2b0
stmmac_open+0x23c/0x380
__dev_open+0x11d/0x2c0
__dev_change_flags+0x1d2/0x250
netif_change_flags+0x2b/0x70
dev_change_flags+0x40/0xb0
Add __free(kfree) for ACPI object to properly release the allocated buffer.
Cc: stable@vger.kernel.org
Fixes: 7e2f7e25f6 ("arch: x86: add IPC mailbox accessor function and add SoC register access")
Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
Link: https://patch.msgid.link/20251128102437.3412891-2-yongxin.liu@windriver.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
99 lines
2.4 KiB
C
99 lines
2.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Intel Core SoC Power Management Controller Header File
|
|
*
|
|
* Copyright (c) 2025, Intel Corporation.
|
|
* All Rights Reserved.
|
|
*
|
|
*/
|
|
#ifndef INTEL_PMC_IPC_H
|
|
#define INTEL_PMC_IPC_H
|
|
#include <linux/acpi.h>
|
|
#include <linux/cleanup.h>
|
|
|
|
#define IPC_SOC_REGISTER_ACCESS 0xAA
|
|
#define IPC_SOC_SUB_CMD_READ 0x00
|
|
#define IPC_SOC_SUB_CMD_WRITE 0x01
|
|
#define PMC_IPCS_PARAM_COUNT 7
|
|
#define VALID_IPC_RESPONSE 5
|
|
|
|
struct pmc_ipc_cmd {
|
|
u32 cmd;
|
|
u32 sub_cmd;
|
|
u32 size;
|
|
u32 wbuf[4];
|
|
};
|
|
|
|
struct pmc_ipc_rbuf {
|
|
u32 buf[4];
|
|
};
|
|
|
|
/**
|
|
* intel_pmc_ipc() - PMC IPC Mailbox accessor
|
|
* @ipc_cmd: Prepared input command to send
|
|
* @rbuf: Allocated array for returned IPC data
|
|
*
|
|
* Return: 0 on success. Non-zero on mailbox error
|
|
*/
|
|
static inline int intel_pmc_ipc(struct pmc_ipc_cmd *ipc_cmd, struct pmc_ipc_rbuf *rbuf)
|
|
{
|
|
#ifdef CONFIG_ACPI
|
|
struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
|
|
union acpi_object params[PMC_IPCS_PARAM_COUNT] = {
|
|
{.type = ACPI_TYPE_INTEGER,},
|
|
{.type = ACPI_TYPE_INTEGER,},
|
|
{.type = ACPI_TYPE_INTEGER,},
|
|
{.type = ACPI_TYPE_INTEGER,},
|
|
{.type = ACPI_TYPE_INTEGER,},
|
|
{.type = ACPI_TYPE_INTEGER,},
|
|
{.type = ACPI_TYPE_INTEGER,},
|
|
};
|
|
struct acpi_object_list arg_list = { PMC_IPCS_PARAM_COUNT, params };
|
|
int status;
|
|
|
|
if (!ipc_cmd || !rbuf)
|
|
return -EINVAL;
|
|
|
|
/*
|
|
* 0: IPC Command
|
|
* 1: IPC Sub Command
|
|
* 2: Size
|
|
* 3-6: Write Buffer for offset
|
|
*/
|
|
params[0].integer.value = ipc_cmd->cmd;
|
|
params[1].integer.value = ipc_cmd->sub_cmd;
|
|
params[2].integer.value = ipc_cmd->size;
|
|
params[3].integer.value = ipc_cmd->wbuf[0];
|
|
params[4].integer.value = ipc_cmd->wbuf[1];
|
|
params[5].integer.value = ipc_cmd->wbuf[2];
|
|
params[6].integer.value = ipc_cmd->wbuf[3];
|
|
|
|
status = acpi_evaluate_object(NULL, "\\IPCS", &arg_list, &buffer);
|
|
if (ACPI_FAILURE(status))
|
|
return -ENODEV;
|
|
|
|
union acpi_object *obj __free(kfree) = buffer.pointer;
|
|
|
|
if (obj && obj->type == ACPI_TYPE_PACKAGE &&
|
|
obj->package.count == VALID_IPC_RESPONSE) {
|
|
const union acpi_object *objs = obj->package.elements;
|
|
|
|
if ((u8)objs[0].integer.value != 0)
|
|
return -EINVAL;
|
|
|
|
rbuf->buf[0] = objs[1].integer.value;
|
|
rbuf->buf[1] = objs[2].integer.value;
|
|
rbuf->buf[2] = objs[3].integer.value;
|
|
rbuf->buf[3] = objs[4].integer.value;
|
|
} else {
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
#else
|
|
return -ENODEV;
|
|
#endif /* CONFIG_ACPI */
|
|
}
|
|
|
|
#endif /* INTEL_PMC_IPC_H */
|