Forwarded: [PATCH] Fix invalid-free in f_uac1_opts_c_srate_store

[syzbot <syzbot+2532c7901f590afd0c3a@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] Fix invalid-free in f_uac1_opts_c_srate_store
Author: subasris1210@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-linus

Signed-off-by: Subasri S <subasris1210@gmail.com>
---
 drivers/usb/gadget/function/f_uac1.c | 4 +++-
 drivers/usb/gadget/function/f_uac2.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 85c502e98f57..488c59fdb2bf 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -1595,6 +1595,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 {									\
 	struct f_uac1_opts *opts = to_f_uac1_opts(item);		\
 	char *split_page = NULL;					\
+	char *original_split_page = NULL;		\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -1609,6 +1610,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 	split_page = kstrdup(page, GFP_KERNEL);				\
+	original_split_page = split_page;					\
 	while ((token = strsep(&split_page, ",")) != NULL) {		\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
@@ -1619,7 +1621,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 	};								\
 									\
 end:									\
-	kfree(split_page);						\
+	kfree(original_split_page);						\
 	mutex_unlock(&opts->lock);					\
 	return ret;							\
 }									\
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c..a0b52c262ad8 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 {									\
 	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
 	char *split_page = NULL;					\
+	char *original_split_page = NULL;		\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -2027,6 +2028,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 	split_page = kstrdup(page, GFP_KERNEL);				\
+	original_split_page = split_page;					\
 	while ((token = strsep(&split_page, ",")) != NULL) {		\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
@@ -2037,7 +2039,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 	};								\
 									\
 end:									\
-	kfree(split_page);						\
+	kfree(original_split_page);						\
 	mutex_unlock(&opts->lock);					\
 	return ret;							\
 }									\
-- 
2.43.0