* [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store
@ 2026-06-09 9:19 Peter Korsgaard
2026-06-09 9:19 ` [PATCH 2/2] usb: gadget: f_uac1: fix memory leak in UAC1_RATE_ATTRIBUTE store Peter Korsgaard
2026-06-14 9:39 ` [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store Peter Korsgaard
0 siblings, 2 replies; 4+ messages in thread
From: Peter Korsgaard @ 2026-06-09 9:19 UTC (permalink / raw)
To: linux-usb, julian, gregkh, Pavel Hofman; +Cc: Peter Korsgaard, linux-kernel
strsep() clobbers the passed pointer, so we need a separate variable to be
able to correctly kfree() the memory at the end.
Detected by kmemleak:
unreferenced object 0xffffff80038f9098 (size 8):
comm "audio.hook", pid 323, jiffies 4294896085
hex dump (first 8 bytes):
34 38 30 30 30 0a 00 cc 48000...
backtrace (crc 503efa75):
kmemleak_alloc+0x30/0x40
__kmalloc_node_track_caller_noprof+0x240/0x3d0
kstrdup+0x44/0x90
f_uac2_opts_c_srate_store+0x13c/0x200
configfs_write_iter+0x238/0x360
vfs_write+0x4a4/0xd00
ksys_write+0xf4/0x1e0
__arm64_sys_write+0x68/0xa0
invoke_syscall.constprop.0+0xa4/0x260
do_el0_svc+0xc0/0x1c0
el0_svc+0x20/0x60
el0t_64_sync_handler+0x118/0x130
el0t_64_sync+0x14c/0x150
Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
drivers/usb/gadget/function/f_uac2.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c1..0c2a8afccbb69 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2012,7 +2012,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
const char *page, size_t len) \
{ \
struct f_uac2_opts *opts = to_f_uac2_opts(item); \
- char *split_page = NULL; \
+ char *p, *split_page = NULL; \
int ret = -EINVAL; \
char *token; \
u32 num; \
@@ -2026,8 +2026,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
\
i = 0; \
memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
- split_page = kstrdup(page, GFP_KERNEL); \
- while ((token = strsep(&split_page, ",")) != NULL) { \
+ split_page = p = kstrdup(page, GFP_KERNEL); \
+ while ((token = strsep(&p, ",")) != NULL) { \
ret = kstrtou32(token, 0, &num); \
if (ret) \
goto end; \
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 2/2] usb: gadget: f_uac1: fix memory leak in UAC1_RATE_ATTRIBUTE store
2026-06-09 9:19 [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store Peter Korsgaard
@ 2026-06-09 9:19 ` Peter Korsgaard
2026-06-14 9:39 ` [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store Peter Korsgaard
1 sibling, 0 replies; 4+ messages in thread
From: Peter Korsgaard @ 2026-06-09 9:19 UTC (permalink / raw)
To: linux-usb, julian, gregkh, Pavel Hofman; +Cc: Peter Korsgaard, linux-kernel
strsep() clobbers the passed pointer, so we need a separate variable to be
able to correctly kfree() the memory at the end.
Fixes: 695d39ffc2b5 ("usb: gadget: f_uac1: Support multiple sampling rates")
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
drivers/usb/gadget/function/f_uac1.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 85c502e98f577..5cd63e590f553 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -1594,7 +1594,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
const char *page, size_t len) \
{ \
struct f_uac1_opts *opts = to_f_uac1_opts(item); \
- char *split_page = NULL; \
+ char *p, *split_page = NULL; \
int ret = -EINVAL; \
char *token; \
u32 num; \
@@ -1608,8 +1608,8 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
\
i = 0; \
memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
- split_page = kstrdup(page, GFP_KERNEL); \
- while ((token = strsep(&split_page, ",")) != NULL) { \
+ split_page = p = kstrdup(page, GFP_KERNEL); \
+ while ((token = strsep(&p, ",")) != NULL) { \
ret = kstrtou32(token, 0, &num); \
if (ret) \
goto end; \
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store
2026-06-09 9:19 [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store Peter Korsgaard
2026-06-09 9:19 ` [PATCH 2/2] usb: gadget: f_uac1: fix memory leak in UAC1_RATE_ATTRIBUTE store Peter Korsgaard
@ 2026-06-14 9:39 ` Peter Korsgaard
2026-06-15 10:52 ` Ming Qing
1 sibling, 1 reply; 4+ messages in thread
From: Peter Korsgaard @ 2026-06-14 9:39 UTC (permalink / raw)
To: linux-usb, a0yami; +Cc: julian, gregkh, Pavel Hofman, linux-kernel
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> strsep() clobbers the passed pointer, so we need a separate variable to be
> able to correctly kfree() the memory at the end.
> Detected by kmemleak:
> unreferenced object 0xffffff80038f9098 (size 8):
> comm "audio.hook", pid 323, jiffies 4294896085
> hex dump (first 8 bytes):
> 34 38 30 30 30 0a 00 cc 48000...
> backtrace (crc 503efa75):
> kmemleak_alloc+0x30/0x40
> __kmalloc_node_track_caller_noprof+0x240/0x3d0
> kstrdup+0x44/0x90
> f_uac2_opts_c_srate_store+0x13c/0x200
> configfs_write_iter+0x238/0x360
> vfs_write+0x4a4/0xd00
> ksys_write+0xf4/0x1e0
> __arm64_sys_write+0x68/0xa0
> invoke_syscall.constprop.0+0xa4/0x260
> do_el0_svc+0xc0/0x1c0
> el0_svc+0x20/0x60
> el0t_64_sync_handler+0x118/0x130
> el0t_64_sync+0x14c/0x150
> Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
FYI, I see the same issue is also fixed in the recently proposed
"[PATCH] usb: gadget: uac: validate rate list length before storing"
https://lore.kernel.org/linux-usb/20260519143319.147494-1-a0yami@mailbox.org/
> ---
> drivers/usb/gadget/function/f_uac2.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
> diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
> index 897787d0803c1..0c2a8afccbb69 100644
> --- a/drivers/usb/gadget/function/f_uac2.c
> +++ b/drivers/usb/gadget/function/f_uac2.c
> @@ -2012,7 +2012,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
> const char *page, size_t len) \
> { \
> struct f_uac2_opts *opts = to_f_uac2_opts(item); \
> - char *split_page = NULL; \
> + char *p, *split_page = NULL; \
> int ret = -EINVAL; \
> char *token; \
> u32 num; \
> @@ -2026,8 +2026,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
> \
> i = 0; \
> memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
> - split_page = kstrdup(page, GFP_KERNEL); \
> - while ((token = strsep(&split_page, ",")) != NULL) { \
> + split_page = p = kstrdup(page, GFP_KERNEL); \
> + while ((token = strsep(&p, ",")) != NULL) { \
> ret = kstrtou32(token, 0, &num); \
> if (ret) \
> goto end; \
> --
> 2.47.3
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store
2026-06-14 9:39 ` [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store Peter Korsgaard
@ 2026-06-15 10:52 ` Ming Qing
0 siblings, 0 replies; 4+ messages in thread
From: Ming Qing @ 2026-06-15 10:52 UTC (permalink / raw)
To: Peter Korsgaard, linux-usb; +Cc: julian, gregkh, Pavel Hofman, linux-kernel
On Sun, Jun 14, 2026 at 5:39 PM +0800, Peter Korsgaard wrote:
> FYI, I see the same issue is also fixed in the recently proposed
> "[PATCH] usb: gadget: uac: validate rate list length before storing"
>
> https://lore.kernel.org/linux-usb/20260519143319.147494-1-a0yami@mailbox.org/
Yes, that includes the same buffer lifetime fix. I'm happy to split it up if that makes it easier to pick.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-06-15 10:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-09 9:19 [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store Peter Korsgaard
2026-06-09 9:19 ` [PATCH 2/2] usb: gadget: f_uac1: fix memory leak in UAC1_RATE_ATTRIBUTE store Peter Korsgaard
2026-06-14 9:39 ` [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store Peter Korsgaard
2026-06-15 10:52 ` Ming Qing
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox