* [PATCH] usb: gadget: f_uac2: fix memory leak in sample rate store
@ 2026-08-02 0:58 Rituparna Warwatkar
0 siblings, 0 replies; 2+ messages in thread
From: Rituparna Warwatkar @ 2026-08-02 0:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-usb, linux-kernel, Rituparna Warwatkar,
syzbot+ebd045a6645cfb713c95
f_uac2_opts_{p,c}_srate_store() duplicate the input page with kstrdup()
and then tokenize it with strsep(&split_page, ","). strsep() advances
the pointer it is given, so by the time the parsing loop finishes
split_page points at the end of the string (or NULL). The subsequent
kfree(split_page) therefore frees the wrong pointer (NULL when the
whole buffer was consumed), leaking the buffer allocated by kstrdup():
BUG: memory leak
unreferenced object 0xffff888112a01e00 (size 64):
kstrdup
f_uac2_opts_c_srate_store
configfs_write_iter
vfs_write
ksys_write
Keep the original allocation in split_page and hand a separate iterator
to strsep(), so the buffer is always freed. While at it, handle a
kstrdup() failure instead of dereferencing NULL. Both the p_srate and
c_srate attributes use the same macro and are fixed together.
Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
Reported-by: syzbot+ebd045a6645cfb713c95@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ebd045a6645cfb713c95
Signed-off-by: Rituparna Warwatkar <rwarwatkar@gmail.com>
---
drivers/usb/gadget/function/f_uac2.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803..8facf289710 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
{ \
struct f_uac2_opts *opts = to_f_uac2_opts(item); \
char *split_page = NULL; \
+ char *rest; \
int ret = -EINVAL; \
char *token; \
u32 num; \
@@ -2027,7 +2028,12 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
i = 0; \
memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
split_page = kstrdup(page, GFP_KERNEL); \
- while ((token = strsep(&split_page, ",")) != NULL) { \
+ if (!split_page) { \
+ ret = -ENOMEM; \
+ goto end; \
+ } \
+ rest = split_page; \
+ while ((token = strsep(&rest, ",")) != NULL) { \
ret = kstrtou32(token, 0, &num); \
if (ret) \
goto end; \
--
2.47.3
^ permalink raw reply related [flat|nested] 2+ messages in thread* [PATCH] usb: gadget: f_uac2: fix memory leak in sample rate store
@ 2026-08-02 3:29 Rituparna Warwatkar
0 siblings, 0 replies; 2+ messages in thread
From: Rituparna Warwatkar @ 2026-08-02 3:29 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-usb, linux-kernel, Rituparna Warwatkar,
syzbot+ebd045a6645cfb713c95
f_uac2_opts_{p,c}_srate_store() duplicate the input page with kstrdup()
and then tokenize it with strsep(&split_page, ","). strsep() advances
the pointer it is given, so by the time the parsing loop finishes
split_page points at the end of the string (or NULL). The subsequent
kfree(split_page) therefore frees the wrong pointer (NULL when the
whole buffer was consumed), leaking the buffer allocated by kstrdup():
BUG: memory leak
unreferenced object 0xffff888112a01e00 (size 64):
kstrdup
f_uac2_opts_c_srate_store
configfs_write_iter
vfs_write
ksys_write
Keep the original allocation in split_page and hand a separate iterator
to strsep(), so the buffer is always freed. While at it, handle a
kstrdup() failure instead of dereferencing NULL. Both the p_srate and
c_srate attributes use the same macro and are fixed together.
Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
Reported-by: syzbot+ebd045a6645cfb713c95@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ebd045a6645cfb713c95
Signed-off-by: Rituparna Warwatkar <rwarwatkar@gmail.com>
---
drivers/usb/gadget/function/f_uac2.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803..8facf289710 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
{ \
struct f_uac2_opts *opts = to_f_uac2_opts(item); \
char *split_page = NULL; \
+ char *rest; \
int ret = -EINVAL; \
char *token; \
u32 num; \
@@ -2027,7 +2028,12 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
i = 0; \
memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
split_page = kstrdup(page, GFP_KERNEL); \
- while ((token = strsep(&split_page, ",")) != NULL) { \
+ if (!split_page) { \
+ ret = -ENOMEM; \
+ goto end; \
+ } \
+ rest = split_page; \
+ while ((token = strsep(&rest, ",")) != NULL) { \
ret = kstrtou32(token, 0, &num); \
if (ret) \
goto end; \
--
2.47.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-02 3:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-02 0:58 [PATCH] usb: gadget: f_uac2: fix memory leak in sample rate store Rituparna Warwatkar
-- strict thread matches above, loose matches on Subject: below --
2026-08-02 3:29 Rituparna Warwatkar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox