Re: [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > strsep() clobbers the passed pointer, so we need a separate variable to be
 > able to correctly kfree() the memory at the end.

 > Detected by kmemleak:
 > unreferenced object 0xffffff80038f9098 (size 8):
 >   comm "audio.hook", pid 323, jiffies 4294896085
 >   hex dump (first 8 bytes):
 >     34 38 30 30 30 0a 00 cc                          48000...
 >   backtrace (crc 503efa75):
 >     kmemleak_alloc+0x30/0x40
 >     __kmalloc_node_track_caller_noprof+0x240/0x3d0
 >     kstrdup+0x44/0x90
 >     f_uac2_opts_c_srate_store+0x13c/0x200
 >     configfs_write_iter+0x238/0x360
 >     vfs_write+0x4a4/0xd00
 >     ksys_write+0xf4/0x1e0
 >     __arm64_sys_write+0x68/0xa0
 >     invoke_syscall.constprop.0+0xa4/0x260
 >     do_el0_svc+0xc0/0x1c0
 >     el0_svc+0x20/0x60
 >     el0t_64_sync_handler+0x118/0x130
 >     el0t_64_sync+0x14c/0x150

 > Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

FYI, I see the same issue is also fixed in the recently proposed
"[PATCH] usb: gadget: uac: validate rate list length before storing"

https://lore.kernel.org/linux-usb/20260519143319.147494-1-a0yami@mailbox.org/


> ---
 >  drivers/usb/gadget/function/f_uac2.c | 6 +++---
 >  1 file changed, 3 insertions(+), 3 deletions(-)

 > diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
 > index 897787d0803c1..0c2a8afccbb69 100644
 > --- a/drivers/usb/gadget/function/f_uac2.c
 > +++ b/drivers/usb/gadget/function/f_uac2.c
 > @@ -2012,7 +2012,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 >  					  const char *page, size_t len)	\
 >  {									\
 >  	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
 > -	char *split_page = NULL;					\
 > +	char *p, *split_page = NULL;					\
 >  	int ret = -EINVAL;						\
 >  	char *token;							\
 >  	u32 num;							\
 > @@ -2026,8 +2026,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 >  									\
 >  	i = 0;								\
 >  	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 > -	split_page = kstrdup(page, GFP_KERNEL);				\
 > -	while ((token = strsep(&split_page, ",")) != NULL) {		\
 > +	split_page = p = kstrdup(page, GFP_KERNEL);			\
 > +	while ((token = strsep(&p, ",")) != NULL) {			\
 >  		ret = kstrtou32(token, 0, &num);			\
 >  		if (ret)						\
 >  			goto end;					\
 > -- 

 > 2.47.3



-- 
Bye, Peter Korsgaard