[PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store

[PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store

[Peter Korsgaard]

strsep() clobbers the passed pointer, so we need a separate variable to be
able to correctly kfree() the memory at the end.

Detected by kmemleak:
unreferenced object 0xffffff80038f9098 (size 8):
  comm "audio.hook", pid 323, jiffies 4294896085
  hex dump (first 8 bytes):
    34 38 30 30 30 0a 00 cc                          48000...
  backtrace (crc 503efa75):
    kmemleak_alloc+0x30/0x40
    __kmalloc_node_track_caller_noprof+0x240/0x3d0
    kstrdup+0x44/0x90
    f_uac2_opts_c_srate_store+0x13c/0x200
    configfs_write_iter+0x238/0x360
    vfs_write+0x4a4/0xd00
    ksys_write+0xf4/0x1e0
    __arm64_sys_write+0x68/0xa0
    invoke_syscall.constprop.0+0xa4/0x260
    do_el0_svc+0xc0/0x1c0
    el0_svc+0x20/0x60
    el0t_64_sync_handler+0x118/0x130
    el0t_64_sync+0x14c/0x150

Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 drivers/usb/gadget/function/f_uac2.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c1..0c2a8afccbb69 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2012,7 +2012,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 					  const char *page, size_t len)	\
 {									\
 	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
-	char *split_page = NULL;					\
+	char *p, *split_page = NULL;					\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -2026,8 +2026,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 									\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
-	split_page = kstrdup(page, GFP_KERNEL);				\
-	while ((token = strsep(&split_page, ",")) != NULL) {		\
+	split_page = p = kstrdup(page, GFP_KERNEL);			\
+	while ((token = strsep(&p, ",")) != NULL) {			\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
 			goto end;					\
-- 
2.47.3

[PATCH 2/2] usb: gadget: f_uac1: fix memory leak in UAC1_RATE_ATTRIBUTE store

[Peter Korsgaard]

strsep() clobbers the passed pointer, so we need a separate variable to be
able to correctly kfree() the memory at the end.

Fixes: 695d39ffc2b5 ("usb: gadget: f_uac1: Support multiple sampling rates")
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 drivers/usb/gadget/function/f_uac1.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 85c502e98f577..5cd63e590f553 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -1594,7 +1594,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 					  const char *page, size_t len)	\
 {									\
 	struct f_uac1_opts *opts = to_f_uac1_opts(item);		\
-	char *split_page = NULL;					\
+	char *p, *split_page = NULL;					\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -1608,8 +1608,8 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 									\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
-	split_page = kstrdup(page, GFP_KERNEL);				\
-	while ((token = strsep(&split_page, ",")) != NULL) {		\
+	split_page = p = kstrdup(page, GFP_KERNEL);			\
+	while ((token = strsep(&p, ",")) != NULL) {			\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
 			goto end;					\
-- 
2.47.3

Re: [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > strsep() clobbers the passed pointer, so we need a separate variable to be
 > able to correctly kfree() the memory at the end.

 > Detected by kmemleak:
 > unreferenced object 0xffffff80038f9098 (size 8):
 >   comm "audio.hook", pid 323, jiffies 4294896085
 >   hex dump (first 8 bytes):
 >     34 38 30 30 30 0a 00 cc                          48000...
 >   backtrace (crc 503efa75):
 >     kmemleak_alloc+0x30/0x40
 >     __kmalloc_node_track_caller_noprof+0x240/0x3d0
 >     kstrdup+0x44/0x90
 >     f_uac2_opts_c_srate_store+0x13c/0x200
 >     configfs_write_iter+0x238/0x360
 >     vfs_write+0x4a4/0xd00
 >     ksys_write+0xf4/0x1e0
 >     __arm64_sys_write+0x68/0xa0
 >     invoke_syscall.constprop.0+0xa4/0x260
 >     do_el0_svc+0xc0/0x1c0
 >     el0_svc+0x20/0x60
 >     el0t_64_sync_handler+0x118/0x130
 >     el0t_64_sync+0x14c/0x150

 > Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

FYI, I see the same issue is also fixed in the recently proposed
"[PATCH] usb: gadget: uac: validate rate list length before storing"

https://lore.kernel.org/linux-usb/20260519143319.147494-1-a0yami@mailbox.org/


> ---
 >  drivers/usb/gadget/function/f_uac2.c | 6 +++---
 >  1 file changed, 3 insertions(+), 3 deletions(-)

 > diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
 > index 897787d0803c1..0c2a8afccbb69 100644
 > --- a/drivers/usb/gadget/function/f_uac2.c
 > +++ b/drivers/usb/gadget/function/f_uac2.c
 > @@ -2012,7 +2012,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 >  					  const char *page, size_t len)	\
 >  {									\
 >  	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
 > -	char *split_page = NULL;					\
 > +	char *p, *split_page = NULL;					\
 >  	int ret = -EINVAL;						\
 >  	char *token;							\
 >  	u32 num;							\
 > @@ -2026,8 +2026,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 >  									\
 >  	i = 0;								\
 >  	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 > -	split_page = kstrdup(page, GFP_KERNEL);				\
 > -	while ((token = strsep(&split_page, ",")) != NULL) {		\
 > +	split_page = p = kstrdup(page, GFP_KERNEL);			\
 > +	while ((token = strsep(&p, ",")) != NULL) {			\
 >  		ret = kstrtou32(token, 0, &num);			\
 >  		if (ret)						\
 >  			goto end;					\
 > -- 

 > 2.47.3



-- 
Bye, Peter Korsgaard

Re: [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store

[Ming Qing]

On Sun, Jun 14, 2026 at 5:39 PM +0800, Peter Korsgaard wrote:
> FYI, I see the same issue is also fixed in the recently proposed
> "[PATCH] usb: gadget: uac: validate rate list length before storing"
> 
> https://lore.kernel.org/linux-usb/20260519143319.147494-1-a0yami@mailbox.org/

Yes, that includes the same buffer lifetime fix. I'm happy to split it up if that makes it easier to pick.

Re: [PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store

[Greg KH]

On Mon, Jun 15, 2026 at 06:52:01PM +0800, Ming Qing wrote:
> On Sun, Jun 14, 2026 at 5:39 PM +0800, Peter Korsgaard wrote:
> > FYI, I see the same issue is also fixed in the recently proposed
> > "[PATCH] usb: gadget: uac: validate rate list length before storing"
> > 
> > https://lore.kernel.org/linux-usb/20260519143319.147494-1-a0yami@mailbox.org/
> 
> Yes, that includes the same buffer lifetime fix. I'm happy to split it up if that makes it easier to pick.
> 

Please do, I just took that one now and this series does not apply.

thanks,

greg k-h