From nobody Fri Oct 2 11:42:26 2026 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E78CA18871F for ; Sun, 2 Aug 2026 03:30:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785641436; cv=none; b=Md0yH+GqVgKqBt3LfOgAjVKgEWDyWWLRkglJrjk9Y9tNkbpxBgnMvPQmkb4hrkCo1zdTTFxdH5XFbVf/p3Cs1/g6RAog2RsvJoWWoJPpcjjHnSS7TOB5BUaq9ho2775W0qqZuOOe7U0a1js5csY74pfi+AUtk4AKnUXNO7h18YM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785641436; c=relaxed/simple; bh=QZaiviFXIpFOU6xrt4pohFGuFmFnFNWk4lMFpZyHZPg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=B3ih0KwrmcnzLPK1wISe4/jrRve84wUPWdNBrF/4uIM43SzNL+KNAUky37jXHpkgHYf2MwxsiNgfR6cwqnRROk7ssk3UyQkg6k1J5AdywQGBA/b0y1TCIHdkXk0JewSA7y0Vg7UybPCXnbHy3zs/3Xjp7cu8f1REMqK7L1wrzVY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oazx74BQ; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oazx74BQ" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4954a2e73a9so5950755e9.3 for ; Sat, 01 Aug 2026 20:30:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785641433; x=1786246233; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=5getTzD0IVo0TFYhF1w5tTOZvncb1cQf4iioeWqGs5Y=; b=oazx74BQ5ljVYFxE5ay4CDYSl+BifQzmkdGHWprgszYz6Kij1gUD3iBg9VNiDSLA7z 6GmEzqbEndXioOCOzs8M24m00sBVUdU1+HO4NbSNbKT8jwMDfy/W7rj83HNZlC+8FLVX AfMQyQVB75Ir6YfCMKtqXNVVB/DKIB5DW5sHgBcHbAvpLfx8cElgpEIEd5VZwjahRIPb 3v/cwYaZ4iYtSCeYQlQUl/hInKN2WRXIPl63oap3Ej1PMfmB4XTXaXhu4Si/St/etfPF R3s/dg51bY1HJKBxxHMCVQOwtjS7AfIXZzwzj6rF7lvYzWMozokBowBevJrXRMFXDgCJ YYrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785641433; x=1786246233; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=5getTzD0IVo0TFYhF1w5tTOZvncb1cQf4iioeWqGs5Y=; b=Y38cA6tWgtGyc2ViBELbZopwondjcPBf04gWzlCc0xXf2Z0Kx3h5wAy7Gv0eLpp3Pf 0+wryMLxrLkUQfnpDK+qMyEbhsHTEyympyEUSkZNeqzsExHaKM/JJkIJYM2pwk0LY6UC 6wrk2IsZzGrLQa+ZhjygF1VuvUpHIZ2z08z8gs7/0Y7v07rE6gi9NagN2i/KbxbW9q9/ q8mBetM5AtU3gtPsDICvIgmV2BvSFVKBQC/oKnb+hkG4gpMhElUKmuwumJmoX40zXPmN lsmTkQzDh+sASubAvbFlP//1jvgrP3syE2jIb+G3WDxJ45K2nUBY8rgjeDRhFrrxpH0e tfaA== X-Forwarded-Encrypted: i=1; AHgh+Rpi8yWG6IPvVvtMe8Z9jR7z8DULtVHJJecMtX0WJX42F/Bv20AbevOZacuaZEzPvEj6sCHiLqvYvttWAx0=@vger.kernel.org X-Gm-Message-State: AOJu0Yy6TLjJSrCzzicR0yZ3nbhbG/jYCnQQ5cX5rsmFp2pkub93naRY Nv5R7r70Gph7i8kt3HV/IwH/+q2FqQSVm9N3PvH/z9ZtkxMt9hRE6+gl X-Gm-Gg: AR+sD10htl3aRAo0YF6A4SgBUozBixjrgsgC+v7uaAUtwJe4xTGCs1iZbd4iuyzWRn3 oM/hoeTLYy1vMoT9doyUzqZof60HH01DeS98qR3fUZG04CwCILAXTV+HHppF397Hm+m2zSO850u 6euYMH+qK56KCzH0ddIZQHqtPN7gx0+JwNtjB0L3LtJhz3axXtXHRAMHrrMqbfGvFhDeIuwJUSO s1O7HlPJajhvTYeoF3FDgC/XbL7ZE5r2aYyxrcZzsPdSbJH9fbtyJKUBkmZ+9u+oXIRGCmlAwlY gTyS//psdM3JvyQTSy1pURvsS+ZRih4uZSA+NN+SWlaXTsyaw1p4A5G49K6lmv3gkTV852WLvkw ne378yIKBd5mG8b/6JAEX8BAcjgIwCz6dY+uHnNdIXN+jEHAmVJqlBVnVcXbdg42tSHrFLkV4y6 MtQ+A1tl+W+MnBx27TraW3h2rXjonZiwwTkAjf5wQMGrh89kpphNf3QYiuFEW1khD/jWi4kLZ7t YC6lagh72wFfiTg3nIKNr67+ImAN0RsjSPcDKutmLnoHs1w8hGqE3l+kFQOCFPG2PC90+8Hsprb SyC6Kk6Vs0gz0BXz83pmffAgZ0NVS2z81wXoKYyP6lgTlWWd9awofqM= X-Received: by 2002:a05:600c:4795:b0:495:5d5b:7533 with SMTP id 5b1f17b1804b1-4980c65b84bmr53485235e9.13.1785641433009; Sat, 01 Aug 2026 20:30:33 -0700 (PDT) Received: from riacini.speedport.ip (p200300fcd73d5b95e8f13abce6faaab2.dip0.t-ipconnect.de. [2003:fc:d73d:5b95:e8f1:3abc:e6fa:aab2]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49808191be8sm159659035e9.2.2026.08.01.20.30.31 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 01 Aug 2026 20:30:32 -0700 (PDT) From: Rituparna Warwatkar To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Rituparna Warwatkar , syzbot+ebd045a6645cfb713c95@syzkaller.appspotmail.com Subject: [PATCH] usb: gadget: f_uac2: fix memory leak in sample rate store Date: Sun, 2 Aug 2026 05:29:59 +0200 Message-ID: <20260802032959.98815-1-rwarwatkar@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" f_uac2_opts_{p,c}_srate_store() duplicate the input page with kstrdup() and then tokenize it with strsep(&split_page, ","). strsep() advances the pointer it is given, so by the time the parsing loop finishes split_page points at the end of the string (or NULL). The subsequent kfree(split_page) therefore frees the wrong pointer (NULL when the whole buffer was consumed), leaking the buffer allocated by kstrdup(): BUG: memory leak unreferenced object 0xffff888112a01e00 (size 64): kstrdup f_uac2_opts_c_srate_store configfs_write_iter vfs_write ksys_write Keep the original allocation in split_page and hand a separate iterator to strsep(), so the buffer is always freed. While at it, handle a kstrdup() failure instead of dereferencing NULL. Both the p_srate and c_srate attributes use the same macro and are fixed together. Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates") Reported-by: syzbot+ebd045a6645cfb713c95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Debd045a6645cfb713c95 Signed-off-by: Rituparna Warwatkar --- drivers/usb/gadget/function/f_uac2.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/func= tion/f_uac2.c index 897787d0803..8facf289710 100644 --- a/drivers/usb/gadget/function/f_uac2.c +++ b/drivers/usb/gadget/function/f_uac2.c @@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct conf= ig_item *item, \ { \ struct f_uac2_opts *opts =3D to_f_uac2_opts(item); \ char *split_page =3D NULL; \ + char *rest; \ int ret =3D -EINVAL; \ char *token; \ u32 num; \ @@ -2027,7 +2028,12 @@ static ssize_t f_uac2_opts_##name##_store(struct con= fig_item *item, \ i =3D 0; \ memset(opts->name##s, 0x00, sizeof(opts->name##s)); \ split_page =3D kstrdup(page, GFP_KERNEL); \ - while ((token =3D strsep(&split_page, ",")) !=3D NULL) { = \ + if (!split_page) { \ + ret =3D -ENOMEM; \ + goto end; \ + } \ + rest =3D split_page; \ + while ((token =3D strsep(&rest, ",")) !=3D NULL) { = \ ret =3D kstrtou32(token, 0, &num); \ if (ret) \ goto end; \ -- 2.47.3