For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] Fix invalid-free in f_uac1_opts_c_srate_store
Author: subasris1210@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git 5d5fd841c34649f1b09220fe58e59dffd61c447d
Signed-off-by: Subasri S <subasris1210@gmail.com>
---
drivers/usb/gadget/function/f_uac1.c | 4 +++-
drivers/usb/gadget/function/f_uac2.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 85c502e98f57..488c59fdb2bf 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -1595,6 +1595,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
{ \
struct f_uac1_opts *opts = to_f_uac1_opts(item); \
char *split_page = NULL; \
+ char *original_split_page = NULL; \
int ret = -EINVAL; \
char *token; \
u32 num; \
@@ -1609,6 +1610,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
i = 0; \
memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
split_page = kstrdup(page, GFP_KERNEL); \
+ original_split_page = split_page; \
while ((token = strsep(&split_page, ",")) != NULL) { \
ret = kstrtou32(token, 0, &num); \
if (ret) \
@@ -1619,7 +1621,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \
}; \
\
end: \
- kfree(split_page); \
+ kfree(original_split_page); \
mutex_unlock(&opts->lock); \
return ret; \
} \
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c..a0b52c262ad8 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
{ \
struct f_uac2_opts *opts = to_f_uac2_opts(item); \
char *split_page = NULL; \
+ char *original_split_page = NULL; \
int ret = -EINVAL; \
char *token; \
u32 num; \
@@ -2027,6 +2028,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
i = 0; \
memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
split_page = kstrdup(page, GFP_KERNEL); \
+ original_split_page = split_page; \
while ((token = strsep(&split_page, ",")) != NULL) { \
ret = kstrtou32(token, 0, &num); \
if (ret) \
@@ -2037,7 +2039,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
}; \
\
end: \
- kfree(split_page); \
+ kfree(original_split_page); \
mutex_unlock(&opts->lock); \
return ret; \
} \
--
2.43.0