For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] usb: gadget: f_uac2: Fix memory leak in srate parsing
Author: ryan.mehri1@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fc02acf6ac0c
Signed-off-by: Ryan Mehri <ryan.mehri1@gmail.com>
---
drivers/usb/gadget/function/f_uac2.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c..5d6701019e10 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
{ \
struct f_uac2_opts *opts = to_f_uac2_opts(item); \
char *split_page = NULL; \
+ char *p = NULL; \
int ret = -EINVAL; \
char *token; \
u32 num; \
@@ -2026,8 +2027,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \
\
i = 0; \
memset(opts->name##s, 0x00, sizeof(opts->name##s)); \
- split_page = kstrdup(page, GFP_KERNEL); \
- while ((token = strsep(&split_page, ",")) != NULL) { \
+ split_page = p = kstrdup(page, GFP_KERNEL); \
+ while ((token = strsep(&p, ",")) != NULL) { \
ret = kstrtou32(token, 0, &num); \
if (ret) \
goto end; \
--
2.55.0