[PATCH 1/2] usb: gadget: f_uac2: fix invalid-free in srate configfs store
Anuj Bolewar via B4 Relay <devnull+bolewara.gmail.com-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
| Newsgroups | gmane.linux.usb.general,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Anuj Bolewar <[email protected]> The store path for the p_srate/c_srate attributes calls kfree() on split_page after it has been advanced by strsep(). When the first token fails to parse, strsep() leaves split_page pointing into the middle of the kstrdup()'d buffer and the subsequent kfree() triggers a KASAN invalid-free. Keep the original pointer returned by kstrdup() and free that instead. Reported-by: syzbot+38bab69d2760cc99cfbe-Pl5Pbv+GP7P466ipTTIvnc23WoclnBCfAL8bYrjMMd8@public.gmane.org Closes: https://syzkaller.appspot.com/bug?extid=38bab69d2760cc99cfbe Reported-by: syzbot+a4f65284f1451010b0a8-Pl5Pbv+GP7P466ipTTIvnc23WoclnBCfAL8bYrjMMd8@public.gmane.org Closes: https://syzkaller.appspot.com/bug?extid=a4f65284f1451010b0a8 Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates") Assisted-by: deepseek:v4-pro Signed-off-by: Anuj Bolewar <[email protected]> --- drivers/usb/gadget/function/f_uac2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c index 897787d0803..1ea1bedef9a 100644 --- a/drivers/usb/gadget/function/f_uac2.c +++ b/drivers/usb/gadget/function/f_uac2.c @@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \ { \ struct f_uac2_opts *opts = to_f_uac2_opts(item); \ char *split_page = NULL; \ + char *split_page_orig = NULL; \ int ret = -EINVAL; \ char *token; \ u32 num; \ @@ -2026,7 +2027,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \ \ i = 0; \ memset(opts->name##s, 0x00, sizeof(opts->name##s)); \ - split_page = kstrdup(page, GFP_KERNEL); \ + split_page_orig = split_page = kstrdup(page, GFP_KERNEL); \ while ((token = strsep(&split_page, ",")) != NULL) { \ ret = kstrtou32(token, 0, &num); \ if (ret) \ @@ -2037,7 +2038,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item, \ }; \ \ end: \ - kfree(split_page); \ + kfree(split_page_orig); \ mutex_unlock(&opts->lock); \ return ret; \ } \ -- 2.53.0