[PATCH 2/2] usb: gadget: f_uac1: fix invalid-free in srate configfs store
Anuj Bolewar via B4 Relay <devnull+bolewara.gmail.com-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
| Newsgroups | gmane.linux.usb.general,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Anuj Bolewar <[email protected]> Same bug as f_uac2: the store path for the p_srate/c_srate attributes frees split_page after strsep() has advanced it into the middle of the kstrdup()'d buffer. A non-numeric first token makes kstrtou32() fail and kfree() is called on a pointer into the slab object, triggering a KASAN invalid-free. Keep the original pointer returned by kstrdup() and free that instead. Reported-by: syzbot+2532c7901f590afd0c3a-Pl5Pbv+GP7P466ipTTIvnc23WoclnBCfAL8bYrjMMd8@public.gmane.org Closes: https://syzkaller.appspot.com/bug?extid=2532c7901f590afd0c3a Fixes: 695d39ffc2b5 ("usb: gadget: f_uac1: Support multiple sampling rates") Assisted-by: deepseek:v4-pro Signed-off-by: Anuj Bolewar <[email protected]> --- drivers/usb/gadget/function/f_uac1.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c index 85c502e98f5..94c716d72c6 100644 --- a/drivers/usb/gadget/function/f_uac1.c +++ b/drivers/usb/gadget/function/f_uac1.c @@ -1595,6 +1595,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \ { \ struct f_uac1_opts *opts = to_f_uac1_opts(item); \ char *split_page = NULL; \ + char *split_page_orig = NULL; \ int ret = -EINVAL; \ char *token; \ u32 num; \ @@ -1608,7 +1609,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \ \ i = 0; \ memset(opts->name##s, 0x00, sizeof(opts->name##s)); \ - split_page = kstrdup(page, GFP_KERNEL); \ + split_page_orig = split_page = kstrdup(page, GFP_KERNEL); \ while ((token = strsep(&split_page, ",")) != NULL) { \ ret = kstrtou32(token, 0, &num); \ if (ret) \ @@ -1619,7 +1620,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \ }; \ \ end: \ - kfree(split_page); \ + kfree(split_page_orig); \ mutex_unlock(&opts->lock); \ return ret; \ } \ -- 2.53.0