[PATCH] usb: gadget: f_uac1/f_uac2: fix invalid-free and memory leak in sampling rate store

strsep() modifies the pointer passed to it, advancing it past each
delimiter. In f_uac1.c, in the UAC1_RATE_ATTRIBUTE macro,
it advances the 'split_page' pointer past the ","
between the sampling rates. This causes two bugs:

On the error path: if kstrtou32() fails while parsing (possibly due
to a garbage value passed to it), the goto jumps to 'end' where kfree()
is called on 'split_page', which now points into the middle of the
'split_page' pointer instead of its start, causing an invalid-free.

On the success path: when strsep() exhausts the string it sets
'split_page' to NULL, so the kfree() at 'end' becomes a no-op,
silently leaking the kstrdup allocation on every successful write.

Save the return value of kstrdup into 'dup_page' before the strsep
loop and always free that instead. This fixes both the invalid-free
on the error path and the memory leak on the success path.

Apply the same fix to the identical UAC2_RATE_ATTRIBUTE macro in
f_uac2.c.

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=2532c7901f590afd0c3a
Tested-by: [email protected]
Fixes: 695d39ffc2b5 ("usb: gadget: f_uac1: Support multiple sampling rates")
Signed-off-by: Subasri S <[email protected]>
---
 drivers/usb/gadget/function/f_uac1.c | 4 +++-
 drivers/usb/gadget/function/f_uac2.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 85c502e98f57..07c33dbce3be 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -1595,6 +1595,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 {									\
 	struct f_uac1_opts *opts = to_f_uac1_opts(item);		\
 	char *split_page = NULL;					\
+	char *dup_page = NULL;				\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -1609,6 +1610,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 	split_page = kstrdup(page, GFP_KERNEL);				\
+	dup_page = split_page;				\
 	while ((token = strsep(&split_page, ",")) != NULL) {		\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
@@ -1619,7 +1621,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 	};								\
 									\
 end:									\
-	kfree(split_page);						\
+	kfree(dup_page);					\
 	mutex_unlock(&opts->lock);					\
 	return ret;							\
 }									\
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c..2292c72f3843 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 {									\
 	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
 	char *split_page = NULL;					\
+	char *dup_page = NULL;				\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -2027,6 +2028,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 	split_page = kstrdup(page, GFP_KERNEL);				\
+	dup_page = split_page;				\
 	while ((token = strsep(&split_page, ",")) != NULL) {		\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
@@ -2037,7 +2039,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 	};								\
 									\
 end:									\
-	kfree(split_page);						\
+	kfree(dup_page);					\
 	mutex_unlock(&opts->lock);					\
 	return ret;							\
 }									\

---
base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
change-id: 20260802-usb-f_uac1-fabdd3e688bd

Best regards,
-- 
Subasri S <[email protected]>