[PATCH 1/2] usb: gadget: f_uac2: fix invalid-free in srate configfs store

From: Anuj Bolewar <[email protected]>

The store path for the p_srate/c_srate attributes calls kfree() on
split_page after it has been advanced by strsep(). When the first
token fails to parse, strsep() leaves split_page pointing into the
middle of the kstrdup()'d buffer and the subsequent kfree() triggers
a KASAN invalid-free.

Keep the original pointer returned by kstrdup() and free that
instead.

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=38bab69d2760cc99cfbe
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=a4f65284f1451010b0a8
Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
Assisted-by: deepseek:v4-pro
Signed-off-by: Anuj Bolewar <[email protected]>
---
 drivers/usb/gadget/function/f_uac2.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803..1ea1bedef9a 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 {									\
 	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
 	char *split_page = NULL;					\
+	char *split_page_orig = NULL;					\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -2026,7 +2027,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 									\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
-	split_page = kstrdup(page, GFP_KERNEL);				\
+	split_page_orig = split_page = kstrdup(page, GFP_KERNEL);      \
 	while ((token = strsep(&split_page, ",")) != NULL) {		\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
@@ -2037,7 +2038,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 	};								\
 									\
 end:									\
-	kfree(split_page);						\
+	kfree(split_page_orig);						\
 	mutex_unlock(&opts->lock);					\
 	return ret;							\
 }									\

-- 
2.53.0