From: Robert-Andrei Mercea <robertandreimercea@gmail.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Kuen-Han Tsai <khtsai@google.com>,
	Al Viro <viro@zeniv.linux.org.uk>,
	Xu Yang <xu.yang_2@nxp.com>,
	linux-usb@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Robert-Andrei Mercea <robertandreimercea@gmail.com>,
	syzbot+7cc26dd73231714cecd4@syzkaller.appspotmail.com
Subject: [PATCH] usb: gadget: f_uac1: fix memory leak in f_uac1_opts_*_store
Date: Thu,  6 Aug 2026 16:21:02 +0300
Message-ID: <20260806132102.88183-1-robertandreimercea@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

f_uac1_opts_*_store() duplicates the page given as parameter using
kstrdup(). It parses the duplicate (stored as split_page) using
strsep(). Upon completion, it frees split_page.

strsep() mutates the string given as parameter (split_page in this
case). When it is fully parsed it becomes NULL. Instead, if an error
arises, split_page will be a pointer somewhere in the string. In both
cases, kfree() is called and the original memory is not freed.

Fix this by creating a copy of the original pointer and passing that to
kfree() instead.

Fixes: 695d39ffc2b59 ("usb: gadget: f_uac1: Support multiple sampling rates")
Reported-by: syzbot+7cc26dd73231714cecd4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7cc26dd73231714cecd4
Signed-off-by: Robert-Andrei Mercea <robertandreimercea@gmail.com>
---
 drivers/usb/gadget/function/f_uac1.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 85c502e98f57..ce399e4b80c4 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -1595,6 +1595,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 {									\
 	struct f_uac1_opts *opts = to_f_uac1_opts(item);		\
 	char *split_page = NULL;					\
+	char *split_page_orig = NULL;					\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -1609,6 +1610,8 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 	split_page = kstrdup(page, GFP_KERNEL);				\
+									\
+	split_page_orig = split_page;					\
 	while ((token = strsep(&split_page, ",")) != NULL) {		\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
@@ -1619,7 +1622,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item,	\
 	};								\
 									\
 end:									\
-	kfree(split_page);						\
+	kfree(split_page_orig);						\
 	mutex_unlock(&opts->lock);					\
 	return ret;							\
 }									\
-- 
2.55.0