usb: gadget: f_uac1: fix memory leak in f_uac1_opts_*_store
PATCH 1/1 usb: gadget: f_uac1: fix memory leak in f_uac1_opts_*_store
f_uac1_opts_*_store() duplicates the page given as parameter using kstrdup(). It parses the duplicate (stored as split_page) using strsep(). Upon completion, it frees split_page.
strsep() mutates the string given as parameter (split_page in this case). When it is fully parsed it becomes NULL. Instead, if an error arises, split_page will be a pointer somewhere in the string. In both cases, kfree() is called and the original memory is not freed.
Fix this by creating a copy of the original pointer and passing that to kfree() instead.
Fixes 695d39ffc2b59 ("usb: gadget: f_uac1: Support multiple sampling rates")
Reported-by [email protected]
Signed-off-by Robert-Andrei Mercea <[email protected]>
--- drivers/usb/gadget/function/f_uac1.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_uac1.c +4 -1
@@ -1595,6 +1595,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \ { \struct f_uac1_opts *opts =to_f_uac1_opts (item); \char *split_page =NULL ; \ +char *split_page_orig =NULL ; \int ret = -EINVAL ; \char *token; \u32 num; \
@@ -1609,6 +1610,8 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \ i =0 ; \ memset(opts->name##s, 0x00, sizeof(opts->name##s)); \ split_page = kstrdup(page, GFP_KERNEL); \ + \ + split_page_orig = split_page; \ while ((token = strsep(&split_page, ",")) != NULL) { \ ret = kstrtou32(token, 0, &num); \ if (ret) \
@@ -1619,7 +1622,7 @@ static ssize_t f_uac1_opts_##name##_store(struct config_item *item, \ }; \ \ end: \ -kfree (split_page); \ +kfree (split_page_orig); \mutex_unlock (&opts->lock); \return ret; \ } \
Signature · 1 line
2.55.0