[PATCH 1/2] usb: gadget: f_uac2: fix memory leak in UAC2_RATE_ATTRIBUTE store

[Peter Korsgaard]

strsep() clobbers the passed pointer, so we need a separate variable to be
able to correctly kfree() the memory at the end.

Detected by kmemleak:
unreferenced object 0xffffff80038f9098 (size 8):
  comm "audio.hook", pid 323, jiffies 4294896085
  hex dump (first 8 bytes):
    34 38 30 30 30 0a 00 cc                          48000...
  backtrace (crc 503efa75):
    kmemleak_alloc+0x30/0x40
    __kmalloc_node_track_caller_noprof+0x240/0x3d0
    kstrdup+0x44/0x90
    f_uac2_opts_c_srate_store+0x13c/0x200
    configfs_write_iter+0x238/0x360
    vfs_write+0x4a4/0xd00
    ksys_write+0xf4/0x1e0
    __arm64_sys_write+0x68/0xa0
    invoke_syscall.constprop.0+0xa4/0x260
    do_el0_svc+0xc0/0x1c0
    el0_svc+0x20/0x60
    el0t_64_sync_handler+0x118/0x130
    el0t_64_sync+0x14c/0x150

Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
Signed-off-by: Peter Korsgaard <peter@xxxxxxxxxxxxx>
---
 drivers/usb/gadget/function/f_uac2.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c1..0c2a8afccbb69 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2012,7 +2012,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 					  const char *page, size_t len)	\
 {									\
 	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
-	char *split_page = NULL;					\
+	char *p, *split_page = NULL;					\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -2026,8 +2026,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 									\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
-	split_page = kstrdup(page, GFP_KERNEL);				\
-	while ((token = strsep(&split_page, ",")) != NULL) {		\
+	split_page = p = kstrdup(page, GFP_KERNEL);			\
+	while ((token = strsep(&p, ",")) != NULL) {			\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
 			goto end;					\
-- 
2.47.3