[PATCH] usb: gadget: f_uac2: fix memory leak in sample rate parsing

[Chaithanya Lagisetty]

The UAC2_ATTRIBUTE store macro duplicates the input string with
kstrdup() and then tokenises the copy with strsep(). strsep() advances
the pointer it is given, so once the string has been fully consumed that
pointer is NULL and no longer refers to the start of the allocation. The
macro passed the same pointer to both strsep() and the final kfree(), so
kfree() was called on NULL (or a mid-buffer address) and the buffer
returned by kstrdup() was leaked on every write to attributes such as
p_srate and c_srate.

Keep the pointer returned by kstrdup() in a stable variable used for
kfree() and iterate with a separate cursor passed to strsep().

Fixes: a7339e4f5788 ("usb: gadget: f_uac2: Support multiple sampling rates")
Reported-by: syzbot+87c10526d2cfa8d14ff6@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=87c10526d2cfa8d14ff6
Signed-off-by: Chaithanya Lagisetty <nagachaithanya9911@xxxxxxxxx>
---
 drivers/usb/gadget/function/f_uac2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 897787d0803c..2cbdaf6a7db9 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -2013,6 +2013,7 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 {									\
 	struct f_uac2_opts *opts = to_f_uac2_opts(item);		\
 	char *split_page = NULL;					\
+	char *iter = NULL;						\
 	int ret = -EINVAL;						\
 	char *token;							\
 	u32 num;							\
@@ -2027,7 +2028,8 @@ static ssize_t f_uac2_opts_##name##_store(struct config_item *item,	\
 	i = 0;								\
 	memset(opts->name##s, 0x00, sizeof(opts->name##s));		\
 	split_page = kstrdup(page, GFP_KERNEL);				\
-	while ((token = strsep(&split_page, ",")) != NULL) {		\
+	iter = split_page;						\
+	while ((token = strsep(&iter, ",")) != NULL) {			\
 		ret = kstrtou32(token, 0, &num);			\
 		if (ret)						\
 			goto end;					\
-- 
2.43.0