kernel/linux.git/drivers/usb/class/usblp.c, branch linux-7.0.y

usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

2026-05-14T13:31:04+00:00

commit b38e53cbfb9d84732e5984fbd73e128d592415c5 upstream. Just like in a previous problem in this driver, usblp_ctrl_msg() will collapse the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred. Ideally that short command should be detected and error out, but many printers are known to send "incorrect" responses back so we can't just do that. statusbuf is kmalloc(8) at probe time and never filled before the first LPGETSTATUS ioctl. usblp_read_status() requests 1 byte. If a malicious printer responds with zero bytes, *statusbuf is one byte of stale kmalloc heap, sign-extended into the local int status, which the LPGETSTATUS path then copy_to_user()s directly to the ioctl caller. Fix this all by just zapping out the memory buffer when allocated at probe time. If a later call does a short read, the data will be identical to what the device sent it the last time, so there is no "leak" of information happening. Cc: Pete Zaitcev Assisted-by: gkh_clanker_t1000 Cc: stable Link: https://patch.msgid.link/2026042011-shredder-savage-48c6@gregkh Signed-off-by: Greg Kroah-Hartman

usb: usblp: fix heap leak in IEEE 1284 device ID via short response

2026-05-14T13:31:04+00:00

commit 7a400c6fe3617e31e690e3f7ca37bb335e0498f3 upstream. usblp_ctrl_msg() collapses the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred. A broken printer can complete the GET_DEVICE_ID control transfer short and the driver has no way to know. usblp_cache_device_id_string() reads the 2-byte big-endian length prefix from the response and trusts it (clamped only to the buffer bounds). The buffer is kmalloc(1024) at probe time. A device that sends exactly two bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves device_id_string[2..1022] holding stale kmalloc heap. That stale data is then exposed: - via the ieee1284_id sysfs attribute (sprintf("%s", buf+2), truncated at the first NUL in the stale heap), and - via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full claimed length regardless of NULs, up to 1021 bytes of uninitialized heap, with the leak size chosen by the device. Fix this up by just zapping the buffer with zeros before each request sent to the device. Cc: Pete Zaitcev Assisted-by: gkh_clanker_t1000 Cc: stable Link: https://patch.msgid.link/2026042002-unicorn-greedily-3c63@gregkh Signed-off-by: Greg Kroah-Hartman

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

usb: usblp: Use min_t() to improve usblp_read()

2025-09-06T13:20:22+00:00

Use min_t() to improve usblp_read() and avoid calculating 'avail - usblp->readcount' twice. Use min_t(ssize_t,,) instead of min() to avoid a signedness error. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250829173713.56222-1-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman

usb: usblp: clean up assignment inside if conditions

2025-07-21T14:30:54+00:00

This patch cleans up a few cases where assignments were made inside of if conditions, like if ((rv = func()) < 0) into two lines, to improve readability and be more in-line with Linux kernel coding style. It also cleans up checkpatch warnings like: ERROR: do not use assignment in if condition No functional change, just a style and maintainability fix. Signed-off-by: Darshan Rathod Link: https://lore.kernel.org/r/20250718091045.264129-1-darshan.rathod@siqol.com Signed-off-by: Greg Kroah-Hartman

Merge 6.13-rc7 into usb-next

2025-01-13T05:11:06+00:00

We need the USB fixes in here as well for testing. Signed-off-by: Greg Kroah-Hartman

USB: usblp: return error when setting unsupported protocol

2024-12-23T17:50:41+00:00

Fix the regression introduced by commit d8c6edfa3f4e ("USB: usblp: don't call usb_set_interface if there's a single alt"), which causes that unsupported protocols can also be set via ioctl when the num_altsetting of the device is 1. Move the check for protocol support to the earlier stage. Fixes: d8c6edfa3f4e ("USB: usblp: don't call usb_set_interface if there's a single alt") Cc: stable Signed-off-by: Jun Yan Link: https://lore.kernel.org/r/20241212143852.671889-1-jerrysteve1101@gmail.com Signed-off-by: Greg Kroah-Hartman

USB: usblp: remove redundant semicolon

2024-12-23T17:40:39+00:00

remove redundant semicolon in LPIOC_SOFT_RESET to fix the incorrect macro expansion syntax. Signed-off-by: Jun Yan Link: https://lore.kernel.org/r/20241213145314.785616-1-jerrysteve1101@gmail.com Signed-off-by: Greg Kroah-Hartman

USB: make devnode() callback in usb_class_driver take a const *

2022-10-20T10:11:56+00:00

With the changes to the driver core to make more pointers const, the USB subsystem also needs to be modified to take a const * for the devnode callback so that the driver core's constant pointer will also be properly propagated. Cc: Benjamin Tissoires Cc: Juergen Stuber Reviewed-by: Johan Hovold Acked-by: Pete Zaitcev Reviewed-by: Jiri Kosina Link: https://lore.kernel.org/r/20221001165128.2688526-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman