kernel/linux.git/drivers/usb/gadget/function/f_printer.c, branch v6.1.186

usb: gadget: printer: fix infinite loop in printer_read()

2026-08-19T15:15:57+00:00

commit c2e819be6a5c7f34344926b4bd7e3dfca58cf48a upstream. printer_read() uses the same variable for the requested copy size and the number of bytes actually copied to user space. copy_to_user() returns the number of bytes not copied, so when it fails to copy anything, the computed copied length becomes zero. In that case len, buf, current_rx_bytes and current_rx_buf are left unchanged. If RX data is available and the user buffer remains unwritable, the read loop can repeat indefinitely. Track the copied length separately and return -EFAULT, or the number of bytes already copied, if an iteration makes no progress. Fixes: b185f01a9ab7 ("usb: gadget: printer: factor out f_printer") Cc: stable Reviewed-by: Peter Chen Signed-off-by: Melbin K Mathew Link: https://patch.msgid.link/20260709205622.55700-1-mlbnkm1@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: printer: fix races against disable

2024-07-05T07:31:54+00:00

commit e587a7633dfee8987a999cf253f7c52a8e09276c upstream. printer_read() and printer_write() guard against the race against disable() by checking the dev->interface flag, which in turn is guarded by a spinlock. These functions, however, drop the lock on multiple occasions. This means that the test has to be redone after reacquiring the lock and before doing IO. Add the tests. This also addresses CVE-2024-25741 Fixes: 7f2ca14d2f9b9 ("usb: gadget: function: printer: Interface is disabled and returns error") Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20240620114039.5767-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: printer: SS+ support

2024-07-05T07:31:54+00:00

commit fd80731e5e9d1402cb2f85022a6abf9b1982ec5f upstream. We need to treat super speed plus as super speed, not the default, which is full speed. Signed-off-by: Oliver Neukum Cc: stable Link: https://lore.kernel.org/r/20240620093800.28901-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API

2024-06-27T11:46:17+00:00

[ Upstream commit 920e7522e3bab5ebc2fb0cc1a034f4470c87fa97 ] ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove(). Note that the upper limit of ida_simple_get() is exclusive, but the one of ida_alloc_max() is inclusive. So a -1 has been added when needed. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/7cd361e2b377a5373968fa7deee4169229992a1e.1713107386.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: gadget: function: fix dangling pnp_string in f_printer.c

2022-09-22T13:52:29+00:00

When opts->pnp_string is changed with configfs, new memory is allocated for the string. It does not, however, update dev->pnp_string, even though the memory is freed. When rquesting the string, the host then gets old or corrupted data rather than the new string. The ieee 1284 id string should be allowed to change while the device is connected. The bug was introduced in commit fdc01cc286be ("usb: gadget: printer: Remove pnp_string static buffer"), which changed opts->pnp_string from a char[] to a char*. This patch changes dev->pnp_string from a char* to a char** pointing to opts->pnp_string. Fixes: fdc01cc286be ("usb: gadget: printer: Remove pnp_string static buffer") Signed-off-by: Albert Briscoe Link: https://lore.kernel.org/r/20220911223753.20417-1-albertsbriscoe@gmail.com Signed-off-by: Greg Kroah-Hartman

Merge tag 'v5.13-rc6' into usb-next

2021-06-14T07:18:07+00:00

We want the usb fixes in here as well, and this resolves some merge issues with: drivers/usb/dwc3/debugfs.c drivers/usb/dwc3/gadget.c Signed-off-by: Greg Kroah-Hartman

usb: gadget: function: printer: use list_move instead of list_del/list_add

2021-06-09T09:11:30+00:00

Using list_move() instead of list_del() + list_add(). Reported-by: Hulk Robot Signed-off-by: Baokun Li Link: https://lore.kernel.org/r/20210609070612.1325044-1-libaokun1@huawei.com Signed-off-by: Greg Kroah-Hartman

usb: fix various gadgets null ptr deref on 10gbps cabling.

2021-06-09T08:37:13+00:00

This avoids a null pointer dereference in f_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm} by simply reusing the 5gbps config for 10gbps. Fixes: eaef50c76057 ("usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus") Cc: Christophe JAILLET Cc: Felipe Balbi Cc: Gustavo A. R. Silva Cc: Lorenzo Colitti Cc: Martin K. Petersen Cc: Michael R Sweet Cc: Mike Christie Cc: Pawel Laszczak Cc: Peter Chen Cc: Sudhakar Panneerselvam Cc: Wei Ming Chen Cc: Will McVicker Cc: Zqiang Reviewed-By: Lorenzo Colitti Cc: stable Signed-off-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20210608044141.3898496-1-zenczykowski@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: function: fix typo in f_printer.c

2021-03-10T08:37:15+00:00

In line 824, it is trying to enable `out_ep`, so I believe that in line 826, it should print `out_ep` instead of `in_ep`. Signed-off-by: Wei Ming Chen Link: https://lore.kernel.org/r/20210214121929.9750-1-jj251510319013@gmail.com Signed-off-by: Greg Kroah-Hartman

Merge 5.11-rc3 into usb-next

2021-01-11T07:11:26+00:00

Resolves a merge issue in: drivers/usb/dwc3/gadget.c Signed-off-by: Greg Kroah-Hartman