printer_soft_reset() tests rx_reqs_active in its second draining loop but
retrieves the next entry from rx_buffers. If rx_reqs_active is non-empty
after endpoint shutdown, this operates on the wrong list and never removes
the active entry, leading to list corruption and a non-terminating loop.
Retrieve the request from the list named by the loop condition.
Fixes: 25a010c8c1a5 ("USB: add Printer Gadget Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
drivers/usb/gadget/function/f_printer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 1857d78611..e3dc5d810a 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -940,8 +940,8 @@ static void printer_soft_reset(struct printer_dev *dev)
}
while (likely(!(list_empty(&dev->rx_reqs_active)))) {
- req = container_of(dev->rx_buffers.next, struct usb_request,
- list);
+ req = list_first_entry(&dev->rx_reqs_active,
+ struct usb_request, list);
list_del_init(&req->list);
list_add(&req->list, &dev->rx_reqs);
}
--
2.43.0