From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DDC03E024B for ; Thu, 9 Jul 2026 20:56:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783630589; cv=none; b=Ip5xGHL8ShD6j5DPTrQhQEJMIwOxxqj5KAr7iWi5CJtaRJ2K2ZA0PfMn2A5FU/5ToserZMcT6hqik68M0EO1YP8gdYsKNVcK7uBlsAcxbpTFYKT7UXDrh0CUlneeYkiL7wmljTZezvBEEk1i2mUE0uMPAjn1/fWguJDZgEjyxIA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783630589; c=relaxed/simple; bh=3j4syLrTH3ss+LT1uFL+xIlIo+tKkPs2LMGlAzDqXgU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=scuxxaxNr5seJDXy94lnqDEVQIbgb7i+HJp7vE7HUhBN1Me0fpH1b341ryV3SNCgGU9901YmftaFXSA6v9EAouLtYkG6QgFl991/Wz8I/pECxSLR834sJN0z43Wtdtht+AgK3lvilbHMN2ZMlid5NSWV2wgXj22yobGGidjmZV0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ECXp4Z38; arc=none smtp.client-ip=209.85.221.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ECXp4Z38" Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-4758b2a9e2aso205707f8f.2 for ; Thu, 09 Jul 2026 13:56:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783630586; x=1784235386; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FyQ2SYryPffIKXgX/hPe6feFKCE/nZgCPpWlF8Eq6IM=; b=ECXp4Z38357s8n3YE3StUPVwlIm8EOi8+0zbJD2MCl4ucPQpK0bdeUpYOYUSn1y5FW xy5/XsNWdXVvElOKSoAMZJ9AZmV0meLuQfm9b2NJWbxelCaXs/8VcsiXalU/XbqjmbTJ sgsthA0PS3lw8VkRnG8LHZ0toWj1VW/G1h+q/TEDeH2w2LfUgF8OIJQwQyMaaDajg27N pMQXvjxF9E6OQKGm+GH1nIdHNyI9HEyWJ8X5//YoP1dGbruz4S1KDG0Qb3u9/KdBdyIP Vh8cxJhEMRFl1GFLIhXcuN44SB8RuiKt8xwLEkeb6KXZ+O0ArDiiROMCs5sXh8oF7+7G V1SQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783630586; x=1784235386; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=FyQ2SYryPffIKXgX/hPe6feFKCE/nZgCPpWlF8Eq6IM=; b=nAEepnh0JvjYlqjzdmKPmIECbRVYNAftjdXjizaAiqs6eXtWVJ9CNDkbVR7a9mklPP KwIxL/Dmv6KJ75ylETqbYS9bIUqB0FIdvP9Eh1Yc/iUygTUQUN6DtTWo8GU8WBvPQmsD sEUmqUMsLX2XCLESX6apEE/hrk5Js4XUbQJbLtHLn+sC3JZvFQVGtiFTO380UlIV8YCI YSGkiy6QNG5PycAXwuNkSlZS79++KWEjbbAzrCWyxY81YKT+OVMZEA+KW2xjFqtb4D3L Nc3ksP9oaYinKA9MxMXemslUJoVN8jIX8AeQKC6oyJbPFeyNU8/9ioKlAE416/o52k2j 0AVg== X-Gm-Message-State: AOJu0YxV7TvXXcG/Hq8hApS5GjfyP1bqyXQMaxr0sU/ObMfq4siYlkGs YXe441tso4ZWOEsWcwvEsrmRgIcGuxUPKGaqFq/QajjXzlOn1ye7xZuS X-Gm-Gg: AfdE7ck+8VaLy2V7Oin3BNkTIVSU6rAn0vg5W9h3smazfk4lE1VVFteUFNvpgoNXXRA ws9skSARUFgHdEnd3jPw3DqMl+jd9VMb2sWpZCaIqisEJDHslcSjaqjglONNFgfNQSqVMbhXGjd av9DzYyM9DdqZQCSg+e9+jPj3bu4h+D34UiAN1/djMOQm0LDPux+og8HDJVTpHb/W91Eff6uAjd qNXpsHQ8OCZ+MGM2OAulG688KUZa67+h7ynUxSkm/OkjvVFpBtVblgx95oAfiqjHF2SB8uuIoRp ZJ2dDQO/v7ZwCQpDmvB5BfNCcupgHBe3zWkArzLeozYJuk1QKHW5lIahN2H9izg4BvaEzczDFBz xFuCaAJ2gb0TtYC6IoJw3nKT2k3VIb4eBe1WVO+OnAZLeneab4poUJwPhuRpbHos6mx+mVWAYb2 t2iDBpShA0Be70XM6gt1yREas/u6kj8uRqojW0DQ9HdqFwt6uyoRQG7UHDQfcBccwMlG3Y0GGZ5 5emvZdTHhM7m48YjITRT2WLDY9zrgR9pnnmwvh5 X-Received: by 2002:a05:6000:24c5:b0:46e:8f0e:2f02 with SMTP id ffacd0b85a97d-47df075e410mr9661610f8f.33.1783630585822; Thu, 09 Jul 2026 13:56:25 -0700 (PDT) Received: from DESKTOP-O40ECIK (108.228-30-62.static.virginmediabusiness.co.uk. [62.30.228.108]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47aa039b0cesm55210785f8f.22.2026.07.09.13.56.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Jul 2026 13:56:25 -0700 (PDT) From: Melbin K Mathew To: Greg Kroah-Hartman , linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Peter Chen , stable@vger.kernel.org Subject: [PATCH v3] usb: gadget: printer: fix infinite loop in printer_read() Date: Thu, 9 Jul 2026 21:56:22 +0100 Message-ID: <20260709205622.55700-1-mlbnkm1@gmail.com> X-Mailer: git-send-email 2.52.0.windows.1 In-Reply-To: <20260703075429.302687-1-mlbnkm1@gmail.com> References: <20260703075429.302687-1-mlbnkm1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit printer_read() uses the same variable for the requested copy size and the number of bytes actually copied to user space. copy_to_user() returns the number of bytes not copied, so when it fails to copy anything, the computed copied length becomes zero. In that case len, buf, current_rx_bytes and current_rx_buf are left unchanged. If RX data is available and the user buffer remains unwritable, the read loop can repeat indefinitely. Track the copied length separately and return -EFAULT, or the number of bytes already copied, if an iteration makes no progress. Fixes: b185f01a9ab7 ("usb: gadget: printer: factor out f_printer") Cc: stable@vger.kernel.org Reviewed-by: Peter Chen Signed-off-by: Melbin K Mathew --- Changes in v3: - Regenerate the patch to fix the corrupted v2 diff. Changes in v2: - Drop unrelated comment wording change. - Add Reviewed-by tag from Peter Chen. drivers/usb/gadget/function/f_printer.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c index e4f7828ae75d..a22e2a6ea14b 100644 --- a/drivers/usb/gadget/function/f_printer.c +++ b/drivers/usb/gadget/function/f_printer.c @@ -432,7 +432,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) { struct printer_dev *dev = fd->private_data; unsigned long flags; - size_t size; + size_t size, not_copied, copied; size_t bytes_copied; struct usb_request *req; /* This is a pointer to the current USB rx request. */ @@ -525,10 +525,12 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) else size = len; - size -= copy_to_user(buf, current_rx_buf, size); - bytes_copied += size; - len -= size; - buf += size; + not_copied = copy_to_user(buf, current_rx_buf, size); + copied = size - not_copied; + + bytes_copied += copied; + len -= copied; + buf += copied; spin_lock_irqsave(&dev->lock, flags); @@ -543,6 +545,17 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr) if (dev->interface < 0) goto out_disabled; + if (!copied) { + dev->current_rx_req = current_rx_req; + dev->current_rx_bytes = current_rx_bytes; + dev->current_rx_buf = current_rx_buf; + spin_unlock_irqrestore(&dev->lock, flags); + mutex_unlock(&dev->lock_printer_io); + return bytes_copied ? bytes_copied : -EFAULT; + } + + size = copied; + /* If we not returning all the data left in this RX request * buffer then adjust the amount of data left in the buffer. * Othewise if we are done with this RX request buffer then -- 2.43.0