update kernel to 5.10.198

hc

2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf

 kernel/drivers/usb/gadget/function/f_printer.c
..
..
@@ -51,6 +51,8 @@
51
51
 #define GET_PORT_STATUS		1
52
52
 #define SOFT_RESET		2
53
53
 
54
+#define DEFAULT_Q_LEN		10 /* same as legacy g_printer gadget */
55
+
54
56
 static int major, minors;
55
57
 static struct class *usb_gadget_class;
56
58
 static DEFINE_IDA(printer_ida);
..
..
@@ -87,7 +89,7 @@
87
89
 	u8			printer_cdev_open;
88
90
 	wait_queue_head_t	wait;
89
91
 	unsigned		q_len;
90
-	char			*pnp_string;	/* We don't own memory! */
92
+	char			**pnp_string;	/* We don't own memory! */
91
93
 	struct usb_function	function;
92
94
 };
93
95
 
..
..
@@ -293,7 +295,7 @@
293
295
 
294
296
 	/* data overrun */
295
297
 	case -EOVERFLOW:
296
-		/* FALLTHROUGH */
298
+		fallthrough;
297
299
 
298
300
 	default:
299
301
 		DBG(dev, "rx status %d\n", status);
..
..
@@ -312,7 +314,7 @@
312
314
 	switch (req->status) {
313
315
 	default:
314
316
 		VDBG(dev, "tx err %d\n", req->status);
315
-		/* FALLTHROUGH */
317
+		fallthrough;
316
318
 	case -ECONNRESET:		/* unlink */
317
319
 	case -ESHUTDOWN:		/* disconnect etc */
318
320
 		break;
..
..
@@ -345,6 +347,11 @@
345
347
 	dev = container_of(inode->i_cdev, struct printer_dev, printer_cdev);
346
348
 
347
349
 	spin_lock_irqsave(&dev->lock, flags);
350
+
351
+	if (dev->interface < 0) {
352
+		spin_unlock_irqrestore(&dev->lock, flags);
353
+		return -ENODEV;
354
+	}
348
355
 
349
356
 	if (!dev->printer_cdev_open) {
350
357
 		dev->printer_cdev_open = 1;
..
..
@@ -439,6 +446,12 @@
439
446
 
440
447
 	mutex_lock(&dev->lock_printer_io);
441
448
 	spin_lock_irqsave(&dev->lock, flags);
449
+
450
+	if (dev->interface < 0) {
451
+		spin_unlock_irqrestore(&dev->lock, flags);
452
+		mutex_unlock(&dev->lock_printer_io);
453
+		return -ENODEV;
454
+	}
442
455
 
443
456
 	/* We will use this flag later to check if a printer reset happened
444
457
 	 * after we turn interrupts back on.
..
..
@@ -571,6 +584,12 @@
571
584
 	mutex_lock(&dev->lock_printer_io);
572
585
 	spin_lock_irqsave(&dev->lock, flags);
573
586
 
587
+	if (dev->interface < 0) {
588
+		spin_unlock_irqrestore(&dev->lock, flags);
589
+		mutex_unlock(&dev->lock_printer_io);
590
+		return -ENODEV;
591
+	}
592
+
574
593
 	/* Check if a printer reset happens while we have interrupts on */
575
594
 	dev->reset_printer = 0;
576
595
 
..
..
@@ -677,6 +696,13 @@
677
696
 
678
697
 	inode_lock(inode);
679
698
 	spin_lock_irqsave(&dev->lock, flags);
699
+
700
+	if (dev->interface < 0) {
701
+		spin_unlock_irqrestore(&dev->lock, flags);
702
+		inode_unlock(inode);
703
+		return -ENODEV;
704
+	}
705
+
680
706
 	tx_list_empty = (likely(list_empty(&dev->tx_reqs)));
681
707
 	spin_unlock_irqrestore(&dev->lock, flags);
682
708
 
..
..
@@ -699,6 +725,13 @@
699
725
 
700
726
 	mutex_lock(&dev->lock_printer_io);
701
727
 	spin_lock_irqsave(&dev->lock, flags);
728
+
729
+	if (dev->interface < 0) {
730
+		spin_unlock_irqrestore(&dev->lock, flags);
731
+		mutex_unlock(&dev->lock_printer_io);
732
+		return EPOLLERR | EPOLLHUP;
733
+	}
734
+
702
735
 	setup_rx_reqs(dev);
703
736
 	spin_unlock_irqrestore(&dev->lock, flags);
704
737
 	mutex_unlock(&dev->lock_printer_io);
..
..
@@ -731,6 +764,11 @@
731
764
 	/* handle ioctls */
732
765
 
733
766
 	spin_lock_irqsave(&dev->lock, flags);
767
+
768
+	if (dev->interface < 0) {
769
+		spin_unlock_irqrestore(&dev->lock, flags);
770
+		return -ENODEV;
771
+	}
734
772
 
735
773
 	switch (code) {
736
774
 	case GADGET_GET_PRINTER_STATUS:
..
..
@@ -929,7 +967,7 @@
929
967
 		if (!w_value && !w_length &&
930
968
 		   !(USB_DIR_IN & ctrl->bRequestType))
931
969
 			break;
932
-		/* fall through */
970
+		fallthrough;
933
971
 	default:
934
972
 		return false;
935
973
 	}
..
..
@@ -963,16 +1001,16 @@
963
1001
 			if ((wIndex>>8) != dev->interface)
964
1002
 				break;
965
1003
 
966
-			if (!dev->pnp_string) {
1004
+			if (!*dev->pnp_string) {
967
1005
 				value = 0;
968
1006
 				break;
969
1007
 			}
970
-			value = strlen(dev->pnp_string);
1008
+			value = strlen(*dev->pnp_string);
971
1009
 			buf[0] = (value >> 8) & 0xFF;
972
1010
 			buf[1] = value & 0xFF;
973
-			memcpy(buf + 2, dev->pnp_string, value);
1011
+			memcpy(buf + 2, *dev->pnp_string, value);
974
1012
 			DBG(dev, "1284 PNP String: %x %s\n", value,
975
-			    dev->pnp_string);
1013
+			    *dev->pnp_string);
976
1014
 			break;
977
1015
 
978
1016
 		case GET_PORT_STATUS: /* Get Port Status */
..
..
@@ -1329,6 +1367,9 @@
1329
1367
 	opts->func_inst.free_func_inst = gprinter_free_inst;
1330
1368
 	ret = &opts->func_inst;
1331
1369
 
1370
+	/* Make sure q_len is initialized, otherwise the bound device can't support read/write! */
1371
+	opts->q_len = DEFAULT_Q_LEN;
1372
+
1332
1373
 	mutex_lock(&printer_ida_lock);
1333
1374
 
1334
1375
 	if (ida_is_empty(&printer_ida)) {
..
..
@@ -1435,7 +1476,7 @@
1435
1476
 	kref_init(&dev->kref);
1436
1477
 	++opts->refcnt;
1437
1478
 	dev->minor = opts->minor;
1438
-	dev->pnp_string = opts->pnp_string;
1479
+	dev->pnp_string = &opts->pnp_string;
1439
1480
 	dev->q_len = opts->q_len;
1440
1481
 	mutex_unlock(&opts->lock);
1441
1482