Patch "usb: gadget: function: fix dangling pnp_string in f_printer.c" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    usb: gadget: function: fix dangling pnp_string in f_printer.c

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-gadget-function-fix-dangling-pnp_string-in-f_pri.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1430f8cf246a60c094d4abf349f003f312d1adfb
Author: Albert Briscoe <albertsbriscoe@xxxxxxxxx>
Date:   Sun Sep 11 15:37:55 2022 -0700

    usb: gadget: function: fix dangling pnp_string in f_printer.c
    
    [ Upstream commit 24b7ba2f88e04800b54d462f376512e8c41b8a3c ]
    
    When opts->pnp_string is changed with configfs, new memory is allocated for
    the string. It does not, however, update dev->pnp_string, even though the
    memory is freed. When rquesting the string, the host then gets old or
    corrupted data rather than the new string. The ieee 1284 id string should
    be allowed to change while the device is connected.
    
    The bug was introduced in commit fdc01cc286be ("usb: gadget: printer:
    Remove pnp_string static buffer"), which changed opts->pnp_string from a
    char[] to a char*.
    This patch changes dev->pnp_string from a char* to a char** pointing to
    opts->pnp_string.
    
    Fixes: fdc01cc286be ("usb: gadget: printer: Remove pnp_string static buffer")
    Signed-off-by: Albert Briscoe <albertsbriscoe@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20220911223753.20417-1-albertsbriscoe@xxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index abec5c58f525..a881c69b1f2b 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -89,7 +89,7 @@ struct printer_dev {
 	u8			printer_cdev_open;
 	wait_queue_head_t	wait;
 	unsigned		q_len;
-	char			*pnp_string;	/* We don't own memory! */
+	char			**pnp_string;	/* We don't own memory! */
 	struct usb_function	function;
 };
 
@@ -1000,16 +1000,16 @@ static int printer_func_setup(struct usb_function *f,
 			if ((wIndex>>8) != dev->interface)
 				break;
 
-			if (!dev->pnp_string) {
+			if (!*dev->pnp_string) {
 				value = 0;
 				break;
 			}
-			value = strlen(dev->pnp_string);
+			value = strlen(*dev->pnp_string);
 			buf[0] = (value >> 8) & 0xFF;
 			buf[1] = value & 0xFF;
-			memcpy(buf + 2, dev->pnp_string, value);
+			memcpy(buf + 2, *dev->pnp_string, value);
 			DBG(dev, "1284 PNP String: %x %s\n", value,
-			    dev->pnp_string);
+			    *dev->pnp_string);
 			break;
 
 		case GET_PORT_STATUS: /* Get Port Status */
@@ -1475,7 +1475,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
 	kref_init(&dev->kref);
 	++opts->refcnt;
 	dev->minor = opts->minor;
-	dev->pnp_string = opts->pnp_string;
+	dev->pnp_string = &opts->pnp_string;
 	dev->q_len = opts->q_len;
 	mutex_unlock(&opts->lock);