[PATCH] usb: gadget: f_printer: use the active RX list in soft reset

[PATCH] usb: gadget: f_printer: use the active RX list in soft reset

[Aldo Ariel Panzardo]

printer_soft_reset() tests rx_reqs_active in its second draining loop but
retrieves the next entry from rx_buffers. If rx_reqs_active is non-empty
after endpoint shutdown, this operates on the wrong list and never removes
the active entry, leading to list corruption and a non-terminating loop.

Retrieve the request from the list named by the loop condition.

Fixes: 25a010c8c1a5 ("USB: add Printer Gadget Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/usb/gadget/function/f_printer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 1857d78611..e3dc5d810a 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -940,8 +940,8 @@ static void printer_soft_reset(struct printer_dev *dev)
 	}
 
 	while (likely(!(list_empty(&dev->rx_reqs_active)))) {
-		req = container_of(dev->rx_buffers.next, struct usb_request,
-				list);
+		req = list_first_entry(&dev->rx_reqs_active,
+				       struct usb_request, list);
 		list_del_init(&req->list);
 		list_add(&req->list, &dev->rx_reqs);
 	}
-- 
2.43.0