Re: [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
Sakari Ailus <sakari.ailus-VuQAYsv1563Yd54FQh9/[email protected]>
| Newsgroups | gmane.linux.usb.general,gmane.linux.kernel,gmane.linux.kernel.stable |
|---|---|
| Organization | Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo |
| Message-ID | <[email protected]> |
On Thu, Jul 30, 2026 at 03:29:45PM +0300, Antti Laakso wrote:
> On Wed, Jul 22, 2026 at 06:18:10PM +0800, Jiangshan Yi wrote:
> > ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
> > in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
> > endpoint size. Both are taken independently from different endpoints
> > in usbio_probe(), so the check is wrong when they differ.
> >
> > Use rxbuf_len for the IN direction. This matches the buffer that
> > actually holds the response data.
> >
> > Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
> > Cc: [email protected]
> > Signed-off-by: Jiangshan Yi <yijiangshan-UOlijcLmZ/[email protected]>
> > ---
> > drivers/usb/misc/usbio.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> > index 3c2474dca810..fe093e7760d5 100644
> > --- a/drivers/usb/misc/usbio.c
> > +++ b/drivers/usb/misc/usbio.c
> > @@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
> > lockdep_assert_held(&usbio->bulk_mutex);
> >
> > if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
> > - (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
> > + (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
> > return -EMSGSIZE;
> >
> > if (ibuf_len)
>
> Tested-by: Antti Laakso <antti.laakso-VuQAYsv1563Yd54FQh9/[email protected]>
Acked-by: Sakari Ailus <sakari.ailus-VuQAYsv1563Yd54FQh9/[email protected]>
--
Sakari Ailus