From: Antti Laakso <antti.laakso@linux.intel.com>
To: Jiangshan Yi <yijiangshan@kylinos.cn>
Cc: israel.a.cepeda.lopez@intel.com, hansg@kernel.org,
gregkh@linuxfoundation.org, sakari.ailus@linux.intel.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
13667453960@163.com, stable@vger.kernel.org
Subject: Re: [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
Date: Thu, 30 Jul 2026 15:29:45 +0300 [thread overview]
Message-ID: <amtDubB1yNk1JGXG@alaakso-desk> (raw)
In-Reply-To: <20260722101810.458634-1-yijiangshan@kylinos.cn>
On Wed, Jul 22, 2026 at 06:18:10PM +0800, Jiangshan Yi wrote:
> ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
> in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
> endpoint size. Both are taken independently from different endpoints
> in usbio_probe(), so the check is wrong when they differ.
>
> Use rxbuf_len for the IN direction. This matches the buffer that
> actually holds the response data.
>
> Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> ---
> drivers/usb/misc/usbio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> index 3c2474dca810..fe093e7760d5 100644
> --- a/drivers/usb/misc/usbio.c
> +++ b/drivers/usb/misc/usbio.c
> @@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
> lockdep_assert_held(&usbio->bulk_mutex);
>
> if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
> - (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
> + (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
> return -EMSGSIZE;
>
> if (ibuf_len)
Tested-by: Antti Laakso <antti.laakso@linux.intel.com>
prev parent reply other threads:[~2026-07-30 12:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-22 10:18 [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg Jiangshan Yi
2026-07-30 12:29 ` Antti Laakso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=amtDubB1yNk1JGXG@alaakso-desk \
--to=antti.laakso@linux.intel.com \
--cc=13667453960@163.com \
--cc=gregkh@linuxfoundation.org \
--cc=hansg@kernel.org \
--cc=israel.a.cepeda.lopez@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=sakari.ailus@linux.intel.com \
--cc=stable@vger.kernel.org \
--cc=yijiangshan@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox