* [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
@ 2026-07-22 10:18 Jiangshan Yi
2026-07-30 12:29 ` Antti Laakso
0 siblings, 1 reply; 3+ messages in thread
From: Jiangshan Yi @ 2026-07-22 10:18 UTC (permalink / raw)
To: israel.a.cepeda.lopez, hansg, gregkh
Cc: sakari.ailus, linux-usb, linux-kernel, 13667453960, Jiangshan Yi,
stable
ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
endpoint size. Both are taken independently from different endpoints
in usbio_probe(), so the check is wrong when they differ.
Use rxbuf_len for the IN direction. This matches the buffer that
actually holds the response data.
Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
drivers/usb/misc/usbio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
index 3c2474dca810..fe093e7760d5 100644
--- a/drivers/usb/misc/usbio.c
+++ b/drivers/usb/misc/usbio.c
@@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
lockdep_assert_held(&usbio->bulk_mutex);
if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
- (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
+ (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
return -EMSGSIZE;
if (ibuf_len)
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
2026-07-22 10:18 [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg Jiangshan Yi
@ 2026-07-30 12:29 ` Antti Laakso
2026-08-04 8:55 ` Sakari Ailus
0 siblings, 1 reply; 3+ messages in thread
From: Antti Laakso @ 2026-07-30 12:29 UTC (permalink / raw)
To: Jiangshan Yi
Cc: israel.a.cepeda.lopez, hansg, gregkh, sakari.ailus, linux-usb,
linux-kernel, 13667453960, stable
On Wed, Jul 22, 2026 at 06:18:10PM +0800, Jiangshan Yi wrote:
> ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
> in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
> endpoint size. Both are taken independently from different endpoints
> in usbio_probe(), so the check is wrong when they differ.
>
> Use rxbuf_len for the IN direction. This matches the buffer that
> actually holds the response data.
>
> Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> ---
> drivers/usb/misc/usbio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> index 3c2474dca810..fe093e7760d5 100644
> --- a/drivers/usb/misc/usbio.c
> +++ b/drivers/usb/misc/usbio.c
> @@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
> lockdep_assert_held(&usbio->bulk_mutex);
>
> if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
> - (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
> + (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
> return -EMSGSIZE;
>
> if (ibuf_len)
Tested-by: Antti Laakso <antti.laakso@linux.intel.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
2026-07-30 12:29 ` Antti Laakso
@ 2026-08-04 8:55 ` Sakari Ailus
0 siblings, 0 replies; 3+ messages in thread
From: Sakari Ailus @ 2026-08-04 8:55 UTC (permalink / raw)
To: Antti Laakso
Cc: Jiangshan Yi, israel.a.cepeda.lopez, hansg, gregkh, linux-usb,
linux-kernel, 13667453960, stable
On Thu, Jul 30, 2026 at 03:29:45PM +0300, Antti Laakso wrote:
> On Wed, Jul 22, 2026 at 06:18:10PM +0800, Jiangshan Yi wrote:
> > ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
> > in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
> > endpoint size. Both are taken independently from different endpoints
> > in usbio_probe(), so the check is wrong when they differ.
> >
> > Use rxbuf_len for the IN direction. This matches the buffer that
> > actually holds the response data.
> >
> > Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> > ---
> > drivers/usb/misc/usbio.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> > index 3c2474dca810..fe093e7760d5 100644
> > --- a/drivers/usb/misc/usbio.c
> > +++ b/drivers/usb/misc/usbio.c
> > @@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
> > lockdep_assert_held(&usbio->bulk_mutex);
> >
> > if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
> > - (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
> > + (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
> > return -EMSGSIZE;
> >
> > if (ibuf_len)
>
> Tested-by: Antti Laakso <antti.laakso@linux.intel.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
--
Sakari Ailus
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-04 8:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-22 10:18 [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg Jiangshan Yi
2026-07-30 12:29 ` Antti Laakso
2026-08-04 8:55 ` Sakari Ailus
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox