Re: [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

[Sakari Ailus <sakari.ailus@linux.intel.com>]

On Thu, Jul 30, 2026 at 03:29:45PM +0300, Antti Laakso wrote:
> On Wed, Jul 22, 2026 at 06:18:10PM +0800, Jiangshan Yi wrote:
> > ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
> > in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
> > endpoint size.  Both are taken independently from different endpoints
> > in usbio_probe(), so the check is wrong when they differ.
> > 
> > Use rxbuf_len for the IN direction.  This matches the buffer that
> > actually holds the response data.
> > 
> > Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> > ---
> >  drivers/usb/misc/usbio.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> > index 3c2474dca810..fe093e7760d5 100644
> > --- a/drivers/usb/misc/usbio.c
> > +++ b/drivers/usb/misc/usbio.c
> > @@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
> >  	lockdep_assert_held(&usbio->bulk_mutex);
> >  
> >  	if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
> > -	    (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
> > +	    (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
> >  		return -EMSGSIZE;
> >  
> >  	if (ibuf_len)
> 
> Tested-by: Antti Laakso <antti.laakso@linux.intel.com>

Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>

-- 
Sakari Ailus