Re: [PATCH] usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

[Antti Laakso]

On Wed, Jul 22, 2026 at 06:18:10PM +0800, Jiangshan Yi wrote:
> ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
> in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
> endpoint size.  Both are taken independently from different endpoints
> in usbio_probe(), so the check is wrong when they differ.
> 
> Use rxbuf_len for the IN direction.  This matches the buffer that
> actually holds the response data.
> 
> Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>
> ---
>  drivers/usb/misc/usbio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
> index 3c2474dca810..fe093e7760d5 100644
> --- a/drivers/usb/misc/usbio.c
> +++ b/drivers/usb/misc/usbio.c
> @@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
>  	lockdep_assert_held(&usbio->bulk_mutex);
>  
>  	if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
> -	    (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
> +	    (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
>  		return -EMSGSIZE;
>  
>  	if (ibuf_len)

Tested-by: Antti Laakso <antti.laakso@xxxxxxxxxxxxxxx>