diff options
| author | Andrey Konovalov <andreyknvl@gmail.com> | 2025-10-22 00:25:45 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-29 14:09:00 +0100 |
| commit | a8d81c9599f6e2097ce20eaa8402cc0071ba75e3 (patch) | |
| tree | 02f5ea78921da5ef9fd60808beb954cc3b99b937 | |
| parent | d1446a98ca5f74dd7985fbb666b34d99b1c94acd (diff) | |
| download | linux-a8d81c9599f6e2097ce20eaa8402cc0071ba75e3.tar.gz linux-a8d81c9599f6e2097ce20eaa8402cc0071ba75e3.tar.bz2 linux-a8d81c9599f6e2097ce20eaa8402cc0071ba75e3.zip | |
usb: raw-gadget: do not limit transfer length
commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream.
Drop the check on the maximum transfer length in Raw Gadget for both
control and non-control transfers.
Limiting the transfer length causes a problem with emulating USB devices
whose full configuration descriptor exceeds PAGE_SIZE in length.
Overall, there does not appear to be any reason to enforce any kind of
transfer length limit on the Raw Gadget side for either control or
non-control transfers, so let's just drop the related check.
Cc: stable <stable@kernel.org>
Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/gadget/legacy/raw_gadget.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c index 112fd18d8c99..c713a9854a3e 100644 --- a/drivers/usb/gadget/legacy/raw_gadget.c +++ b/drivers/usb/gadget/legacy/raw_gadget.c @@ -667,8 +667,6 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr, return ERR_PTR(-EINVAL); if (!usb_raw_io_flags_valid(io->flags)) return ERR_PTR(-EINVAL); - if (io->length > PAGE_SIZE) - return ERR_PTR(-EINVAL); if (get_from_user) data = memdup_user(ptr + sizeof(*io), io->length); else { |