diff options
| author | Andrey Konovalov <andreyknvl@gmail.com> | 2025-10-22 00:25:45 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-29 14:10:29 +0100 |
| commit | 68a63948c0b320e717dcfc20f5a0d9ffd442226f (patch) | |
| tree | 7ace3c5c3f215a49bf48b65a46c157ef777ef543 /drivers | |
| parent | ac538cf59cb5b64ca275c13a7b9069246744c22b (diff) | |
| download | linux-68a63948c0b320e717dcfc20f5a0d9ffd442226f.tar.gz linux-68a63948c0b320e717dcfc20f5a0d9ffd442226f.tar.bz2 linux-68a63948c0b320e717dcfc20f5a0d9ffd442226f.zip | |
usb: raw-gadget: do not limit transfer length
commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream.
Drop the check on the maximum transfer length in Raw Gadget for both
control and non-control transfers.
Limiting the transfer length causes a problem with emulating USB devices
whose full configuration descriptor exceeds PAGE_SIZE in length.
Overall, there does not appear to be any reason to enforce any kind of
transfer length limit on the Raw Gadget side for either control or
non-control transfers, so let's just drop the related check.
Cc: stable <stable@kernel.org>
Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/gadget/legacy/raw_gadget.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c index 20165e1582d9..b71680c58de6 100644 --- a/drivers/usb/gadget/legacy/raw_gadget.c +++ b/drivers/usb/gadget/legacy/raw_gadget.c @@ -667,8 +667,6 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr, return ERR_PTR(-EINVAL); if (!usb_raw_io_flags_valid(io->flags)) return ERR_PTR(-EINVAL); - if (io->length > PAGE_SIZE) - return ERR_PTR(-EINVAL); if (get_from_user) data = memdup_user(ptr + sizeof(*io), io->length); else { |