diff options
| author | Andrey Konovalov <andreyknvl@gmail.com> | 2025-10-22 00:25:45 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-29 14:07:04 +0100 |
| commit | 2c217d0e86885cf61138f084a7b81d3a38bebccf (patch) | |
| tree | 14a96e4c3cfd469f16fb69bbce7ed5c641dd1321 /drivers | |
| parent | cbf278c90c64a6b8487d532a13a2d88deaad0cc6 (diff) | |
| download | linux-2c217d0e86885cf61138f084a7b81d3a38bebccf.tar.gz linux-2c217d0e86885cf61138f084a7b81d3a38bebccf.tar.bz2 linux-2c217d0e86885cf61138f084a7b81d3a38bebccf.zip | |
usb: raw-gadget: do not limit transfer length
commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream.
Drop the check on the maximum transfer length in Raw Gadget for both
control and non-control transfers.
Limiting the transfer length causes a problem with emulating USB devices
whose full configuration descriptor exceeds PAGE_SIZE in length.
Overall, there does not appear to be any reason to enforce any kind of
transfer length limit on the Raw Gadget side for either control or
non-control transfers, so let's just drop the related check.
Cc: stable <stable@kernel.org>
Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/gadget/legacy/raw_gadget.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c index ea106ad665a1..2deab4a6030d 100644 --- a/drivers/usb/gadget/legacy/raw_gadget.c +++ b/drivers/usb/gadget/legacy/raw_gadget.c @@ -620,8 +620,6 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr, return ERR_PTR(-EINVAL); if (!usb_raw_io_flags_valid(io->flags)) return ERR_PTR(-EINVAL); - if (io->length > PAGE_SIZE) - return ERR_PTR(-EINVAL); if (get_from_user) data = memdup_user(ptr + sizeof(*io), io->length); else { |