usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check
in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT
endpoint size.  Both are taken independently from different endpoints
in usbio_probe(), so the check is wrong when they differ.

Use rxbuf_len for the IN direction.  This matches the buffer that
actually holds the response data.

Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Tested-by: Antti Laakso <antti.laakso@linux.intel.com>
Link: https://patch.msgid.link/20260722101810.458634-1-yijiangshan@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/misc/usbio.c b/drivers/usb/misc/usbio.c
index 3c2474dca8101c3e603a47473234cf2fc38489c2..fe093e7760d5ef6fcc2852de70f5afb1ca79c477 100644 (file)
--- a/drivers/usb/misc/usbio.c
+++ b/drivers/usb/misc/usbio.c
@@ -265,7 +265,7 @@ int usbio_bulk_msg(struct auxiliary_device *adev, u8 type, u8 cmd, bool last,
        lockdep_assert_held(&usbio->bulk_mutex);
 
        if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
-           (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
+           (ibuf_len > (usbio->rxbuf_len - sizeof(*bpkt))))
                return -EMSGSIZE;
 
        if (ibuf_len)