[PATCH] USB: Remove 4088-byte limit on usbfs control URBs

This patch removes the artificial 4088-byte limit that usbfs
currently places on Control transfers. The USB spec does not
specify a strict limit on the size of an entire control transfer.
It does, however, state that the data stage "follows the same
protocol rules as bulk transfers." (USB 2, 8.5.3)

The level of support for large control transfers in real host
controllers varies, but it's important to support at least 4K
transfers. Windows enforces a maximum control transfer size
of 4K, so there exists some hardware that requires a full 4096
byte data stage. Without this patch, we fall short of that by
8 bytes on architectures with a 4K page size, and it becomes
impossible to support such hardware with a user-space driver.

Since any limit placed on control transfers by usbfs would be
arbitrary, this patch replaces the PAGE_SIZE limit with the same
arbitrary limit used by bulk transfers.

Signed-off-by: Micah Dowty <micah@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 2 insertions, 2 deletions

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 545da37afca7..04f7504e0985 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -923,8 +923,8 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                 if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
                                 != USB_ENDPOINT_XFER_CONTROL)
                         return -EINVAL;
-                /* min 8 byte setup packet, max arbitrary */
-                if (uurb->buffer_length < 8 || uurb->buffer_length > PAGE_SIZE)
+                /* min 8 byte setup packet, max 8 byte setup plus an arbitrary data stage */
+                if (uurb->buffer_length < 8 || uurb->buffer_length > (8 + MAX_USBFS_BUFFER_SIZE))
                         return -EINVAL;
                 if (!(dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL)))
                         return -ENOMEM;