|
@@ -339,14 +339,6 @@ static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
|
|
|
|
|
|
epd = &ep->desc;
|
|
|
|
|
|
- /* validate transfer_buffer_length */
|
|
|
- if (pdu->u.cmd_submit.transfer_buffer_length > INT_MAX) {
|
|
|
- dev_err(&sdev->udev->dev,
|
|
|
- "CMD_SUBMIT: -EMSGSIZE transfer_buffer_length %d\n",
|
|
|
- pdu->u.cmd_submit.transfer_buffer_length);
|
|
|
- return -1;
|
|
|
- }
|
|
|
-
|
|
|
if (usb_endpoint_xfer_control(epd)) {
|
|
|
if (dir == USBIP_DIR_OUT)
|
|
|
return usb_sndctrlpipe(udev, epnum);
|
|
@@ -479,8 +471,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
|
|
|
}
|
|
|
|
|
|
/* allocate urb transfer buffer, if needed */
|
|
|
- if (pdu->u.cmd_submit.transfer_buffer_length > 0 &&
|
|
|
- pdu->u.cmd_submit.transfer_buffer_length <= INT_MAX) {
|
|
|
+ if (pdu->u.cmd_submit.transfer_buffer_length > 0) {
|
|
|
priv->urb->transfer_buffer =
|
|
|
kzalloc(pdu->u.cmd_submit.transfer_buffer_length,
|
|
|
GFP_KERNEL);
|