diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6..7b579a86c145 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -670,6 +670,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
        if (get_from_user)
                data = memdup_user(ptr + sizeof(*io), io->length);
        else {
+               if (io->length > KMALLOC_MAX_SIZE)
+                       return ERR_PTR(-EINVAL);
                data = kmalloc(io->length, GFP_KERNEL);
                if (!data)
                        data = ERR_PTR(-ENOMEM);