From nobody Sun Feb 8 16:12:24 2026 Received: from mail-ed1-f46.google.com (mail-ed1-f46.google.com [209.85.208.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A684738DEC for ; Sun, 21 Dec 2025 17:16:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766337363; cv=none; b=GxNE+iAJpaW7EOITDW2B1wqx3Dx0t+jOIK4V2VY5L1J5nOlzQf/0+YN0X5iMRz8fi0biIr8TjC+7XI/4mAky9Q4Vbb7FIqOikmtFk0QG3f5kOfGklZM2ahTdDtwv3QkaTpLJdAlBg9OKCuEKHmcmhC9NpAR5f7Vgq6X2FI9LB3c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766337363; c=relaxed/simple; bh=laqkOQStcAl+I4c5s3ym2wDYh0jYR46LDJd27hh652s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GBMzuFgu4bLUc/BCoFIs3RBnbHshGr604yObms3gff7vr30B2d50+ULzslsPTfCe70E8WmtoBwrnr5LHUGjx8oLilasEswDJkVoFQg5C9qSLYtHX4hOhVa0p+awepgJgCQR6ddGEvu6YmvCriiqRYPnFCMmoG1wKywo+x1iGuEI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mm/0frHC; arc=none smtp.client-ip=209.85.208.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mm/0frHC" Received: by mail-ed1-f46.google.com with SMTP id 4fb4d7f45d1cf-64b5ed53d0aso4424748a12.3 for ; Sun, 21 Dec 2025 09:16:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766337360; x=1766942160; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=XinSJrSvWSy//0PWBG637vnEFTJuBzhx/iavcQumeX0=; b=mm/0frHC+YyhiTHpCFB037LAtypTuHkIBLqe6qi+oci6F1kCKNdV1Au+1RVyOv/cz9 9h2FS2xXlLMWRbCFwRu8k8Vs4NBS1fKNUkthmhI5tIcHq1Af9+Uk/CVwF96MK7IcGMau dFWs0Tv2Jzo8m94KdK5dKmcknW5yPr/A0U1QUG1No+Bc7/MUUIAcnfz1p/RX4OgqBn7a BpuqfJ2k7UsKvlaO3QANJJ80oR31tbJ78D0A6t9Vfxj7c52R/tGN2ZdRoVjb3aeSSy4Z oz8yyMfzfKYqaP4H4oVwPz6TyR174+BPTB6BOTBtzSVPPv1wpPmccf7aLGxwY/V9elfk uQtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766337360; x=1766942160; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=XinSJrSvWSy//0PWBG637vnEFTJuBzhx/iavcQumeX0=; b=wqDtfNo8HwbalpXGhSrezMvKGClxZnKmAOQQVGKGgqwxgGYteywZOa+wa+G5FvkGHY wGShRMUE1hm+50Qo9iksEShhSY2BfrGuqdGtQNYfWIbkshPC2WTBbxH1pGzeuaGpGn36 EKcNWTtdA/QiCk1s8vMic4MLmoU0nsQGydjaOVCw5YFFbO16epmA/dNkOasYa1GBHOta JXGbsgj7V2p+sgL8p8j3yso0LykuMh7LJlv73oELgIwdpXUK3ANPcAvKcDrww4IC85zQ 33quwupYo1wNhD7jKxToIYNFUz+BaNiYa17vPPlgYYxLoXrwPuZVqARmV/aTfNMLZs+U YGlw== X-Forwarded-Encrypted: i=1; AJvYcCU7RzfK7pR0SxAAgd/IS5jLB07OUrcJMY4ALJ665MiwLIoadlMOhgadHPpXkzghUlKWsPHqi4/jUpeEeQg=@vger.kernel.org X-Gm-Message-State: AOJu0YxUDJq3EToV3oH2QJEb8cLOXasQnW3JCW+uMiEGS/WBATDU1Exn ukbkloQQgOBCuGyjYklUkxukogBEY8m7faq8fSqkKXPSvqIShcEiYjPHPLEBtes8 X-Gm-Gg: AY/fxX5nhzaEkCbMdZp1p6OEDf0oiphYQfG7K/2u2MlKm4iGyQAX2C9XKjXczkQufmd fXVB41Lke8sHUt7NsLDJMa8Bqug/yXnEIH4IRVYn/1EsTtJHz7iG1oca5ftzlqtSpRsv6xNk+gB nuc18sJRiggw/eJ67Di3ywDxeWkaliEAJclw3UYXrCUiUVKYdO1Pr5Ys5sf4tASUX6pvsiWSKjw BXDAcXYcM93gpX8D1MIVfJn533tRBHDJBOfh+gMyg4DdDkAhV0PNXSCWb3Vv1NCux72vXGGjRIY gaxOAdDE4N1bifkilpUcbss8FhUeekMaFdczafOKsXGA4P6f4rMI8w8QSqE/tbKibleSEjMWviQ HBEukybbymV4F8QECCAHvYfmKfXIBSkVYfQqpCP4R39QhsmsnbKu9yeUVBItZ1pkosoPleGIdVS A= X-Google-Smtp-Source: AGHT+IG9CbfvM+V2HbAAeZgmRYURafysypR+NSMQlDu2eOP+EhFyYhcFRSV9MNSo4928nr9v7FqWZA== X-Received: by 2002:a05:6402:2755:b0:64d:4894:774c with SMTP id 4fb4d7f45d1cf-64d48947a3emr1741329a12.7.1766337359773; Sun, 21 Dec 2025 09:15:59 -0800 (PST) Received: from prometheus ([85.11.110.37]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-64b91056726sm7534266a12.10.2025.12.21.09.15.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 21 Dec 2025 09:15:59 -0800 (PST) From: Szymon Wilczek To: mchehab@kernel.org Cc: hverkuil+cisco@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Szymon Wilczek , syzbot+e6a50a2e7cbb4f775d04@syzkaller.appspotmail.com Subject: [PATCH] media: dtv5100: fix BOGUS control dir warning on 0-length reads Date: Sun, 21 Dec 2025 18:15:42 +0100 Message-ID: <20251221171542.47748-1-swilczek.lx@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The kernel's usb_submit_urb() validates that 0-length control transfers use an OUT pipe, since there is no data stage direction to enforce. The dtv5100 driver uses usb_rcvctrlpipe() (IN pipe) for all reads, including 0-length ones (when rlen is 0). This triggers the 'BOGUS control dir' warning in usb_submit_urb(). Fix this by using usb_sndctrlpipe() (OUT pipe) when rlen is 0, satisfying the kernel's validation while maintaining correct protocol behavior for Setup packets. Reported-by: syzbot+e6a50a2e7cbb4f775d04@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3De6a50a2e7cbb4f775d04 Signed-off-by: Szymon Wilczek --- drivers/media/usb/dvb-usb/dtv5100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-us= b/dtv5100.c index c448e2ebda1a..a16406cc8db7 100644 --- a/drivers/media/usb/dvb-usb/dtv5100.c +++ b/drivers/media/usb/dvb-usb/dtv5100.c @@ -62,8 +62,8 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 a= ddr, =20 memcpy(st->data, rbuf, rlen); msleep(1); /* avoid I2C errors */ - return usb_control_msg(d->udev, pipe, request, - type, value, index, st->data, rlen, + return usb_control_msg(d->udev, rlen ? pipe : usb_sndctrlpipe(d->udev, 0), + request, type, value, index, st->data, rlen, DTV5100_USB_TIMEOUT); } =20 --=20 2.52.0