Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp3323641pxj; Mon, 24 May 2021 04:12:02 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxRhiHyiItSSZBQo4OgeBiCLFrSlKm93AYlQS0uk2ROp0dv0Or+1BhjoGXQVeIfTz5dmFf5 X-Received: by 2002:a02:c652:: with SMTP id k18mr23951019jan.105.1621854722505; Mon, 24 May 2021 04:12:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1621854722; cv=none; d=google.com; s=arc-20160816; b=Xql+5AlQBifQDpypRBwl3J5e8jrHgcjlc9gYfuI3cZfU0jALMhaTSYHVF+zC7VxgZN 9pN5mHmi+rI/DSjzKA3G2dmuRBi2Tm2G1jIjQNoW2NYVG3bt5kZILaZFFPnxFRVmtanQ lXwUAL1+Ly8nXWSD0/FfgKODtvMulfwsxVG+1hW0lP5s8tQoqJ+/jtYxWppa+rim9JXu bT7+pxiAhlnSuRbzsiYMXnfZV2cb45EELKc7YsiSwt0IInipEpoSAYOFGROHXF8LjpLP MuJxkVbbjhnpr7OqbunD1eUcXKRgFBKZMETRje2/AySIRZBYnp2oc9MmNRMoOQ0SmJWP XFIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=bDt61LUPdRhrs/bpJJ2hvrkTZYTlnLNjwjvVcqJFWhM=; b=acGzqEh0g7AL40Kwq9XJPUTQ3lCOpF6I7woYgIWyzj3QHX4JS3y8HbMiYRHDBqwnXC RLoCkeb2lb9B04Zgd6laZjtcK9UKquxtJQhUvNT1TefhwIdXZnWJkCzgKpTOSVpMCyXP 02cAjz1RZwtskB0nVKzMKDr9FoViH2azzkYHR00PKjcZQEd3Bd5NG5/mprEJsQoRvU7D gCveDgkC0SPwur27FA75P9CWbZVwcB1HNgComQKovBoPkMqOQR5LuTlwmg3YHl517Ux5 S2BX34rU8yuxGn84PWB1DbpBvW+Mm1dABORQTuO1qXj4mCee7Lg1P07iJ4sf4I1pPZEv gfyw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=hcwVbcNJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id d25si13001121jam.64.2021.05.24.04.11.49; Mon, 24 May 2021 04:12:02 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=hcwVbcNJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232802AbhEXLLV (ORCPT + 99 others); Mon, 24 May 2021 07:11:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:36702 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232734AbhEXLLK (ORCPT ); Mon, 24 May 2021 07:11:10 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8775361153; Mon, 24 May 2021 11:09:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1621854582; bh=GVsPUYUbH6Fhhs9/c1HYG789KkLiGQmAFPvGxAEzfZw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hcwVbcNJ0Akpo4wTKnWBaTfvzngnBY9pvoRnrM6kiZoEiZBS+zyPHwbmI6J7k3Vfu +kmyyh5jCP5lGK4RelfJJgRC0u09ocQLXuL271GdSQQe5HOQ3UB+oyPyiL7tYWdrzF Efe217s5NENfYhE7A7VEFcDvj9lT/WNUulhVDllPe81oFARpMfKxSsxqHqCxCLDQSW TAHoOFJMTP0KrPiYaxuelbp3HiYJkeVXI65AHxn0dEbwWzzYhDAqkfpm1hWlc0bEyi EDgPW+nqgGTzB+tkXrfDEX+q/zR+EiUdz8JC6ZL05m/CDLo/kS9jE2eAfMtUwRR2J5 cwod2wQaCBeNA== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1ll8Sp-0006Pt-Hr; Mon, 24 May 2021 13:09:39 +0200 From: Johan Hovold To: Mauro Carvalho Chehab Cc: Hans Verkuil , linux-media@vger.kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com, stable@vger.kernel.org, Antti Palosaari Subject: [PATCH 3/3] media: rtl28xxu: fix zero-length control request Date: Mon, 24 May 2021 13:09:20 +0200 Message-Id: <20210524110920.24599-4-johan@kernel.org> X-Mailer: git-send-email 2.26.3 In-Reply-To: <20210524110920.24599-1-johan@kernel.org> References: <20210524110920.24599-1-johan@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation. Control transfers without a data stage are treated as OUT requests by the USB stack and should be using usb_sndctrlpipe(). Failing to do so will now trigger a warning. Fix the zero-length i2c-read request used for type detection by attempting to read a single byte instead. Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type") Cc: stable@vger.kernel.org # 4.0 Cc: Antti Palosaari Signed-off-by: Johan Hovold --- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c index 97ed17a141bb..2c04ed8af0e4 100644 --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c @@ -612,8 +612,9 @@ static int rtl28xxu_read_config(struct dvb_usb_device *d) static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name) { struct rtl28xxu_dev *dev = d_to_priv(d); + u8 buf[1]; int ret; - struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL}; + struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf}; dev_dbg(&d->intf->dev, "\n"); -- 2.26.3