ec168_i2c_xfer() checks the length of the register-address message in a combined demodulator read, but does not validate the read message length. Userspace can supply a zero-length read through I2C_RDWR. This reaches ec168_ctrl_msg(), which selects an IN control pipe for READ_DEMOD with wLength set to zero. The USB core treats control requests without a data stage as OUT(*), triggering the "BOGUS control dir" warning in usb_submit_urb(). Reject zero-length read messages with -EOPNOTSUPP before issuing the USB request, using the existing exit path to release the I2C mutex. (*) is_out = ... || !setup->wLength; Fixes: 2bf290be4f3e ("V4L/DVB (13364): ec168: add new driver for E3C EC168 DVB USB") Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e Signed-off-by: Andi Shyti Cc: # v2.6.33+ --- drivers/media/usb/dvb-usb-v2/ec168.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c index 973b32356b17..f6b98c7d3704 100644 --- a/drivers/media/usb/dvb-usb-v2/ec168.c +++ b/drivers/media/usb/dvb-usb-v2/ec168.c @@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], while (i < num) { if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) { if (msg[i].addr == ec168_ec100_config.demod_address) { - if (msg[i].len < 1) { + if (msg[i].len < 1 || msg[i+1].len < 1) { i = -EOPNOTSUPP; break; } -- 2.55.0