On Tue Sep 8 00:07:34 2026 -0400, Juan Perdomo wrote:
> The I2C core stores message lengths in u16, but cx231xx truncates them to
> u8 when populating cx231xx_i2c_xfer_data. A 0x700-byte read therefore
> becomes a zero-length request. USB treats zero-length control transfers as
> OUT regardless of bRequestType, so the IN control pipe trips the
> usb_submit_urb() direction warning.
>
> Use u16 for buf_size, matching both i2c_msg.len and
> VENDOR_REQUEST_IN.wLength. Oversized transfers then reach the existing
> URB_MAX_CTRL_SIZE check and return -EINVAL.
>
> Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
> Cc: [email protected]
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=ddccc0c0dbc0a38ffccb
> Tested-by: [email protected]
> Signed-off-by: Juan Perdomo <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/usb/cx231xx/cx231xx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/usb/cx231xx/cx231xx.h
b/drivers/media/usb/cx231xx/cx231xx.h
index 19f5036a78d7..f85d054fbb5c 100644
--- a/drivers/media/usb/cx231xx/cx231xx.h
+++ b/drivers/media/usb/cx231xx/cx231xx.h
@@ -463,7 +463,7 @@ struct cx231xx_i2c_xfer_data {
u8 direction; /* 1 - IN, 0 - OUT */
u8 saddr_len; /* sub address len */
u16 saddr_dat; /* sub addr data */
- u8 buf_size; /* buffer size */
+ u16 buf_size; /* buffer size */
u8 *p_buffer; /* pointer to the buffer */
};
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
