Forwarded: Re: [syzbot] [usb?] WARNING in dib0700_ctrl_rd/usb_submit_urb

[syzbot <syzbot+0cd0fb4cf3f4722d6663@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [usb?] WARNING in dib0700_ctrl_rd/usb_submit_urb
Author: contact@henrialfonso.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 9afe652958c3

diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
index 986e552f0a97..000000000000 100644
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -311,6 +311,11 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
 			st->buf[0] = REQUEST_I2C_READ;
 			st->buf[1] |= 1;
 
+			if (msg[i + 1].len == 0) {
+				result = -EINVAL;
+				goto unlock;
+			}
+
 			/* special thing in the current firmware: when length is zero the read-failed */
 			len = dib0700_ctrl_rd(d, st->buf, msg[i].len + 2,
 					      st->buf, msg[i + 1].len);