[PATCH] media: rc: igorplugusb: Fix wrong pointer passed to usb_fill_control_urb()

[PATCH] media: rc: igorplugusb: Fix wrong pointer passed to usb_fill_control_urb()

[Moksh Panicker]

ir->request is already a pointer to struct usb_ctrlrequest, so passing
&ir->request passes the address of the pointer rather than the pointer
itself. This causes usb_submit_urb() to read garbage as the URB setup
packet, resulting in a direction mismatch warning:

  usb 1-1: BOGUS control dir, pipe doesn't match bRequestType

Fix this by passing ir->request directly instead of &ir->request.

Reported-by: syzbot+2599e08a22e4565ea9f9@syzkaller.appspot.com
Closes: https://syzkaller.appspot.com/bug?extid=2599e08a22e4565ea9f9
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
 drivers/media/rc/igorplugusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index 3e10f6fe8..b5117ee9f 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -184,7 +184,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
 	if (!ir->buf_in)
 		goto fail;
 	usb_fill_control_urb(ir->urb, udev,
-		usb_rcvctrlpipe(udev, 0), (uint8_t *)&ir->request,
+		usb_rcvctrlpipe(udev, 0), (uint8_t *)ir->request,
 		ir->buf_in, MAX_PACKET, igorplugusb_callback, ir);
 
 	usb_make_path(udev, ir->phys, sizeof(ir->phys));
-- 
2.34.1

Re: [PATCH] media: rc: igorplugusb: Fix wrong pointer passed to usb_fill_control_urb()

[Sean Young]

On Tue, Jun 16, 2026 at 09:43:34PM +0000, Moksh Panicker wrote:
> ir->request is already a pointer to struct usb_ctrlrequest, so passing
> &ir->request passes the address of the pointer rather than the pointer
> itself. This causes usb_submit_urb() to read garbage as the URB setup
> packet, resulting in a direction mismatch warning:
> 
>   usb 1-1: BOGUS control dir, pipe doesn't match bRequestType
> 
> Fix this by passing ir->request directly instead of &ir->request.

Already fixed and merged upstream, see commit
171022c7d594c133a45f92357a2a91475edabe20.

Thanks,

Sean

> 
> Reported-by: syzbot+2599e08a22e4565ea9f9@syzkaller.appspot.com
> Closes: https://syzkaller.appspot.com/bug?extid=2599e08a22e4565ea9f9
> Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
> ---
>  drivers/media/rc/igorplugusb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
> index 3e10f6fe8..b5117ee9f 100644
> --- a/drivers/media/rc/igorplugusb.c
> +++ b/drivers/media/rc/igorplugusb.c
> @@ -184,7 +184,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
>  	if (!ir->buf_in)
>  		goto fail;
>  	usb_fill_control_urb(ir->urb, udev,
> -		usb_rcvctrlpipe(udev, 0), (uint8_t *)&ir->request,
> +		usb_rcvctrlpipe(udev, 0), (uint8_t *)ir->request,
>  		ir->buf_in, MAX_PACKET, igorplugusb_callback, ir);
>  
>  	usb_make_path(udev, ir->phys, sizeof(ir->phys));
> -- 
> 2.34.1
>