[PATCH] media: dvb-usb-v2: ec168: Reject zero-length I2C reads

[Andi Shyti <andi.shyti@kernel.org>]

ec168_i2c_xfer() checks the length of the register-address
message in a combined demodulator read, but does not validate the
read message length. Userspace can supply a zero-length read
through I2C_RDWR.

This reaches ec168_ctrl_msg(), which selects an IN control pipe
for READ_DEMOD with wLength set to zero. The USB core treats
control requests without a data stage as OUT(*), triggering the
"BOGUS control dir" warning in usb_submit_urb().

Reject zero-length read messages with -EOPNOTSUPP before issuing
the USB request, using the existing exit path to release the I2C
mutex.

(*) is_out = ... || !setup->wLength;

Fixes: 2bf290be4f3e ("V4L/DVB (13364): ec168: add new driver for E3C EC168 DVB USB")
Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Cc: <stable@vger.kernel.org> # v2.6.33+
---
 drivers/media/usb/dvb-usb-v2/ec168.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
index 973b32356b17..f6b98c7d3704 100644
--- a/drivers/media/usb/dvb-usb-v2/ec168.c
+++ b/drivers/media/usb/dvb-usb-v2/ec168.c
@@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 	while (i < num) {
 		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
 			if (msg[i].addr == ec168_ec100_config.demod_address) {
-				if (msg[i].len < 1) {
+				if (msg[i].len < 1 || msg[i+1].len < 1) {
 					i = -EOPNOTSUPP;
 					break;
 				}
-- 
2.55.0