[PATCH] media: dvb-usb-v2: ec168: Reject zero-length I2C reads

[PATCH] media: dvb-usb-v2: ec168: Reject zero-length I2C reads

[Andi Shyti]

ec168_i2c_xfer() checks the length of the register-address
message in a combined demodulator read, but does not validate the
read message length. Userspace can supply a zero-length read
through I2C_RDWR.

This reaches ec168_ctrl_msg(), which selects an IN control pipe
for READ_DEMOD with wLength set to zero. The USB core treats
control requests without a data stage as OUT(*), triggering the
"BOGUS control dir" warning in usb_submit_urb().

Reject zero-length read messages with -EOPNOTSUPP before issuing
the USB request, using the existing exit path to release the I2C
mutex.

(*) is_out = ... || !setup->wLength;

Fixes: 2bf290be4f3e ("V4L/DVB (13364): ec168: add new driver for E3C EC168 DVB USB")
Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Cc: <stable@vger.kernel.org> # v2.6.33+
---
 drivers/media/usb/dvb-usb-v2/ec168.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
index 973b32356b17..f6b98c7d3704 100644
--- a/drivers/media/usb/dvb-usb-v2/ec168.c
+++ b/drivers/media/usb/dvb-usb-v2/ec168.c
@@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 	while (i < num) {
 		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
 			if (msg[i].addr == ec168_ec100_config.demod_address) {
-				if (msg[i].len < 1) {
+				if (msg[i].len < 1 || msg[i+1].len < 1) {
 					i = -EOPNOTSUPP;
 					break;
 				}
-- 
2.55.0

Re: [PATCH] media: dvb-usb-v2: ec168: Reject zero-length I2C reads

[sashiko-bot]

> ec168_i2c_xfer() checks the length of the register-address
> message in a combined demodulator read, but does not validate the
> read message length. Userspace can supply a zero-length read
> through I2C_RDWR.
> 
> This reaches ec168_ctrl_msg(), which selects an IN control pipe
> for READ_DEMOD with wLength set to zero. The USB core treats
> control requests without a data stage as OUT(*), triggering the
> "BOGUS control dir" warning in usb_submit_urb().
> 
> Reject zero-length read messages with -EOPNOTSUPP before issuing
> the USB request, using the existing exit path to release the I2C
> mutex.
> 
> (*) is_out = ... || !setup->wLength;
> 
> Fixes: 2bf290be4f3e ("V4L/DVB (13364): ec168: add new driver for E3C EC168 DVB USB")
> Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
> Signed-off-by: Andi Shyti <andi.shyti@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019123542.4040472-1-andi.shyti@kernel.org?part=1

Re: [PATCH] media: dvb-usb-v2: ec168: Reject zero-length I2C reads

[Alan Stern]

On Mon, Oct 19, 2026 at 02:35:42PM +0200, Andi Shyti wrote:
> ec168_i2c_xfer() checks the length of the register-address
> message in a combined demodulator read, but does not validate the
> read message length. Userspace can supply a zero-length read
> through I2C_RDWR.
> 
> This reaches ec168_ctrl_msg(), which selects an IN control pipe
> for READ_DEMOD with wLength set to zero. The USB core treats
> control requests without a data stage as OUT(*), triggering the
> "BOGUS control dir" warning in usb_submit_urb().
> 
> Reject zero-length read messages with -EOPNOTSUPP before issuing
> the USB request, using the existing exit path to release the I2C
> mutex.
> 
> (*) is_out = ... || !setup->wLength;
> 
> Fixes: 2bf290be4f3e ("V4L/DVB (13364): ec168: add new driver for E3C EC168 DVB USB")
> Reported-by: syzbot+ed3ada41c4eb1c4ab78e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
> Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
> Cc: <stable@vger.kernel.org> # v2.6.33+
> ---
>  drivers/media/usb/dvb-usb-v2/ec168.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
> index 973b32356b17..f6b98c7d3704 100644
> --- a/drivers/media/usb/dvb-usb-v2/ec168.c
> +++ b/drivers/media/usb/dvb-usb-v2/ec168.c
> @@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
>  	while (i < num) {
>  		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
>  			if (msg[i].addr == ec168_ec100_config.demod_address) {
> -				if (msg[i].len < 1) {
> +				if (msg[i].len < 1 || msg[i+1].len < 1) {
>  					i = -EOPNOTSUPP;
>  					break;
>  				}

Isn't there an I2C quirks flag to indicate that 0-length reads aren't 
allowed?  Setting that flag would be more understandable than this test.

Alan Stern