Forwarded: Re: [syzbot] [usb?] WARNING in dib0700_ctrl_rd/usb_submit_urb

[syzbot <syzbot+0cd0fb4cf3f4722d6663@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [usb?] WARNING in dib0700_ctrl_rd/usb_submit_urb
Author: contact@henrialfonso.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 9afe652958c3

diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
  index 986e552f0a97..000000000000 100644
  @@ -311,6 +311,11 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap,
                        st->buf[0] = REQUEST_I2C_READ;
                        st->buf[1] |= 1;

  +                     if (msg[i + 1].len == 0) {
  +                             result = -EINVAL;
  +                             goto unlock;
  +                     }
  +
                        /* special thing in the current firmware: when length is zero the read-failed */
                        len = dib0700_ctrl_rd(d, st->buf, msg[i].len + 2,
                                              st->buf, msg[i + 1].len);