diff options
| author | Juan Perdomo <jcperdomo100@gmail.com> | 2026-09-08 00:07:34 -0400 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-09-10 14:21:05 +0200 |
| commit | a19c9502a69bbd42c18816b09cbefdeb4cb68066 (patch) | |
| tree | 42a2e53bafa51a4abf16103728634a60b734dbb4 | |
| parent | 489ac9a332f162246290930f9c497661720627dd (diff) | |
| download | linux-next-a19c9502a69bbd42c18816b09cbefdeb4cb68066.tar.gz linux-next-a19c9502a69bbd42c18816b09cbefdeb4cb68066.zip | |
media: cx231xx: preserve I2C transfer length
The I2C core stores message lengths in u16, but cx231xx truncates them to
u8 when populating cx231xx_i2c_xfer_data. A 0x700-byte read therefore
becomes a zero-length request. USB treats zero-length control transfers as
OUT regardless of bRequestType, so the IN control pipe trips the
usb_submit_urb() direction warning.
Use u16 for buf_size, matching both i2c_msg.len and
VENDOR_REQUEST_IN.wLength. Oversized transfers then reach the existing
URB_MAX_CTRL_SIZE check and return -EINVAL.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: stable@kernel.org
Reported-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ddccc0c0dbc0a38ffccb
Tested-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com
Signed-off-by: Juan Perdomo <jcperdomo100@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
| -rw-r--r-- | drivers/media/usb/cx231xx/cx231xx.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/cx231xx/cx231xx.h b/drivers/media/usb/cx231xx/cx231xx.h index 19f5036a78d7..f85d054fbb5c 100644 --- a/drivers/media/usb/cx231xx/cx231xx.h +++ b/drivers/media/usb/cx231xx/cx231xx.h @@ -463,7 +463,7 @@ struct cx231xx_i2c_xfer_data { u8 direction; /* 1 - IN, 0 - OUT */ u8 saddr_len; /* sub address len */ u16 saddr_dat; /* sub addr data */ - u8 buf_size; /* buffer size */ + u16 buf_size; /* buffer size */ u8 *p_buffer; /* pointer to the buffer */ }; |