[BUG] media: dvb-usb-v2: gl861: WARNING in usb_submit_urb due to bogus control direction

[ZW Tang]

Hi,

I am reporting a WARNING triggered by a syzkaller reproducer in the
GL861 DVB USB driver.

Although a similar bug has been reported before, I can still trigger
this warning on Linux 7.2-rc3 with the attached syzkaller reproducer.

The warning is emitted from usb_submit_urb() because the USB control
transfer direction appears inconsistent:

usb 3-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
WARNING: CPU: 0 PID: 4359 at drivers/usb/core/urb.c:412
usb_submit_urb+0x117a/0x18d0 drivers/usb/core/urb.c:410

This looks like a driver-side control-message construction or
validation issue in the GL861 DVB USB driver, rather than a USB core
problem. The reproducer creates a dummy GL861 USB device, opens the
corresponding I2C device, and issues an I2C_SMBUS ioctl. The execution
path reaches gl861_i2c_master_xfer(), then gl861_ctrl_msg(), and
finally usb_control_msg()/usb_submit_urb().

In the observed crash, the driver submits a vendor IN control request
with bRequestType 0xc0, but USB core reports that the control pipe
direction does not match the request direction/length. This may be
related to insufficient validation of zero-length or malformed
I2C/SMBus read requests before calling gl861_ctrl_msg().

The system panics afterwards because panic_on_warn is enabled.

Reproducer:
console output: https://pastebin.com/raw/NDGEuRHC
kernel config: https://pastebin.com/raw/ysywjhc0
syz reproducer:

# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"repeat":true,"procs":5,"slowdown":1,"sandbox":"","sandbox_arg":0,"close_fds":false,"callcomments":true}
syz_usb_connect(0x5, 0x24,
&(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"],
0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000380)={0x1, 0x10, 0x0, 0x0})

Kernel:
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2-rc3


Crash signature:

WARNING: CPU: 0 PID: 4359 at drivers/usb/core/urb.c:412
usb_submit_urb+0x117a/0x18d0
usb 3-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0

Call trace:

usb_submit_urb
usb_start_wait_urb
usb_control_msg
gl861_ctrl_msg
gl861_i2c_master_xfer
__i2c_transfer
__i2c_smbus_xfer
i2c_smbus_xfer
i2cdev_ioctl_smbus
i2cdev_ioctl
__se_sys_ioctl
do_syscall_64
entry_SYSCALL_64_after_hwframe



Thanks