Re: [syzbot] [usb?] WARNING in ec168_ctrl_msg/usb_submit_urb

[Alan Stern]

On Sun, Oct 18, 2026 at 09:18:28AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    4056b3c9d3c9 Merge tag 'nios2_update_for_v7.4' of git://gi..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11370ce1580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=7d1b274ca9837366
> dashboard link: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=114faaea580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=154faaea580000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-4056b3c9.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/811a43c89106/vmlinux-4056b3c9.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2bb4f3abea76/bzImage-4056b3c9.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ed3ada41c4eb1c4ab78e@xxxxxxxxxxxxxxxxxxxxxxxxx

This looks like another example of a 0-length I2C-over-USB read.  It 
would be nice if we could rule out these things at all at once, instead 
of going after them piecemeal.

Alternatively, this WARN() in the USB core could be reduced to something 
less severe in the case of length-0 control reads.  We haven't been 
seeing very many instances of it apart from I2C, and those have only 
occurred during fuzzing.

Alan Stern

> ------------[ cut here ]------------
> usb 5-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
> WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0 drivers/usb/core/urb.c:411, CPU#0: syz.0.17/5521
> Modules linked in:
> CPU: 0 UID: 0 PID: 5521 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:usb_submit_urb+0x1100/0x18b0 drivers/usb/core/urb.c:411
> Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89
> RSP: 0000:ffffc9000228f8d8 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff888044085800 RCX: 0000000080000280
> RDX: ffff88801317fa20 RSI: ffffffff8cc57b40 RDI: ffffffff91885110
> RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000
> R10: ffffc9000228f9c0 R11: fffff52000451f44 R12: 1ffff11003c397d4
> R13: ffff88801e1cbea0 R14: ffff88801317fa20 R15: 0000000080000280
> FS:  0000555560660500(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f1c3f68e000 CR3: 00000000440b1000 CR4: 0000000000352ef0
> Call Trace:
>  <TASK>
>  usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
>  usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
>  usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
>  ec168_ctrl_msg+0x308/0x7c0 drivers/media/usb/dvb-usb-v2/ec168.c:73
>  ec168_i2c_xfer+0x10e/0x630 drivers/media/usb/dvb-usb-v2/ec168.c:127
>  __i2c_transfer+0x7bf/0x1fe0 drivers/i2c/i2c-core-base.c:-1
>  i2c_transfer+0x1cb/0x2d0 drivers/i2c/i2c-core-base.c:2350
>  i2cdev_ioctl_rdwr+0x460/0x740 drivers/i2c/i2c-dev.c:306
>  i2cdev_ioctl+0x6a5/0x880 drivers/i2c/i2c-dev.c:467
>  vfs_ioctl fs/ioctl.c:51 [inline]