Re: [syzbot] [usb?] WARNING in ec168_ctrl_msg/usb_submit_urb

[Andi Shyti]

Hi,

On Sun, Oct 18, 2026 at 12:30:24PM -0400, Alan Stern wrote:
> On Sun, Oct 18, 2026 at 09:18:28AM -0700, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    4056b3c9d3c9 Merge tag 'nios2_update_for_v7.4' of git://gi..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11370ce1580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=7d1b274ca9837366
> > dashboard link: https://syzkaller.appspot.com/bug?extid=ed3ada41c4eb1c4ab78e
> > compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=114faaea580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=154faaea580000
> > 
> > Downloadable assets:
> > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-4056b3c9.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/811a43c89106/vmlinux-4056b3c9.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/2bb4f3abea76/bzImage-4056b3c9.xz
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+ed3ada41c4eb1c4ab78e@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> This looks like another example of a 0-length I2C-over-USB read.  It 
> would be nice if we could rule out these things at all at once, instead 
> of going after them piecemeal.
> 
> Alternatively, this WARN() in the USB core could be reduced to something 
> less severe in the case of length-0 control reads.  We haven't been 
> seeing very many instances of it apart from I2C, and those have only 
> occurred during fuzzing.

I am about to send a patch for it, we just need to disallow size
'0' read messages:

@@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 	while (i < num) {
 		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
 			if (msg[i].addr == ec168_ec100_config.demod_address) {
-				if (msg[i].len < 1) {
+				if (msg[i].len < 1 || msg[i+1].len < 1) {
 					i = -EOPNOTSUPP;
 					break;
 				}

Thanks,
Andi