[PATCH v2] media: dvb-usb-v2: ec168: reject zero-length I2C reads

[Zhao Feng]

ec168_i2c_xfer() validates the length of the write-phase message of a
combined write-then-read transaction, but not the length of the
read-phase message.  A userspace I2C_RDWR ioctl on the adapter's
/dev/i2c node can therefore pass a zero-length read message, which
makes ec168_ctrl_msg() issue an IN-direction control transfer with
wLength == 0.

The USB core treats a zero-length control transfer as OUT-direction,
so it detects the pipe direction mismatch and emits the "BOGUS control
dir" dev_WARN_ONCE() in usb_submit_urb(), which panics on systems
running with panic_on_warn.

Reject zero-length reads the same way the driver already rejects
zero-length writes.

Fixes: 2bf290be4f3e ("V4L/DVB (13364): ec168: add new driver for E3C EC168 DVB USB")
Reported-by: syzbot+ed3ada41c4eb1c4ab78e@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzbot.org/bug?extid=ed3ada41c4eb1c4ab78e
Signed-off-by: Zhao Feng <zhaofeng2@xxxxxxxxxxxxxxxxxxxx>
---
v2: add missing spaces around '+' flagged by checkpatch, add Fixes tag.
    Link to v1: https://lore.kernel.org/linux-media/20261023025535.90-1-zhaofeng2@xxxxxxxxxxxxxxxxxxxx/

Note: Andi Shyti has posted an identical fix for the same syzbot
report (https://ci.syzbot.org/patches/80b80f7f-e688-493b-b3eb-1516027aec7b);
happy to defer to his version.

 drivers/media/usb/dvb-usb-v2/ec168.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
index 0e4773fc02..193c752b6a 100644
--- a/drivers/media/usb/dvb-usb-v2/ec168.c
+++ b/drivers/media/usb/dvb-usb-v2/ec168.c
@@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 	while (i < num) {
 		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
 			if (msg[i].addr == ec168_ec100_config.demod_address) {
-				if (msg[i].len < 1) {
+				if (msg[i].len < 1 || msg[i + 1].len < 1) {
 					i = -EOPNOTSUPP;
 					break;
 				}
-- 
2.39.2