[BUG] dev_WARN_ONCE "BOGUS control dir" -- drivers/usb/core/urb.c:413 (dtcs033)

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/156-gspca-dtcs033-control-urb-wrong-pipe-dir/

  usb 3-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType 40
  WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1074/0x18c0,
CPU#1: repro/9497
  Call Trace:
   usb_start_wait_urb+0x13f/0x5b0
   usb_control_msg+0x234/0x3e0
   reg_reqs+0x216/0x590
   gspca_init_transfer+0x2470/0x3060
   gspca_start_streaming+0x6f/0x250
   vb2_start_streaming+0x128/0x460
   vb2_core_streamon+0x2e0/0x4f0
   __video_do_ioctl+0xadb/0xca0
   video_usercopy+0x876/0x1450
   v4l2_ioctl+0x18d/0x1e0
   __se_sys_ioctl+0xfc/0x170
   do_syscall_64+0x155/0x510

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,