[PATCH] media: cx231xx: preserve I2C transfer length

[Juan Perdomo]

The I2C core stores message lengths in u16, but cx231xx truncates them to
u8 when populating cx231xx_i2c_xfer_data. A 0x700-byte read therefore
becomes a zero-length request. USB treats zero-length control transfers as
OUT regardless of bRequestType, so the IN control pipe trips the
usb_submit_urb() direction warning.

Use u16 for buf_size, matching both i2c_msg.len and
VENDOR_REQUEST_IN.wLength. Oversized transfers then reach the existing
URB_MAX_CTRL_SIZE check and return -EINVAL.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Reported-by: syzbot+ddccc0c0dbc0a38ffccb@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=ddccc0c0dbc0a38ffccb
Tested-by: syzbot+ddccc0c0dbc0a38ffccb@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Juan Perdomo <jcperdomo100@xxxxxxxxx>
---
Testing:
- Syzbot reproduced the original USB direction warning on unpatched
  df290809 (Linux 7.3-rc2).
  https://syzkaller.appspot.com/x/report.txt?x=1107e749580000
- Built the complete cx231xx linked object on ARM64 with GCC 11.4.0,
  CONFIG_VIDEO_CX231XX=m and W=1.
- Syzbot tested the patch on df290809 (Linux 7.3-rc2) with Clang 22.1.8;
  the supplied reproducer did not trigger an issue.
  https://syzkaller.appspot.com/x/log.txt?x=1123f105580000

No physical-device testing was performed.

 drivers/media/usb/cx231xx/cx231xx.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/cx231xx/cx231xx.h b/drivers/media/usb/cx231xx/cx231xx.h
index 19f5036a7..f85d054fb 100644
--- a/drivers/media/usb/cx231xx/cx231xx.h
+++ b/drivers/media/usb/cx231xx/cx231xx.h
@@ -463,7 +463,7 @@ struct cx231xx_i2c_xfer_data {
 	u8 direction;		/* 1 - IN, 0 - OUT */
 	u8 saddr_len;		/* sub address len */
 	u16 saddr_dat;		/* sub addr data */
-	u8 buf_size;		/* buffer size */
+	u16 buf_size;		/* buffer size */
 	u8 *p_buffer;		/* pointer to the buffer */
 };
 

base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.50.1 (Apple Git-155)