[PATCH] media: dvb-usb-v2: ec168: reject zero-length I2C reads

[Zhao Feng]

ec168_i2c_xfer() validates the length of the write-phase message of a
combined write-then-read transaction, but not the length of the
read-phase message.  A userspace I2C_RDWR ioctl on the adapter's
/dev/i2c node can therefore pass a zero-length read message, which
makes ec168_ctrl_msg() issue an IN-direction control transfer with
wLength == 0.

The USB core treats a zero-length control transfer as OUT-direction,
so it detects the pipe direction mismatch and emits the "BOGUS control
dir" dev_WARN_ONCE() in usb_submit_urb(), which panics on systems
running with panic_on_warn.

Reject zero-length reads the same way the driver already rejects
zero-length writes.

Reported-by: syzbot+ed3ada41c4eb1c4ab78e@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzbot.org/bug?extid=ed3ada41c4eb1c4ab78e
Signed-off-by: Zhao Feng <zhaofeng2@xxxxxxxxxxxxxxxxxxxx>
---
 drivers/media/usb/dvb-usb-v2/ec168.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
index 0e4773fc02..c45bebe5af 100644
--- a/drivers/media/usb/dvb-usb-v2/ec168.c
+++ b/drivers/media/usb/dvb-usb-v2/ec168.c
@@ -115,7 +115,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 	while (i < num) {
 		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
 			if (msg[i].addr == ec168_ec100_config.demod_address) {
-				if (msg[i].len < 1) {
+				if (msg[i].len < 1 || msg[i+1].len < 1) {
 					i = -EOPNOTSUPP;
 					break;
 				}
-- 
2.39.2