From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D7E0384238 for ; Tue, 16 Jun 2026 21:43:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781646223; cv=none; b=nieQVU2c/72si0rZB56pqmLOityz9eXH5uI4u8b2tmAjkKQZO44LKGM1BwkYCLjsF+/WmJUL/NQEkpqGeF+ZQJDuAoLFizuBbFAlG4zGqH7iW3b35Qsr4CUhgh6Jwo98pV3R/lP4aWvpjwd4xISC7nsa+L4oUPD/8idm9J2ygos= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781646223; c=relaxed/simple; bh=/Hs37zcNpwtyVvT2hh9IfdFDnL3CdV9f49cUgJRpxko=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=KxDBXw9W+8zcIkSvujJS1E2p4+EKxmLJFzteBVQnGaRE4XnI0IVjXjMLTDYyhPoSPOsgQ7xrEt084ij/RAh3n75BoVGmciZ+HABoDaqySsSCR2rtHagz6UIHNNeoStn+JzOunv4i0fyJxxBUBbDdOWLF2Bbp+axZ385kar3aRio= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KlLwcq3e; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KlLwcq3e" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-c85b73ffb52so2255692a12.3 for ; Tue, 16 Jun 2026 14:43:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781646222; x=1782251022; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Wuf6hY6fJuP1Fob6GRl/CCrYfo/S8Iq/mxxXiZHMvDc=; b=KlLwcq3esYn5OjnWQ2Ypghh/KkHhzkwrte+5aYWlTYhjRVK2poVf5q0JB7zVpUqTgG 7/lwEWlY51yf/N+8YqdSHJRtZ7GuFh7o4KTcoeOr2SYtX+lfZ7e0JxiJiuU9ck6YUmQ8 eu3ksujvxGWJTKSo+olGzZN6GpCMT3V4/1OZIaAotkNrZgH4f0YzBVqKEY3iXiTZh/kH YKbge1LEDwS3bBf+Lb+jBl3D0ImBDWn7fHC08iCAR3IF7/DoXP4Vkza3jJ6sDTmQwCyC 0OSUPXgJaShSDxEcIg8PurQR/4fUIBnvXSMWLx3VmNtsYgWVenMk3h6U1e+/7wotdmyg 7nAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781646222; x=1782251022; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Wuf6hY6fJuP1Fob6GRl/CCrYfo/S8Iq/mxxXiZHMvDc=; b=i8H2hlEp3oEYjiGsJzVWQ56SvI+2hcmUqL+IZwgcyvwLiSl2lhgzkuzMt1EK+kbkOp 2VXG0MEU4aXrDyFqscfIwOGF2aKl1RvYQ5+mM8Scq+8eR/XVJ2Lk0zV8ajuDhpmdjVzy X2AmM2JHNvo4q4M6b8+p8q0gZaViGMAAMo8ol6ER5tta6S6U57ZMtE+Yw3R9cY7KhhSX zvWF4oOPIBFeXEZfoPONeIP6//RF/0APm0eMDdasnz+nMTAkCuEvCAIu/RtlGsLrZI3S 8GitkJyww/dHgWR6eTRCftikJGyBScTATlJDZob8J6n8CYeYoMLFlbWMjjTsRQjwjaNv YH7w== X-Forwarded-Encrypted: i=1; AFNElJ97ry7CKhIjSYXZgIIhTx09U/k3eNT3JVcj9QfP0LoTz5GCl21iA1pfbULKEeG5NK+cYLmr+TXtdIKGUpQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzUbvf3+yijygC+hODYoqP5jugdQfqLBYwQrY4DOCTNUM3NooIq 49oJn5zWiSrYxUjVYmuSakovtM5Joio8Xco8BM6Cw7GO6zEN7yGyxSVZv3ucUw== X-Gm-Gg: Acq92OF6Wcvhgt+3dF9xFRjOztnqAuszjZTGeYg7dVVe1blxdQ+/RagzHvGxHafDF7c AbySuKmwFSbm58iO1QVezUqU1CvsCZGs1XgBaqBNnHrCNsuILimMHpatD88NPW5j/E+fYO9Kw53 U1UVYilOQMN3YYn5vfwZGzUpqsvU61z1F64vP2K+LdVLPpd2Hesol/vn81sSkC8t+X/+qPpoZRf KBxeOzJ7yGDM2HZjz+giDPLy3fM3YVx8dby027oJysLzvT8dCspZGuYJtUd+pGbFV8yjO3Y5icg lBfARYhjM1wAn6/fYdstEdPvvi1F2mUM0yqF0VeAoMleBR37YF/uIVbobaYL2vR1noJau5zaGu/ v8CvGny9+DIoVyTOwvVz8EInG0etwfMQODRdJOblTK+bsysKkfR/nZo2Gup6WdnQpH6zGiVpwOj UM2b7UCsOLmcngzu/XqucKnc1F2QhOQ8OokqZxBY5pVOW852w/0MeLHxa5qldj9Nio60RO75rmL xyxGWFPSnxLg/Y= X-Received: by 2002:a05:6a21:6190:b0:3b3:bdf5:1166 with SMTP id adf61e73a8af0-3b8b7feb3f5mr1115960637.39.1781646221920; Tue, 16 Jun 2026 14:43:41 -0700 (PDT) Received: from moksh-Nitro-ANV15-51.. ([203.192.239.31]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c866325e477sm12067256a12.10.2026.06.16.14.43.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 14:43:41 -0700 (PDT) From: Moksh Panicker To: sean@mess.org Cc: mchehab@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, Moksh Panicker , syzbot+2599e08a22e4565ea9f9@syzkaller.appspot.com Subject: [PATCH] media: rc: igorplugusb: Fix wrong pointer passed to usb_fill_control_urb() Date: Tue, 16 Jun 2026 21:43:34 +0000 Message-Id: <20260616214334.36525-1-mokshpanicker.7@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ir->request is already a pointer to struct usb_ctrlrequest, so passing &ir->request passes the address of the pointer rather than the pointer itself. This causes usb_submit_urb() to read garbage as the URB setup packet, resulting in a direction mismatch warning: usb 1-1: BOGUS control dir, pipe doesn't match bRequestType Fix this by passing ir->request directly instead of &ir->request. Reported-by: syzbot+2599e08a22e4565ea9f9@syzkaller.appspot.com Closes: https://syzkaller.appspot.com/bug?extid=2599e08a22e4565ea9f9 Signed-off-by: Moksh Panicker --- drivers/media/rc/igorplugusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c index 3e10f6fe8..b5117ee9f 100644 --- a/drivers/media/rc/igorplugusb.c +++ b/drivers/media/rc/igorplugusb.c @@ -184,7 +184,7 @@ static int igorplugusb_probe(struct usb_interface *intf, if (!ir->buf_in) goto fail; usb_fill_control_urb(ir->urb, udev, - usb_rcvctrlpipe(udev, 0), (uint8_t *)&ir->request, + usb_rcvctrlpipe(udev, 0), (uint8_t *)ir->request, ir->buf_in, MAX_PACKET, igorplugusb_callback, ir); usb_make_path(udev, ir->phys, sizeof(ir->phys)); -- 2.34.1