Re: [syzbot] [usb?] WARNING in dtv5100_i2c_msg/usb_submit_urb

[Oliver Neukum <oneukum@suse.com>]

On 27.05.25 04:02, syzbot wrote:

> 
> ------------[ cut here ]------------
> usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
> WARNING: CPU: 0 PID: 5833 at drivers/usb/core/urb.c:413 usb_submit_urb+0x1112/0x1870 drivers/usb/core/urb.c:411

[..]
> Call Trace:
>   <TASK>
>   usb_start_wait_urb+0x114/0x4c0 drivers/usb/core/message.c:59
>   usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
>   usb_control_msg+0x232/0x3e0 drivers/usb/core/message.c:154
>   dtv5100_i2c_msg+0x250/0x330 drivers/media/usb/dvb-usb/dtv5100.c:60
>   dtv5100_i2c_xfer+0x1a4/0x3c0 drivers/media/usb/dvb-usb/dtv5100.c:86

Hi,

these transfers are done via control transfers to endpoint 0.
So this is not yet another one of those cases that a driver fails
to verify that it operates on the intended hardware.
I'd say that a driver can assume that endpoint 0 exists and is
a control endpoint.

But I am afraid we never check that. Should we?

	Regards
		Oliver