Description
In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules. However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest. USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 Pass ir->request itself as the setup packet.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bc04b8633b375af6ac8a8bb615258b80fe06cdaa to < e823e4294511989f5962e7ad85bf4d179ba74f52affected81f0fb813e4bf28b3ca28dc218938a32eb48f740 to < 2243ad78ce64d344754260533ae7730c2174a34aaffected0e84aa8fc23c7578f105e3a2160f9d0aa2bed79a to < aa22590a16e51455c6db802c774b31aadc604a9aaffected18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a to < 060fca8e098387f949e4eedaf215d952e477ac12affected0be8fcd9005e3d3b5a61fe34b070a9663adbb4dc to < 0d880d2db9856e94127ab09331363bef59f98005affected0adac0ee2c42027d80bac02ea9b576a88f8955d3 to < f33b5a61673bd220fdaaf4202cf1013d6d66c943affecteda62ca67e3c72fb297dc7c86495ba8f7329d7f150 to < 5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15affectedeac69475b01fe1e861dfe3960b57fa95671c132e to < 171022c7d594c133a45f92357a2a91475edabe20affected
Linux Linux
Default version status: unaffected
6.6.140 to < 6.6.143affected6.12.86 to < 6.12.93affected6.18.27 to < 6.18.35affected7.0.4 to < 7.0.12affected
References
- https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52 ↗
- https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a ↗
- https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a ↗
- https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12 ↗
- https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005 ↗
- https://git.kernel.org/stable/c/f33b5a61673bd220fdaaf4202cf1013d6d66c943 ↗
- https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15 ↗
- https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20 ↗