kernel/linux.git/drivers/media/rc/igorplugusb.c, branch v6.1.176

media: rc: igorplugusb: fix control request setup packet

2026-06-19T11:37:33+00:00

commit 171022c7d594c133a45f92357a2a91475edabe20 upstream. Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules. However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest. USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 Pass ir->request itself as the setup packet. Fixes: eac69475b01f ("media: rc: igorplugusb: heed coherency rules") Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51 Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5.5 Signed-off-by: Henri A Signed-off-by: Sean Young Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: rc: igorplugusb: heed coherency rules

2026-06-19T11:37:19+00:00

[ Upstream commit eac69475b01fe1e861dfe3960b57fa95671c132e ] In a control request, the USB request structure can be subject to DMA on some HCs. Hence it must obey the rules for DMA coherency. Allocate it separately. Fixes: b1c97193c6437 ("[media] rc: port IgorPlug-USB to rc-core") Cc: stable@vger.kernel.org Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Hans Verkuil [ replaced kzalloc_obj(*ir->request, GFP_KERNEL) with kzalloc(sizeof(*ir->request), GFP_KERNEL) ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

media: igorplugusb: use correct size pass to igorplugusb_probe()

2022-07-15T13:52:20+00:00

After 'buf_in' change to pointer, the sizeof() is not correct buffer size, it should be MAX_PACKET. Fixes: b3f820b905c9 ("media: igorplugusb: respect DMA coherency") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: igorplugusb: remove superfluous usb_unlink_urb()

2022-06-20T09:30:33+00:00

Calling that on yourself while the completion handler is running is a NOP. Remove it. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: igorplugusb: break cyclical race on disconnect

2022-06-20T09:30:33+00:00

The driver uses a timer, that may submit the URB and the URB may start the timer. No simple order of killing can break te cycle. Poison the URB before killing the timer. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: igorplugusb: prevent use after free in probe error

2022-06-20T09:30:33+00:00

The timer uses the URB. Free it only after the timer has been stopped. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: igorplugusb: respect DMA coherency

2022-06-20T09:30:32+00:00

The coherency rules mean that you cannot embed a buffer inside a descriptor. kmalloc() separately. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc-core: rename ir_raw_event_reset to ir_raw_event_overflow

2022-01-28T18:32:50+00:00

The driver report a reset event when the hardware reports and overflow. There is no reason to have a generic "reset" event. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: igorplugusb: receiver overflow should be reported

2021-12-14T14:09:13+00:00

Without this, some IR will be missing mid-stream and we might decode something which never really occurred. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc: harmonize infrared durations to microseconds

2020-09-03T14:18:55+00:00

rc-core kapi uses nanoseconds for infrared durations for receiving, and microseconds for sending. The uapi already uses microseconds for both, so this patch does not change the uapi. Infrared durations do not need nanosecond resolution. IR protocols do not have durations shorter than about 100 microseconds. Some IR hardware offers 250 microseconds resolution, which is sufficient for most protocols. Better hardware has 50 microsecond resolution and is enough for every protocol I am aware off. Unify on microseconds everywhere. This simplifies the code since less conversion between microseconds and nanoseconds needs to be done. This affects: - rx_resolution member of struct rc_dev - timeout member of struct rc_dev - duration member in struct ir_raw_event Cc: "Bruno Prémont" Cc: Hans Verkuil Cc: Maxim Levitsky Cc: Patrick Lerda Cc: Kevin Hilman Cc: Neil Armstrong Cc: Jerome Brunet Cc: Martin Blumenstingl Cc: Sean Wang Cc: Matthias Brugger Cc: Patrice Chotard Cc: Maxime Ripard Cc: Chen-Yu Tsai Cc: "David Härdeman" Cc: Benjamin Valentin Cc: Antti Palosaari Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab