Commit 171022c7d594 for kernel

commit 171022c7d594c133a45f92357a2a91475edabe20
Author: Henri A <contact@henrialfonso.com>
Date:   Wed May 20 10:25:44 2026 -0400

    media: rc: igorplugusb: fix control request setup packet

    Commit eac69475b01f ("media: rc: igorplugusb: heed coherency
    rules") changed the control request storage from an embedded struct to
    an allocated pointer so it can obey DMA coherency rules.

    However, the driver still passes &ir->request to usb_fill_control_urb().
    That points the URB setup packet at the pointer field itself rather than
    at the allocated struct usb_ctrlrequest.

    USB core then interprets pointer bytes as the setup packet. This can
    produce an invalid bRequestType and trigger the control direction warning
    reported by syzbot:

      usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0

    Pass ir->request itself as the setup packet.

    Fixes: eac69475b01f ("media: rc: igorplugusb: heed coherency rules")
    Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51
    Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
    Cc: stable@vger.kernel.org
    Assisted-by: Codex:GPT-5.5
    Signed-off-by: Henri A <contact@henrialfonso.com>
    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index 3e10f6fe89f8..b5117ee9f5fa 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -184,7 +184,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
 	if (!ir->buf_in)
 		goto fail;
 	usb_fill_control_urb(ir->urb, udev,
-		usb_rcvctrlpipe(udev, 0), (uint8_t *)&ir->request,
+		usb_rcvctrlpipe(udev, 0), (uint8_t *)ir->request,
 		ir->buf_in, MAX_PACKET, igorplugusb_callback, ir);

 	usb_make_path(udev, ir->phys, sizeof(ir->phys));