5.10-stable patches

added patches:
	media-rc-igorplugusb-fix-control-request-setup-packet.patch
	media-rc-ttusbir-fix-inverted-error-logic.patch

diff --git a/queue-5.10/media-rc-igorplugusb-fix-control-request-setup-packet.patch b/queue-5.10/media-rc-igorplugusb-fix-control-request-setup-packet.patch
new file mode 100644 (file)
index 0000000..20c67af
--- /dev/null
+++ b/queue-5.10/media-rc-igorplugusb-fix-control-request-setup-packet.patch
@@ -0,0 +1,50 @@
+From 171022c7d594c133a45f92357a2a91475edabe20 Mon Sep 17 00:00:00 2001
+From: Henri A <contact@henrialfonso.com>
+Date: Wed, 20 May 2026 10:25:44 -0400
+Subject: media: rc: igorplugusb: fix control request setup packet
+
+From: Henri A <contact@henrialfonso.com>
+
+commit 171022c7d594c133a45f92357a2a91475edabe20 upstream.
+
+Commit eac69475b01f ("media: rc: igorplugusb: heed coherency
+rules") changed the control request storage from an embedded struct to
+an allocated pointer so it can obey DMA coherency rules.
+
+However, the driver still passes &ir->request to usb_fill_control_urb().
+That points the URB setup packet at the pointer field itself rather than
+at the allocated struct usb_ctrlrequest.
+
+USB core then interprets pointer bytes as the setup packet. This can
+produce an invalid bRequestType and trigger the control direction warning
+reported by syzbot:
+
+  usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0
+
+Pass ir->request itself as the setup packet.
+
+Fixes: eac69475b01f ("media: rc: igorplugusb: heed coherency rules")
+Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51
+Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
+Cc: stable@vger.kernel.org
+Assisted-by: Codex:GPT-5.5
+Signed-off-by: Henri A <contact@henrialfonso.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/igorplugusb.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/rc/igorplugusb.c
++++ b/drivers/media/rc/igorplugusb.c
+@@ -183,7 +183,7 @@ static int igorplugusb_probe(struct usb_
+               goto fail;
+ 
+       usb_fill_control_urb(ir->urb, udev,
+-              usb_rcvctrlpipe(udev, 0), (uint8_t *)&ir->request,
++              usb_rcvctrlpipe(udev, 0), (uint8_t *)ir->request,
+               ir->buf_in, sizeof(ir->buf_in), igorplugusb_callback, ir);
+ 
+       usb_make_path(udev, ir->phys, sizeof(ir->phys));

diff --git a/queue-5.10/media-rc-ttusbir-fix-inverted-error-logic.patch b/queue-5.10/media-rc-ttusbir-fix-inverted-error-logic.patch
new file mode 100644 (file)
index 0000000..50ee584
--- /dev/null
+++ b/queue-5.10/media-rc-ttusbir-fix-inverted-error-logic.patch
@@ -0,0 +1,33 @@
+From 646ebdd3105809d84ed04aa9e92e47e89cc44502 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Fri, 10 Apr 2026 23:03:09 +0200
+Subject: media: rc: ttusbir: fix inverted error logic
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 646ebdd3105809d84ed04aa9e92e47e89cc44502 upstream.
+
+We have to report ENOMEM if no buffer is allocated.
+Typo dropped a "!". Restore it.
+
+Fixes: 50acaad3d202 ("media: rc: ttusbir: respect DMA coherency rules")
+Cc: stable@vger.kernel.org
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/ttusbir.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/rc/ttusbir.c
++++ b/drivers/media/rc/ttusbir.c
+@@ -193,7 +193,7 @@ static int ttusbir_probe(struct usb_inte
+       tt = kzalloc(sizeof(*tt), GFP_KERNEL);
+       buffer = kzalloc(5, GFP_KERNEL);
+       rc = rc_allocate_device(RC_DRIVER_IR_RAW);
+-      if (!tt || !rc || buffer) {
++      if (!tt || !rc || !buffer) {
+               ret = -ENOMEM;
+               goto out;
+       }

diff --git a/queue-5.10/series b/queue-5.10/series
index 2667b03248f916f825cd1267e473f9014a02c0f1..f4272a6b4cf8e6c12d3c00076951ed6c38f65757 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -340,3 +340,5 @@ arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch
 fbdev-vt8500lcdfb-fix-dma_free_coherent-cpu_addr-parameter.patch
 apparmor-validate-default-dfa-states-are-in-bounds.patch
 x86-cpu-amd-move-the-zen3-btc_no-detection-to-the-zen3-init-function.patch
+media-rc-ttusbir-fix-inverted-error-logic.patch
+media-rc-igorplugusb-fix-control-request-setup-packet.patch