[PATCH] usb: gadget: uvc: reject zero interval in uvc_v4l2_s_parm()

[PATCH] usb: gadget: uvc: reject zero interval in uvc_v4l2_s_parm()

[Liu Chao]

v4l2_fraction_to_interval() returns 0 when the caller passes
numerator == 0 with a non-zero denominator.  If this zero value is
stored in video->interval, the isoc path in uvc_video_prep_requests()
computes:

    nreq = DIV_ROUND_UP(video->interval, interval_duration);  /* 0 */
    req_size = DIV_ROUND_UP(video->imagesize + header_size, nreq);

The second DIV_ROUND_UP divides by zero, crashing the kernel.

Any local process that can open the UVC gadget's /dev/videoN and issue
VIDIOC_S_PARM with timeperframe.numerator = 0 followed by
VIDIOC_STREAMON triggers this immediately.

Reject a zero interval in uvc_v4l2_s_parm() before it is stored.

Fixes: 0525210c9840 ("usb: gadget: uvc: add VIDIOC_S_PARM and VIDIOC_G_PARM support")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/function/uvc_v4l2.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c
index dfa0521a2..e9b9288c5 100644
--- a/drivers/usb/gadget/function/uvc_v4l2.c
+++ b/drivers/usb/gadget/function/uvc_v4l2.c
@@ -368,6 +368,11 @@ static int uvc_v4l2_s_parm(struct file *file, void *fh,
 	video->interval = v4l2_fraction_to_interval(timeperframe.numerator,
 						    timeperframe.denominator);
 
+	if (!video->interval) {
+		uvcg_dbg(&uvc->func, "Invalid zero interval, rejecting\n");
+		return -EINVAL;
+	}
+
 	uvcg_dbg(&uvc->func, "Setting frame interval to %u/%u (%u)\n",
 		 timeperframe.numerator, timeperframe.denominator,
 		 video->interval);
-- 
2.50.1