[PATCH v4 0/3] media: uvcvideo: harden the frame buffer size computation

[Natasha Klaus <natalie.klaus@runtimeverification.com>]

uvc_parse_frame() computes dwMaxVideoFrameBufferSize as
bpp * wWidth * wHeight / 8 in int, from unvalidated descriptor
fields. The product wraps; the stored size is wrong and can be zero.

1/3 lets uvc_parse_frame() skip one frame descriptor instead of
failing the whole streaming interface (Ricardo's suggestion).
2/3 is Noam's overflow fix, adapted to skip.
3/3 skips a frame whose computed size is zero.

Stable: 1/3 carries Cc: stable without Fixes: because 2/3 needs it.
Both or neither.

Testing: Noam, UVC gadget over dummy_hcd, on v3 code; the >> 3 in
2/3 does not change the result for his inputs. No physical camera.
-ENODATA path not exercised. Builds W=1 on x86_64 and i386
allmodconfig.

Tools: prepared with Claude Code. It applied Ricardo's design in 1/3
and fixed the build, wrote the code and comment in 3/3 and found that
case, drafted the commit messages and notes from my outline, and did
the call path analysis. I reviewed and built everything. 2/3 is
Noam's; he found the overflow with Claude's help and wrote the fix by
hand (confirmed off-list).

v3: https://lore.kernel.org/linux-media/20260820111556.232652-1-natalie.klaus@runtimeverification.com/

Changes in v4:
- 2/3: >> 3 instead of DIV_ROUND_UP_ULL. Per Laurent on v3 2/3, width * bpp
  is a multiple of 8 on real devices. Keeps the stable fix minimal.
- 2/3 and 3/3 changelogs say how each case was found.
- No Assisted-by tag: removed from the docs in 1e035297ffda. Tool use
  is in this cover letter instead.
- Rebased onto d135ab453a74.

Changes in v3:
- Tested-by from Noam on all three.

Changes in v2:
- 1/3: check -ENODATA before counting the frame (Ricardo).
- 2/3: DIV_ROUND_UP -> DIV_ROUND_UP_ULL (Ricardo).
- Reviewed-by from Ricardo on all three.

Natasha Klaus (2):
  media: uvcvideo: Let uvc_parse_frame() report a skipped frame
  media: uvcvideo: Skip frame descriptors with a zero computed size

Noam Ben Shimon (1):
  media: uvcvideo: Fix integer overflow in frame buffer size calculation

 drivers/media/usb/uvc/uvc_driver.c | 52 ++++++++++++++++++++++--------
 1 file changed, 39 insertions(+), 13 deletions(-)


base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
-- 
2.34.1