media: uvcvideo: fix division by zero at stream start

jhovold · mchehab · commit 8aa637bf6d70 · 2021-12-07T11:29:53.000+01:00
Add the missing bulk-endpoint max-packet sanity check to uvc_video_start_transfer() to avoid division by zero in uvc_alloc_urb_buffers() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: c0efd23 ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org # 2.6.26 Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
@@ -1963,6 +1963,10 @@ static int uvc_video_start_transfer(struct uvc_streaming *stream,
 		if (ep == NULL)
 			return -EIO;
 
+		/* Reject broken descriptors. */
+		if (usb_endpoint_maxp(&ep->desc) == 0)
+			return -EIO;
+
 		ret = uvc_init_video_bulk(stream, ep, gfp_flags);
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -1963,6 +1963,10 @@ static int uvc_video_start_transfer(struct uvc_streaming *stream,`
`1963`	`1963`	`if (ep == NULL)`
`1964`	`1964`	`return -EIO;`
`1965`	`1965`
	`1966`	`+ /* Reject broken descriptors. */`
	`1967`	`+ if (usb_endpoint_maxp(&ep->desc) == 0)`
	`1968`	`+ return -EIO;`
	`1969`	`+`
`1966`	`1970`	`ret = uvc_init_video_bulk(stream, ep, gfp_flags);`
`1967`	`1971`	`}`
`1968`	`1972`