v4l2_fraction_to_interval() returns 0 when the caller passes numerator == 0 with a non-zero denominator. If this zero value is stored in video->interval, the isoc path in uvc_video_prep_requests() computes: nreq = DIV_ROUND_UP(video->interval, interval_duration); /* 0 */ req_size = DIV_ROUND_UP(video->imagesize + header_size, nreq); The second DIV_ROUND_UP divides by zero, crashing the kernel. Any local process that can open the UVC gadget's /dev/videoN and issue VIDIOC_S_PARM with timeperframe.numerator = 0 followed by VIDIOC_STREAMON triggers this immediately. Reject a zero interval in uvc_v4l2_s_parm() before it is stored. Fixes: 0525210c9840 ("usb: gadget: uvc: add VIDIOC_S_PARM and VIDIOC_G_PARM support") Cc: stable@vger.kernel.org Reviewed-by: Weibin Liu Signed-off-by: Liu Chao --- drivers/usb/gadget/function/uvc_v4l2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c index dfa0521a2..e9b9288c5 100644 --- a/drivers/usb/gadget/function/uvc_v4l2.c +++ b/drivers/usb/gadget/function/uvc_v4l2.c @@ -368,6 +368,11 @@ static int uvc_v4l2_s_parm(struct file *file, void *fh, video->interval = v4l2_fraction_to_interval(timeperframe.numerator, timeperframe.denominator); + if (!video->interval) { + uvcg_dbg(&uvc->func, "Invalid zero interval, rejecting\n"); + return -EINVAL; + } + uvcg_dbg(&uvc->func, "Setting frame interval to %u/%u (%u)\n", timeperframe.numerator, timeperframe.denominator, video->interval); -- 2.50.1