Commit 2c5ecf0
Ocean: Reject a zero maximal payload transfer size instead of dividing by it
Summary:
`determineIsochronousTransferLayout()` divides by `endpointPacketSize` at line 581, reached whenever `endpointPacketSize >= maxPayloadTransferSize`. `endpointPacketSize` starts at 0 and stays 0 for an altsetting with no endpoints - which is exactly the zero-bandwidth altsetting 0 of a UVC streaming interface, and that altsetting must exist, because the caller only takes this path when the interface has more than one altsetting. So with `maxPayloadTransferSize == 0` the condition reads `0 >= 0`, the gate opens and the division runs with a zero divisor. The `ocean_assert(endpointPacketSize >= 1u)` directly above is compiled out in release builds.
The consequence is architecture dependent. On x86 the division raises `#DE` and the process takes SIGFPE. On AArch64 `udiv` by zero does not trap, it produces 0, so the function silently returns altsetting 0 with `transferSize`, `packetsPerTransfer` and `bytesPerPacket` all zero, and the caller then submits degenerate zero-length isochronous transfers.
Two changes. `determineIsochronousTransferLayout()` returns -1 immediately for a zero payload size, since no altsetting can satisfy a transfer of that size and the only reason the loop appeared to match one was the same zero. A separate `endpointPacketSize != 0u` guard is not needed on top: once the payload size is at least 1, `endpointPacketSize >= maxPayloadTransferSize` already implies the divisor is non-zero.
And `VideoDevice::start()` now aborts on a zero `dwMaxPayloadTransferSize` rather than only logging. That check sat between two neighbours which both release the subscription and return, and was the odd one out in forwarding the value anyway. It also covers the bulk path, which the early return in `Device` does not reach and which otherwise builds a zero-length transfer.
landed-with-radar-review
Reviewed By: enpe
Differential Revision: D115344588
fbshipit-source-id: d36d1644beabbda112a19ab87f44093b8ec39aa81 parent b53e32a commit 2c5ecf0
2 files changed
Lines changed: 9 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
531 | 531 | | |
532 | 532 | | |
533 | 533 | | |
| 534 | + | |
| 535 | + | |
| 536 | + | |
| 537 | + | |
| 538 | + | |
| 539 | + | |
534 | 540 | | |
535 | 541 | | |
536 | 542 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1912 | 1912 | | |
1913 | 1913 | | |
1914 | 1914 | | |
| 1915 | + | |
| 1916 | + | |
| 1917 | + | |
1915 | 1918 | | |
1916 | 1919 | | |
1917 | 1920 | | |
| |||
0 commit comments