[PATCH] Fix Null Pointer Dereference in uvcg_video_init()

[PATCH] Fix Null Pointer Dereference in uvcg_video_init()

[Jeffin Philip]

uvcg_video_init references video->uvc before assigning it
leading to a null pointer dereference. Fix this by assigning
video->uvc first and then dereferencing it later.

Reported-by: syzbot+8dcac923582c28505fd7@syzkaller.appspotmail.com
Fixes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
---
 drivers/usb/gadget/function/uvc_video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 2f9700b3f1b6..cb532654b9b8 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -806,6 +806,7 @@ int uvcg_video_enable(struct uvc_video *video)
  */
 int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
 {
+	video->uvc = uvc;
 	video->is_enabled = false;
 	INIT_LIST_HEAD(&video->ureqs);
 	INIT_LIST_HEAD(&video->req_free);
@@ -829,7 +830,6 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
 
 	sched_set_fifo(video->kworker->task);
 
-	video->uvc = uvc;
 	video->fcc = V4L2_PIX_FMT_YUYV;
 	video->bpp = 16;
 	video->width = 320;
-- 
2.55.0

Re: [PATCH] Fix Null Pointer Dereference in uvcg_video_init()

[Greg KH]

On Thu, Jul 30, 2026 at 11:27:05AM +0530, Jeffin Philip wrote:
> uvcg_video_init references video->uvc before assigning it
> leading to a null pointer dereference. Fix this by assigning
> video->uvc first and then dereferencing it later.

Please say _when_ this dereference happens (i.e. in an error path only,
right?)

> Reported-by: syzbot+8dcac923582c28505fd7@syzkaller.appspotmail.com
> Fixes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7
> Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>

No cc: stable or Fixes: tag?

thanks,

greg k-h

Re: [PATCH] Fix Null Pointer Dereference in uvcg_video_init()

[Xu Yang]

On Thu, Jul 30, 2026 at 11:27:05AM +0530, Jeffin Philip wrote:
> uvcg_video_init references video->uvc before assigning it
> leading to a null pointer dereference. Fix this by assigning
> video->uvc first and then dereferencing it later.

The subject should indicate the subsystem: 
  usb: gadget: uvc: Fix Null Pointer Dereference in uvcg_video_init()

Please refer to: https://www.kernel.org/doc/html/latest/process/submitting-patches.html

> 
> Reported-by: syzbot+8dcac923582c28505fd7@syzkaller.appspotmail.com
> Fixes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7

Not Fixes, it should be:
  Closes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7

> Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
> ---
>  drivers/usb/gadget/function/uvc_video.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
> index 2f9700b3f1b6..cb532654b9b8 100644
> --- a/drivers/usb/gadget/function/uvc_video.c
> +++ b/drivers/usb/gadget/function/uvc_video.c
> @@ -806,6 +806,7 @@ int uvcg_video_enable(struct uvc_video *video)
>   */
>  int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
>  {
> +	video->uvc = uvc;
>  	video->is_enabled = false;
>  	INIT_LIST_HEAD(&video->ureqs);
>  	INIT_LIST_HEAD(&video->req_free);
> @@ -829,7 +830,6 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
>  
>  	sched_set_fifo(video->kworker->task);
>  
> -	video->uvc = uvc;
>  	video->fcc = V4L2_PIX_FMT_YUYV;
>  	video->bpp = 16;
>  	video->width = 320;

It's caused by below code:
  uvcg_err(&video->uvc->func, "failed to create UVCG kworker\n");

Would directly use "&uvc->func" be more reasonable?

Thanks,
Xu Yang