[PATCH v5] usb: gadget: uvc: Fix Null Pointer Dereference in uvcg_video_init()

[PATCH v5] usb: gadget: uvc: Fix Null Pointer Dereference in uvcg_video_init()

[Jeffin Philip]

In uvcg_video_init(), if kthread_run_worker() fails,
the error logged uses uvcg_err(), however, the pointer it uses:
video->uvc is not assigned at this point, triggering a null
pointer dereference. Fix this by directly using uvc->func which
is assigned already.

Reported-by: syzbot+8dcac923582c28505fd7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7
Fixes: 7ea95b110811 ("usb: gadget: uvc: rename functions to avoid conflicts with host uvc")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
---
Changelog:
 -Small fixes addressed in v4 discussion
  https://lore.kernel.org/all/20260730093948.7800-1-jeffinphilip14@gmail.com/T/#u

 drivers/usb/gadget/function/uvc_video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 2f9700b3f1b6..9ba09118bb74 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -821,7 +821,7 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
 	/* Allocate a kthread for asynchronous hw submit handler. */
 	video->kworker = kthread_run_worker(0, "UVCG");
 	if (IS_ERR(video->kworker)) {
-		uvcg_err(&video->uvc->func, "failed to create UVCG kworker\n");
+		uvcg_err(&uvc->func, "failed to create UVCG kworker\n");
 		return PTR_ERR(video->kworker);
 	}

--
2.55.0

Re: [PATCH v5] usb: gadget: uvc: Fix Null Pointer Dereference in uvcg_video_init()

[Greg KH]

On Thu, Jul 30, 2026 at 06:09:41PM +0530, Jeffin Philip wrote:
> In uvcg_video_init(), if kthread_run_worker() fails,
> the error logged uses uvcg_err(), however, the pointer it uses:
> video->uvc is not assigned at this point, triggering a null
> pointer dereference. Fix this by directly using uvc->func which
> is assigned already.
> 
> Reported-by: syzbot+8dcac923582c28505fd7@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7
> Fixes: 7ea95b110811 ("usb: gadget: uvc: rename functions to avoid conflicts with host uvc")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
> ---
> Changelog:
>  -Small fixes addressed in v4 discussion
>   https://lore.kernel.org/all/20260730093948.7800-1-jeffinphilip14@gmail.com/T/#u
> 
>  drivers/usb/gadget/function/uvc_video.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
> index 2f9700b3f1b6..9ba09118bb74 100644
> --- a/drivers/usb/gadget/function/uvc_video.c
> +++ b/drivers/usb/gadget/function/uvc_video.c
> @@ -821,7 +821,7 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
>  	/* Allocate a kthread for asynchronous hw submit handler. */
>  	video->kworker = kthread_run_worker(0, "UVCG");
>  	if (IS_ERR(video->kworker)) {
> -		uvcg_err(&video->uvc->func, "failed to create UVCG kworker\n");
> +		uvcg_err(&uvc->func, "failed to create UVCG kworker\n");
>  		return PTR_ERR(video->kworker);
>  	}
> 
> --
> 2.55.0
> 

Dropped due to lack of following directions...

Re: [PATCH v5] usb: gadget: uvc: Fix Null Pointer Dereference in uvcg_video_init()

[Jeffin Philip]

Hi Greg, 
Apologies for the noise and flooding the queue. I understand the situation
and am stepping back.

Thanks,
Jeffin.