Re: [PATCH] Fix Null Pointer Dereference in uvcg_video_init()

On Thu, Jul 30, 2026 at 11:27:05AM +0530, Jeffin Philip wrote:
> uvcg_video_init references video->uvc before assigning it
> leading to a null pointer dereference. Fix this by assigning
> video->uvc first and then dereferencing it later.

The subject should indicate the subsystem: 
  usb: gadget: uvc: Fix Null Pointer Dereference in uvcg_video_init()

Please refer to: https://www.kernel.org/doc/html/latest/process/submitting-patches.html

> 
> Reported-by: [email protected]
> Fixes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7

Not Fixes, it should be:
  Closes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7

> Signed-off-by: Jeffin Philip <[email protected]>
> ---
>  drivers/usb/gadget/function/uvc_video.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
> index 2f9700b3f1b6..cb532654b9b8 100644
> --- a/drivers/usb/gadget/function/uvc_video.c
> +++ b/drivers/usb/gadget/function/uvc_video.c
> @@ -806,6 +806,7 @@ int uvcg_video_enable(struct uvc_video *video)
>   */
>  int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
>  {
> +	video->uvc = uvc;
>  	video->is_enabled = false;
>  	INIT_LIST_HEAD(&video->ureqs);
>  	INIT_LIST_HEAD(&video->req_free);
> @@ -829,7 +830,6 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
>  
>  	sched_set_fifo(video->kworker->task);
>  
> -	video->uvc = uvc;
>  	video->fcc = V4L2_PIX_FMT_YUYV;
>  	video->bpp = 16;
>  	video->width = 320;

It's caused by below code:
  uvcg_err(&video->uvc->func, "failed to create UVCG kworker\n");

Would directly use "&uvc->func" be more reasonable?

Thanks,
Xu Yang