Re: [PATCH v3] usb: gadget: uvc: Fix Null Pointer Dereference in uvcg_video_init()

Xu Yang <[email protected]> Thu, 30 Jul 2026 17:21:41 +0800

Newsgroups	org.kernel.vger.linux-usb,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID	<h4azn6c6p4vxsctlj37gs3jzzjndq5rrphaodcmknbsrf3ayr3@etv5qa6l6xzu>

On Thu, Jul 30, 2026 at 01:53:20PM +0530, Jeffin Philip wrote:
> In uvcg_video_init(), if kthread_run_worker() fails,
> the error logged uses uvcg_err(), however, the pointer it uses:
> video->uvc is not assigned at this point, triggering a null
> pointer dereference. Fix this by directly using uvc->func which
> is assigned already.
> 
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7
> Fixes: 7ea95b110811 (usb: gadget: uvc: rename functions to avoid conflicts with host uvc)

The issue was introduced by below commit instead:
  Fixes: f0bbfbd16b3b ("usb: gadget: uvc: rework to enqueue in pump worker from encoded queue")

Thanks,
Xu Yang