[PATCH] Fix Null Pointer Dereference in uvcg_video_init()

From: Jeffin Philip

Date: Thu Jul 30 2026 - 02:01:00 EST


uvcg_video_init references video->uvc before assigning it
leading to a null pointer dereference. Fix this by assigning
video->uvc first and then dereferencing it later.

Reported-by: syzbot+8dcac923582c28505fd7@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: https://syzkaller.appspot.com/bug?extid=8dcac923582c28505fd7
Signed-off-by: Jeffin Philip <jeffinphilip14@xxxxxxxxx>
---
drivers/usb/gadget/function/uvc_video.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 2f9700b3f1b6..cb532654b9b8 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -806,6 +806,7 @@ int uvcg_video_enable(struct uvc_video *video)
*/
int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
{
+ video->uvc = uvc;
video->is_enabled = false;
INIT_LIST_HEAD(&video->ureqs);
INIT_LIST_HEAD(&video->req_free);
@@ -829,7 +830,6 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)

sched_set_fifo(video->kworker->task);

- video->uvc = uvc;
video->fcc = V4L2_PIX_FMT_YUYV;
video->bpp = 16;
video->width = 320;
--
2.55.0