diff options
| author | Wei Jie Law <98lawweijie@gmail.com> | 2026-09-07 20:18:43 +0800 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-10-02 08:34:58 +0200 |
| commit | daa379e2b74d6c10ba4e3b56eeca5aa8c8704fca (patch) | |
| tree | 199affad0080d1ae8a6bd2365afd38a1dcac1e3b /drivers/media | |
| parent | f0e024045d80a9b37da973f8f94f088f320d62d8 (diff) | |
media: uvcvideo: Fix NULL deref on events for uninitialized controls
A null-ptr-deref exists in v6.12.105 and upstream. KASAN crash log:
KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
Workqueue: events uvc_ctrl_status_event_work
RIP: 0010:uvc_ctrl_status_event+0x105/0x280
uvc_ctrl_status_event_work+0x82/0x240
process_one_work+0x66f/0x10b0
XU controls are initialized lazily, on the first UVCIOC_CTRL_MAP or
UVCIOC_CTRL_QUERY. Until then ctrl->info is all zeroes, so
info.mappings is not a valid list head, list_empty() returns false, and
uvc_ctrl_status_event() walks it from a NULL next pointer.
Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Cc: stable@vger.kernel.org
Signed-off-by: Wei Jie Law <98lawweijie@gmail.com>
Assisted-by: LLM
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260907121844.2592492-1-98lawweijie@gmail.com
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/usb/uvc/uvc_ctrl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 3ca108b83f1d..ea28c4e819bd 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -2209,7 +2209,7 @@ bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain, struct uvc_device *dev = chain->dev; struct uvc_ctrl_work *w = &dev->async_ctrl; - if (list_empty(&ctrl->info.mappings)) + if (!ctrl->initialized || list_empty(&ctrl->info.mappings)) return false; w->data = data; |