linux-kernel - Re: [PATCH v2] media: usb: uvc: Fix NULL pointer dereference during USB device hot-unplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANiDSCtNuYbxH9JH1=1NisDQy+b+SahpvGw3BjyvT4PXX=FO_w@mail.gmail.com>
Date: Mon, 24 Nov 2025 10:06:58 +0100
From: Ricardo Ribalda <ribalda@...omium.org>
To: Jie Deng <dengjie03@...inos.cn>
Cc: laurent.pinchart@...asonboard.com, hansg@...nel.org, mchehab@...nel.org, 
	kieran.bingham@...asonboard.com, linux-media@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] media: usb: uvc: Fix NULL pointer dereference during
 USB device hot-unplug

Hi Jie



On Mon, 24 Nov 2025 at 04:08, Jie Deng <dengjie03@...inos.cn> wrote:
>
> Hi Ricardo
>
> Thank you for your reply
>
> 在 2025/11/22 16:17, Ricardo Ribalda 写道:
> > Hi Jie
> >
> > On Sat, 22 Nov 2025 at 08:26, Jie Deng <dengjie03@...inos.cn> wrote:
> >> Add safety checks to prevent kernel panic during the race window in
> >> USB device disconnection.
> > Can you share the kernel version that you are using?
> The kernel version I'm using is 5.4.18
> >
> > This patch
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c93d73c9c2cfa7658f7100d201a47c4856746222
> > Should prevent the race that you are describing.
> >
> >
> > In your trace you have a reference to uvc_queue_streamoff that was
> > deleted by that patch
>
> This patch may indeed eliminate the problem I described.
>
> The 5.4 longterm version should not have synchronized this patch？

Seems that the patch that fixed the issue:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/media/usb/uvc/uvc_driver.c?id=c9ec6f1736363b2b2bb4e266997389740f628441

Was only backported until 5.10

5.4 is EOL this December. So it is probably not worth doing anything more.

Regards!

>
>
> Thanks,
>
> Jie Deng
>


-- 
Ricardo Ribalda