[PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[Zhao Feng]

The MCT U232-P9 has no bulk-in endpoint; received data arrives
through the interrupt-in endpoint of the second port, whose URB is
stashed in priv->read_urb by mct_u232_port_probe().  The generic
port->read_urb is only allocated for ports with a bulk-in endpoint
and therefore remains NULL for this device.

If submitting the read URB fails in mct_u232_open(), the error
message dereferences port->read_urb->pipe, causing a NULL pointer
dereference at offset 0x50 (the pipe field of struct urb), as
reported by syzbot on KASAN-enabled kernels.

Print the pipe of the URB that was actually submitted instead.

Reported-by: syzbot+58b2d8b19cd6761a395b@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhao Feng <zhaofeng2@xxxxxxxxxxxxxxxxxxxx>
---
No Fixes tag: the buggy error message appears to date back to the
original driver import; the introducing commit could not be verified
with the trees available to me.

Not runtime-tested (no hardware).  The affected lines are identical
in current linux-next (drivers/usb/serial/mct_u232.c @ ddfe51b0a0f5),
so the patch applies there as-is.

 drivers/usb/serial/mct_u232.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index 6570c8817a..ad11697e3b 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -459,7 +459,7 @@ static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port)
 	if (retval) {
 		dev_err(&port->dev,
 			"usb_submit_urb(read) failed pipe 0x%x err %d\n",
-			port->read_urb->pipe, retval);
+			priv->read_urb->pipe, retval);
 		goto error;
 	}
 
-- 
2.39.2