Re: [PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[Johan Hovold]

On Fri, Nov 06, 2026 at 04:12:54PM +0800, Zhao Feng wrote:
> The MCT U232-P9 has no bulk-in endpoint; received data arrives
> through the interrupt-in endpoint of the second port, whose URB is
> stashed in priv->read_urb by mct_u232_port_probe().  The generic
> port->read_urb is only allocated for ports with a bulk-in endpoint
> and therefore remains NULL for this device.
> 
> If submitting the read URB fails in mct_u232_open(), the error
> message dereferences port->read_urb->pipe, causing a NULL pointer
> dereference at offset 0x50 (the pipe field of struct urb), as
> reported by syzbot on KASAN-enabled kernels.
> 
> Print the pipe of the URB that was actually submitted instead.
> 
> Reported-by: syzbot+58b2d8b19cd6761a395b@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhao Feng <zhaofeng2@xxxxxxxxxxxxxxxxxxxx>
> ---

Thanks for the fix. I apparently beat you to it, though:

	https://lore.kernel.org/linux-usb/sashiko-outbox-201021@xxxxxxxxxx

> No Fixes tag: the buggy error message appears to date back to the
> original driver import; the introducing commit could not be verified
> with the trees available to me.

No, this was introduced later by a clean up from myself.

Johan