[PATCH] USB: serial: usb_wwan: handle urb allocation failure

[Johan Hovold <johan@kernel.org>]

Make sure to bail out from probe if URB allocation fails to avoid ever
dereferencing a NULL-pointer in usb_wwan_write() or on resume of an open
port.

Note that URB allocation is not expected to fail unless doing fault
injection.

The usb_wwan_write() issue was flagged by Sashiko.

Fixes: 58cfe9113e48 ("[PATCH] USB: add Option Card driver")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/serial/usb_wwan.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 6beb4062bda3..92362565796d 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -343,8 +343,7 @@ int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port)
 	/* Start reading from the IN endpoint */
 	for (i = 0; i < N_IN_URB; i++) {
 		urb = portdata->in_urbs[i];
-		if (!urb)
-			continue;
+
 		err = usb_submit_urb(urb, GFP_KERNEL);
 		if (err) {
 			dev_err(&port->dev,
@@ -465,6 +464,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
 						USB_DIR_IN, port,
 						buffer, IN_BUFLEN,
 						usb_wwan_indat_callback);
+		if (!urb)
+			goto bail_out_error;
+
 		portdata->in_urbs[i] = urb;
 	}
 
@@ -478,6 +480,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
 						USB_DIR_OUT, port,
 						buffer, OUT_BUFLEN,
 						usb_wwan_outdat_callback);
+		if (!urb)
+			goto bail_out_error2;
+
 		portdata->out_urbs[i] = urb;
 	}
 
-- 
2.55.0