Re: [PATCH 01/11] USB: serial: io_edgeport: fix NULL-deref on early status

[sashiko-bot@kernel.org]

> The driver submits the interrupt-in URB during probe or on first port
> open, which on completion may submit the bulk-in URB before all ports
> have been opened and their waitqueues have been initialised.
> 
> If a (malicious) device sends a status message for a port that has not
> yet been opened this may lead to a NULL-pointer dereference in the
> bulk-in completion handler when attempting to wakeup blocked tasks.
> 
> Move waitqueue initialisation from open() to port_probe() to address
> this.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+763813d65c7e18c1b6d5@syzkaller.appspotmail.com
> Link: https://lore.kernel.org/6a8818d8.ae6ddae5.3da009.0031.GAE@google.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Johan Hovold <johan@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021141154.2324793-1-johan@kernel.org?part=1