Re: [PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] USB: serial: mct_u232: missing Fixes trailer for commit
  35807187e4b3
--

commit aa7ec61a20b2d78c30fb0a49d63ab051c4605906
Author: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

> USB: serial: mct_u232: fix NULL deref in open error path
>
> The MCT U232-P9 has no bulk-in endpoint; received data arrives
> through the interrupt-in endpoint of the second port, whose URB is
> stashed in priv->read_urb by mct_u232_port_probe().  The generic
> port->read_urb is only allocated for ports with a bulk-in endpoint
> and therefore remains NULL for this device.
>
> If submitting the read URB fails in mct_u232_open(), the error
> message dereferences port->read_urb->pipe, causing a NULL pointer
> dereference at offset 0x50 (the pipe field of struct urb), as
> reported by syzbot on KASAN-enabled kernels.
>
> Print the pipe of the URB that was actually submitted instead.
>
> Reported-by: syzbot+58b2d8b19cd6761a395b@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

[Severity: Low]
Prior to 35807187e4b3 ("USB: mct_u232: clean up read implementation"),
mct_u232_startup() assigned rport->interrupt_in_urb to port->read_urb.
That commit moved the URB pointer to priv->read_urb and updated the
usb_submit_urb() call in mct_u232_open(), leaving port->read_urb->pipe in
the error path.  Should this include:

  Fixes: 35807187e4b3 ("USB: mct_u232: clean up read implementation")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106081254.1389-1-zhaofeng2@cmss.chinamobile.com?part=1