[PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[Zhao Feng]

The MCT U232-P9 has no bulk-in endpoint; received data arrives
through the interrupt-in endpoint of the second port, whose URB is
stashed in priv->read_urb by mct_u232_port_probe().  The generic
port->read_urb is only allocated for ports with a bulk-in endpoint
and therefore remains NULL for this device.

If submitting the read URB fails in mct_u232_open(), the error
message dereferences port->read_urb->pipe, causing a NULL pointer
dereference at offset 0x50 (the pipe field of struct urb), as
reported by syzbot on KASAN-enabled kernels.

Print the pipe of the URB that was actually submitted instead.

Reported-by: syzbot+58b2d8b19cd6761a395b@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
No Fixes tag: the buggy error message appears to date back to the
original driver import; the introducing commit could not be verified
with the trees available to me.

Not runtime-tested (no hardware).  The affected lines are identical
in current linux-next (drivers/usb/serial/mct_u232.c @ ddfe51b0a0f5),
so the patch applies there as-is.

 drivers/usb/serial/mct_u232.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index 6570c8817a..ad11697e3b 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -459,7 +459,7 @@ static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port)
 	if (retval) {
 		dev_err(&port->dev,
 			"usb_submit_urb(read) failed pipe 0x%x err %d\n",
-			port->read_urb->pipe, retval);
+			priv->read_urb->pipe, retval);
 		goto error;
 	}
 
-- 
2.39.2

Re: [PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] USB: serial: mct_u232: missing Fixes trailer for commit
  35807187e4b3
--

commit aa7ec61a20b2d78c30fb0a49d63ab051c4605906
Author: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

> USB: serial: mct_u232: fix NULL deref in open error path
>
> The MCT U232-P9 has no bulk-in endpoint; received data arrives
> through the interrupt-in endpoint of the second port, whose URB is
> stashed in priv->read_urb by mct_u232_port_probe().  The generic
> port->read_urb is only allocated for ports with a bulk-in endpoint
> and therefore remains NULL for this device.
>
> If submitting the read URB fails in mct_u232_open(), the error
> message dereferences port->read_urb->pipe, causing a NULL pointer
> dereference at offset 0x50 (the pipe field of struct urb), as
> reported by syzbot on KASAN-enabled kernels.
>
> Print the pipe of the URB that was actually submitted instead.
>
> Reported-by: syzbot+58b2d8b19cd6761a395b@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>

[Severity: Low]
Prior to 35807187e4b3 ("USB: mct_u232: clean up read implementation"),
mct_u232_startup() assigned rport->interrupt_in_urb to port->read_urb.
That commit moved the URB pointer to priv->read_urb and updated the
usb_submit_urb() call in mct_u232_open(), leaving port->read_urb->pipe in
the error path.  Should this include:

  Fixes: 35807187e4b3 ("USB: mct_u232: clean up read implementation")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106081254.1389-1-zhaofeng2@cmss.chinamobile.com?part=1

Re: [PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[Johan Hovold]

On Fri, Nov 06, 2026 at 04:12:54PM +0800, Zhao Feng wrote:
> The MCT U232-P9 has no bulk-in endpoint; received data arrives
> through the interrupt-in endpoint of the second port, whose URB is
> stashed in priv->read_urb by mct_u232_port_probe().  The generic
> port->read_urb is only allocated for ports with a bulk-in endpoint
> and therefore remains NULL for this device.
> 
> If submitting the read URB fails in mct_u232_open(), the error
> message dereferences port->read_urb->pipe, causing a NULL pointer
> dereference at offset 0x50 (the pipe field of struct urb), as
> reported by syzbot on KASAN-enabled kernels.
> 
> Print the pipe of the URB that was actually submitted instead.
> 
> Reported-by: syzbot+58b2d8b19cd6761a395b@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
> ---

Thanks for the fix. I apparently beat you to it, though:

	https://lore.kernel.org/linux-usb/sashiko-outbox-201021@kernel.org

> No Fixes tag: the buggy error message appears to date back to the
> original driver import; the introducing commit could not be verified
> with the trees available to me.

No, this was introduced later by a clean up from myself.

Johan