[PATCH] USB: serial: mct_u232: fix NULL-deref on open() failure

[PATCH] USB: serial: mct_u232: fix NULL-deref on open() failure

[Johan Hovold]

The driver uses a second interrupt endpoint for reading but still
dereferences the port bulk-in URB pointer, which is no longer overridden
by the driver, in an error path.

Fix the dev_err() on failure to submit the read interrupt URB to avoid
dereferencing a NULL-pointer.

Fixes: 35807187e4b3 ("USB: mct_u232: clean up read implementation")
Reported-by: syzbot+58b2d8b19cd6761a395b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/6aed834c.dadc8e63.45095.0003.GAE@google.com
Cc: stable@vger.kernel.org	# 3.10
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/serial/mct_u232.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index a6de18917ec9..8a7aee2b26dd 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -457,7 +457,7 @@ static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port)
 	if (retval) {
 		dev_err(&port->dev,
 			"usb_submit_urb(read) failed pipe 0x%x err %d\n",
-			port->read_urb->pipe, retval);
+			priv->read_urb->pipe, retval);
 		goto error;
 	}
 
-- 
2.56.0