[PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[Zhao Feng]

The MCT U232-P9 has no bulk-in endpoint; received data arrives
through the interrupt-in endpoint of the second port, whose URB is
stashed in priv->read_urb by mct_u232_port_probe().  The generic
port->read_urb is only allocated for ports with a bulk-in endpoint
and therefore remains NULL for this device.

If submitting the read URB fails in mct_u232_open(), the error
message dereferences port->read_urb->pipe, causing a NULL pointer
dereference at offset 0x50 (the pipe field of struct urb), as
reported by syzbot on KASAN-enabled kernels.

Print the pipe of the URB that was actually submitted instead.

Reported-by: syzbot+58b2d8b19cd6761a395b@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
---
No Fixes tag: the buggy error message appears to date back to the
original driver import; the introducing commit could not be verified
with the trees available to me.

Not runtime-tested (no hardware).  The affected lines are identical
in current linux-next (drivers/usb/serial/mct_u232.c @ ddfe51b0a0f5),
so the patch applies there as-is.

 drivers/usb/serial/mct_u232.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index 6570c8817a..ad11697e3b 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -459,7 +459,7 @@ static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port)
 	if (retval) {
 		dev_err(&port->dev,
 			"usb_submit_urb(read) failed pipe 0x%x err %d\n",
-			port->read_urb->pipe, retval);
+			priv->read_urb->pipe, retval);
 		goto error;
 	}
 
-- 
2.39.2

Re: [PATCH] USB: serial: mct_u232: fix NULL deref in open error path

[Johan Hovold]

On Fri, Nov 06, 2026 at 04:12:54PM +0800, Zhao Feng wrote:
> The MCT U232-P9 has no bulk-in endpoint; received data arrives
> through the interrupt-in endpoint of the second port, whose URB is
> stashed in priv->read_urb by mct_u232_port_probe().  The generic
> port->read_urb is only allocated for ports with a bulk-in endpoint
> and therefore remains NULL for this device.
> 
> If submitting the read URB fails in mct_u232_open(), the error
> message dereferences port->read_urb->pipe, causing a NULL pointer
> dereference at offset 0x50 (the pipe field of struct urb), as
> reported by syzbot on KASAN-enabled kernels.
> 
> Print the pipe of the URB that was actually submitted instead.
> 
> Reported-by: syzbot+58b2d8b19cd6761a395b@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=58b2d8b19cd6761a395b
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
> ---

Thanks for the fix. I apparently beat you to it, though:

	https://lore.kernel.org/linux-usb/sashiko-outbox-201021@kernel.org

> No Fixes tag: the buggy error message appears to date back to the
> original driver import; the introducing commit could not be verified
> with the trees available to me.

No, this was introduced later by a clean up from myself.

Johan