* Re: [PATCH] media: i2c: mt9p031: fix endpoint parsing use-after-free
2026-06-13 8:48 [PATCH] media: i2c: mt9p031: fix endpoint parsing use-after-free Biren Pandya
@ 2026-06-15 7:41 ` Laurent Pinchart
2026-07-08 8:18 ` Sakari Ailus
2026-07-08 12:37 ` [PATCH v2] " Biren Pandya
2 siblings, 0 replies; 4+ messages in thread
From: Laurent Pinchart @ 2026-06-15 7:41 UTC (permalink / raw)
To: Biren Pandya; +Cc: linux-media, sakari.ailus, mchehab, linux-kernel
On Sat, Jun 13, 2026 at 02:18:49PM +0530, Biren Pandya wrote:
> The mt9p031_probe() function calls fwnode_handle_put(np) immediately
> after parsing the endpoint. However, it subsequently calls
> fwnode_property_read_u32() twice using the same 'np' handle, leading
> to a potential use-after-free.
>
> Fix this by moving fwnode_handle_put(np) to the end of the endpoint
> property reading block, and adding it to the error path of
> v4l2_fwnode_endpoint_parse().
>
> Signed-off-by: Biren Pandya <birenpandya@gmail.com>
> ---
> drivers/media/i2c/mt9p031.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
> index ea5d43d..04c17cb 100644
> --- a/drivers/media/i2c/mt9p031.c
> +++ b/drivers/media/i2c/mt9p031.c
> @@ -1075,15 +1075,18 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
> return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
>
> ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
> - fwnode_handle_put(np);
> - if (ret)
> + if (ret) {
> + fwnode_handle_put(np);
> return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
> + }
>
> fwnode_property_read_u32(np, "input-clock-frequency",
> &mt9p031->ext_freq);
> fwnode_property_read_u32(np, "pixel-clock-frequency",
> &mt9p031->target_freq);
>
> + fwnode_handle_put(np);
> +
This seems to be a candidate for __free().
> mt9p031->pixclk_pol = !!(endpoint.bus.parallel.flags &
> V4L2_MBUS_PCLK_SAMPLE_RISING);
>
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] media: i2c: mt9p031: fix endpoint parsing use-after-free
2026-06-13 8:48 [PATCH] media: i2c: mt9p031: fix endpoint parsing use-after-free Biren Pandya
2026-06-15 7:41 ` Laurent Pinchart
@ 2026-07-08 8:18 ` Sakari Ailus
2026-07-08 12:37 ` [PATCH v2] " Biren Pandya
2 siblings, 0 replies; 4+ messages in thread
From: Sakari Ailus @ 2026-07-08 8:18 UTC (permalink / raw)
To: Biren Pandya; +Cc: linux-media, laurent.pinchart, mchehab, linux-kernel
Hi Biren,
On Sat, Jun 13, 2026 at 02:18:49PM +0530, Biren Pandya wrote:
> The mt9p031_probe() function calls fwnode_handle_put(np) immediately
> after parsing the endpoint. However, it subsequently calls
> fwnode_property_read_u32() twice using the same 'np' handle, leading
> to a potential use-after-free.
>
> Fix this by moving fwnode_handle_put(np) to the end of the endpoint
> property reading block, and adding it to the error path of
> v4l2_fwnode_endpoint_parse().
>
> Signed-off-by: Biren Pandya <birenpandya@gmail.com>
> ---
> drivers/media/i2c/mt9p031.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
> index ea5d43d..04c17cb 100644
> --- a/drivers/media/i2c/mt9p031.c
> +++ b/drivers/media/i2c/mt9p031.c
> @@ -1075,15 +1075,18 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
> return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
>
> ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
> - fwnode_handle_put(np);
> - if (ret)
> + if (ret) {
> + fwnode_handle_put(np);
> return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
> + }
>
> fwnode_property_read_u32(np, "input-clock-frequency",
> &mt9p031->ext_freq);
> fwnode_property_read_u32(np, "pixel-clock-frequency",
> &mt9p031->target_freq);
Same comment on this one -- just move these before
v4l2_fwnode_endpoint_parse().
>
> + fwnode_handle_put(np);
> +
> mt9p031->pixclk_pol = !!(endpoint.bus.parallel.flags &
> V4L2_MBUS_PCLK_SAMPLE_RISING);
>
--
Regards,
Sakari Ailus
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v2] media: i2c: mt9p031: fix endpoint parsing use-after-free
2026-06-13 8:48 [PATCH] media: i2c: mt9p031: fix endpoint parsing use-after-free Biren Pandya
2026-06-15 7:41 ` Laurent Pinchart
2026-07-08 8:18 ` Sakari Ailus
@ 2026-07-08 12:37 ` Biren Pandya
2 siblings, 0 replies; 4+ messages in thread
From: Biren Pandya @ 2026-07-08 12:37 UTC (permalink / raw)
To: laurent.pinchart, sakari.ailus, mchehab, hverkuil, linux-media,
linux-kernel
Cc: Biren Pandya, stable
The mt9p031_parse_properties() function calls fwnode_handle_put(np)
immediately after parsing the endpoint. However, it subsequently reads
the 'input-clock-frequency' and 'pixel-clock-frequency' properties
using the same 'np' handle, leading to a use-after-free.
Fix the use-after-free by reordering the property reads to occur before
the endpoint is parsed and freed. Additionally, utilize the
__free(fwnode_handle) scoped guard to automate the endpoint's lifecycle
management, preventing future leaks and simplifying the error paths.
Fixes: 8f2da25e85c1 ("media: i2c: mt9p031: Switch from OF to fwnode API")
Cc: stable@vger.kernel.org
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
---
v2: reworded as the UAF fix it is; added Fixes/Cc stable; moved property reads before parse (Sakari); adopted __free (Laurent).
---
drivers/media/i2c/mt9p031.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index d21510caf45a8..4dcb6c973ef1c 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -9,6 +9,7 @@
* Based on the MT9V032 driver and Bastian Hecht's code.
*/
+#include <linux/cleanup.h>
#include <linux/clk.h>
#include <linux/delay.h>
#include <linux/device.h>
@@ -1067,23 +1068,22 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
struct v4l2_fwnode_endpoint endpoint = {
.bus_type = V4L2_MBUS_PARALLEL
};
- struct fwnode_handle *np;
int ret;
- np = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ struct fwnode_handle *np __free(fwnode_handle) =
+ fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
if (!np)
return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
- ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
- fwnode_handle_put(np);
- if (ret)
- return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
-
fwnode_property_read_u32(np, "input-clock-frequency",
&mt9p031->ext_freq);
fwnode_property_read_u32(np, "pixel-clock-frequency",
&mt9p031->target_freq);
+ ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
+ if (ret)
+ return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
+
mt9p031->pixclk_pol = !!(endpoint.bus.parallel.flags &
V4L2_MBUS_PCLK_SAMPLE_RISING);
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 4+ messages in thread