[PATCH v3] media: i2c: mt9p031: Fix Use-After-Free in mt9p031_parse_properties()

[PATCH v3] media: i2c: mt9p031: Fix Use-After-Free in mt9p031_parse_properties()

[Biren Pandya]

The mt9p031_parse_properties() function calls fwnode_handle_put(np) to
release the fwnode handle. However, immediately after this call, np is
used in fwnode_property_read_u32(), leading to a Use-After-Free bug.

Use the __free(fwnode_handle) attribute for the np pointer to automate
cleanup. This allows us to remove the manual fwnode_handle_put(np) call,
ensuring the handle is only dropped when the function returns, thus
preventing the Use-After-Free.

Fixes: 8d4da37c3006 ("[media] media: i2c: mt9p031: add OF support")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
---
Changes in v3:
- Fixed the incorrect commit hash in the Fixes tag that caused checkpatch to fail.

Changes in v2:
- Utilized __free(fwnode_handle) to automate cleanup and safely fix the UAF
  as suggested by reviewers.
---
 drivers/media/i2c/mt9p031.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index ea5d43d925ffa..3b3714b0ef8f3 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -1067,15 +1067,14 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
 	struct v4l2_fwnode_endpoint endpoint = {
 		.bus_type = V4L2_MBUS_PARALLEL
 	};
-	struct fwnode_handle *np;
+	struct fwnode_handle *np __free(fwnode_handle) =
+		fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
 	int ret;
 
-	np = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
 	if (!np)
 		return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
 
 	ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
-	fwnode_handle_put(np);
 	if (ret)
 		return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
 
-- 
2.50.1 (Apple Git-155)