[PATCH v2] media: v4l2-subdev: fix use-after-free in v4l2_subdev_get_fwnode_pad_1_to_1

[PATCH v2] media: v4l2-subdev: fix use-after-free in v4l2_subdev_get_fwnode_pad_1_to_1

[Biren Pandya]

The fwnode reference returned by fwnode_graph_get_port_parent() is
currently dropped immediately via fwnode_handle_put(), but the pointer
is subsequently passed to device_match_fwnode(). This creates a
Use-After-Free vulnerability if the fwnode is freed before the match
completes.

Fix this by using the modern __free(fwnode_handle) macro to ensure the
reference is held for the duration of the function and automatically
dropped when it goes out of scope.

Signed-off-by: Biren Pandya <birenpandya@gmail.com>

---

Changes in v2:

- Rebased on latest media_tree.

- Combined the two mutually exclusive v1 submissions into a single
  patch utilizing the modern scoped_guard/__free approach.

- Updated subsystem prefix to 'media: v4l2-subdev:' based on
  historical usage.
---
 drivers/media/v4l2-core/v4l2-subdev.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
index 831c69c958b8a..e6b133ef78504 100644
--- a/drivers/media/v4l2-core/v4l2-subdev.c
+++ b/drivers/media/v4l2-core/v4l2-subdev.c
@@ -7,7 +7,7 @@
  * Contact: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  *	    Sakari Ailus <sakari.ailus@iki.fi>
  */
-
+#include <linux/cleanup.h>
 #include <linux/export.h>
 #include <linux/ioctl.h>
 #include <linux/leds.h>
@@ -1243,7 +1243,7 @@ const struct v4l2_file_operations v4l2_subdev_fops = {
 int v4l2_subdev_get_fwnode_pad_1_to_1(struct media_entity *entity,
 				      struct fwnode_endpoint *endpoint)
 {
-	struct fwnode_handle *fwnode;
+	struct fwnode_handle *fwnode __free(fwnode_handle) = NULL;
 	struct v4l2_subdev *sd;
 
 	if (!is_media_entity_v4l2_subdev(entity))
@@ -1252,7 +1252,6 @@ int v4l2_subdev_get_fwnode_pad_1_to_1(struct media_entity *entity,
 	sd = media_entity_to_v4l2_subdev(entity);
 
 	fwnode = fwnode_graph_get_port_parent(endpoint->local_fwnode);
-	fwnode_handle_put(fwnode);
 
 	if (device_match_fwnode(sd->dev, fwnode))
 		return endpoint->port;
-- 
2.50.1 (Apple Git-155)