From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DF6C44E041 for ; Wed, 8 Jul 2026 12:37:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783514261; cv=none; b=SP0Ut4Zy08/viLkp9OqPFyE1bSt/YYt4Pykbtl3WrmiBA1rxS8xHqzfB0r1pL0yr2kOZWuyJcSTWyn23aMRRC5hoHVOxTElupuiifSTNqmPweKnaEsDbbiRX8BojURMvtTace3ymB4CKLWbM4dQEpzaXG4Wcg/k0dz06vPl1AOI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783514261; c=relaxed/simple; bh=TY4aCopFbN3dYhQmkdEiXOewerjmzHG8UUy9gUxqM/I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RJcyoZH1NGe6ike8JxnGkh3rhc6nVdArJYykgsxGZSTM3ZlvTADUr9uhlPRbmt7ZhTM+FxFeRp0k3mUN6m6uRhIB0SC9gQlv7KN+VRKSJfL/j0uSU5xC1nObeXSEiAfnn1WttnD9WRbcg4tWanKgencZkJJQNZG7EaA0QALiZ8o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HfnJ9r26; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HfnJ9r26" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38125cebfdaso748613a91.1 for ; Wed, 08 Jul 2026 05:37:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783514258; x=1784119058; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=m2NCGWcB63pGFQ2fmc+yu9xWhLG7x52oZf2ocF8l0Sg=; b=HfnJ9r26VJ8gaIMhf7uOQ8PK+JrPFA+v8ZCEYRbT6d/oj1DRfadhl8puYbayvibIC7 d5AvgUmlRFq+F+eXkChdXwTnt3SnkTZeNCEJkUzz/dUiJ5tzWPKzA/z3AoBB/oSfV+4o Frpqroa5+70UACQmamXVd0YYA6AxdyHf9HNUvM/sIQdiCJ6a11wDLtAuVs4CaEssZiZ3 bsh4/tQY88/981ilxcHjIQiJfgjFasa5l0UZ3Tvcugw9+yOyhMqYVMrlec5Xq2q2h3XI HG4r281GZZmCmfyG2HTKBR9GUCj/cbMR0ii4ARJtTzmAH+Dy6lZv/mTIrB3H4ncU0s2j GN2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783514258; x=1784119058; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=m2NCGWcB63pGFQ2fmc+yu9xWhLG7x52oZf2ocF8l0Sg=; b=iKubzGHWpcXXn6pNE3bQzvHvGR+AXHk2IfZCHu4SaGRc2GsER05JGp+9zb4cw7Qa9k tg6mM8wYhk9q4YvKVPW96WPIoO2wSN9D04CsHhS9jXLsmHsx2mlVXNTnfPwrpORCp34E 9leYVEdocvHkr2YlQCHaT2WqpkZR/httprNJ50yRz/908D8jbKqg9dKGn1vsy9y1QUgE LdgfEKuNASp88O1SaAwPGgRm6qD28KrnxYe9L2Top8pEyXZmwPsXaKQDCMC7+cmlYml+ ILs+TIjRbocwQCOPXawA06bg4pH35uoxyIWrWA6c8Na+e9jncKp9Ffbi8l4VVh4SW7ng wghw== X-Forwarded-Encrypted: i=1; AHgh+RqzMFny8MOZ0caJvATNiCjDq8wDoFizM3UQvO7TWDPaJwzyQqmnS8Q6evUtRQ61m0N2y82vzOgwVHM/fQQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzgMaNUvJa415RanB+psO0PxyJHAgv5/wVQiQBNR1BNKTsG9Aii anDx4BkvjIncnCKl71eulTfKiysO5kQ/wbrp1FtT54BtvkScMHOCigTn X-Gm-Gg: AfdE7cmpiX9edzb9IYOErerUkwEGBEChSTietBDS816W0pdW42rrfYAhlBmAnRRFose 2moJNVAqnN+eeewI3NWqvEieAmDGN/w/W4pyS5jc6ttiAjX9+JT33ysfWL8Ic5+iqX58FRHzgoh /dhFAN8KgNr3B/QPDknTNNQKDHghVenieTGPhksq828NIzngWBJwiAxQZXgLgPxqli+FjUouxQx mvfeFUyN4us7ubWx7U+x5Xe99eeg0QZn72O4fK4u7VcTqC+8pxU51jiUTgSiDp4USpATF73KXJL XEubJGyjGwWUEYztFtHttOzAWTVwvTm9NeE4ZqRvUTph9Rh3SuytSLonZWooXgV2qrRlUPtDmJQ kfFIi/w/Bssh/T9YEVTWqNdG8lvWnhcHjBFmBkztGDBOulzimNs7P3ame/dmSBg77YHLlsJsxLE kO73p0jHC396dh6vnAeuAkPGYdjV+x6Sf+ZTjHdASoIUg= X-Received: by 2002:a05:6a20:2d06:b0:3bf:6c08:2844 with SMTP id adf61e73a8af0-3c0bd252e38mr3247489637.51.1783514258356; Wed, 08 Jul 2026 05:37:38 -0700 (PDT) Received: from localhost.localdomain ([49.207.223.101]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31174a92eccsm18701979eec.23.2026.07.08.05.37.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 08 Jul 2026 05:37:37 -0700 (PDT) From: Biren Pandya To: laurent.pinchart@ideasonboard.com, sakari.ailus@linux.intel.com, mchehab@kernel.org, hverkuil@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Biren Pandya , stable@vger.kernel.org Subject: [PATCH v2] media: i2c: mt9p031: fix endpoint parsing use-after-free Date: Wed, 8 Jul 2026 18:07:25 +0530 Message-ID: <20260708123724.26707-2-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260613084849.57897-1-birenpandya@gmail.com> References: <20260613084849.57897-1-birenpandya@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The mt9p031_parse_properties() function calls fwnode_handle_put(np) immediately after parsing the endpoint. However, it subsequently reads the 'input-clock-frequency' and 'pixel-clock-frequency' properties using the same 'np' handle, leading to a use-after-free. Fix the use-after-free by reordering the property reads to occur before the endpoint is parsed and freed. Additionally, utilize the __free(fwnode_handle) scoped guard to automate the endpoint's lifecycle management, preventing future leaks and simplifying the error paths. Fixes: 8f2da25e85c1 ("media: i2c: mt9p031: Switch from OF to fwnode API") Cc: stable@vger.kernel.org Signed-off-by: Biren Pandya --- v2: reworded as the UAF fix it is; added Fixes/Cc stable; moved property reads before parse (Sakari); adopted __free (Laurent). --- drivers/media/i2c/mt9p031.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c index d21510caf45a8..4dcb6c973ef1c 100644 --- a/drivers/media/i2c/mt9p031.c +++ b/drivers/media/i2c/mt9p031.c @@ -9,6 +9,7 @@ * Based on the MT9V032 driver and Bastian Hecht's code. */ +#include #include #include #include @@ -1067,23 +1068,22 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev) struct v4l2_fwnode_endpoint endpoint = { .bus_type = V4L2_MBUS_PARALLEL }; - struct fwnode_handle *np; int ret; - np = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL); + struct fwnode_handle *np __free(fwnode_handle) = + fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL); if (!np) return dev_err_probe(dev, -EINVAL, "endpoint node not found\n"); - ret = v4l2_fwnode_endpoint_parse(np, &endpoint); - fwnode_handle_put(np); - if (ret) - return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n"); - fwnode_property_read_u32(np, "input-clock-frequency", &mt9p031->ext_freq); fwnode_property_read_u32(np, "pixel-clock-frequency", &mt9p031->target_freq); + ret = v4l2_fwnode_endpoint_parse(np, &endpoint); + if (ret) + return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n"); + mt9p031->pixclk_pol = !!(endpoint.bus.parallel.flags & V4L2_MBUS_PCLK_SAMPLE_RISING); -- 2.50.1 (Apple Git-155)