Re: [PATCH v3] media: i2c: mt9p031: Fix Use-After-Free in mt9p031_parse_properties()
Sakari Ailus <[email protected]>
| Newsgroups | org.kernel.vger.linux-media,org.kernel.vger.linux-kernel |
|---|---|
| Organization | Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo |
| Message-ID | <[email protected]> |
Hi Biren,
On Fri, Jun 19, 2026 at 01:49:27PM +0530, Biren Pandya wrote:
> The mt9p031_parse_properties() function calls fwnode_handle_put(np) to
> release the fwnode handle. However, immediately after this call, np is
> used in fwnode_property_read_u32(), leading to a Use-After-Free bug.
>
> Use the __free(fwnode_handle) attribute for the np pointer to automate
> cleanup. This allows us to remove the manual fwnode_handle_put(np) call,
> ensuring the handle is only dropped when the function returns, thus
> preventing the Use-After-Free.
>
> Fixes: 8d4da37c3006 ("[media] media: i2c: mt9p031: add OF support")
> Signed-off-by: Biren Pandya <[email protected]>
This should be cc'd to stable.
> ---
> Changes in v3:
> - Fixed the incorrect commit hash in the Fixes tag that caused checkpatch to fail.
>
> Changes in v2:
> - Utilized __free(fwnode_handle) to automate cleanup and safely fix the UAF
> as suggested by reviewers.
> ---
> drivers/media/i2c/mt9p031.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
> index ea5d43d925ffa..3b3714b0ef8f3 100644
> --- a/drivers/media/i2c/mt9p031.c
> +++ b/drivers/media/i2c/mt9p031.c
> @@ -1067,15 +1067,14 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
> struct v4l2_fwnode_endpoint endpoint = {
> .bus_type = V4L2_MBUS_PARALLEL
> };
> - struct fwnode_handle *np;
> + struct fwnode_handle *np __free(fwnode_handle) =
> + fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
Can you call fwnode_graph_get_next_endpoint() where it used to be called,
also declaring np there?
> int ret;
>
> - np = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
> if (!np)
> return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
>
> ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
> - fwnode_handle_put(np);
> if (ret)
> return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
>
--
Regards,
Sakari Ailus