[PATCH v3] media: i2c: mt9p031: Fix Use-After-Free in mt9p031_parse_properties()

[PATCH v3] media: i2c: mt9p031: Fix Use-After-Free in mt9p031_parse_properties()

[Biren Pandya]

The mt9p031_parse_properties() function calls fwnode_handle_put(np) to
release the fwnode handle. However, immediately after this call, np is
used in fwnode_property_read_u32(), leading to a Use-After-Free bug.

Use the __free(fwnode_handle) attribute for the np pointer to automate
cleanup. This allows us to remove the manual fwnode_handle_put(np) call,
ensuring the handle is only dropped when the function returns, thus
preventing the Use-After-Free.

Fixes: 8d4da37c3006 ("[media] media: i2c: mt9p031: add OF support")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
---
Changes in v3:
- Fixed the incorrect commit hash in the Fixes tag that caused checkpatch to fail.

Changes in v2:
- Utilized __free(fwnode_handle) to automate cleanup and safely fix the UAF
  as suggested by reviewers.
---
 drivers/media/i2c/mt9p031.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index ea5d43d925ffa..3b3714b0ef8f3 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -1067,15 +1067,14 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
 	struct v4l2_fwnode_endpoint endpoint = {
 		.bus_type = V4L2_MBUS_PARALLEL
 	};
-	struct fwnode_handle *np;
+	struct fwnode_handle *np __free(fwnode_handle) =
+		fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
 	int ret;
 
-	np = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
 	if (!np)
 		return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
 
 	ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
-	fwnode_handle_put(np);
 	if (ret)
 		return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v3] media: i2c: mt9p031: Fix Use-After-Free in mt9p031_parse_properties()

[Sakari Ailus]

Hi Biren,

On Fri, Jun 19, 2026 at 01:49:27PM +0530, Biren Pandya wrote:
> The mt9p031_parse_properties() function calls fwnode_handle_put(np) to
> release the fwnode handle. However, immediately after this call, np is
> used in fwnode_property_read_u32(), leading to a Use-After-Free bug.
> 
> Use the __free(fwnode_handle) attribute for the np pointer to automate
> cleanup. This allows us to remove the manual fwnode_handle_put(np) call,
> ensuring the handle is only dropped when the function returns, thus
> preventing the Use-After-Free.
> 
> Fixes: 8d4da37c3006 ("[media] media: i2c: mt9p031: add OF support")
> Signed-off-by: Biren Pandya <birenpandya@gmail.com>

This should be cc'd to stable.

> ---
> Changes in v3:
> - Fixed the incorrect commit hash in the Fixes tag that caused checkpatch to fail.
> 
> Changes in v2:
> - Utilized __free(fwnode_handle) to automate cleanup and safely fix the UAF
>   as suggested by reviewers.
> ---
>  drivers/media/i2c/mt9p031.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
> index ea5d43d925ffa..3b3714b0ef8f3 100644
> --- a/drivers/media/i2c/mt9p031.c
> +++ b/drivers/media/i2c/mt9p031.c
> @@ -1067,15 +1067,14 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
>  	struct v4l2_fwnode_endpoint endpoint = {
>  		.bus_type = V4L2_MBUS_PARALLEL
>  	};
> -	struct fwnode_handle *np;
> +	struct fwnode_handle *np __free(fwnode_handle) =
> +		fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);

Can you call fwnode_graph_get_next_endpoint() where it used to be called,
also declaring np there?

>  	int ret;
>  
> -	np = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
>  	if (!np)
>  		return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
>  
>  	ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
> -	fwnode_handle_put(np);
>  	if (ret)
>  		return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
>  

-- 
Regards,

Sakari Ailus