From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5521D33AD88 for ; Sat, 13 Jun 2026 08:32:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781339563; cv=none; b=GyQle94tGE7hGADDN3begs92feVTWQQmVgNzPmWOH97U7YTdR1exnR5SIcw/QyLT9/wB3JgSmJegO6aSpa2Xw4X+xQSYmCrte9KoPRnp5cYPokpHyUcjy9E+T6lLuubLQXLnyeqE4wxFvUMaBHMUFFPG9R3vFvznRtiqdk0hTg8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781339563; c=relaxed/simple; bh=uPKIkZlhYoBQCHSj4lKsMmL61hDT6UcJ+fB+zDBMb6c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DREYo4wV2lc2oE4Z4XYFrcJiZieja5nGAwUJC35hVq5OpqjY6lYoy1bbwt/dCTaId0mKbfGa1P4+eJriKKWQwkB3kNi+Kphaugwp5+HbUov7fnswTBjZJiLEpfpxQ2zarFKNgQ9ofjD/bG4SWWoXJpDjM9pAArcjlCzX6AogT9M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Eq/2BVYI; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Eq/2BVYI" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2bf1f074a12so18261755ad.0 for ; Sat, 13 Jun 2026 01:32:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781339562; x=1781944362; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=yo0ZagI1wjHBIRxCvM8uk+CoeAPsq0DsPwmR+5mIpTo=; b=Eq/2BVYICw9UENPsbFrUiiui6PaazfbJDOpvQ16SsYgYvsKeHPJfmkONaMgwBSla9b gAfIKEUmEu+I5Fd+zPnj2KnBKZKUN1iYNKBwJfKXoI6/ENk0SVvCVJHh2hn27WGyTJPH f5RDOYvU1M5LQNdC0gZPtJvBB7tmbZ7ZANW1A6qCd5Y5lnGbj5DBJKma2+5UDuzz37fU 3JDfEwwGwMZ0tnE6Lrf467OJKx5fD3wiciGP3sN53r9Nx4U9n4uK4nz8ljBTPfZ+ILFj rMN2LQ1TXldHGnEyPNCutKScyvNjxJwCCZOZCCfZkRrkXZCm09ggnURC+ul+B0WveK8G d5Rg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781339562; x=1781944362; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=yo0ZagI1wjHBIRxCvM8uk+CoeAPsq0DsPwmR+5mIpTo=; b=aWYsE3oBlr7b52VInwpVA+x0S5fxyxfppE0B5xWMFE5sxIPSPz01fYnpx2EEENCb2s sOJji+u9Gmtb3MG+8FVxchYj+CDZFR6W+/1MIszEzGc90sJfJB0MePICZ16e7y7hl7l4 tGb71VV9OjBaOVkpJtSVO9l8n0WX2Srgl4sHsHYxSerWIZHYbwIA+TZbQYcTyZAOdnhC 1dl5/Qp5tLUVmyFqL+DLCInfnTDj8f0K19W9Tz+VXdXMv1wIAQCVV3Y9DzeuaIwphH2y t6Lia2p0Hk7DSoOsivX0hzvxzFdKokkK6k1nFzKzrSy7RvRnR0vLwmMUtM33HkSFgiK7 DqwA== X-Forwarded-Encrypted: i=1; AFNElJ9k9BRy/X7nvQXf9CqdDaxqZg1wJqfnOqGD0noui6K2B4IOsuHhc/On+mSjcpurvzsLfW8j/PHgacSmxX4=@vger.kernel.org X-Gm-Message-State: AOJu0YwKCt6VqQJgI3MbDYiHeTmdIQCSTlkTQjTjPsHwjakO6gANNKDQ CLRqPw1jmvRZb8ib2cjY2xP8C/O0iOBy83/gICOD4b8YqZSOMNWNt8JaytMThnS3 X-Gm-Gg: Acq92OFv2qyGkJi7gSbd+qOOdOV1LlENLheO+9nCB5KiN2erWxP9Rcc7z2fuTS+Q6Rt 4j0d68rPwxaULzJjP/8Tzp6KF06xSbBBuse9iTXD3YfauD1U+Vf9HmViisZU/Hs7Lasv1fL+bJe xLOoEjMtJoPfV1D/JvPb4f6iIUJ4uzHBgQxvJQFNbsm9mOwsDLuwgksRX9szCyoOkq2RlMsoVuK 4xVBswA+z9HBY5NXXf2OFsH8/gz2swDYKTwZa/W995lpYlpFS7GrDEM+inK+xJYocjEDgR8aq8i rOgLwKj8HC8jjF3vN5TUSB7vRikOsQFUjNdfRa//9pOV0cemp6bfe5pCanzU1fIJoo2dp1lFjAp a6ChsZWzXf0wRB3fTzf9AR68/lKSU550R0tfa9fYJQoG/c3ewiXDmSVDbraPLKwHQw/uY97H1Pe vPKPP3LHLjrouMR+8Tnpp9SjhM17h1vc5EbELRUffjXXyr+lxQAGaJ X-Received: by 2002:a17:902:e74e:b0:2c2:33a4:aa8f with SMTP id d9443c01a7336-2c410fbb865mr77312415ad.13.1781339561710; Sat, 13 Jun 2026 01:32:41 -0700 (PDT) Received: from localhost.localdomain ([49.207.217.37]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c42fbb4424sm42665865ad.31.2026.06.13.01.32.38 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 13 Jun 2026 01:32:41 -0700 (PDT) From: Biren Pandya To: linux-media@vger.kernel.org Cc: sakari.ailus@linux.intel.com, mchehab@kernel.org, dongchun.zhu@mediatek.com, linux-kernel@vger.kernel.org, Biren Pandya , stable@vger.kernel.org Subject: [PATCH] media: i2c: ov02a10: fix endpoint parsing use-after-free and error leak Date: Sat, 13 Jun 2026 14:02:35 +0530 Message-ID: <20260613083235.57363-1-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely. Fix the use-after-free by moving fwnode_handle_put(ep) to the end of the endpoint property reading block, and adding it to the error path of v4l2_fwnode_endpoint_alloc_parse(). Fix the error leak by avoiding assigning the result of fwnode_property_read_u32() to 'ret'. Fixes: cf10e09b9a4b ("media: i2c: Add OV02A10 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Biren Pandya --- drivers/media/i2c/ov02a10.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/ov02a10.c b/drivers/media/i2c/ov02a10.c index 143dcfe..53ff86b 100644 --- a/drivers/media/i2c/ov02a10.c +++ b/drivers/media/i2c/ov02a10.c @@ -821,9 +821,10 @@ static int ov02a10_check_hwcfg(struct device *dev, struct ov02a10 *ov02a10) return -ENXIO; ret = v4l2_fwnode_endpoint_alloc_parse(ep, &bus_cfg); - fwnode_handle_put(ep); - if (ret) + if (ret) { + fwnode_handle_put(ep); return ret; + } /* Optional indication of MIPI clock voltage unit */ ret = fwnode_property_read_u32(ep, "ovti,mipi-clock-voltage", @@ -832,6 +833,8 @@ static int ov02a10_check_hwcfg(struct device *dev, struct ov02a10 *ov02a10) if (!ret) ov02a10->mipi_clock_voltage = clk_volt; + fwnode_handle_put(ep); + for (i = 0; i < ARRAY_SIZE(link_freq_menu_items); i++) { for (j = 0; j < bus_cfg.nr_of_link_frequencies; j++) { if (link_freq_menu_items[i] == -- 2.50.1 (Apple Git-155)