From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 93285397699 for ; Tue, 16 Jun 2026 09:25:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781601924; cv=none; b=WPU39m+bv/MDao1b1UcegEXQGqEc3+zY46Rz8MHYROuwGsCb7jsmmQZC1bf4+Ev6iQnTfiIB+syYo0v/MSeTBnMpILw4kse4RD1ZiFTpU3EjqI0b+0g4nVebXzXXKUX176hFNFauoLe5k0x9Qe3jEk50NVHo2xc1+svD3n4R8mE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781601924; c=relaxed/simple; bh=Fi3+Edj1vCwPdfBKcJ9NF6yrRuHhIar24v5OJ2pIEps=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QmvEQa8r9gzRmRL/bvRkoEJ9uh0mYNRdL39isj43UQQ+JJnmqsw1e1lL1l0zWu/ZNiBLayB00sB4XeBGwoC6UT6k/zhNGwDj+d4XYcz8L7++CxXScJcWrgLS6eosSLjGFhd8y3sCErp6SrABX9g12LrYpYETHj7b8FlXc9AUfII= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=F26snVv9; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="F26snVv9" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2c168baac83so19604585ad.2 for ; Tue, 16 Jun 2026 02:25:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781601923; x=1782206723; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=nQDYhPlQvRFUX7M9coPWTPJbINbAS+sfJCZWJojAKpg=; b=F26snVv9lHGbICJVASyKi3sEmMVfcbIJTShUdJta6a++KO70PTHzocwXWLWkD6cBa7 2mecc5H9Ne5u3IjPqAQfmc7/F+ho5ZHvxxC1UjJpq68QUIEmyXUmkA0TjbIeY6BwhWiJ MmRJYfiVS/AqlCltYy0rbXjgyzbFQSWQoYjBveqIpi9HrATbcL8f2DzEQcHASaERzfoA bkXmhJDv8gGyoHHyE7HRi/CmIGTgD45gLq2y6fLhYbvnMEkQ3CekcXsW5iSXXO/EJPXv mzVKVXGh1dz4VNkP6Dkyi2AyC1hJi5ZiPe6l5/l2fhhot9d6N68Qiiixmns4YtC+BcAb LbdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781601923; x=1782206723; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=nQDYhPlQvRFUX7M9coPWTPJbINbAS+sfJCZWJojAKpg=; b=A8ln2e5HQ6iR/EFv7Nda7FegWp+d2YBye6JYWBISptbyvjr3AfEeJl9TjeQhpkSlUa LlOwfZrMQKaViKc0Or4G34iQekhz2JjhxfhTLGFKLB28Xz81FS9wzts5dfO4oLDLRQgC fBdN96d+OoMXd2ILdBsEAFjWDV0ro9dXK+CzUmtMognxkHw0oeSQ6HBlslTN2FGRp/kJ 2/9L5tDVwCLHhB/Yjyk85P/A50K1FTfJJ3LiqUG4Oa2BaD0/Q9pGnXHeKU/NasWSkwe7 dg8k/rCxy8lEn7uY27sCdLG3YhlM6AGQYXDPD+feQ2OJqalaou/gQ6jcBNLlhbo4vzBV /tPw== X-Forwarded-Encrypted: i=1; AFNElJ8i1bDVwy/9hAg1VuP6yJLAEJR2rUITGmNb0VkMdMvIOzJ5WMZbg6JRm+3kaeTGi9jh8X17nBrOMxnDmk4=@vger.kernel.org X-Gm-Message-State: AOJu0YxOoDiaQQ2+bHeb9/LyFPgi0eobHN/eEzgaXlNrU1I0g9KNLxRE vAGdnwcd9uUP0XJGPP50aWjvr1xD88H8OdGTYr4WVN/w3UF6hZl3kmY9 X-Gm-Gg: Acq92OHWtoN/o2n/+4p3ZRg+37dCvds6/PsQ7ZPCXeOxPj3SkfgJkFuBomBINrmXB87 xcwOg2yXZKmCdtLwoXaGNKAE5NDghi+9ksU1JDO1PHCLvyKGBDYohxIbchtDievv3UQsMuj3vxN UijVfoAhs/NgH4ME0sGY1XDVzLBDTXYnCHv3TPUYJejmGN9NUSwr/nANLcaj8+Im9u9vbuxqtPq vsuSzQnqAw53CeIE1mDq8WhUA47LOkCxi+8nBlDbHsKOFCJtW8/X9rKC/1zJKaH0WonInhjJh1f 7Bos+t+94CPySgQwa/Th6Fd+UIqoNo/IRap8WvApYs6n9+CyZScg57DWnefZcXkSZPPw7w2nWbZ fZ2NCjPnWMzsMqVshHaOj3KTP1vIKRsRF3LdKQYdO3SC+8pjN88dcFbMxkVypbw/JvFEZmsNd0I Pfun0ZQgnumiME6L4bh7xsfdJ+dxlMEffKC8F873kVxPTujeJTm6Dq X-Received: by 2002:a17:902:ce03:b0:2c6:a99a:52a9 with SMTP id d9443c01a7336-2c6a99a5426mr3485315ad.7.1781601922802; Tue, 16 Jun 2026 02:25:22 -0700 (PDT) Received: from localhost.localdomain ([49.207.217.37]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c6aa228f8fsm1618825ad.24.2026.06.16.02.25.19 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 16 Jun 2026 02:25:22 -0700 (PDT) From: Biren Pandya To: laurent.pinchart@ideasonboard.com, sakari.ailus@linux.intel.com, hverkuil+cisco@kernel.org Cc: mchehab@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Biren Pandya Subject: [PATCH] media: v4l2-core: Fix Use-After-Free in v4l2_subdev_get_fwnode_pad_1_to_1 Date: Tue, 16 Jun 2026 14:55:16 +0530 Message-ID: <20260616092516.46339-1-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit v4l2_subdev_get_fwnode_pad_1_to_1() drops the fwnode reference via fwnode_handle_put() before passing it to device_match_fwnode(). This creates a Use-After-Free vulnerability. If the freed memory is instantly reallocated by SLUB, the pointer comparison could accidentally match the wrong pad or trigger a KASAN panic. Fix this by using the __free(fwnode_handle) scoped guard. This safely binds the fwnode lifecycle to the function scope, holding the reference during the match and releasing it automatically upon return. Signed-off-by: Biren Pandya --- drivers/media/v4l2-core/v4l2-subdev.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c index 831c69c958b8..e6b133ef7850 100644 --- a/drivers/media/v4l2-core/v4l2-subdev.c +++ b/drivers/media/v4l2-core/v4l2-subdev.c @@ -7,7 +7,7 @@ * Contact: Laurent Pinchart * Sakari Ailus */ - +#include #include #include #include @@ -1243,7 +1243,7 @@ const struct v4l2_file_operations v4l2_subdev_fops = { int v4l2_subdev_get_fwnode_pad_1_to_1(struct media_entity *entity, struct fwnode_endpoint *endpoint) { - struct fwnode_handle *fwnode; + struct fwnode_handle *fwnode __free(fwnode_handle) = NULL; struct v4l2_subdev *sd; if (!is_media_entity_v4l2_subdev(entity)) @@ -1252,7 +1252,6 @@ int v4l2_subdev_get_fwnode_pad_1_to_1(struct media_entity *entity, sd = media_entity_to_v4l2_subdev(entity); fwnode = fwnode_graph_get_port_parent(endpoint->local_fwnode); - fwnode_handle_put(fwnode); if (device_match_fwnode(sd->dev, fwnode)) return endpoint->port; -- 2.50.1 (Apple Git-155)