From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B9BB32ED3A for ; Wed, 8 Jul 2026 15:38:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783525106; cv=none; b=JFDfHmpMRuAuMHvbgocen64gro4ToxU8TjmBwVCY1zktnOu0uWnWpl2whGpmf3S9ZMjO/m3ALJ9DL7JpyqY/dq8y1pK04mUkHuJOyx7VJEhJKtK5e8nXdn77dVtQ0+CuQcnSgoEdw+Hvw7FYnWxMargYwTIf/foozmHUdGtYDi8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783525106; c=relaxed/simple; bh=y1Zkb/qQ7tH76c5nw0yWw9pfRRFL5z9KF7XJjkvkH3c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kVw+oBIlmgLAurlAFomBianrQWt48mXy+h06ON60JgPecOSfpduv8OATPBTR7yLK3WWDEzawjr9kbjM/MqvamfZ+BmwT4der9OPLg0JtrTrRbCUi3yUK5nMZnSGBfNbe7rdzz7fGK4GBefkjiYnpfWJBaYmwYui9AxX6BTwkDm8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LKRw+KqK; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LKRw+KqK" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c8b49639fbaso532685a12.0 for ; Wed, 08 Jul 2026 08:38:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783525105; x=1784129905; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=E7M+3gHwLkUuZk+ZzB1+zc6TOfv5YYqtskQPl4nbwro=; b=LKRw+KqKrPUGMl3c149vOZRWpZbsXbk4Ycm4mUuHMgaiBk8qaoFjnbbj3eqR6TELcU iIJ3yWUSvw0TOofMr90DyGK8Sso30iLH4raoksC6+VgPjsb6QYDTXTfRVa+zYGgGxw7E BHV+Z83vvly+BOLX/Xq+fOpONF429m0X6zgRzFGgKqM4AuRJd2nUTiutiUwdy+ULSJIj PAA52xbIVk4CA5O9B5RHK4gO8LhIyt3aM2u4IwsiM5JdT2NsFyvDhEFzDAEAZr6rd595 rd4QcC+7xguCaHseLu5AwcD75qN4/SWIUk0iOV+Q1qAdsOhmMJMQ4h66A0sg/kKJxzzL N2eA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783525105; x=1784129905; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=E7M+3gHwLkUuZk+ZzB1+zc6TOfv5YYqtskQPl4nbwro=; b=XP51DKaikIxXfdyklLdJxYz64kvK6vJYJwr+S2KS+DkVsMPx2SOAPjKVg5O26j3gGN 0X8hMqgaDN9BdMN9g8qz71taQ38vVYhQ1OhQ+Sf5G1AOafqQUMQT/iMjb19B++jCxM8H MHQsawn/apnoppZCyiiaJoIVUAz3mxO9apD4AB8Yf7ZVYtNKHzAK2Lke2H7j7CQKYPfG K7oio8GedulR/pPImNcC1eU30v7Boy36Mh1OqEU2Z5jTn1cP+ai/qxULsfTqEKh9Joes j3JEfj/JKrwcrbgpTcID/puYcTpxARtUpviU67mmcmrh00Y5VJ62EPWMiurjD4MSNTTR 5BMg== X-Forwarded-Encrypted: i=1; AHgh+Rp+yaCXZ3FP7SL3NqAxAdE7ql7LHVY054Mb7tO74H92uRVK8X++dQmLbNRJQvN6P+UTaOeoTc7123wdweQ=@vger.kernel.org X-Gm-Message-State: AOJu0YwYm6y4NGEuZ7aBj/vjuYsrjv1f5VBdyZPQktsScvJPLEnosyk8 wt5C6ICuQ+cdKZZGT0vD3h+L8RZbI3M7UUFLNlAiLHtKUoIGcksWEE52 X-Gm-Gg: AfdE7ckzWZpvtqYi+maCqR0uo+bI4A0FT/feLPvnu6iLD5ICbv7AWQ6cGlCj2+gy0HZ DP3PFYj078Fxc1Ns6AqmbomNBLeUhyXGJbzUCLgLXykRkETL03naRkUPD27eLndWyKAmREzHWJo 9j69/Hp/0Ew4/15itcIaBBMoPum6oKt0BlowdI8kBH3p1dBSxdTPqLrF/ytZfUVvzSK7D+JFZQK AI/eZQCAY0dNDaRZ6YfCAFEgl0YpYcZHQukdEmZ4afYs6b4AnyxgmA3dxw7/er2TzkVmNYRDrc9 bIx1+vX6PwLAEyiHOKBFk70wlzEAyDHeuf66U/GrbXZi5uRYfyvfPy6x4sGPLgK8tuWgVIJbtPm 7zSQjcFj8Q/0NQWt/DoCX7bYieB1H6W6PgglFvpXUKBHZbdVk8U7+ORwhbJT/EMXuTLsFtkQGX0 pUQHLgGPI5fASJPH4G6zSp/Fi/3UnwkhR0QEnqNv+/6rk= X-Received: by 2002:a05:6a20:c998:b0:3bf:bdb9:f602 with SMTP id adf61e73a8af0-3c0bcc6a270mr3505171637.22.1783525104357; Wed, 08 Jul 2026 08:38:24 -0700 (PDT) Received: from localhost.localdomain ([49.207.223.101]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31174a583bcsm24462238eec.19.2026.07.08.08.38.20 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 08 Jul 2026 08:38:23 -0700 (PDT) From: Biren Pandya To: sakari.ailus@linux.intel.com, mchehab@kernel.org, dongchun.zhu@mediatek.com, andriy.shevchenko@linux.intel.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Biren Pandya , stable@vger.kernel.org, Vladimir Zapolskiy Subject: [PATCH v4] media: i2c: ov02a10: fix endpoint parsing use-after-free Date: Wed, 8 Jul 2026 21:08:15 +0530 Message-ID: <20260708153815.50692-2-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260613083235.57363-1-birenpandya@gmail.com> References: <20260613083235.57363-1-birenpandya@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint. However, it subsequently calls fwnode_property_read_u32() using the same 'ep' handle, leading to a potential use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property used to overwrite the 'ret' variable. If the property was missing, 'ret' would become negative, and this failure code would be incorrectly returned at the end of the function, causing probe to fail entirely. Fix the use-after-free by moving fwnode_property_read_u32() before the endpoint is parsed and freed. Avoid the error leak by not assigning the result of fwnode_property_read_u32() to 'ret'. Fixes: 91807efbe8ec ("media: i2c: add OV02A10 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Biren Pandya Reviewed-by: Vladimir Zapolskiy --- Changes in v4: - Collapsed fwnode_property_read_u32() into a single line per Vladimir's review. Changes in v3: - Moved property reads before parse to avoid UAF. - Fixed error leak by dropping assignment to ret. - Added Fixes/Cc stable. - Picked up Reviewed-by. --- drivers/media/i2c/ov02a10.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/drivers/media/i2c/ov02a10.c b/drivers/media/i2c/ov02a10.c index 143dcfe104456..98f8fc5b6a5ae 100644 --- a/drivers/media/i2c/ov02a10.c +++ b/drivers/media/i2c/ov02a10.c @@ -820,18 +820,15 @@ static int ov02a10_check_hwcfg(struct device *dev, struct ov02a10 *ov02a10) if (!ep) return -ENXIO; + /* Optional indication of MIPI clock voltage unit */ + if (!fwnode_property_read_u32(ep, "ovti,mipi-clock-voltage", &clk_volt)) + ov02a10->mipi_clock_voltage = clk_volt; + ret = v4l2_fwnode_endpoint_alloc_parse(ep, &bus_cfg); fwnode_handle_put(ep); if (ret) return ret; - /* Optional indication of MIPI clock voltage unit */ - ret = fwnode_property_read_u32(ep, "ovti,mipi-clock-voltage", - &clk_volt); - - if (!ret) - ov02a10->mipi_clock_voltage = clk_volt; - for (i = 0; i < ARRAY_SIZE(link_freq_menu_items); i++) { for (j = 0; j < bus_cfg.nr_of_link_frequencies; j++) { if (link_freq_menu_items[i] == -- 2.50.1 (Apple Git-155)