From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E334E370AD0 for ; Wed, 8 Jul 2026 18:05:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783533940; cv=none; b=pQXvZgrrUeMtRCs/XKVt7vZS7xqt6VFGcx6DrxmnoW0EnV1JP6VRJPaAWI2Ky30JQND6Z5fcK34reMjp7JCuQUg4LgQtRKJ0D+vhyA1iYTZDCo567VTmXalG4ApYLTR+a020whqj1CsRVdCPJdLMKK35uX/h+9deP3cQvvMln2k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783533940; c=relaxed/simple; bh=mSybehUJynHQTwbTGlJ174ILGlyT0yffKNrbTRCOEB4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CHgBAW3MXfMmnxGWLDPupyBX1Ozq6J9fXqwkjMkrhk9j2Cd+7QVN9/JAzMiS0VUcmSZJ+2B8/xgKQZTHfZD/uOCbWIxyEl3WJkyf74ihu2QbEvBY0QPrcBqUWxbVUU1Ib0rcKRrWfu2/dk0Ebrk47Gj3GdNzk+88sqUFGGjx7ZM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZYU/zUT5; arc=none smtp.client-ip=209.85.215.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZYU/zUT5" Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-c998fd549a8so684894a12.2 for ; Wed, 08 Jul 2026 11:05:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783533938; x=1784138738; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=D3pVcb1PF24XGDYrC38hDgnfb8Q0xDq9hExE3enlJ8A=; b=ZYU/zUT5XW6+kXwOvvx59vvaTu7a59VtdNutobRTLaO3D0o6l35vNz3lEwHGqiDzIb CGyNcIbHofTWo8cHqY/gJHZWc8YUBMmXySFxiLStrOPXZxnA0r4ZvaL5EA7JwCXjBG4L HQTa495lr1Gmx2b1TAtKkO3wB+VDfvRhCVADFAGZRPoop98ps47ex21myok5p8RnVILE YuTqTQ9YaNZJzJrZQ3U5JrsZXLJovRTMMTmZvscOOynOW3Ck1/UDs96u5yEEYNSjeZKY fKZ6eKPI/7Q95vz4HsQLYkLzbrZkZIkHEWZ3RGfpy8J4deRY5SY3a3Gcy9UpElGr85jX A2Yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783533938; x=1784138738; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=D3pVcb1PF24XGDYrC38hDgnfb8Q0xDq9hExE3enlJ8A=; b=Q5wXP9nqn7keG8VoK3I5aYcHPUEDH3IO3v2SI75zV3mtTLW5BrnVrQ2mtaN46HZC2E u5ks796S7sFgwsnvhSNBqp8vvLLdHW8VaAnBZOuTGLGX7Qf6RfWJU5aXVMkgGAViQCWo kn5Let2GP8FOupMGl0KRNacFTYY8uEmlLYosxAOGG66LfMynzVArt4tACEfXso3csr/m WMHhwLKw6EEWOE/QWaxjJjreLJlZ4hOfVzOVlWsRpahq/4Jg7a1JcRJle63b/7V35vwh nnjhsNXg8MCVb6bOKCxwgpdB9wGSAO2oBupcwY1Im6zCj1McXO4HHEFWPrE1TqMcIalu PPfg== X-Forwarded-Encrypted: i=1; AHgh+RpwGT36W/hQm53fE7vBlFMkygaSi6rPLVqYqw0hcs7ytKlO/y1/JleJ+nWgxNjHzaJqaz35gzGqb6BSY3c=@vger.kernel.org X-Gm-Message-State: AOJu0YxkqDpcn66x5zTKNY7Y/TS+MoswHYRFfruh2fv1lNW8wU0HJFkX q9QQdsFHP+HlEuMcAaqIst0NOIMZMUhA+0uiHdCGjNATCwq9BaB4sA8y X-Gm-Gg: AfdE7clpJrvq4U9Y3HGZlBCVWv4i5JEm+lcNjNr/g3HYy2bdOC2D4cy2oI2PHNBeMIw DB3P8ALrGZUSXyEsjsAvEywogSz0XvaAFE0Nw4fiuRPSlEtJnwoXAGh9x0snu0MXhGIb42I7L+B q4hKU5fhmx0wKij0yRACogLp6fzc6GxU0bKkaF8Q9h6+Fn+OjiDae87+Ruxh0iuKxt5PHzMjJSj 9ubJiEgxgDI30olXrvy0RvJh4+k3S9sYWsPJ+A8hYmVB1Nv2fdJinJZDpvdxlE3g1obqgibvz/t mPSiV2hfNRGRAhVt8ja5j8abGgq22PT7i2OnDWkfhDsmUfzQJcaZNrNE1pweEKcBpHgRQTo6ouE Ctg8BknYet6xS//kO/PNELj4reKVQ3Z4XkVk7UPI9urL+hvDNHq2AuGRnodACWeJUfus6dP2wnL XCAM0wN0bNGCJfO7MQly0rsjbItI2OCZ49RXkpB7YBFR8= X-Received: by 2002:a05:6a20:9151:b0:3c0:9c19:65a9 with SMTP id adf61e73a8af0-3c0bd32fd9amr4326445637.65.1783533938162; Wed, 08 Jul 2026 11:05:38 -0700 (PDT) Received: from localhost.localdomain ([49.207.223.101]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13b659d7c8bsm23721887c88.12.2026.07.08.11.05.35 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 08 Jul 2026 11:05:37 -0700 (PDT) From: Biren Pandya To: mchehab@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Biren Pandya Subject: [PATCH v2] media: v4l2-subdev: fix use-after-free in v4l2_subdev_get_fwnode_pad_1_to_1 Date: Wed, 8 Jul 2026 23:35:29 +0530 Message-ID: <20260708180529.57414-2-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260616092516.32617-1-birenpandya@gmail.com> References: <20260616092516.32617-1-birenpandya@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The fwnode reference returned by fwnode_graph_get_port_parent() is currently dropped immediately via fwnode_handle_put(), but the pointer is subsequently passed to device_match_fwnode(). This creates a Use-After-Free vulnerability if the fwnode is freed before the match completes. Fix this by using the modern __free(fwnode_handle) macro to ensure the reference is held for the duration of the function and automatically dropped when it goes out of scope. Signed-off-by: Biren Pandya --- Changes in v2: - Rebased on latest media_tree. - Combined the two mutually exclusive v1 submissions into a single patch utilizing the modern scoped_guard/__free approach. - Updated subsystem prefix to 'media: v4l2-subdev:' based on historical usage. --- drivers/media/v4l2-core/v4l2-subdev.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c index 831c69c958b8a..e6b133ef78504 100644 --- a/drivers/media/v4l2-core/v4l2-subdev.c +++ b/drivers/media/v4l2-core/v4l2-subdev.c @@ -7,7 +7,7 @@ * Contact: Laurent Pinchart * Sakari Ailus */ - +#include #include #include #include @@ -1243,7 +1243,7 @@ const struct v4l2_file_operations v4l2_subdev_fops = { int v4l2_subdev_get_fwnode_pad_1_to_1(struct media_entity *entity, struct fwnode_endpoint *endpoint) { - struct fwnode_handle *fwnode; + struct fwnode_handle *fwnode __free(fwnode_handle) = NULL; struct v4l2_subdev *sd; if (!is_media_entity_v4l2_subdev(entity)) @@ -1252,7 +1252,6 @@ int v4l2_subdev_get_fwnode_pad_1_to_1(struct media_entity *entity, sd = media_entity_to_v4l2_subdev(entity); fwnode = fwnode_graph_get_port_parent(endpoint->local_fwnode); - fwnode_handle_put(fwnode); if (device_match_fwnode(sd->dev, fwnode)) return endpoint->port; -- 2.50.1 (Apple Git-155)