Re: [PATCH] media: i2c: ov02a10: fix endpoint parsing use-after-free and error leak

[Sakari Ailus]

Hi Biren,

Thanks for the patch.

On Sat, Jun 13, 2026 at 02:02:35PM +0530, Biren Pandya wrote:
> The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)
> immediately after allocating and parsing the endpoint. However, it
> subsequently calls fwnode_property_read_u32() using the same 'ep'
> handle, leading to a potential use-after-free.
> 
> Additionally, reading the optional 'ovti,mipi-clock-voltage' property
> used to overwrite the 'ret' variable. If the property was missing,
> 'ret' would become negative, and this failure code would be incorrectly
> returned at the end of the function, causing probe to fail entirely.
> 
> Fix the use-after-free by moving fwnode_handle_put(ep) to the end of
> the endpoint property reading block, and adding it to the error path of
> v4l2_fwnode_endpoint_alloc_parse().
> 
> Fix the error leak by avoiding assigning the result of
> fwnode_property_read_u32() to 'ret'.
> 
> Fixes: cf10e09b9a4b ("media: i2c: Add OV02A10 image sensor driver")
> Cc: stable@xxxxxxxxxxxxxxx
> 
> Signed-off-by: Biren Pandya <birenpandya@xxxxxxxxx>
> ---
>  drivers/media/i2c/ov02a10.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/i2c/ov02a10.c b/drivers/media/i2c/ov02a10.c
> index 143dcfe..53ff86b 100644
> --- a/drivers/media/i2c/ov02a10.c
> +++ b/drivers/media/i2c/ov02a10.c
> @@ -821,9 +821,10 @@ static int ov02a10_check_hwcfg(struct device *dev, struct ov02a10 *ov02a10)
>  		return -ENXIO;
>  
>  	ret = v4l2_fwnode_endpoint_alloc_parse(ep, &bus_cfg);
> -	fwnode_handle_put(ep);
> -	if (ret)
> +	if (ret) {
> +		fwnode_handle_put(ep);
>  		return ret;
> +	}
>  
>  	/* Optional indication of MIPI clock voltage unit */
>  	ret = fwnode_property_read_u32(ep, "ovti,mipi-clock-voltage",
> @@ -832,6 +833,8 @@ static int ov02a10_check_hwcfg(struct device *dev, struct ov02a10 *ov02a10)
>  	if (!ret)
>  		ov02a10->mipi_clock_voltage = clk_volt;
>  
> +	fwnode_handle_put(ep);
> +
>  	for (i = 0; i < ARRAY_SIZE(link_freq_menu_items); i++) {
>  		for (j = 0; j < bus_cfg.nr_of_link_frequencies; j++) {
>  			if (link_freq_menu_items[i] ==

I'd fix this by moving the fwnode_property_read_u32() before finding the
endpoint. That doesn't involve complicating the error handling.

-- 
Regards.

Sakari Ailus