[PATCH v2] media: i2c: mt9p031: fix endpoint parsing use-after-free

[Biren Pandya]

The mt9p031_parse_properties() function calls fwnode_handle_put(np)
immediately after parsing the endpoint. However, it subsequently reads
the 'input-clock-frequency' and 'pixel-clock-frequency' properties
using the same 'np' handle, leading to a use-after-free.

Fix the use-after-free by reordering the property reads to occur before
the endpoint is parsed and freed. Additionally, utilize the
__free(fwnode_handle) scoped guard to automate the endpoint's lifecycle
management, preventing future leaks and simplifying the error paths.

Fixes: 8f2da25e85c1 ("media: i2c: mt9p031: Switch from OF to fwnode API")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Biren Pandya <birenpandya@xxxxxxxxx>
---
 v2: reworded as the UAF fix it is; added Fixes/Cc stable; moved property reads before parse (Sakari); adopted __free (Laurent).
---
 drivers/media/i2c/mt9p031.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index d21510caf45a8..4dcb6c973ef1c 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -9,6 +9,7 @@
  * Based on the MT9V032 driver and Bastian Hecht's code.
  */
 
+#include <linux/cleanup.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/device.h>
@@ -1067,23 +1068,22 @@ static int mt9p031_parse_properties(struct mt9p031 *mt9p031, struct device *dev)
 	struct v4l2_fwnode_endpoint endpoint = {
 		.bus_type = V4L2_MBUS_PARALLEL
 	};
-	struct fwnode_handle *np;
 	int ret;
 
-	np = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+	struct fwnode_handle *np __free(fwnode_handle) =
+		fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
 	if (!np)
 		return dev_err_probe(dev, -EINVAL, "endpoint node not found\n");
 
-	ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
-	fwnode_handle_put(np);
-	if (ret)
-		return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
-
 	fwnode_property_read_u32(np, "input-clock-frequency",
 				 &mt9p031->ext_freq);
 	fwnode_property_read_u32(np, "pixel-clock-frequency",
 				 &mt9p031->target_freq);
 
+	ret = v4l2_fwnode_endpoint_parse(np, &endpoint);
+	if (ret)
+		return dev_err_probe(dev, -EINVAL, "could not parse endpoint\n");
+
 	mt9p031->pixclk_pol = !!(endpoint.bus.parallel.flags &
 				 V4L2_MBUS_PCLK_SAMPLE_RISING);
 
-- 
2.50.1 (Apple Git-155)