Re: [PATCH v3] media: i2c: ov02a10: fix endpoint parsing use-after-free

[Andy Shevchenko]

On Wed, Jul 08, 2026 at 06:35:33PM +0530, Biren Pandya wrote:
> The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)
> immediately after allocating and parsing the endpoint. However, it
> subsequently calls fwnode_property_read_u32() using the same 'ep'
> handle, leading to a potential use-after-free.
> 
> Additionally, reading the optional 'ovti,mipi-clock-voltage' property
> used to overwrite the 'ret' variable. If the property was missing,
> 'ret' would become negative, and this failure code would be incorrectly
> returned at the end of the function, causing probe to fail entirely.
> 
> Fix the use-after-free by moving fwnode_property_read_u32() before
> the endpoint is parsed and freed. Avoid the error leak by not
> assigning the result of fwnode_property_read_u32() to 'ret'.

...

> +	/* Optional indication of MIPI clock voltage unit */
> +	if (!fwnode_property_read_u32(ep, "ovti,mipi-clock-voltage",
> +				      &clk_volt))

Besides this being exactly a single line in length (80 chars),
the way how we check and read the optional properties is like this

	if (_property_present()) {
		ret = _property_read_u32();
		if (ret)
			return ret;
	} else {
		...apply default...
	}

But since this is a fix, just make the above a single line for now and refactor
in a later change.

> +		ov02a10->mipi_clock_voltage = clk_volt;

-- 
With Best Regards,
Andy Shevchenko