solo_enc_alloc() allocates a video_device with video_device_alloc() and
releases it from the vdev_release error path if video_register_device()
fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

  video_register_device()
    -> __video_register_device()
       -> device_register() fails
          -> put_device(&vdev->dev)
             -> v4l2_device_release()
                -> vdev->release(vdev)
                   -> video_device_release(vdev)

  solo_enc_alloc()
    -> vdev_release
       -> video_device_release(solo_enc->vfd)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free solo_enc->vfd through
vdev->release(). solo_enc_alloc() then releases solo_enc->vfd exactly
once from vdev_release. Restore video_device_release() after successful
registration so the registered device keeps its normal lifetime handling.

This issue was found by a static analysis tool I am developing.

Fixes: a7eb931d635c ("[media] solo6x10: move global fields in solo_enc_fh to solo_enc_dev")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/pci/solo6x10/solo6x10-v4l2-enc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/pci/solo6x10/solo6x10-v4l2-enc.c b/drivers/media/pci/solo6x10/solo6x10-v4l2-enc.c
index 91b5c4161930..ab85d86b68fc 100644
--- a/drivers/media/pci/solo6x10/solo6x10-v4l2-enc.c
+++ b/drivers/media/pci/solo6x10/solo6x10-v4l2-enc.c
@@ -1295,6 +1295,7 @@ static struct solo_enc_dev *solo_enc_alloc(struct solo_dev *solo_dev,
 		goto pci_free;
 
 	*solo_enc->vfd = solo_enc_template;
+	solo_enc->vfd->release = video_device_release_empty;
 	solo_enc->vfd->v4l2_dev = &solo_dev->v4l2_dev;
 	solo_enc->vfd->ctrl_handler = hdl;
 	solo_enc->vfd->queue = &solo_enc->vidq;
@@ -1304,6 +1305,8 @@ static struct solo_enc_dev *solo_enc_alloc(struct solo_dev *solo_dev,
 	if (ret < 0)
 		goto vdev_release;
 
+	solo_enc->vfd->release = video_device_release;
+
 	snprintf(solo_enc->vfd->name, sizeof(solo_enc->vfd->name),
 		 "%s-enc (%i/%i)", SOLO6X10_NAME, solo_dev->vfd->num,
 		 solo_enc->vfd->num);
-- 
2.43.0