solo_v4l2_init() allocates a video_device with video_device_alloc() and
releases it from the fail error path if video_register_device() fails.
This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:
video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)
solo_v4l2_init()
-> fail
-> video_device_release(solo_dev->vfd)
Use video_device_release_empty() while registering the device so that
registration failure paths do not free solo_dev->vfd through
vdev->release(). solo_v4l2_init() then releases solo_dev->vfd exactly
once from fail. Restore video_device_release() after successful
registration so the registered device keeps its normal lifetime handling.
This issue was found by a static analysis tool I am developing.
Fixes: a4056c2fb4c4 ("[media] solo6x10: convert the display node to vb2")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/media/pci/solo6x10/solo6x10-v4l2.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/pci/solo6x10/solo6x10-v4l2.c b/drivers/media/pci/solo6x10/solo6x10-v4l2.c
index 35715b21dbdf..6ce489919ecf 100644
--- a/drivers/media/pci/solo6x10/solo6x10-v4l2.c
+++ b/drivers/media/pci/solo6x10/solo6x10-v4l2.c
@@ -647,6 +647,7 @@ int solo_v4l2_init(struct solo_dev *solo_dev, unsigned nr)
return -ENOMEM;
*solo_dev->vfd = solo_v4l2_template;
+ solo_dev->vfd->release = video_device_release_empty;
solo_dev->vfd->v4l2_dev = &solo_dev->v4l2_dev;
solo_dev->vfd->queue = &solo_dev->vidq;
solo_dev->vfd->lock = &solo_dev->lock;
@@ -690,6 +691,8 @@ int solo_v4l2_init(struct solo_dev *solo_dev, unsigned nr)
if (ret < 0)
goto fail;
+ solo_dev->vfd->release = video_device_release;
+
snprintf(solo_dev->vfd->name, sizeof(solo_dev->vfd->name), "%s (%i)",
SOLO6X10_NAME, solo_dev->vfd->num);
--
2.43.0