empress_init() allocates a video_device with video_device_alloc() and
releases it if video_register_device() fails.
This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:
video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)
empress_init()
-> video_device_release(dev->empress_dev)
Use video_device_release_empty() while registering the device so that
registration failure paths do not free dev->empress_dev through
vdev->release(). empress_init() then releases dev->empress_dev exactly
once on failure. Restore video_device_release() after successful
registration so the registered device keeps its normal lifetime handling.
This issue was found by a static analysis tool I am developing.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/media/pci/saa7134/saa7134-empress.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index 8c4f70e4177d..884c6418401a 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -250,7 +250,7 @@ static int empress_init(struct saa7134_dev *dev)
return -ENOMEM;
*(dev->empress_dev) = saa7134_empress_template;
dev->empress_dev->v4l2_dev = &dev->v4l2_dev;
- dev->empress_dev->release = video_device_release;
+ dev->empress_dev->release = video_device_release_empty;
dev->empress_dev->lock = &dev->lock;
snprintf(dev->empress_dev->name, sizeof(dev->empress_dev->name),
"%s empress (%s)", dev->name,
@@ -305,6 +305,8 @@ static int empress_init(struct saa7134_dev *dev)
dev->empress_dev = NULL;
return err;
}
+
+ dev->empress_dev->release = video_device_release;
pr_info("%s: registered device %s [mpeg]\n",
dev->name, video_device_node_name(dev->empress_dev));
--
2.43.0