cxusb_medion_register_analog_video() allocates a video_device with
video_device_alloc() and releases it from the ret_vrelease error path if
video_register_device() fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

  video_register_device()
    -> __video_register_device()
       -> device_register() fails
          -> put_device(&vdev->dev)
             -> v4l2_device_release()
                -> vdev->release(vdev)
                   -> cxusb_medion_videodev_release(vdev)

  cxusb_medion_register_analog_video()
    -> ret_vrelease
       -> video_device_release(cxdev->videodev)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free cxdev->videodev through
vdev->release(). cxusb_medion_register_analog_video() then releases
cxdev->videodev exactly once from ret_vrelease. Restore
cxusb_medion_videodev_release() after successful registration so the
registered device keeps its normal lifetime handling.

This issue was found by a static analysis tool I am developing.

Fixes: e478d4054054 ("media: cxusb: add analog mode support for Medion MD95700")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/usb/dvb-usb/cxusb-analog.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb-analog.c b/drivers/media/usb/dvb-usb/cxusb-analog.c
index 3bbee1fcbc8d..2d899af0d5c3 100644
--- a/drivers/media/usb/dvb-usb/cxusb-analog.c
+++ b/drivers/media/usb/dvb-usb/cxusb-analog.c
@@ -1654,7 +1654,7 @@ static int cxusb_medion_register_analog_video(struct dvb_usb_device *dvbdev)
 	cxdev->videodev->vfl_dir = VFL_DIR_RX;
 	cxdev->videodev->ioctl_ops = &cxusb_video_ioctl;
 	cxdev->videodev->tvnorms = V4L2_STD_ALL;
-	cxdev->videodev->release = cxusb_medion_videodev_release;
+	cxdev->videodev->release = video_device_release_empty;
 	cxdev->videodev->lock = &cxdev->dev_lock;
 	video_set_drvdata(cxdev->videodev, dvbdev);
 
@@ -1664,6 +1664,7 @@ static int cxusb_medion_register_analog_video(struct dvb_usb_device *dvbdev)
 			"video device register failed, ret = %d\n", ret);
 		goto ret_vrelease;
 	}
+	cxdev->videodev->release = cxusb_medion_videodev_release;
 
 	return 0;
 
-- 
2.43.0