vpu_add_func() allocates a video_device with video_device_alloc() and
releases it if video_register_device() fails.
This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:
video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)
vpu_add_func()
-> video_device_release(vfd)
Use video_device_release_empty() while registering the device so that
registration failure paths do not free vfd through vdev->release().
vpu_add_func() then releases vfd exactly once on failure. Restore
video_device_release() after successful registration so the registered
device keeps its normal lifetime handling.
This issue was found by a static analysis tool I am developing.
Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/media/platform/amphion/vpu_v4l2.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
index 64fc88d89ccc..8a89e48ae467 100644
--- a/drivers/media/platform/amphion/vpu_v4l2.c
+++ b/drivers/media/platform/amphion/vpu_v4l2.c
@@ -832,7 +832,7 @@ int vpu_add_func(struct vpu_dev *vpu, struct vpu_func *func)
dev_err(vpu->dev, "alloc vpu decoder video device fail\n");
return -ENOMEM;
}
- vfd->release = video_device_release;
+ vfd->release = video_device_release_empty;
vfd->vfl_dir = VFL_DIR_M2M;
vfd->v4l2_dev = &vpu->v4l2_dev;
vfd->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
@@ -853,6 +853,8 @@ int vpu_add_func(struct vpu_dev *vpu, struct vpu_func *func)
v4l2_m2m_release(func->m2m_dev);
return ret;
}
+
+ vfd->release = video_device_release;
func->vfd = vfd;
ret = v4l2_m2m_register_media_controller(func->m2m_dev, func->vfd, func->function);
--
2.43.0