e5010_probe() allocates a video_device with video_device_alloc() and
releases it from the fail_after_video_device_alloc error path if
video_register_device() fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

  video_register_device()
    -> __video_register_device()
       -> device_register() fails
          -> put_device(&vdev->dev)
             -> v4l2_device_release()
                -> vdev->release(vdev)
                   -> video_device_release(vdev)

  e5010_probe()
    -> fail_after_video_device_alloc
       -> video_device_release(e5010->vdev)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free e5010->vdev through vdev->release().
e5010_probe() then releases e5010->vdev exactly once from
fail_after_video_device_alloc. Restore video_device_release() after
successful registration so the registered device keeps its normal lifetime
handling.

This issue was found by a static analysis tool I am developing.

Fixes: 609ba05b9484 ("media: imagination: fix a potential memory leak in e5010_probe()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/platform/imagination/e5010-jpeg-enc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/imagination/e5010-jpeg-enc.c b/drivers/media/platform/imagination/e5010-jpeg-enc.c
index 42ad9ee3993b..7f4076d3bca8 100644
--- a/drivers/media/platform/imagination/e5010-jpeg-enc.c
+++ b/drivers/media/platform/imagination/e5010-jpeg-enc.c
@@ -1045,7 +1045,7 @@ static int e5010_probe(struct platform_device *pdev)
 	e5010->vdev->fops = &e5010_fops;
 	e5010->vdev->ioctl_ops = &e5010_ioctl_ops;
 	e5010->vdev->minor = -1;
-	e5010->vdev->release = video_device_release;
+	e5010->vdev->release = video_device_release_empty;
 	e5010->vdev->vfl_dir = VFL_DIR_M2M;
 	e5010->vdev->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
 	e5010->vdev->v4l2_dev = &e5010->v4l2_dev;
@@ -1106,6 +1106,7 @@ static int e5010_probe(struct platform_device *pdev)
 		dev_err_probe(dev, ret, "failed to register video device\n");
 		goto fail_after_video_register_device;
 	}
+	e5010->vdev->release = video_device_release;
 
 	v4l2_info(&e5010->v4l2_dev, "Device registered as /dev/video%d\n",
 		  e5010->vdev->num);
-- 
2.43.0