hva_register_device() allocates a video_device with video_device_alloc()
and releases it from the err_vdev_release error path if
video_register_device() fails.
This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:
video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)
hva_register_device()
-> err_vdev_release
-> video_device_release(vdev)
Use video_device_release_empty() while registering the device so that
registration failure paths do not free vdev through vdev->release().
hva_register_device() then releases vdev exactly once from
err_vdev_release. Restore video_device_release() after successful
registration so the registered device keeps its normal lifetime handling.
This issue was found by a static analysis tool I am developing.
Fixes: 57b2c0628b60 ("[media] st-hva: multi-format video encoder V4L2 driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/media/platform/st/sti/hva/hva-v4l2.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/st/sti/hva/hva-v4l2.c b/drivers/media/platform/st/sti/hva/hva-v4l2.c
index 645e4f155dd0..4e93a7d4b245 100644
--- a/drivers/media/platform/st/sti/hva/hva-v4l2.c
+++ b/drivers/media/platform/st/sti/hva/hva-v4l2.c
@@ -1305,7 +1305,7 @@ static int hva_register_device(struct hva_dev *hva)
vdev->fops = &hva_fops;
vdev->ioctl_ops = &hva_ioctl_ops;
- vdev->release = video_device_release;
+ vdev->release = video_device_release_empty;
vdev->lock = &hva->lock;
vdev->vfl_dir = VFL_DIR_M2M;
vdev->device_caps = V4L2_CAP_STREAMING | V4L2_CAP_VIDEO_M2M;
@@ -1319,6 +1319,7 @@ static int hva_register_device(struct hva_dev *hva)
HVA_PREFIX);
goto err_vdev_release;
}
+ vdev->release = video_device_release;
hva->vdev = vdev;
video_set_drvdata(vdev, hva);
--
2.43.0