From nobody Mon May 25 03:04:49 2026 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D30E3ECBE9 for ; Tue, 19 May 2026 09:11:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779181908; cv=none; b=ll9NiJvJM7JFvaV+v9jApxS+Pd7n74fU15k2RDbZKCpwZu+juSfSaucGjvGDF9YEYSbVJ/ylNXK+GlvENJLOwTOXpSH1sapVzUEiZp+fxS1M2B3SCG6/iNuGYa4xytvNo1SXfGo/Hw3rj/wWJ7L0VF2EhjdHJkiYBhkZ09s7e98= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779181908; c=relaxed/simple; bh=bO38FoplUF0OGefgQu5Ge6i3It4LuEiVmTb7e877Jfk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UyrTcn96iIk0Ow3wQ/1PYeZB+w5IOrYXY9cml8BTbmKOeljAR0Nmrct4x6WfX+LjOEa4q+3v/PBq4FXxpxAZTZusFwkM0KmcQ/rknC+ZsS9Uh04I4s6UESEb/ntuVLe1xwUNgsctEdA3j6DTziLjiK1CL9Sz4918hJrJQxtiI80= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SatVj3yh; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SatVj3yh" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-c736261ee8dso1446121a12.1 for ; Tue, 19 May 2026 02:11:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779181906; x=1779786706; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=NeHeRdGkO0e2zRMbKYJezoLxkuEvt+FGgdG9h+Dao0E=; b=SatVj3yhK7pULLb55fh8yNfdp1+n1NlERVYVz0xUmwD4XJp7NOi7c2aRaHwy9aCpCZ T9mygHB7ol6lTkSZ69k+VqGNlmGnd6s18siGUYXEjBpGWmqnRSMHCjY0K+kQeJuyaO60 IBElEBKjkxek8QojcKkD2I6dnajW4Bivm7w20sYCLwM1dEgkOLm/N+24KvABCXETpvKW dSxXAsoL+uQsPEr/E+L+lXvkV8u1qB3jQNM0tfV2oSOUbFcROibA3e2MLrdrLs6Afw4G x9Yol+QMSmxTzvXxxPqfupRL6hq7egvDGDUaf1IOnBtLdv93SH22+lcIwjwdamB/Ik0k styA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779181906; x=1779786706; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=NeHeRdGkO0e2zRMbKYJezoLxkuEvt+FGgdG9h+Dao0E=; b=WfTMgZilhp+Mm8IbpqSZAUdDNaHy//fujgMe7lRDfXSpkjRHfUhUoEYoy95CyYpVP1 KERIwBSJR4H4lO3W/J5XAodacDEkOxuP34OvdhzFyOTe6JRlnLEwdPTpk9Buz7GXCxKR PgBfaahSQyoQEQZP7zz2n9QG9m9tokXUKYLxV7f2XdZN2uaa919kFmpo6CR75BcUqWjp vW/yL2YxfR66b0pASFZOhcyHlgia8lmr6Lk+VZQLQFpjlZT+qtKvSEYUVZMQ+nCCbf7k rP+Xs+JiksYgY6wt/QXTRi8HV6ZTM4xb85X0DpyuHhC4K6ZaRYEkNlLVUN2JpK9caX5a xztg== X-Forwarded-Encrypted: i=1; AFNElJ9RNL1hyq8gWH/knqd4YRB7siwyO/OfJkatTCkBIGdRPSwHuQVj6PYK0UUhmEG1raLxgOYylQUl63Ht8sA=@vger.kernel.org X-Gm-Message-State: AOJu0YwXl5lqzQ19MUcFKY/QyrPevC8TlWfjLJ0ymkLRWIt3Ky3CKs2v +XtyBhwC6EhR50pGHInJGneagUXVgSLAoEM749q2vnnJGfo055AwoqwE X-Gm-Gg: Acq92OEL6ZDDgY72uwbhjB5BPZvY4U8w3hi27DSsIdeEZ6eOrRG5GW68y1zTrU67S+y RJW3tEo/zlEs2uWvWIysGwHuOd7FUzQQUTZzvVe3IkVIm+ybA0gpmjLIsOk9GmhNAPjz4Zmojrl xM4ztqbuhN79gD8TAdb5tYoowElCX7uzw8DfOyuc4ky01h94pCnFVK/Ja7o51fkoQ1ua5sd2B08 8G0E9u262pQBdpcKEmPt7lWYUPNZVXnGIzGMi4Ao9CKOOEXD4NX9M47YH6Z6AxGzUyoCzvE4JlO p8Q6Gnt5KUMn2rW5Z+1PhvJeMyyTZCJuEWGWfM4ZjSy9b9QEVS2top2O7Jgk5bpnnsEcak3+9Qj wjUlAAcQ4Hjl8CJHargNLIHe/iouUj/CzcEudTBMapYUYarAHS80wTolhTLcVUZ3o5dhvJ8bqbx 6v/QbajQ== X-Received: by 2002:a05:6a21:32a7:b0:39f:a8fb:3354 with SMTP id adf61e73a8af0-3b22e71ff87mr21414233637.17.1779181905823; Tue, 19 May 2026 02:11:45 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1000::f280]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c82bb0626b2sm20595369a12.6.2026.05.19.02.11.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2026 02:11:45 -0700 (PDT) From: Guangshuo Li To: Vikash Garodia , Dikshita Agarwal , "Bryan O'Donoghue" , Mauro Carvalho Chehab , Stanimir Varbanov , Hans Verkuil , linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] media: venus: venc: avoid double free on video register failure Date: Tue, 19 May 2026 17:08:19 +0800 Message-ID: <20260519090819.1041314-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" venc_probe() allocates a video_device with video_device_alloc() and releases it from the err_vdev_release error path if video_register_device() fails. This can double free the video_device when __video_register_device() reaches device_register() and that call fails: video_register_device() -> __video_register_device() -> device_register() fails -> put_device(&vdev->dev) -> v4l2_device_release() -> vdev->release(vdev) -> video_device_release(vdev) venc_probe() -> err_vdev_release -> video_device_release(vdev) Use video_device_release_empty() while registering the device so that registration failure paths do not free vdev through vdev->release(). venc_probe() then releases vdev exactly once from err_vdev_release. Restore video_device_release() after successful registration so the registered device keeps its normal lifetime handling. This issue was found by a static analysis tool I am developing. Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files") Signed-off-by: Guangshuo Li --- drivers/media/platform/qcom/venus/venc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platf= orm/qcom/venus/venc.c index bf53267cb68d..9a5a025607fb 100644 --- a/drivers/media/platform/qcom/venus/venc.c +++ b/drivers/media/platform/qcom/venus/venc.c @@ -1579,7 +1579,7 @@ static int venc_probe(struct platform_device *pdev) return -ENOMEM; =20 strscpy(vdev->name, "qcom-venus-encoder", sizeof(vdev->name)); - vdev->release =3D video_device_release; + vdev->release =3D video_device_release_empty; vdev->fops =3D &venc_fops; vdev->ioctl_ops =3D &venc_ioctl_ops; vdev->vfl_dir =3D VFL_DIR_M2M; @@ -1590,6 +1590,7 @@ static int venc_probe(struct platform_device *pdev) if (ret) goto err_vdev_release; =20 + vdev->release =3D video_device_release; core->vdev_enc =3D vdev; core->dev_enc =3D dev; =20 --=20 2.43.0