[PATCH] media: ti-vpe: vip: avoid double free on video register failure

[Guangshuo Li]

alloc_stream() allocates a video_device with video_device_alloc() and
releases it from the do_free_vfd error path if video_register_device()
fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

  video_register_device()
    -> __video_register_device()
       -> device_register() fails
          -> put_device(&vdev->dev)
             -> v4l2_device_release()
                -> vdev->release(vdev)
                   -> video_device_release(vdev)

  alloc_stream()
    -> do_free_vfd
       -> video_device_release(vfd)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free vfd through vdev->release().
alloc_stream() then releases vfd exactly once from do_free_vfd. Restore
video_device_release() after successful registration so the registered
device keeps its normal lifetime handling.

This issue was found by a static analysis tool I am developing.

Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/media/platform/ti/vpe/vip.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/ti/vpe/vip.c b/drivers/media/platform/ti/vpe/vip.c
index a4b616a5ece7..aae6cb3abe8d 100644
--- a/drivers/media/platform/ti/vpe/vip.c
+++ b/drivers/media/platform/ti/vpe/vip.c
@@ -3094,6 +3094,7 @@ static int alloc_stream(struct vip_port *port, int stream_id, int vfl_type)
 		goto do_free_dropq;
 	}
 	*vfd = vip_videodev;
+	vfd->release = video_device_release_empty;
 	vfd->v4l2_dev = &dev->v4l2_dev;
 	vfd->queue = q;
 
@@ -3107,6 +3108,8 @@ static int alloc_stream(struct vip_port *port, int stream_id, int vfl_type)
 		goto do_free_vfd;
 	}
 
+	vfd->release = video_device_release;
+
 	v4l2_info(&dev->v4l2_dev, "device registered as %s\n",
 		  video_device_node_name(vfd));
 	return 0;
-- 
2.43.0