]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
staging: most: video: avoid double free on video register failure
authorGuangshuo Li <lgs201920130244@gmail.com>
Sun, 17 May 2026 11:12:18 +0000 (19:12 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 21 May 2026 10:42:38 +0000 (12:42 +0200)
commit7cb1c5b32a2bfde961fff8d5204526b609bcb30a
tree87e77b114cf519c6101917683a3a3266427b63c9
parentd5c28c0db2ef88132e4502108cac726bac1ab715
staging: most: video: avoid double free on video register failure

comp_register_videodev() allocates a video_device with
video_device_alloc() and releases it if video_register_device() fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

  video_register_device()
    -> __video_register_device()
       -> device_register() fails
          -> put_device(&vdev->dev)
             -> v4l2_device_release()
                -> vdev->release(vdev)
                   -> video_device_release(vdev)

  comp_register_videodev()
    -> video_device_release(mdev->vdev)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free mdev->vdev through vdev->release().
comp_register_videodev() then releases mdev->vdev exactly once on failure.
Restore video_device_release() after successful registration so the
registered device keeps its normal lifetime handling.

This issue was found by a static analysis tool I am developing.

Fixes: eab231c0398a ("staging: most: v4l2-aim: remove unnecessary label err_vbi_dev")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260517111218.945796-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/most/video/video.c