staging: most: video: avoid double free on video register failure

comp_register_videodev() allocates a video_device with
video_device_alloc() and releases it if video_register_device() fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

  video_register_device()
    -> __video_register_device()
       -> device_register() fails
          -> put_device(&vdev->dev)
             -> v4l2_device_release()
                -> vdev->release(vdev)
                   -> video_device_release(vdev)

  comp_register_videodev()
    -> video_device_release(mdev->vdev)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free mdev->vdev through vdev->release().
comp_register_videodev() then releases mdev->vdev exactly once on failure.
Restore video_device_release() after successful registration so the
registered device keeps its normal lifetime handling.

This issue was found by a static analysis tool I am developing.

Fixes: eab231c0398a ("staging: most: v4l2-aim: remove unnecessary label err_vbi_dev")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260517111218.945796-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
index f846bb343b2e4cf9a7a392521807718581e0915f..78234620d48d3c32636c9caa8d1bff287c2324b3 100644 (file)
--- a/drivers/staging/most/video/video.c
+++ b/drivers/staging/most/video/video.c
@@ -420,6 +420,7 @@ static int comp_register_videodev(struct most_video_dev *mdev)
 
        /* Fill the video capture device struct */
        *mdev->vdev = comp_videodev_template;
+       mdev->vdev->release = video_device_release_empty;
        mdev->vdev->v4l2_dev = &mdev->v4l2_dev;
        mdev->vdev->lock = &mdev->lock;
        snprintf(mdev->vdev->name, sizeof(mdev->vdev->name), "MOST: %s",
@@ -432,9 +433,13 @@ static int comp_register_videodev(struct most_video_dev *mdev)
                v4l2_err(&mdev->v4l2_dev, "video_register_device failed (%d)\n",
                         ret);
                video_device_release(mdev->vdev);
+               return ret;
        }
 
-       return ret;
+       mdev->vdev->release = video_device_release;
+
+       return 0;
+
 }
 
 static void comp_unregister_videodev(struct most_video_dev *mdev)