[PATCH] media: meson: vdec: avoid double free on video register failure

[PATCH] media: meson: vdec: avoid double free on video register failure

[Guangshuo Li]

vdec_probe() allocates a video_device with video_device_alloc() and
releases it from the err_vdev_release error path if
video_register_device() fails.

This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:

  video_register_device()
    -> __video_register_device()
       -> device_register() fails
          -> put_device(&vdev->dev)
             -> v4l2_device_release()
                -> vdev->release(vdev)
                   -> video_device_release(vdev)

  vdec_probe()
    -> err_vdev_release
       -> video_device_release(vdev)

Use video_device_release_empty() while registering the device so that
registration failure paths do not free vdev through vdev->release().
vdec_probe() then releases vdev exactly once from err_vdev_release.
Restore video_device_release() after successful registration so the
registered device keeps its normal lifetime handling.

This issue was found by a static analysis tool I am developing.

Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/staging/media/meson/vdec/vdec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 4b77ec1af5a7..2994e46cbc25 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -1074,7 +1074,7 @@ static int vdec_probe(struct platform_device *pdev)
 	mutex_init(&core->lock);
 
 	strscpy(vdev->name, "meson-video-decoder", sizeof(vdev->name));
-	vdev->release = video_device_release;
+	vdev->release = video_device_release_empty;
 	vdev->fops = &vdec_fops;
 	vdev->ioctl_ops = &vdec_ioctl_ops;
 	vdev->vfl_dir = VFL_DIR_M2M;
@@ -1089,6 +1089,7 @@ static int vdec_probe(struct platform_device *pdev)
 		dev_err(dev, "Failed registering video device\n");
 		goto err_vdev_release;
 	}
+	vdev->release = video_device_release;
 
 	return 0;
 
-- 
2.43.0


_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] media: meson: vdec: avoid double free on video register failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Bypassing kobject lifetime management via a dummy release function creates a Use-After-Free (UAF) vulnerability.
--

commit c9bf433f66378b70af4be79f5c3eedbee4a4582b
Author: Guangshuo Li <lgs201920130244@gmail.com>

media: meson: vdec: avoid double free on video register failure

This commit temporarily sets the video device release function to
video_device_release_empty before calling video_register_device() to prevent
a double-free on failure. It restores the original release function upon
success.

> diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
> index 4b77ec1af5a76..2994e46cbc259 100644
> --- a/drivers/staging/media/meson/vdec/vdec.c
> +++ b/drivers/staging/media/meson/vdec/vdec.c
> @@ -1074,7 +1074,7 @@ static int vdec_probe(struct platform_device *pdev)
>  	mutex_init(&core->lock);
>  
>  	strscpy(vdev->name, "meson-video-decoder", sizeof(vdev->name));
> -	vdev->release = video_device_release;
> +	vdev->release = video_device_release_empty;
>  	vdev->fops = &vdec_fops;
>  	vdev->ioctl_ops = &vdec_ioctl_ops;
>  	vdev->vfl_dir = VFL_DIR_M2M;
> @@ -1089,6 +1089,7 @@ static int vdec_probe(struct platform_device *pdev)
>  		dev_err(dev, "Failed registering video device\n");
>  		goto err_vdev_release;

When video_register_device() invokes device_register(), the embedded struct
device is initialized and can potentially be exposed to the system via
sysfs.

If registration fails, put_device() is called to drop the reference, but
this does not guarantee immediate synchronous destruction. Concurrent
subsystems might temporarily hold references, or if
CONFIG_DEBUG_KOBJECT_RELEASE is enabled, the kobject release is scheduled
on a workqueue.

Will bypassing the kobject lifetime management here by setting a dummy
release function and synchronously freeing the device in err_vdev_release
lead to a use-after-free?

Once the delayed kobject cleanup runs or concurrent holders drop their
references, the kernel could access the already-freed struct device within
the freed vdev to perform internal kobject teardown.

>  	}
> +	vdev->release = video_device_release;
>  
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260518054318.979147-1-lgs201920130244@gmail.com?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic