[PATCH RFC] media: cx23885: check MPEG video-device allocation

[Slavin Liu]

cx23885_video_dev_alloc() returns NULL when allocation fails.
cx23885_417_register() subsequently passes that pointer to
video_set_drvdata() and accesses its fields.

Check the allocation and release the initialized CX2341x control
handler on failure. Import its controls into the parent handler only
after the allocation succeeds: the parent retains borrowed control
references and survives a failed MPEG registration, so freeing an
already imported handler would leave dangling references. The successful
registration path keeps the same controls and video device.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: b1b81f1db73f ("V4L/DVB (7725): cx23885: Add generic cx23417 hardware encoder support")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@xxxxxxxxxx>
---
 drivers/media/pci/cx23885/cx23885-417.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index 219937a153b3..13fbb1588e5c 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -1514,11 +1514,16 @@ int cx23885_417_register(struct cx23885_dev *dev)
 	dev->cxhdl.priv = dev;
 	dev->cxhdl.func = cx23885_api_func;
 	cx2341x_handler_set_50hz(&dev->cxhdl, tsport->height == 576);
-	v4l2_ctrl_add_handler(&dev->ctrl_handler, &dev->cxhdl.hdl, NULL, false);
 
 	/* Allocate and initialize V4L video device */
 	dev->v4l_device = cx23885_video_dev_alloc(tsport,
 		dev->pci, &cx23885_mpeg_template, "mpeg");
+	if (!dev->v4l_device) {
+		v4l2_ctrl_handler_free(&dev->cxhdl.hdl);
+		return -ENOMEM;
+	}
+	v4l2_ctrl_add_handler(&dev->ctrl_handler, &dev->cxhdl.hdl, NULL, false);
+
 	q = &dev->vb2_mpegq;
 	q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	q->io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ;