[PATCH] media: vidtv: fix NULL pointer dereference in vidtv_s302m_encode

[zhangdaolong]

vidtv_s302m_access_unit_init() can return NULL on memory allocation
failure, but vidtv_s302m_alloc_au() does not check for this. When
e->access_units is NULL and the encoder is not synchronized with a video
encoder, vidtv_s302m_encode() unconditionally dereferences
e->access_units, leading to a general protection fault / NULL pointer
dereference.

Change vidtv_s302m_alloc_au() to return an error code on allocation
failure, cleaning up any partially allocated access units, and check its
return value in vidtv_s302m_encode().

Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Reported-by: syzbot+e9ce4d4ff55ba65e3980@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=e9ce4d4ff55ba65e3980
Signed-off-by: zhangdaolong <dlzhangak@xxxxxxxxxxxxxx>
---
 drivers/media/test-drivers/vidtv/vidtv_s302m.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/media/test-drivers/vidtv/vidtv_s302m.c b/drivers/media/test-drivers/vidtv/vidtv_s302m.c
index 3c08e442b2d1..83cac8464a4a 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_s302m.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_s302m.c
@@ -176,7 +176,7 @@ static void vidtv_s302m_access_unit_destroy(struct vidtv_encoder *e)
 	e->access_units = NULL;
 }
 
-static void vidtv_s302m_alloc_au(struct vidtv_encoder *e)
+static int vidtv_s302m_alloc_au(struct vidtv_encoder *e)
 {
 	struct vidtv_access_unit *sync_au = NULL;
 	struct vidtv_access_unit *temp = NULL;
@@ -186,16 +186,25 @@ static void vidtv_s302m_alloc_au(struct vidtv_encoder *e)
 
 		while (sync_au) {
 			temp = vidtv_s302m_access_unit_init(e->access_units);
+			if (!temp) {
+				vidtv_s302m_access_unit_destroy(e);
+				return -ENOMEM;
+			}
+
 			if (!e->access_units)
 				e->access_units = temp;
 
 			sync_au = sync_au->next;
 		}
 
-		return;
+		return 0;
 	}
 
 	e->access_units = vidtv_s302m_access_unit_init(NULL);
+	if (!e->access_units)
+		return -ENOMEM;
+
+	return 0;
 }
 
 static void
@@ -405,7 +414,8 @@ static void *vidtv_s302m_encode(struct vidtv_encoder *e)
 	 */
 
 	vidtv_s302m_access_unit_destroy(e);
-	vidtv_s302m_alloc_au(e);
+	if (vidtv_s302m_alloc_au(e))
+		return NULL;
 
 	if (e->sync && e->sync->is_video_encoder) {
 		vidtv_s302m_compute_sample_count_from_video(e);
-- 
2.48.1