media: vidtv: psi: Add check for kstrdup

Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.

Fixes: 7a7899f6f58e ("media: vidtv: psi: Implement an Event Information Table (EIT)")
Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)")
Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c
index ce0b7a6e92dc3338e8cb824573bd692cd4bda4ef..2a51c898c11ebdadb4dbfe05ac11170c4a7b12aa 100644 (file)
--- a/drivers/media/test-drivers/vidtv/vidtv_psi.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c
@@ -301,16 +301,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc
 
        desc->service_name_len = service_name_len;
 
-       if (service_name && service_name_len)
+       if (service_name && service_name_len) {
                desc->service_name = kstrdup(service_name, GFP_KERNEL);
+               if (!desc->service_name)
+                       goto free_desc;
+       }
 
        desc->provider_name_len = provider_name_len;
 
-       if (provider_name && provider_name_len)
+       if (provider_name && provider_name_len) {
                desc->provider_name = kstrdup(provider_name, GFP_KERNEL);
+               if (!desc->provider_name)
+                       goto free_desc_service_name;
+       }
 
        vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
        return desc;
+
+free_desc_service_name:
+       if (service_name && service_name_len)
+               kfree(desc->service_name);
+free_desc:
+       kfree(desc);
+       return NULL;
 }
 
 struct vidtv_psi_desc_registration
@@ -355,8 +368,13 @@ struct vidtv_psi_desc_network_name
 
        desc->length = network_name_len;
 
-       if (network_name && network_name_len)
+       if (network_name && network_name_len) {
                desc->network_name = kstrdup(network_name, GFP_KERNEL);
+               if (!desc->network_name) {
+                       kfree(desc);
+                       return NULL;
+               }
+       }
 
        vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
        return desc;
@@ -442,15 +460,32 @@ struct vidtv_psi_desc_short_event
                iso_language_code = "eng";
 
        desc->iso_language_code = kstrdup(iso_language_code, GFP_KERNEL);
+       if (!desc->iso_language_code)
+               goto free_desc;
 
-       if (event_name && event_name_len)
+       if (event_name && event_name_len) {
                desc->event_name = kstrdup(event_name, GFP_KERNEL);
+               if (!desc->event_name)
+                       goto free_desc_language_code;
+       }
 
-       if (text && text_len)
+       if (text && text_len) {
                desc->text = kstrdup(text, GFP_KERNEL);
+               if (!desc->text)
+                       goto free_desc_event_name;
+       }
 
        vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
        return desc;
+
+free_desc_event_name:
+       if (event_name && event_name_len)
+               kfree(desc->event_name);
+free_desc_language_code:
+       kfree(desc->iso_language_code);
+free_desc:
+       kfree(desc);
+       return NULL;
 }
 
 struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vidtv_psi_desc *desc)