[PATCH v1 4/4] media: ipu6: Fix NULL deref in ipu6_mmu_iova_to_phys()

[Manik Bajpai <manik.bajpai@intel.com>]

ipu6_mmu_iova_to_phys() looked up the L2 page table for the given iova
and dereferenced it immediately, without checking whether the
corresponding L1 entry is actually mapped. l2_map() and l2_unmap()
already guard the equivalent lookup by checking the L1 entry against
mmu_info->dummy_l2_pteval before touching l2_pts[].

An unmapped iova (e.g. a stale address passed from a debug path)
would dereference an invalid pointer and crash.

Add the same "is this L1 entry mapped" check used by l2_map()/
l2_unmap(), returning 0 for an unmapped iova instead of crashing.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Manik Bajpai <manik.bajpai@intel.com>
---
 drivers/media/pci/intel/ipu6/ipu6-mmu.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/intel/ipu6/ipu6-mmu.c b/drivers/media/pci/intel/ipu6/ipu6-mmu.c
index 243d438786ba..b8a8ed622b8d 100644
--- a/drivers/media/pci/intel/ipu6/ipu6-mmu.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-mmu.c
@@ -566,10 +566,19 @@ phys_addr_t ipu6_mmu_iova_to_phys(struct ipu6_mmu_info *mmu_info,
 {
 	phys_addr_t phy_addr;
 	unsigned long flags;
+	u32 l1_idx = iova >> ISP_L1PT_SHIFT;
 	u32 *l2_pt;
 
 	spin_lock_irqsave(&mmu_info->lock, flags);
-	l2_pt = mmu_info->l2_pts[iova >> ISP_L1PT_SHIFT];
+	if (mmu_info->l1_pt[l1_idx] == mmu_info->dummy_l2_pteval) {
+		spin_unlock_irqrestore(&mmu_info->lock, flags);
+		dev_err(mmu_info->dev,
+			"iova_to_phys: no mapping for iova %pad\n",
+			&iova);
+		return 0;
+	}
+
+	l2_pt = mmu_info->l2_pts[l1_idx];
 	phy_addr = (phys_addr_t)l2_pt[(iova & ISP_L2PT_MASK) >> ISP_L2PT_SHIFT];
 	phy_addr <<= ISP_PAGE_SHIFT;
 	spin_unlock_irqrestore(&mmu_info->lock, flags);
-- 
2.53.0