[PATCH] media: pispbe: check configuration buffer CPU mappings

[Slavin Liu]

vb2_plane_vaddr() can return NULL when a DMA-BUF exporter cannot
provide a CPU mapping, even when the buffer's DMA mapping succeeded.
pispbe_node_buffer_prepare() unconditionally copies the configuration
from that address.

Reject the buffer with -ENOMEM before copying or validating the
configuration if no CPU mapping is available. No buffer is queued or
hardware operation started on this failure path.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 12187bd5d4f8 ("media: raspberrypi: Add support for PiSP BE")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@xxxxxxxxxx>
---
 drivers/media/platform/raspberrypi/pisp_be/pisp_be.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c b/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
index d60d92d2ffa1..56bcf69d70f8 100644
--- a/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
+++ b/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
@@ -839,6 +839,9 @@ static int pispbe_node_buffer_prepare(struct vb2_buffer *vb)
 		void *dst = &node->pispbe->config[vb->index];
 		void *src = vb2_plane_vaddr(vb, 0);
 
+		if (!src)
+			return -ENOMEM;
+
 		memcpy(dst, src, sizeof(struct pisp_be_tiles_config));
 
 		return pisp_be_validate_config(pispbe, dst);