[bug report] gpu: host1x: Allow entries in BO caches to be freed

[Dan Carpenter <error27@gmail.com>]

Hello Mikko Perttunen,

Commit 3cbf5e3c46e6 ("gpu: host1x: Allow entries in BO caches to be
freed") from May 15, 2026 (linux-next), leads to the following Smatch
static checker warning:

	drivers/gpu/host1x/bus.c:1018 host1x_bo_clear_cached_mappings()
	warn: 'mapping' was already freed. (line 1017)

drivers/gpu/host1x/bus.c
    1008         struct host1x_bo_cache *cache;
    1009 
    1010         list_for_each_entry_safe(mapping, tmp, &bo->mappings, list) {
                                    ^^^^^
We have to use _safe() here because mapping is freed.

    1011                 cache = mapping->cache;
    1012                 if (WARN_ON(!cache))
    1013                         continue;
    1014 
    1015                 mutex_lock(&mapping->cache->lock);
    1016                 WARN_ON(kref_read(&mapping->ref) != 1);
    1017                 __host1x_bo_unpin(&mapping->ref);
                                           ^^^^^^^^^^^^^
This frees mapping.


--> 1018                 mutex_unlock(&mapping->cache->lock);
                                       ^^^^^^^
Use after free.

    1019         }
    1020 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter