[PATCH] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[PATCH] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[Mikko Perttunen]

__host1x_bo_unpin() drops the last reference to the mapping and frees
it, so we can't dereference mapping afterwards. The cache itself
outlives the mapping, so use the cache local variable instead.

Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
---
This is a fix for the commit

	'gpu: host1x: Allow entries in BO caches to be freed'

that has already been applied by Thierry.
---
 drivers/gpu/host1x/bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 772e05a7b45b..a0f39814ab11 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -1012,10 +1012,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)
 		if (WARN_ON(!cache))
 			continue;
 
-		mutex_lock(&mapping->cache->lock);
+		mutex_lock(&cache->lock);
 		WARN_ON(kref_read(&mapping->ref) != 1);
 		__host1x_bo_unpin(&mapping->ref);
-		mutex_unlock(&mapping->cache->lock);
+		mutex_unlock(&cache->lock);
 	}
 }
 EXPORT_SYMBOL(host1x_bo_clear_cached_mappings);

---
base-commit: 3131ff5a117498bb4b9db3a238bb311cbf8383ce
change-id: 20260603-host1x-bocache-leak-fix-07f39ccdbf4c
prerequisite-change-id: 20260513-host1x-bocache-leak-4759384eb792:v1
prerequisite-patch-id: 37f7eca9233a3163f077161c342071a4ac657f74
prerequisite-patch-id: 11b8f242c122eb03bde9c5a308e8b09a0e75e062

Re: [PATCH] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[Thierry Reding]

[-- Attachment #1: Type: text/plain, Size: 767 bytes --]

On Wed, Jun 03, 2026 at 05:37:49PM +0900, Mikko Perttunen wrote:
> __host1x_bo_unpin() drops the last reference to the mapping and frees
> it, so we can't dereference mapping afterwards. The cache itself
> outlives the mapping, so use the cache local variable instead.
> 
> Reported-by: Dan Carpenter <error27@gmail.com>
> Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u
> Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
> ---
> This is a fix for the commit
> 
> 	'gpu: host1x: Allow entries in BO caches to be freed'
> 
> that has already been applied by Thierry.
> ---
>  drivers/gpu/host1x/bus.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Applied to drm-misc-fixes, thanks.

Thierry

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]