Re: [PATCH] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[Thierry Reding]

On Wed, Jun 03, 2026 at 05:37:49PM +0900, Mikko Perttunen wrote:
> __host1x_bo_unpin() drops the last reference to the mapping and frees
> it, so we can't dereference mapping afterwards. The cache itself
> outlives the mapping, so use the cache local variable instead.
> 
> Reported-by: Dan Carpenter <error27@xxxxxxxxx>
> Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u
> Signed-off-by: Mikko Perttunen <mperttunen@xxxxxxxxxx>
> ---
> This is a fix for the commit
> 
> 	'gpu: host1x: Allow entries in BO caches to be freed'
> 
> that has already been applied by Thierry.
> ---
>  drivers/gpu/host1x/bus.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Applied to drm-misc-fixes, thanks.

Thierry

Attachment: signature.asc
Description: PGP signature