[PATCH RFC] gpu: host1x: validate the firewall source mapping

[Slavin Liu]

DMA pinning and CPU mapping are independent operations. Reject an
ERR_PTR or NULL source mapping before copying gather commands. Return
the mapping error through the existing job-pin unwind path.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 3800391db1b2 ("drm/tegra: Add PRIME support")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@xxxxxxxxxx>
---
 drivers/gpu/host1x/job.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index 71411bc344bb..b8e7a2752cd5 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -575,6 +575,10 @@ static inline int copy_gathers(struct device *host, struct host1x_job *job,
 
 		/* Copy the gather */
 		gather = host1x_bo_mmap(g->bo);
+		if (IS_ERR(gather))
+			return PTR_ERR(gather);
+		if (!gather)
+			return -ENOMEM;
 		memcpy(job->gather_copy_mapped + offset, gather + g->offset,
 		       g->words * sizeof(u32));
 		host1x_bo_munmap(g->bo, gather);