gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

__host1x_bo_unpin() drops the last reference to the mapping and frees
it, so we can't dereference mapping afterwards. The cache itself
outlives the mapping, so use the cache local variable instead.

Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260603-host1x-bocache-leak-fix-v1-1-494101dbfd30@nvidia.com

diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index e3884096c2fe11157d8664eadfc8bff1a1e57fa9..ea3b584990c9a6fad9eed025fae8dc486d802e76 100644 (file)
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -1012,10 +1012,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)
                if (WARN_ON(!cache))
                        continue;
 
-               mutex_lock(&mapping->cache->lock);
+               mutex_lock(&cache->lock);
                WARN_ON(kref_read(&mapping->ref) != 1);
                __host1x_bo_unpin(&mapping->ref);
-               mutex_unlock(&mapping->cache->lock);
+               mutex_unlock(&cache->lock);
        }
 }
 EXPORT_SYMBOL(host1x_bo_clear_cached_mappings);