Mikko Perttunen 266cddf7bd gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings ...

__host1x_bo_unpin() drops the last reference to the mapping and frees
it, so we can't dereference mapping afterwards. The cache itself
outlives the mapping, so use the cache local variable instead.

Reported-by: Dan Carpenter <[email protected]>
Closes: https://lore.kernel.org/linux-tegra/[email protected]/T/#u
Signed-off-by: Mikko Perttunen <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>
Link: https://patch.msgid.link/[email protected]

2026-07-16 20:26:28 +02:00

..

hw

gpu: host1x: Syncpoint interrupt performance optimization

2025-11-14 18:27:19 +01:00

bus.c

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

2026-07-16 20:26:28 +02:00

bus.h

…

cdma.c

…

cdma.h

…

channel.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

channel.h

…

context_bus.c

gpu: host1x: Fix missing 'host1x_context_device_bus_type'

2026-05-28 17:19:30 +02:00

context.c

gpu: host1x: Fix missing 'host1x_context_device_bus_type'

2026-05-28 17:19:30 +02:00

context.h

gpu: host1x: Fix missing 'host1x_context_device_bus_type'

2026-05-28 17:19:30 +02:00

debug.c

…

debug.h

…

dev.c

gpu: host1x: Syncpoint interrupt performance optimization

2025-11-14 18:27:19 +01:00

dev.h

gpu: host1x: Syncpoint interrupt performance optimization

2025-11-14 18:27:19 +01:00

fence.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

fence.h

…

intr.c

gpu: host1x: Skip redundant HW state update

2026-05-28 17:19:28 +02:00

intr.h

…

job.c

gpu: host1x: Fix iommu_map_sgtable() return value check

2026-05-28 17:19:30 +02:00

job.h

…

Kconfig

…

Makefile

gpu: host1x: convert MIPI to use operation function pointers

2026-03-19 08:18:36 +01:00

mipi.c

gpu: host1x: mipi: Fix device_node reference leak in tegra_mipi_request()

2026-05-28 17:19:29 +02:00

syncpt.c

gpu: host1x: Skip redundant syncpoint loads in host1x_syncpt_wait()

2026-05-28 17:19:28 +02:00

syncpt.h

…

tegra114-mipi.c

gpu: host1x: convert MIPI to use operation function pointers

2026-03-19 08:18:36 +01:00