diff options
| author | Mikko Perttunen <mperttunen@nvidia.com> | 2026-06-03 17:37:49 +0900 |
|---|---|---|
| committer | Thierry Reding <treding@nvidia.com> | 2026-07-16 20:26:28 +0200 |
| commit | 266cddf7bd0f6c79b6c0633aef742a22bf70265b (patch) | |
| tree | 45ef1e5523345101d40d46c8b2dba93181acc6b5 /drivers | |
| parent | ddb44baed257560f192b145ed36cf8c0a412de47 (diff) | |
| download | linux-next-266cddf7bd0f6c79b6c0633aef742a22bf70265b.tar.gz linux-next-266cddf7bd0f6c79b6c0633aef742a22bf70265b.zip | |
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
__host1x_bo_unpin() drops the last reference to the mapping and frees
it, so we can't dereference mapping afterwards. The cache itself
outlives the mapping, so use the cache local variable instead.
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260603-host1x-bocache-leak-fix-v1-1-494101dbfd30@nvidia.com
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/host1x/bus.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c index e3884096c2fe..ea3b584990c9 100644 --- a/drivers/gpu/host1x/bus.c +++ b/drivers/gpu/host1x/bus.c @@ -1012,10 +1012,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo) if (WARN_ON(!cache)) continue; - mutex_lock(&mapping->cache->lock); + mutex_lock(&cache->lock); WARN_ON(kref_read(&mapping->ref) != 1); __host1x_bo_unpin(&mapping->ref); - mutex_unlock(&mapping->cache->lock); + mutex_unlock(&cache->lock); } } EXPORT_SYMBOL(host1x_bo_clear_cached_mappings); |