Claude review: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
Author: Mikko Perttunen <mperttunen@nvidia.com>
Patches: 1
Reviewed: 2026-06-04T11:54:02.847182

---

This is a single-patch fix for a use-after-free bug in `host1x_bo_clear_cached_mappings()`. The bug was introduced by a prerequisite commit ("gpu: host1x: Allow entries in BO caches to be freed") and was reported by Dan Carpenter (likely via static analysis / Smatch).

The fix is correct, minimal, and obviously right. The `cache` local variable is assigned from `mapping->cache` at the top of the loop iteration (line 1011), and is used for the NULL check immediately after. However, the `mutex_lock`/`mutex_unlock` calls then redundantly dereference `mapping->cache` instead of using the already-saved `cache` local. Since `__host1x_bo_unpin()` drops the last kref, and the `unpin` callback (e.g. `tegra_bo_unpin()`) calls `kfree(map)`, the `mapping` pointer is freed by the time `mutex_unlock(&mapping->cache->lock)` executes — a clear use-after-free.

**Verdict: Patch looks good. Recommend applying.**

---
Generated by Claude Code Patch Reviewer