[PATCH] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[PATCH] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[Mikko Perttunen]

__host1x_bo_unpin() drops the last reference to the mapping and frees
it, so we can't dereference mapping afterwards. The cache itself
outlives the mapping, so use the cache local variable instead.

Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
---
This is a fix for the commit

	'gpu: host1x: Allow entries in BO caches to be freed'

that has already been applied by Thierry.
---
 drivers/gpu/host1x/bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 772e05a7b45b..a0f39814ab11 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -1012,10 +1012,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)
 		if (WARN_ON(!cache))
 			continue;
 
-		mutex_lock(&mapping->cache->lock);
+		mutex_lock(&cache->lock);
 		WARN_ON(kref_read(&mapping->ref) != 1);
 		__host1x_bo_unpin(&mapping->ref);
-		mutex_unlock(&mapping->cache->lock);
+		mutex_unlock(&cache->lock);
 	}
 }
 EXPORT_SYMBOL(host1x_bo_clear_cached_mappings);

---
base-commit: 3131ff5a117498bb4b9db3a238bb311cbf8383ce
change-id: 20260603-host1x-bocache-leak-fix-07f39ccdbf4c
prerequisite-change-id: 20260513-host1x-bocache-leak-4759384eb792:v1
prerequisite-patch-id: 37f7eca9233a3163f077161c342071a4ac657f74
prerequisite-patch-id: 11b8f242c122eb03bde9c5a308e8b09a0e75e062

Claude review: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[Claude Code Review Bot]

Overall Series Review

Subject: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
Author: Mikko Perttunen <mperttunen@nvidia.com>
Patches: 1
Reviewed: 2026-06-04T11:54:02.847182

---

This is a single-patch fix for a use-after-free bug in `host1x_bo_clear_cached_mappings()`. The bug was introduced by a prerequisite commit ("gpu: host1x: Allow entries in BO caches to be freed") and was reported by Dan Carpenter (likely via static analysis / Smatch).

The fix is correct, minimal, and obviously right. The `cache` local variable is assigned from `mapping->cache` at the top of the loop iteration (line 1011), and is used for the NULL check immediately after. However, the `mutex_lock`/`mutex_unlock` calls then redundantly dereference `mapping->cache` instead of using the already-saved `cache` local. Since `__host1x_bo_unpin()` drops the last kref, and the `unpin` callback (e.g. `tegra_bo_unpin()`) calls `kfree(map)`, the `mapping` pointer is freed by the time `mutex_unlock(&mapping->cache->lock)` executes — a clear use-after-free.

**Verdict: Patch looks good. Recommend applying.**

---
Generated by Claude Code Patch Reviewer

Claude review: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

[Claude Code Review Bot]

Patch Review

**Bug analysis:**

In `host1x_bo_clear_cached_mappings()` (bus.c, around line 1010), the loop body does:

```c
cache = mapping->cache;          // line 1011: save cache pointer
if (WARN_ON(!cache))             // line 1012: NULL guard
    continue;

mutex_lock(&mapping->cache->lock);    // line 1015: dereferences mapping->cache
WARN_ON(kref_read(&mapping->ref) != 1);
__host1x_bo_unpin(&mapping->ref);     // line 1017: drops last ref → frees mapping
mutex_unlock(&mapping->cache->lock);  // line 1018: USE-AFTER-FREE
```

The call chain is: `__host1x_bo_unpin()` → `mapping->bo->ops->unpin(mapping)` → e.g. `tegra_bo_unpin()` which calls `kfree(map)`. After that, `mapping` is freed memory, so `mapping->cache->lock` on line 1018 is a use-after-free.

**Fix correctness:**

The fix simply replaces `mapping->cache->lock` with `cache->lock` in both the `mutex_lock` and `mutex_unlock` calls. This is safe because:

1. `cache` is assigned from `mapping->cache` *before* the unpin (line 1011)
2. The cache object outlives the mapping — it's owned by the host1x device, not the mapping
3. The `list_for_each_entry_safe` macro already saved `tmp` for safe iteration after the mapping is freed

**Nits:** None. The commit message is clear, properly credits the reporter with `Reported-by` and `Closes` tags, and the diff is minimal.

**Note on `WARN_ON(kref_read(&mapping->ref) != 1)`** (line 1016, untouched by this patch): This accesses `mapping->ref` *before* the unpin, so it's fine. Just worth noting for anyone reading along — the access ordering is correct.

Reviewed-by worthy as-is.

---
Generated by Claude Code Patch Reviewer