Re: [PATCH] gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
Thierry Reding <[email protected]>
| Newsgroups | org.kernel.vger.linux-tegra,org.freedesktop.lists.dri-devel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <alkidFSX2nTsQviG@orome> |
On Wed, Jun 03, 2026 at 05:37:49PM +0900, Mikko Perttunen wrote: > __host1x_bo_unpin() drops the last reference to the mapping and frees > it, so we can't dereference mapping afterwards. The cache itself > outlives the mapping, so use the cache local variable instead. > > Reported-by: Dan Carpenter <[email protected]> > Closes: https://lore.kernel.org/linux-tegra/[email protected]/T/#u > Signed-off-by: Mikko Perttunen <[email protected]> > --- > This is a fix for the commit > > 'gpu: host1x: Allow entries in BO caches to be freed' > > that has already been applied by Thierry. > --- > drivers/gpu/host1x/bus.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) Applied to drm-misc-fixes, thanks. Thierry
signature.asc
(application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpZIn8ACgkQ3SOs138+ s6Eyhg//SENKmW1oTotuZfGqg+SpbhWkuzHr4s2hnvMk4AczIg2XDiehR3WyQHh3 azsMGK8VlfY6ASIYsDNVL93MXrpNNZCzx9REBy/M5gXPLu+ilGVHO/7AavEsXJyF qsZsz0LBKJCoNomOu8hN6w77M8dJxdM8fgkt4+8KfEL/hOhthSew56QRLBLDxXuW VfIjzIESdsxp7ZuHycU7RDFkoFBROYGvMW11eFeKynhbgOWjkwU7dmIEhck/Jy5R DxI4FcIMCTOL9PxmyClTzEqy81rG3hbQlP4/RHSdxKLBY/fszPG5sGx7FBN+/sxE JgHI0d+FL5+/i4BcX/9zjpgFs9fVoL8TPX3L5KivkYsWkfupyqUko83cMURCNjxZ ri3kCpvlGpqjfpJId+B+fKJGNnl/JkNnOOkEdK1070uBtnavADV18rlozcR+/oD8 4RSB2k++HXTkdlJD/whudv7Nt/36jy7BDLfvOzChmG05iI0XPmmp9WXUQ042dX7m y3i6i5oSrrHIwhIENileVGMh4Y/xAtlFZrgUu4Au7HvmjS3gUNGtWjCK3yS0v4Rg PftHtA53jTnyLTS+Yg/XJMuMOS0YUAR8YTIITWyhVeaOppvrbiUWX4RINPU3SQpM Q4sSniHL7w2MCELinhNmUyeuk96cImZb8RdQmW8ACefVW+cDYss= =TEkN -----END PGP SIGNATURE-----