Mikko Perttunen 266cddf7bd gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings ... __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead. Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/linux-tegra/ah6ErK6f4kVudVIA@stanley.mountain/T/#u Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260603-host1x-bocache-leak-fix-v1-1-494101dbfd30@nvidia.com		2026-07-16 20:26:28 +02:00
..
hw	gpu: host1x: Syncpoint interrupt performance optimization	2025-11-14 18:27:19 +01:00
bus.c	gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings	2026-07-16 20:26:28 +02:00
bus.h	gpu: host1x: bus: make host1x_bus_type const	2024-02-13 19:10:57 +01:00
cdma.c	gpu: host1x: Remove mid-job CDMA flushes	2025-05-07 17:49:59 +02:00
cdma.h
channel.c	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
channel.h	gpu: host1x: Stop CDMA before suspending	2023-10-11 22:52:44 +02:00
context_bus.c	gpu: host1x: Fix missing 'host1x_context_device_bus_type'	2026-05-28 17:19:30 +02:00
context.c	gpu: host1x: Fix missing 'host1x_context_device_bus_type'	2026-05-28 17:19:30 +02:00
context.h	gpu: host1x: Fix missing 'host1x_context_device_bus_type'	2026-05-28 17:19:30 +02:00
debug.c	gpu: host1x: Remove unused host1x_debug_dump_syncpts	2025-02-28 17:44:13 +01:00
debug.h	gpu: host1x: Remove unused host1x_debug_dump_syncpts	2025-02-28 17:44:13 +01:00
dev.c	gpu: host1x: Syncpoint interrupt performance optimization	2025-11-14 18:27:19 +01:00
dev.h	gpu: host1x: Syncpoint interrupt performance optimization	2025-11-14 18:27:19 +01:00
fence.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
fence.h
intr.c	gpu: host1x: Skip redundant HW state update	2026-05-28 17:19:28 +02:00
intr.h	gpu: host1x: Request syncpoint IRQs only during probe	2024-08-28 17:28:48 +02:00
job.c	gpu: host1x: Fix iommu_map_sgtable() return value check	2026-05-28 17:19:30 +02:00
job.h
Kconfig
Makefile	gpu: host1x: convert MIPI to use operation function pointers	2026-03-19 08:18:36 +01:00
mipi.c	gpu: host1x: mipi: Fix device_node reference leak in tegra_mipi_request()	2026-05-28 17:19:29 +02:00
syncpt.c	gpu: host1x: Skip redundant syncpoint loads in host1x_syncpt_wait()	2026-05-28 17:19:28 +02:00
syncpt.h
tegra114-mipi.c	gpu: host1x: convert MIPI to use operation function pointers	2026-03-19 08:18:36 +01:00