__host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.
Reported-by: Dan Carpenter <[email protected]> Closes: https://lore.kernel.org/linux-tegra/[email protected]/T/#u Signed-off-by: Mikko Perttunen <[email protected]> --- This is a fix for the commit 'gpu: host1x: Allow entries in BO caches to be freed' that has already been applied by Thierry. --- drivers/gpu/host1x/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c index 772e05a7b45b..a0f39814ab11 100644 --- a/drivers/gpu/host1x/bus.c +++ b/drivers/gpu/host1x/bus.c @@ -1012,10 +1012,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo) if (WARN_ON(!cache)) continue; - mutex_lock(&mapping->cache->lock); + mutex_lock(&cache->lock); WARN_ON(kref_read(&mapping->ref) != 1); __host1x_bo_unpin(&mapping->ref); - mutex_unlock(&mapping->cache->lock); + mutex_unlock(&cache->lock); } } EXPORT_SYMBOL(host1x_bo_clear_cached_mappings); --- base-commit: 3131ff5a117498bb4b9db3a238bb311cbf8383ce change-id: 20260603-host1x-bocache-leak-fix-07f39ccdbf4c prerequisite-change-id: 20260513-host1x-bocache-leak-4759384eb792:v1 prerequisite-patch-id: 37f7eca9233a3163f077161c342071a4ac657f74 prerequisite-patch-id: 11b8f242c122eb03bde9c5a308e8b09a0e75e062
