[PATCH RFC] gpu: host1x: validate the firewall source mapping

[Slavin Liu]

DMA pinning and CPU mapping are independent operations. Reject an
ERR_PTR or NULL source mapping before copying gather commands. Return
the mapping error through the existing job-pin unwind path.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 3800391db1b2 ("drm/tegra: Add PRIME support")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin....@seu.edu.cn>
---
 drivers/gpu/host1x/job.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index 71411bc344bb..b8e7a2752cd5 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -575,6 +575,10 @@ static inline int copy_gathers(struct device *host, struct 
host1x_job *job,
 
                /* Copy the gather */
                gather = host1x_bo_mmap(g->bo);
+               if (IS_ERR(gather))
+                       return PTR_ERR(gather);
+               if (!gather)
+                       return -ENOMEM;
                memcpy(job->gather_copy_mapped + offset, gather + g->offset,
                       g->words * sizeof(u32));
                host1x_bo_munmap(g->bo, gather);