Command tracing maps the original buffer independently of job pinning.
An ERR_PTR mapping is non-NULL but is not readable. Skip payload capture
and unmapping when this diagnostic mapping fails.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 3f257bc63c0d ("drm/tegra: gem: Do not return NULL in tegra_bo_mmap()")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 drivers/gpu/host1x/hw/channel_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/host1x/hw/channel_hw.c b/drivers/gpu/host1x/hw/channel_hw.c
index a8251ec0810c..19949c99c427 100644
--- a/drivers/gpu/host1x/hw/channel_hw.c
+++ b/drivers/gpu/host1x/hw/channel_hw.c
@@ -28,7 +28,7 @@ static void trace_write_gather(struct host1x_cdma *cdma, struct host1x_bo *bo,
 	if (host1x_debug_trace_cmdbuf)
 		mem = host1x_bo_mmap(bo);
 
-	if (mem) {
+	if (!IS_ERR_OR_NULL(mem)) {
 		u32 i;
 		/*
 		 * Write in batches of 128 as there seems to be a limit

On Sunday, September 13, 2026 9:51 PM Slavin Liu wrote:
> Command tracing maps the original buffer independently of job pinning.
> An ERR_PTR mapping is non-NULL but is not readable. Skip payload capture
> and unmapping when this diagnostic mapping fails.
> 
> Detected by static analysis and reviewed with AI-assisted source auditing.
> 
> Fixes: 3f257bc63c0d ("drm/tegra: gem: Do not return NULL in tegra_bo_mmap()")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
> ---
>  drivers/gpu/host1x/hw/channel_hw.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/host1x/hw/channel_hw.c b/drivers/gpu/host1x/hw/channel_hw.c
> index a8251ec0810c..19949c99c427 100644
> --- a/drivers/gpu/host1x/hw/channel_hw.c
> +++ b/drivers/gpu/host1x/hw/channel_hw.c
> @@ -28,7 +28,7 @@ static void trace_write_gather(struct host1x_cdma *cdma, struct host1x_bo *bo,
>  	if (host1x_debug_trace_cmdbuf)
>  		mem = host1x_bo_mmap(bo);
>  
> -	if (mem) {
> +	if (!IS_ERR_OR_NULL(mem)) {
>  		u32 i;
>  		/*
>  		 * Write in batches of 128 as there seems to be a limit
> 

After the commit in Fixes:, host1x_bo_mmap should never return NULL 
anymore. So IS_ERR() would be the proper macro to use.

Could you modify the patch to use it?

Thank you
Mikko