drm/gpusvm: Fix mm reference leak in range eviction

[PATCH] drm/gpusvm: Fix mm reference leak in range eviction

Posted by Stanislav Kinsburskii 1 week, 3 days ago

drm_gpusvm_range_evict() pins gpusvm->mm with mmget_not_zero() before
allocating the temporary HMM PFN array. If that allocation fails, the
function returns -ENOMEM directly and leaks the mm reference.

Route the allocation failure through the common mmput() path after
initializing err to -ENOMEM. This preserves the returned error while
balancing the mm reference acquired by mmget_not_zero().

Fixes: 99624bdff8670 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
Cc: stable@vger.kernel.org
Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
---
 drivers/gpu/drm/drm_gpusvm.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index 76e8a0028c7f..1a8bb83bd28d 100644
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -1715,7 +1715,7 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
 	unsigned long *pfns;
 	unsigned long npages = npages_in_range(drm_gpusvm_range_start(range),
 					       drm_gpusvm_range_end(range));
-	int err = 0;
+	int err = -ENOMEM;
 	struct mm_struct *mm = gpusvm->mm;
 
 	if (!mmget_not_zero(mm))
@@ -1723,12 +1723,13 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
 
 	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
 	if (!pfns)
-		return -ENOMEM;
+		goto put_mm;
 
 	hmm_range.hmm_pfns = pfns;
 	err = hmm_range_fault_unlocked_timeout(&hmm_range, timeout);
 
 	kvfree(pfns);
+put_mm:
 	mmput(mm);
 
 	return err == -EBUSY ? -ETIME : err;

Re: [PATCH] drm/gpusvm: Fix mm reference leak in range eviction

Posted by Matthew Brost 4 days, 23 hours ago

On Tue, Jul 14, 2026 at 02:45:14PM -0700, Stanislav Kinsburskii wrote:
> drm_gpusvm_range_evict() pins gpusvm->mm with mmget_not_zero() before
> allocating the temporary HMM PFN array. If that allocation fails, the
> function returns -ENOMEM directly and leaks the mm reference.
> 
> Route the allocation failure through the common mmput() path after
> initializing err to -ENOMEM. This preserves the returned error while
> balancing the mm reference acquired by mmget_not_zero().
> 
> Fixes: 99624bdff8670 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>

Yes, this is a bug... I also have pending patch to fix this here:

https://patchwork.freedesktop.org/patch/740193/?series=170433&rev=1

I think I prefer mine.

Matt

> ---
>  drivers/gpu/drm/drm_gpusvm.c |    5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index 76e8a0028c7f..1a8bb83bd28d 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -1715,7 +1715,7 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
>  	unsigned long *pfns;
>  	unsigned long npages = npages_in_range(drm_gpusvm_range_start(range),
>  					       drm_gpusvm_range_end(range));
> -	int err = 0;
> +	int err = -ENOMEM;
>  	struct mm_struct *mm = gpusvm->mm;
>  
>  	if (!mmget_not_zero(mm))
> @@ -1723,12 +1723,13 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
>  
>  	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
>  	if (!pfns)
> -		return -ENOMEM;
> +		goto put_mm;
>  
>  	hmm_range.hmm_pfns = pfns;
>  	err = hmm_range_fault_unlocked_timeout(&hmm_range, timeout);
>  
>  	kvfree(pfns);
> +put_mm:
>  	mmput(mm);
>  
>  	return err == -EBUSY ? -ETIME : err;
> 
>

Re: [PATCH] drm/gpusvm: Fix mm reference leak in range eviction

Posted by Stanislav Kinsburskii 4 days, 23 hours ago

On Mon, Jul 20, 2026 at 11:42:19AM -0700, Matthew Brost wrote:
> On Tue, Jul 14, 2026 at 02:45:14PM -0700, Stanislav Kinsburskii wrote:
> > drm_gpusvm_range_evict() pins gpusvm->mm with mmget_not_zero() before
> > allocating the temporary HMM PFN array. If that allocation fails, the
> > function returns -ENOMEM directly and leaks the mm reference.
> > 
> > Route the allocation failure through the common mmput() path after
> > initializing err to -ENOMEM. This preserves the returned error while
> > balancing the mm reference acquired by mmget_not_zero().
> > 
> > Fixes: 99624bdff8670 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
> 
> Yes, this is a bug... I also have pending patch to fix this here:
> 
> https://patchwork.freedesktop.org/patch/740193/?series=170433&rev=1
> 
> I think I prefer mine.
> 

Sure, let's disregard mine.

Thanks,
Stanislav

> Matt
> 
> > ---
> >  drivers/gpu/drm/drm_gpusvm.c |    5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> > index 76e8a0028c7f..1a8bb83bd28d 100644
> > --- a/drivers/gpu/drm/drm_gpusvm.c
> > +++ b/drivers/gpu/drm/drm_gpusvm.c
> > @@ -1715,7 +1715,7 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
> >  	unsigned long *pfns;
> >  	unsigned long npages = npages_in_range(drm_gpusvm_range_start(range),
> >  					       drm_gpusvm_range_end(range));
> > -	int err = 0;
> > +	int err = -ENOMEM;
> >  	struct mm_struct *mm = gpusvm->mm;
> >  
> >  	if (!mmget_not_zero(mm))
> > @@ -1723,12 +1723,13 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
> >  
> >  	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> >  	if (!pfns)
> > -		return -ENOMEM;
> > +		goto put_mm;
> >  
> >  	hmm_range.hmm_pfns = pfns;
> >  	err = hmm_range_fault_unlocked_timeout(&hmm_range, timeout);
> >  
> >  	kvfree(pfns);
> > +put_mm:
> >  	mmput(mm);
> >  
> >  	return err == -EBUSY ? -ETIME : err;
> > 
> >