From nobody Sat Jul 25 18:55:14 2026 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1AAC429CF2 for ; Tue, 14 Jul 2026 21:45:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784065517; cv=none; b=ZGZRkJpeV21AUUIcRiQaB7Z+y3Cjof92ENq60OUGb1uQNQ+Dp2icf6WD7xXngWokNEzZZFDCotGfRK3lnFrE+27jqyxIS5aE0QCrqT+fGmGVfyEVDdECi0/snIzqma9xz9ZVRi5X0XXUZA5JvvNnZ/wVXTFkMFutqNPj1arVUY8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784065517; c=relaxed/simple; bh=o/5JqaPeh6nlBEHijYJZrOdZLGQnwIHK21vxRTX4+FM=; h=Subject:From:To:Cc:Date:Message-ID:MIME-Version:Content-Type; b=B7T9CWEyFIrsYVjRjo4XHm+/RGZ8oPI823IJux1PYI8zvDIXxCEdE8NR/GJBI1VE1QFYZI2y89GjNymjHfvxG6mmLQ2xuj1NBQxo6okc0Af/y53fkB04MPQ/axIruTdpot54tuevIVXDiydRAVXyd7RFPhJK1mCLfb0cpMDvOl8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iVDkbIrX; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iVDkbIrX" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2cc7e86e7aeso14799345ad.2 for ; Tue, 14 Jul 2026 14:45:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784065516; x=1784670316; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:user-agent :message-id:date:cc:to:from:subject:from:to:cc:subject:date :message-id:reply-to:content-type; bh=76ycW+rBxOZYacJ1Dbj+MtJGsoesj/kofKqPC3AXyqE=; b=iVDkbIrXqpYjtE2wpY9A7BOpoLtFEktiCOYtZROABJTjbAprSZPHkU4MFhZQXm1Uj/ DFZVGJiMOB/nw4rPda7A8viOep0VpLPvcUCOIkvDRNV94yb08pRFiat1knn6a+PSEGCx 0NPcrsLY9hNirMFuuQ94lebDSu4UzHDnwSKnjETQsb1cL56hlwnrc6DUlBWg0/Tq6UxC BzUqQ5948Dmb92BP5u/5+/V6IFEqm//kh2u7kM0JRm7XN/3crSgd9OwZG+9Larye5/Tc 6feTJn0mPA1Vc7mL5QMlm+kV/ZovhzTlAsW9QyRd/SKochHVY/kYgEPPc4i8jT9C6DPA yy6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784065516; x=1784670316; h=content-transfer-encoding:content-type:mime-version:user-agent :message-id:date:cc:to:from:subject:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=76ycW+rBxOZYacJ1Dbj+MtJGsoesj/kofKqPC3AXyqE=; b=qNVgEtLamUHDTMOaAhjmtspwtneJdJsT7jbEApuP+8XqEjkhUAFNE0oUHggu5NOO6e dkb4zDIMVPNTZobb3ObxCyIlmjzo4BPFee3EPJAN4sG9qoRYfk4WsVYgn44p7oN0BCIi u26D8XU5LUqCHw61sW3KNni6qJuyHhhYaHycAu5OFlRotjLpuC8+nFwZBrvpG8qA2Vgj Lbd2iitpbZTUZFzgJPh7dV4e+AO2940IJxvqgB7A6AbkP4eyUn8E3PjQEpQIPrkTjz3Q laCkvKgFLbzAmmLlO84MWiWOLkGVI2CrCrbh4neqRC81Za3MWIBsPjzSO/Awhpi6YNqE Ab8A== X-Forwarded-Encrypted: i=1; AHgh+RqbR9G4m6QuEqIhsV+AVo5Fs4XtjuldFCRciVDw0tWInLS3jdqEVXrm7bjOyx2sUxGy+2jwHY/RbZGzpoU=@vger.kernel.org X-Gm-Message-State: AOJu0YyYw+jqptXw/A26gJAcp8pIioXpjgITXYR3ODEDTvrRRUT91oLn KPiWX7Te4NVuS4LiVDIlZAJEWwpE9y5NVT4SYJsbTELo4Amqa0FwIs6C X-Gm-Gg: AfdE7cmseu55kAN9/hjgosdbbGyGGLnVJ5e7uy8JuON8p9f23LlZpNBS3h5RX5F6NPL VtcfqIP1a/beBCwSmQA9wg/xZDhA/sLxvWboOS+J9TfD4W88Nc3qdTdUa2RN0HO3lyDl4VWWEjh 1bRsct0sSPgvYaQhjg1PG6PAmKZUnab9jHlFZi0IXXtKMLm3qtykX2NHGntzdRarir/u8lI5vEG 0g4ZZtyffoQV7ndwcYmp61HbsX9hnwnb0lSy2Lw9e3zwtC1lkgWqtlYNGL+w9soSk1gCQj8BMu8 9lAyuCldv9lv6sq/9+pvOBgS26FsDmNs/Tb9ypU6u1FpzFgdf0DUBNqsZJbT83zrRunSYW9TRuT Y1XuJZGhS9lT4TdB5Fn8JJtyWviD/LCg8Ng9+yzqLcsNSXtqfueUu0NyoZVXvEQlcJdoy5zeuP/ eQoIruzhiyLRAoVLXVxbLBTAI74mNoyTL5pmdzvcteCYo7eZHqmFEBa4S3b1s= X-Received: by 2002:a17:903:124c:b0:2ca:3e3f:4956 with SMTP id d9443c01a7336-2ce9f184054mr145126485ad.44.1784065515909; Tue, 14 Jul 2026 14:45:15 -0700 (PDT) Received: from [192.168.0.160] (c-98-225-44-182.hsd1.wa.comcast.net. [98.225.44.182]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9d1e284sm123142975ad.40.2026.07.14.14.45.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 14:45:15 -0700 (PDT) Subject: [PATCH] drm/gpusvm: Fix mm reference leak in range eviction From: Stanislav Kinsburskii To: maarten.lankhorst@linux.intel.com, mripard@kernel.org, tzimmermann@suse.de, airlied@gmail.com, simona@ffwll.ch, skinsburskii@gmail.com Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, intel-xe@lists.freedesktop.org Date: Tue, 14 Jul 2026 14:45:14 -0700 Message-ID: <178406551216.1092539.5238081578161393168.stgit@skinsburskii> User-Agent: StGit/0.19 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable drm_gpusvm_range_evict() pins gpusvm->mm with mmget_not_zero() before allocating the temporary HMM PFN array. If that allocation fails, the function returns -ENOMEM directly and leaks the mm reference. Route the allocation failure through the common mmput() path after initializing err to -ENOMEM. This preserves the returned error while balancing the mm reference acquired by mmget_not_zero(). Fixes: 99624bdff8670 ("drm/gpusvm: Add support for GPU Shared Virtual Memor= y") Cc: stable@vger.kernel.org Signed-off-by: Stanislav Kinsburskii --- drivers/gpu/drm/drm_gpusvm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c index 76e8a0028c7f..1a8bb83bd28d 100644 --- a/drivers/gpu/drm/drm_gpusvm.c +++ b/drivers/gpu/drm/drm_gpusvm.c @@ -1715,7 +1715,7 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm, unsigned long *pfns; unsigned long npages =3D npages_in_range(drm_gpusvm_range_start(range), drm_gpusvm_range_end(range)); - int err =3D 0; + int err =3D -ENOMEM; struct mm_struct *mm =3D gpusvm->mm; =20 if (!mmget_not_zero(mm)) @@ -1723,12 +1723,13 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusv= m, =20 pfns =3D kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL); if (!pfns) - return -ENOMEM; + goto put_mm; =20 hmm_range.hmm_pfns =3D pfns; err =3D hmm_range_fault_unlocked_timeout(&hmm_range, timeout); =20 kvfree(pfns); +put_mm: mmput(mm); =20 return err =3D=3D -EBUSY ? -ETIME : err;