Each sgx_encl_mm instance holds an enclave reference so the enclave
outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
before calling __mmu_notifier_register().

Notifier registration can fail while allocating subscription state or
when mm_take_all_locks() is interrupted. In that case no notifier or
mm_list entry takes ownership of encl_mm. The error path frees encl_mm
but leaves the enclave reference behind, preventing the enclave and its
resources from being released.

Drop the enclave reference before freeing the unpublished encl_mm. This
balances the acquisition without changing the successful registration
and teardown paths.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list entry")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 arch/x86/kernel/cpu/sgx/encl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
index 3f0222d10f6e6..04fbf7e703e1e 100644
--- a/arch/x86/kernel/cpu/sgx/encl.c
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -866,6 +866,7 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm)
 
 	ret = __mmu_notifier_register(&encl_mm->mmu_notifier, mm);
 	if (ret) {
+		kref_put(&encl->refcount, sgx_encl_release);
 		kfree(encl_mm);
 		return ret;
 	}
-- 
2.51.0