intel_vgpu_get_ppgtt_mm() returns a reference the caller must drop, but
the PPGTT page table create path only inspected the result. A page
table that is already tracked gained an extra reference which nothing
would ever drop. Skip the lookup-get for an already registered mm; a
newly created mm keeps its initial registration reference.
Fixes: e6e9c46fd235 ("drm/i915/gvt: Factor out intel_vgpu_{get, put}_ppgtt_mm interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/gpu/drm/i915/gvt/handlers.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index a34f56630af9..3d7aae6c5cf1 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1506,7 +1506,17 @@ static int handle_g2v_notification(struct intel_vgpu *vgpu, int notification)
root_entry_type = GTT_TYPE_PPGTT_ROOT_L3_ENTRY;
fallthrough;
case VGT_G2V_PPGTT_L4_PAGE_TABLE_CREATE:
- mm = intel_vgpu_get_ppgtt_mm(vgpu, root_entry_type, pdps);
+ /*
+ * A newly created mm keeps its initial reference as the
+ * registration reference, dropped by the DESTROY
+ * notification. A duplicate CREATE for an already tracked
+ * mm must not take an extra reference that nothing drops.
+ */
+ mm = intel_vgpu_find_ppgtt_mm(vgpu, pdps);
+ if (mm)
+ return 0;
+
+ mm = intel_vgpu_create_ppgtt_mm(vgpu, root_entry_type, pdps);
return PTR_ERR_OR_ZERO(mm);
case VGT_G2V_PPGTT_L3_PAGE_TABLE_DESTROY:
case VGT_G2V_PPGTT_L4_PAGE_TABLE_DESTROY:
--
2.34.1