drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

If kvmalloc_array() fails in drm_gpusvm_range_evict(), the MM
reference acquired earlier is not released, resulting in a reference
leak.

Fix this by dropping the MM reference on the kvmalloc_array()
failure path.

Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Link: https://patch.msgid.link/20260714170025.3487974-1-matthew.brost@intel.com

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index 9a06ff7d2608e6f40def924ce8255def498a3162..9aeaca02e928058ac7a6262c7bc80990359e88ec 100644 (file)
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -1753,8 +1753,10 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
                return -EFAULT;
 
        pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
-       if (!pfns)
+       if (!pfns) {
+               mmput(mm);
                return -ENOMEM;
+       }
 
        hmm_range.hmm_pfns = pfns;
        while (!time_after(jiffies, timeout)) {