accel/amdxdna: Fix leak when pinning ubuf pages

When pin_user_pages_fast() returns fewer pages than requested, the pages
that were successfully pinned are not released, leading to a leak.

Fix this by unpinning any partially pinned pages before returning failure.

Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260326010642.2596525-1-lizhi.hou@amd.com

diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c b/drivers/accel/amdxdna/amdxdna_ubuf.c
index fb999aa253185e2de831d2eae6e81c96b9c86842..4c0647057759f82c472587b9cebf14bbadf1f967 100644 (file)
--- a/drivers/accel/amdxdna/amdxdna_ubuf.c
+++ b/drivers/accel/amdxdna/amdxdna_ubuf.c
@@ -196,13 +196,17 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev,
                ret = pin_user_pages_fast(va_ent[i].vaddr, npages,
                                          FOLL_WRITE | FOLL_LONGTERM,
                                          &ubuf->pages[start]);
-               if (ret < 0 || ret != npages) {
-                       ret = -ENOMEM;
+               if (ret >= 0) {
+                       start += ret;
+                       if (ret != npages) {
+                               XDNA_ERR(xdna, "Partially pinned pages %d/%u", ret, npages);
+                               ret = -ENOMEM;
+                               goto destroy_pages;
+                       }
+               } else {
                        XDNA_ERR(xdna, "Failed to pin pages ret %d", ret);
                        goto destroy_pages;
                }
-
-               start += ret;
        }
 
        exp_info.ops = &amdxdna_ubuf_dmabuf_ops;