[PATCH] drm/gpusvm: Fix mm reference leak in range eviction

[Stanislav Kinsburskii]

drm_gpusvm_range_evict() pins gpusvm->mm with mmget_not_zero() before
allocating the temporary HMM PFN array. If that allocation fails, the
function returns -ENOMEM directly and leaks the mm reference.

Route the allocation failure through the common mmput() path after
initializing err to -ENOMEM. This preserves the returned error while
balancing the mm reference acquired by mmget_not_zero().

Fixes: 99624bdff8670 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
Cc: sta...@vger.kernel.org
Signed-off-by: Stanislav Kinsburskii <skinsburs...@gmail.com>
---
 drivers/gpu/drm/drm_gpusvm.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index 76e8a0028c7f..1a8bb83bd28d 100644
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -1715,7 +1715,7 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
        unsigned long *pfns;
        unsigned long npages = npages_in_range(drm_gpusvm_range_start(range),
                                               drm_gpusvm_range_end(range));
-       int err = 0;
+       int err = -ENOMEM;
        struct mm_struct *mm = gpusvm->mm;
 
        if (!mmget_not_zero(mm))
@@ -1723,12 +1723,13 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
 
        pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
        if (!pfns)
-               return -ENOMEM;
+               goto put_mm;
 
        hmm_range.hmm_pfns = pfns;
        err = hmm_range_fault_unlocked_timeout(&hmm_range, timeout);
 
        kvfree(pfns);
+put_mm:
        mmput(mm);
 
        return err == -EBUSY ? -ETIME : err;