On Mon, Jul 20, 2026 at 11:42:19AM -0700, Matthew Brost wrote:
> On Tue, Jul 14, 2026 at 02:45:14PM -0700, Stanislav Kinsburskii wrote:
> > drm_gpusvm_range_evict() pins gpusvm->mm with mmget_not_zero() before
> > allocating the temporary HMM PFN array. If that allocation fails, the
> > function returns -ENOMEM directly and leaks the mm reference.
> >
> > Route the allocation failure through the common mmput() path after
> > initializing err to -ENOMEM. This preserves the returned error while
> > balancing the mm reference acquired by mmget_not_zero().
> >
> > Fixes: 99624bdff8670 ("drm/gpusvm: Add support for GPU Shared Virtual
> > Memory")
> > Cc: [email protected]
> > Signed-off-by: Stanislav Kinsburskii <[email protected]>
>
> Yes, this is a bug... I also have pending patch to fix this here:
>
> https://patchwork.freedesktop.org/patch/740193/?series=170433&rev=1
>
> I think I prefer mine.
>
Sure, let's disregard mine.
Thanks,
Stanislav
> Matt
>
> > ---
> > drivers/gpu/drm/drm_gpusvm.c | 5 +++--
> > 1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> > index 76e8a0028c7f..1a8bb83bd28d 100644
> > --- a/drivers/gpu/drm/drm_gpusvm.c
> > +++ b/drivers/gpu/drm/drm_gpusvm.c
> > @@ -1715,7 +1715,7 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
> > unsigned long *pfns;
> > unsigned long npages = npages_in_range(drm_gpusvm_range_start(range),
> > drm_gpusvm_range_end(range));
> > - int err = 0;
> > + int err = -ENOMEM;
> > struct mm_struct *mm = gpusvm->mm;
> >
> > if (!mmget_not_zero(mm))
> > @@ -1723,12 +1723,13 @@ int drm_gpusvm_range_evict(struct drm_gpusvm
> > *gpusvm,
> >
> > pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> > if (!pfns)
> > - return -ENOMEM;
> > + goto put_mm;
> >
> > hmm_range.hmm_pfns = pfns;
> > err = hmm_range_fault_unlocked_timeout(&hmm_range, timeout);
> >
> > kvfree(pfns);
> > +put_mm:
> > mmput(mm);
> >
> > return err == -EBUSY ? -ETIME : err;
> >
> >
