From: Ralph Campbell <[email protected]> The helper function hmm_vma_fault() calls hmm_range_register() but is missing a call to hmm_range_unregister() in one of the error paths. This leads to a reference count leak and ultimately a memory leak on struct hmm.
Always call hmm_range_unregister() if hmm_range_register() succeeded. Signed-off-by: Ralph Campbell <[email protected]> Cc: John Hubbard <[email protected]> Cc: Ira Weiny <[email protected]> Cc: Dan Williams <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Balbir Singh <[email protected]> Cc: Dan Carpenter <[email protected]> Cc: Matthew Wilcox <[email protected]> Cc: Souptick Joarder <[email protected]> Cc: Andrew Morton <[email protected]> --- include/linux/hmm.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/linux/hmm.h b/include/linux/hmm.h index 35a429621e1e..fa0671d67269 100644 --- a/include/linux/hmm.h +++ b/include/linux/hmm.h @@ -559,6 +559,7 @@ static inline int hmm_vma_fault(struct hmm_range *range, bool block) return (int)ret; if (!hmm_range_wait_until_valid(range, HMM_RANGE_DEFAULT_TIMEOUT)) { + hmm_range_unregister(range); /* * The mmap_sem was taken by driver we release it here and * returns -EAGAIN which correspond to mmap_sem have been @@ -570,13 +571,13 @@ static inline int hmm_vma_fault(struct hmm_range *range, bool block) ret = hmm_range_fault(range, block); if (ret <= 0) { + hmm_range_unregister(range); if (ret == -EBUSY || !ret) { /* Same as above, drop mmap_sem to match old API. */ up_read(&range->vma->vm_mm->mmap_sem); ret = -EBUSY; } else if (ret == -EAGAIN) ret = -EBUSY; - hmm_range_unregister(range); return ret; } return 0; -- 2.20.1
