[PATCH] drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

[PATCH] drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

[Matthew Brost]

If kvmalloc_array() fails in drm_gpusvm_range_evict(), the MM
reference acquired earlier is not released, resulting in a reference
leak.

Fix this by dropping the MM reference on the kvmalloc_array()
failure path.

Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
---
 drivers/gpu/drm/drm_gpusvm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index f45bf1d59a06..ac1f135abe68 100644
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -1778,8 +1778,10 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
 		return -EFAULT;
 
 	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
-	if (!pfns)
+	if (!pfns) {
+		mmput(mm);
 		return -ENOMEM;
+	}
 
 	hmm_range.hmm_pfns = pfns;
 	while (!time_after(jiffies, timeout)) {
-- 
2.34.1

Re: [PATCH] drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The timeout loop in drm_gpusvm_range_evict can return 0 (success) without doing any work, or return -EBUSY instead of -ETIME on timeout.
--

--- Patch [1]: [PATCH] drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict ---
commit 288b0fd8ba30a0ce9832357a667252b6d60749ce
Author: Matthew Brost <matthew.brost@intel.com>
Subject: drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

This commit fixes a reference leak in drm_gpusvm_range_evict(). It drops the
MM reference on the kvmalloc_array() failure path.

> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index 958cb605aedd5..9e02a33659d43 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -1732,8 +1732,10 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
>  		return -EFAULT;
>  
>  	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> -	if (!pfns)
> +	if (!pfns) {
> +		mmput(mm);
>  		return -ENOMEM;
> +	}
>  
>  	hmm_range.hmm_pfns = pfns;
>  	while (!time_after(jiffies, timeout)) {

[Severity: High]
This is a pre-existing issue, but can this loop return 0 (success) without
doing any work if the timeout expires during the memory allocation?

The timeout is computed before calling kvmalloc_array() with GFP_KERNEL. If
memory pressure causes the allocation to block longer than the timeout,
this loop condition will evaluate to false immediately, and the function
will exit returning err = 0.

Additionally, if hmm_range_fault() returns -EBUSY and the timeout is
subsequently reached, the loop terminates here and incorrectly returns
-EBUSY rather than -ETIME.

Would it be safer to compute the timeout after the kvmalloc_array() call,
or check the expiration condition after the loop to ensure the correct error
code is returned?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714170025.3487974-1-matthew.brost@intel.com?part=1

Re: [PATCH] drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

[Ghimiray, Himal Prasad]

On 14-07-2026 22:30, Matthew Brost wrote:
> If kvmalloc_array() fails in drm_gpusvm_range_evict(), the MM
> reference acquired earlier is not released, resulting in a reference
> leak.
> 
> Fix this by dropping the MM reference on the kvmalloc_array()
> failure path.
> 
> Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
> Cc: stable@vger.kernel.org
> Signed-off-by: Matthew Brost <matthew.brost@intel.com>
> ---
>   drivers/gpu/drm/drm_gpusvm.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index f45bf1d59a06..ac1f135abe68 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -1778,8 +1778,10 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
>   		return -EFAULT;
>   
>   	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> -	if (!pfns)
> +	if (!pfns) {
> +		mmput(mm);
>   		return -ENOMEM;
> +	}

LGTM

Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>

>   
>   	hmm_range.hmm_pfns = pfns;
>   	while (!time_after(jiffies, timeout)) {