[PATCH v2] drm/i915/selftests: Release GT VM reference on mock device teardown

[Wentao Liang <vulab@iscas.ac.cn>]

mock_gem_device() takes an additional reference to the GGTT VM when
initializing gt->vm. However, the mock device cleanup does not release
this reference, either during normal teardown or when initialization
fails.

The regular i915 driver releases gt->vm through
intel_gt_driver_release(), but the mock device does not use that
teardown path. As a result, the additional VM reference can remain
held after the mock device has been cleaned up.

Release the reference during normal teardown after draining the GEM
workqueue and before finalizing the mock GGTT. Also release it during
initialization error unwinding, before destroying the workqueues.

This change is limited to the mock device used by the i915 selftests
and does not affect normal driver operation.

The issue was identified through static analysis, with AI assistance
used to examine the finding and prepare the fix. The resulting change
was manually reviewed and build-tested with
CONFIG_DRM_I915_SELFTEST=y.

Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
- Remove the Fixes and Cc: stable tags, as this is a selftest-only
  cleanup rather than a fix requiring stable backporting.
- Correct the subject prefix to drm/i915/selftests.
- Adjust the error-path cleanup ordering so the VM reference is
  released before the workqueues are destroyed.
- Clarify the scope of the change and document the use of AI tools.

 drivers/gpu/drm/i915/selftests/mock_gem_device.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/i915/selftests/mock_gem_device.c b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
index 796c9b070e41..88cd83f28586 100644
--- a/drivers/gpu/drm/i915/selftests/mock_gem_device.c
+++ b/drivers/gpu/drm/i915/selftests/mock_gem_device.c
@@ -71,6 +71,7 @@ static void mock_device_release(struct drm_device *dev)
 
 	i915_gem_drain_workqueue(i915);
 
+	i915_vm_put(fetch_and_zero(&to_gt(i915)->vm));
 	mock_fini_ggtt(to_gt(i915)->ggtt);
 	destroy_workqueue(i915->unordered_wq);
 	destroy_workqueue(i915->wq);
@@ -145,6 +146,7 @@ struct drm_i915_private *mock_gem_device(void)
 #endif
 	struct drm_i915_private *i915;
 	struct intel_display *display;
+	struct i915_address_space *vm;
 	struct pci_dev *pdev;
 	int ret;
 
@@ -257,6 +259,9 @@ struct drm_i915_private *mock_gem_device(void)
 err_context:
 	intel_gt_driver_remove(to_gt(i915));
 err_unlock:
+	vm = fetch_and_zero(&to_gt(i915)->vm);
+	if (vm)
+		i915_vm_put(vm);
 	destroy_workqueue(i915->unordered_wq);
 err_wq:
 	destroy_workqueue(i915->wq);
-- 
2.34.1