[PATCH] drm/i915/gvt: Release GGTT MM if scratch page setup fails

[Wentao Liang <vulab@iscas.ac.cn>]

intel_vgpu_init_gtt() creates the GGTT MM before allocating the scratch
page table tree. If scratch page allocation or DMA mapping fails,
create_scratch_page_tree() releases its own pages, but the GGTT MM and
its virtual GGTT and host GGTT buffers remain allocated. The caller
skips intel_vgpu_clean_gtt() when intel_vgpu_init_gtt() fails.

Drop the GGTT MM reference and clear its pointer before returning the
scratch page initialization error.

Fixes: 3b6411c2c205 ("drm/i915/gvt: implement scratch page table tree for shadow PPGTT")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/i915/gvt/gtt.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 5056a5887b31..17d61548ec05 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -2403,6 +2403,7 @@ static int create_scratch_page_tree(struct intel_vgpu *vgpu)
 int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
 {
 	struct intel_vgpu_gtt *gtt = &vgpu->gtt;
+	int ret;
 
 	INIT_RADIX_TREE(&gtt->spt_tree, GFP_KERNEL);
 
@@ -2420,7 +2421,13 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
 
 	INIT_LIST_HEAD(&gtt->ggtt_mm->ggtt_mm.partial_pte_list);
 
-	return create_scratch_page_tree(vgpu);
+	ret = create_scratch_page_tree(vgpu);
+	if (ret) {
+		intel_vgpu_destroy_mm(gtt->ggtt_mm);
+		gtt->ggtt_mm = NULL;
+	}
+
+	return ret;
 }
 
 void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu)
-- 
2.34.1