Re: [PATCH V1] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()

[Lizhi Hou <lizhi.hou@amd.com>]

Applied to drm-misc-fixes

On 6/10/26 08:18, Mario Limonciello wrote:
>
>
> On 6/10/26 10:11, Lizhi Hou wrote:
>> aie2_populate_range() jumps back to the again label without calling
>> mmput(mm), leaking a reference to the mm_struct.
>>
>> Add the missing mmput() before jumping to again.
>>
>> Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> ---
>>   drivers/accel/amdxdna/aie2_ctx.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_ctx.c 
>> b/drivers/accel/amdxdna/aie2_ctx.c
>> index 3e21e2dabe82..e0f30dbe0238 100644
>> --- a/drivers/accel/amdxdna/aie2_ctx.c
>> +++ b/drivers/accel/amdxdna/aie2_ctx.c
>> @@ -1041,6 +1041,7 @@ static int aie2_populate_range(struct 
>> amdxdna_gem_obj *abo)
>>             if (ret == -EBUSY) {
>>               amdxdna_umap_put(mapp);
>> +            mmput(mm);
>>               goto again;
>>           }
>>   @@ -1051,11 +1052,13 @@ static int aie2_populate_range(struct 
>> amdxdna_gem_obj *abo)
>>       if (mmu_interval_read_retry(&mapp->notifier, 
>> mapp->range.notifier_seq)) {
>>           up_write(&xdna->notifier_lock);
>>           amdxdna_umap_put(mapp);
>> +        mmput(mm);
>>           goto again;
>>       }
>>       mapp->invalid = false;
>>       up_write(&xdna->notifier_lock);
>>       amdxdna_umap_put(mapp);
>> +    mmput(mm);
>>       goto again;
>>     put_mm:
>