* [PATCH V1] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
@ 2026-06-10 15:11 Lizhi Hou
2026-06-10 15:18 ` Mario Limonciello
0 siblings, 1 reply; 3+ messages in thread
From: Lizhi Hou @ 2026-06-10 15:11 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, mario.limonciello, karol.wachowski
Cc: Lizhi Hou, linux-kernel, max.zhen, sonal.santan
aie2_populate_range() jumps back to the again label without calling
mmput(mm), leaking a reference to the mm_struct.
Add the missing mmput() before jumping to again.
Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/aie2_ctx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 3e21e2dabe82..e0f30dbe0238 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -1041,6 +1041,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
if (ret == -EBUSY) {
amdxdna_umap_put(mapp);
+ mmput(mm);
goto again;
}
@@ -1051,11 +1052,13 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
if (mmu_interval_read_retry(&mapp->notifier, mapp->range.notifier_seq)) {
up_write(&xdna->notifier_lock);
amdxdna_umap_put(mapp);
+ mmput(mm);
goto again;
}
mapp->invalid = false;
up_write(&xdna->notifier_lock);
amdxdna_umap_put(mapp);
+ mmput(mm);
goto again;
put_mm:
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH V1] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
2026-06-10 15:11 [PATCH V1] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() Lizhi Hou
@ 2026-06-10 15:18 ` Mario Limonciello
2026-06-11 16:53 ` Lizhi Hou
0 siblings, 1 reply; 3+ messages in thread
From: Mario Limonciello @ 2026-06-10 15:18 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, karol.wachowski
Cc: linux-kernel, max.zhen, sonal.santan
On 6/10/26 10:11, Lizhi Hou wrote:
> aie2_populate_range() jumps back to the again label without calling
> mmput(mm), leaking a reference to the mm_struct.
>
> Add the missing mmput() before jumping to again.
>
> Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
> drivers/accel/amdxdna/aie2_ctx.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
> index 3e21e2dabe82..e0f30dbe0238 100644
> --- a/drivers/accel/amdxdna/aie2_ctx.c
> +++ b/drivers/accel/amdxdna/aie2_ctx.c
> @@ -1041,6 +1041,7 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
>
> if (ret == -EBUSY) {
> amdxdna_umap_put(mapp);
> + mmput(mm);
> goto again;
> }
>
> @@ -1051,11 +1052,13 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo)
> if (mmu_interval_read_retry(&mapp->notifier, mapp->range.notifier_seq)) {
> up_write(&xdna->notifier_lock);
> amdxdna_umap_put(mapp);
> + mmput(mm);
> goto again;
> }
> mapp->invalid = false;
> up_write(&xdna->notifier_lock);
> amdxdna_umap_put(mapp);
> + mmput(mm);
> goto again;
>
> put_mm:
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH V1] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
2026-06-10 15:18 ` Mario Limonciello
@ 2026-06-11 16:53 ` Lizhi Hou
0 siblings, 0 replies; 3+ messages in thread
From: Lizhi Hou @ 2026-06-11 16:53 UTC (permalink / raw)
To: Mario Limonciello, ogabbay, quic_jhugo, dri-devel, karol.wachowski
Cc: linux-kernel, max.zhen, sonal.santan
Applied to drm-misc-fixes
On 6/10/26 08:18, Mario Limonciello wrote:
>
>
> On 6/10/26 10:11, Lizhi Hou wrote:
>> aie2_populate_range() jumps back to the again label without calling
>> mmput(mm), leaking a reference to the mm_struct.
>>
>> Add the missing mmput() before jumping to again.
>>
>> Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> ---
>> drivers/accel/amdxdna/aie2_ctx.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/accel/amdxdna/aie2_ctx.c
>> b/drivers/accel/amdxdna/aie2_ctx.c
>> index 3e21e2dabe82..e0f30dbe0238 100644
>> --- a/drivers/accel/amdxdna/aie2_ctx.c
>> +++ b/drivers/accel/amdxdna/aie2_ctx.c
>> @@ -1041,6 +1041,7 @@ static int aie2_populate_range(struct
>> amdxdna_gem_obj *abo)
>> if (ret == -EBUSY) {
>> amdxdna_umap_put(mapp);
>> + mmput(mm);
>> goto again;
>> }
>> @@ -1051,11 +1052,13 @@ static int aie2_populate_range(struct
>> amdxdna_gem_obj *abo)
>> if (mmu_interval_read_retry(&mapp->notifier,
>> mapp->range.notifier_seq)) {
>> up_write(&xdna->notifier_lock);
>> amdxdna_umap_put(mapp);
>> + mmput(mm);
>> goto again;
>> }
>> mapp->invalid = false;
>> up_write(&xdna->notifier_lock);
>> amdxdna_umap_put(mapp);
>> + mmput(mm);
>> goto again;
>> put_mm:
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-11 16:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-06-10 15:11 [PATCH V1] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() Lizhi Hou
2026-06-10 15:18 ` Mario Limonciello
2026-06-11 16:53 ` Lizhi Hou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®