Re: [PATCH V1] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()

[Lizhi Hou]

Applied to drm-misc-fixes

On 6/10/26 08:18, Mario Limonciello wrote:
> On 6/10/26 10:11, Lizhi Hou wrote:
> > aie2_populate_range() jumps back to the again label without calling
> > mmput(mm), leaking a reference to the mm_struct.
> >
> > Add the missing mmput() before jumping to again.
> >
> > Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
> > Signed-off-by: Lizhi Hou <lizhi.hou@xxxxxxx>
> Reviewed-by: Mario Limonciello (AMD) <superm1@xxxxxxxxxx>
> > ---
> >   drivers/accel/amdxdna/aie2_ctx.c | 3 +++
> >   1 file changed, 3 insertions(+)
> >
> > diff --git a/drivers/accel/amdxdna/aie2_ctx.c 
> > b/drivers/accel/amdxdna/aie2_ctx.c
> > index 3e21e2dabe82..e0f30dbe0238 100644
> > --- a/drivers/accel/amdxdna/aie2_ctx.c
> > +++ b/drivers/accel/amdxdna/aie2_ctx.c
> > @@ -1041,6 +1041,7 @@ static int aie2_populate_range(struct 
> > amdxdna_gem_obj *abo)
> >             if (ret == -EBUSY) {
> >               amdxdna_umap_put(mapp);
> > +            mmput(mm);
> >               goto again;
> >           }
> >   @@ -1051,11 +1052,13 @@ static int aie2_populate_range(struct 
> > amdxdna_gem_obj *abo)
> >       if (mmu_interval_read_retry(&mapp->notifier, 
> > mapp->range.notifier_seq)) {
> >           up_write(&xdna->notifier_lock);
> >           amdxdna_umap_put(mapp);
> > +        mmput(mm);
> >           goto again;
> >       }
> >       mapp->invalid = false;
> >       up_write(&xdna->notifier_lock);
> >       amdxdna_umap_put(mapp);
> > +    mmput(mm);
> >       goto again;
> >     put_mm: