Re: [PATCH v11 8/8] drm/gpusvm: Use hmm_range_fault_unlocked_timeout() for range faults

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `mmput()` on the `pfns` allocation failure path causes an `mm_struct` refcount leak.
--

--- Patch [8]: [PATCH v11 8/8] drm/gpusvm: Use hmm_range_fault_unlocked_timeout() for range faults ---
commit 83e2ac7a16c88b9dee7c9dc0f7c00f0dcd69b81d
Author: Stanislav Kinsburskii <[email protected]>

drm/gpusvm: Use hmm_range_fault_unlocked_timeout() for range faults

This commit replaces open-coded HMM fault loops that hold the mmap read lock
with the hmm_range_fault_unlocked_timeout() helper. It delegates the lock
acquisition and retry logic to the helper while maintaining the existing
timeout budgets.

> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index 958cb605aedd5..e912e994beb21 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c

[ ... ]

> @@ -1736,24 +1708,12 @@ int drm_gpusvm_range_evict(struct drm_gpusvm *gpusvm,
>  		return -ENOMEM;

[Severity: High]
This is a pre-existing issue, but does this allocation failure path leak the
mm_struct reference?

In drm_gpusvm_range_evict() in drivers/gpu/drm/drm_gpusvm.c, earlier in this
function mmget_not_zero(mm) successfully acquires a reference to the mm. If
the subsequent kvmalloc_array() call fails, the function immediately returns
-ENOMEM.

Should there be an mmput(mm) before returning to prevent leaking the
mm_struct reference?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=8