I think it makes sense to add a Fixes tag to this:

Fixes: 822cab6150d3 ("drm/nouveau/svm: check for SVM initialized before migrating") Reviewed-by: Karol Herbst kherbst@redhat.com

On Tue, Sep 7, 2021 at 3:20 PM Chenyuan Mi cymi20@fudan.edu.cn wrote:

The reference counting issue happens in one exception handling path of nouveau_svmm_bind(). When cli->svm.svmm is null, the function forgets to decrease the refcount of mm increased by get_task_mm(), causing a refcount leak.

Fix this issue by using mmput() to decrease the refcount in the exception handling path.

Also, the function forgets to do check against null when get mm by get_task_mm().

Fix this issue by adding null check after get mm by get_task_mm().

Signed-off-by: Chenyuan Mi cymi20@fudan.edu.cn Signed-off-by: Xiyu Yang xiyuyang19@fudan.edu.cn Signed-off-by: Xin Tan tanxin.ctf@gmail.com

---

drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c index b0c3422cb01f..9985bfde015a 100644 --- a/drivers/gpu/drm/nouveau/nouveau_svm.c +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c @@ -162,10 +162,14 @@ nouveau_svmm_bind(struct drm_device *dev, void *data, */

    mm = get_task_mm(current);

•   if (!mm) {
  

•           return -EINVAL;
  

•   }
    mmap_read_lock(mm);
  
    if (!cli->svm.svmm) {
            mmap_read_unlock(mm);
  

•           mmput(mm);
            return -EINVAL;
    }
  
  

-- 2.17.1