[PATCH] drm/i915/gvt: Fix mm reference leak in handle_g2v_notification()

[Wentao Liang]

intel_vgpu_get_ppgtt_mm() returns a reference the caller must drop, but
the PPGTT page table create path only inspected the result. A page
table that is already tracked gained an extra reference which nothing
would ever drop. Skip the lookup-get for an already registered mm; a
newly created mm keeps its initial registration reference.

Fixes: e6e9c46fd235 ("drm/i915/gvt: Factor out intel_vgpu_{get, put}_ppgtt_mm interface")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/gpu/drm/i915/gvt/handlers.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index a34f56630af9..3d7aae6c5cf1 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1506,7 +1506,17 @@ static int handle_g2v_notification(struct intel_vgpu *vgpu, int notification)
 		root_entry_type = GTT_TYPE_PPGTT_ROOT_L3_ENTRY;
 		fallthrough;
 	case VGT_G2V_PPGTT_L4_PAGE_TABLE_CREATE:
-		mm = intel_vgpu_get_ppgtt_mm(vgpu, root_entry_type, pdps);
+		/*
+		 * A newly created mm keeps its initial reference as the
+		 * registration reference, dropped by the DESTROY
+		 * notification. A duplicate CREATE for an already tracked
+		 * mm must not take an extra reference that nothing drops.
+		 */
+		mm = intel_vgpu_find_ppgtt_mm(vgpu, pdps);
+		if (mm)
+			return 0;
+
+		mm = intel_vgpu_create_ppgtt_mm(vgpu, root_entry_type, pdps);
 		return PTR_ERR_OR_ZERO(mm);
 	case VGT_G2V_PPGTT_L3_PAGE_TABLE_DESTROY:
 	case VGT_G2V_PPGTT_L4_PAGE_TABLE_DESTROY:
-- 
2.34.1