mock_gem_device() takes an additional reference to the GGTT VM when initializing gt->vm. However, the mock device cleanup does not release this reference, either during normal teardown or when initialization fails.
The regular i915 driver releases gt->vm through intel_gt_driver_release(), but the mock device does not use that teardown path. As a result, the additional VM reference can remain held after the mock device has been cleaned up. Release the reference during normal teardown after draining the GEM workqueue and before finalizing the mock GGTT. Also release it during initialization error unwinding, before destroying the workqueues. This change is limited to the mock device used by the i915 selftests and does not affect normal driver operation. The issue was identified through static analysis, with AI assistance used to examine the finding and prepare the fix. The resulting change was manually reviewed and build-tested with CONFIG_DRM_I915_SELFTEST=y. Signed-off-by: Wentao Liang <[email protected]> --- Changes in v2: - Remove the Fixes and Cc: stable tags, as this is a selftest-only cleanup rather than a fix requiring stable backporting. - Correct the subject prefix to drm/i915/selftests. - Adjust the error-path cleanup ordering so the VM reference is released before the workqueues are destroyed. - Clarify the scope of the change and document the use of AI tools. drivers/gpu/drm/i915/selftests/mock_gem_device.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/i915/selftests/mock_gem_device.c b/drivers/gpu/drm/i915/selftests/mock_gem_device.c index 796c9b070e41..88cd83f28586 100644 --- a/drivers/gpu/drm/i915/selftests/mock_gem_device.c +++ b/drivers/gpu/drm/i915/selftests/mock_gem_device.c @@ -71,6 +71,7 @@ static void mock_device_release(struct drm_device *dev) i915_gem_drain_workqueue(i915); + i915_vm_put(fetch_and_zero(&to_gt(i915)->vm)); mock_fini_ggtt(to_gt(i915)->ggtt); destroy_workqueue(i915->unordered_wq); destroy_workqueue(i915->wq); @@ -145,6 +146,7 @@ struct drm_i915_private *mock_gem_device(void) #endif struct drm_i915_private *i915; struct intel_display *display; + struct i915_address_space *vm; struct pci_dev *pdev; int ret; @@ -257,6 +259,9 @@ struct drm_i915_private *mock_gem_device(void) err_context: intel_gt_driver_remove(to_gt(i915)); err_unlock: + vm = fetch_and_zero(&to_gt(i915)->vm); + if (vm) + i915_vm_put(vm); destroy_workqueue(i915->unordered_wq); err_wq: destroy_workqueue(i915->wq); -- 2.34.1
