When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference on the VM root and the MMU notifier registration are all left behind.
Use release_object here, not user_pages_done, range is still NULL at this point.
(cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e)