CVE-2026-72311: drm/xe: free madvise VMA array on L2 flush failure

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: free madvise VMA array on L2 flush failure

xevmmadviseioctl() allocates madviserange.vmas in getvmas(). After getvmas() succeeds with at least one VMA, error paths must go through freevmas so the array is released before the madvise details are destroyed.

The L2 flush validation path added for PAT madvise rejects some SVM/userptr ranges after getvmas() has succeeded, but jumps directly to madvfini. This skips kfree(madviserange.vmas), leaking the VMA array on each failed ioctl.

Jump to freevmas instead, matching the other validation failure paths after getvmas() has succeeded.

(cherry picked from commit c3a1c3579b1250060da73507a4acef712974c78a)