nvkm_object_ctor initializes ucgrp with an embedded kref and increments the engine's reference count. When nvkm_cgrp_new subsequently fails, the function jumps to done without calling nvkm_object_del to release ucgrp. The caller ignores *pobject on error, so the ucgrp object and its engine reference are permanently leaked.
Cc: [email protected] Fixes: 06db7fded6de ("drm/nouveau/fifo: add new channel classes") Signed-off-by: WenTao Liang <[email protected]> --- drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c index dfa3c7dbdf34..7d11b92f946b 100644 --- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ucgrp.c @@ -113,8 +113,10 @@ nvkm_ucgrp_new(struct nvkm_fifo *fifo, const struct nvkm_oclass *oclass, void *a *pobject = &ucgrp->object; ret = nvkm_cgrp_new(runl, args->v0.name, vmm, true, &ucgrp->cgrp); - if (ret) + if (ret) { + nvkm_object_del(pobject); goto done; + } /* Return channel group info to caller. */ args->v0.cgid = ucgrp->cgrp->id; -- 2.39.5 (Apple Git-154)
