ttm_base_object_init calls ttm_object_file_ref(tfile) to acquire a tfile reference early in the function. On error paths (idr_alloc failure and ttm_ref_object_add failure), the function returns without calling ttm_object_file_unref to release this reference, causing a tfile reference leak.
Add proper cleanup in the error paths to release the tfile reference via ttm_object_file_unref. Cc: [email protected] Fixes: 0b8762e997df ("drm/ttm, drm/vmwgfx: Move the lock- and object functionality to the vmwgfx driver") Signed-off-by: WenTao Liang <[email protected]> --- drivers/gpu/drm/vmwgfx/ttm_object.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c index 2421b0dd057c..93ae5a07d70a 100644 --- a/drivers/gpu/drm/vmwgfx/ttm_object.c +++ b/drivers/gpu/drm/vmwgfx/ttm_object.c @@ -204,7 +204,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile, spin_unlock(&tdev->object_lock); idr_preload_end(); if (ret < 0) - return ret; + goto err_unref_tfile; base->handle = ret; ret = ttm_ref_object_add(tfile, base, NULL, false); @@ -218,6 +218,10 @@ int ttm_base_object_init(struct ttm_object_file *tfile, spin_lock(&tdev->object_lock); idr_remove(&tdev->idr, base->handle); spin_unlock(&tdev->object_lock); + ttm_object_file_unref(&base->tfile); + return ret; +err_unref_tfile: + ttm_object_file_unref(&base->tfile); return ret; } -- 2.39.5 (Apple Git-154)
