ttm_base_object_init unconditionally acquires a base object reference via kref_init. When it fails, the error path only calls vmw_resource_unreference but never calls ttm_base_object_unref to release the base object reference, causing a refcount leak.
Add ttm_base_object_unref in the error path to properly release the base object reference when ttm_base_object_init fails. Cc: [email protected] Fixes: 0b8762e997df ("drm/ttm, drm/vmwgfx: Move the lock- and object functionality to the vmwgfx driver") Signed-off-by: WenTao Liang <[email protected]> --- drivers/gpu/drm/vmwgfx/vmwgfx_simple_resource.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_simple_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_simple_resource.c index 0d51b4542269..05f0f5544142 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_simple_resource.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_simple_resource.c @@ -176,6 +176,7 @@ vmw_simple_resource_create_ioctl(struct drm_device *dev, void *data, if (ret) { vmw_resource_unreference(&tmp); + ttm_base_object_unref(&usimple->base); goto out_err; } -- 2.39.5 (Apple Git-154)
