rocket_ioctl_create_bo() takes an IOMMU domain reference for each newly
created BO.
The normal GEM object release path drops that reference from
rocket_gem_bo_free(). However, the BO creation error paths free the
object with drm_gem_shmem_object_free(), which bypasses the driver's GEM
.free callback. Those paths therefore release the shmem object without
dropping the IOMMU domain reference.
Drop the domain reference explicitly on the BO creation error path before
freeing the shmem object.
Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
Signed-off-by: Guangshuo Li <[email protected]>
---
drivers/accel/rocket/rocket_gem.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/accel/rocket/rocket_gem.c
b/drivers/accel/rocket/rocket_gem.c
index a5fffa51ff35..438694ba567b 100644
--- a/drivers/accel/rocket/rocket_gem.c
+++ b/drivers/accel/rocket/rocket_gem.c
@@ -127,6 +127,8 @@ int rocket_ioctl_create_bo(struct drm_device *dev, void
*data, struct drm_file *
mutex_unlock(&rocket_priv->mm_lock);
err:
+ rocket_iommu_domain_put(rkt_obj->domain);
+ rkt_obj->domain = NULL;
drm_gem_shmem_object_free(gem_obj);
return ret;
--
2.43.0
