[PATCH] drm/vmwgfx: Fix user surface reference leak in vmw_buffer_prime_to_surface_base()

[Wentao Liang]

vmw_lookup_user_surface_for_buffer() returns the surface base object
with an extra reference that the caller must release. When
ttm_ref_object_add() fails in vmw_buffer_prime_to_surface_base(), the
function jumps to out without releasing it, and *base_p is never set,
so the caller cannot clean it up either.

Drop the reference with ttm_base_object_unref() when
ttm_ref_object_add() fails.

Fixes: d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers")
Cc: sta...@vger.kernel.org
Signed-off-by: Wentao Liang <vu...@iscas.ac.cn>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b2d3927b5567..8d3bd34b00f3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -965,6 +965,7 @@ static int vmw_buffer_prime_to_surface_base(struct 
vmw_private *dev_priv,
        base = &user_srf->prime.base;
        ret = ttm_ref_object_add(tfile, base, NULL, false);
        if (ret) {
+               ttm_base_object_unref(&base);
                drm_warn(&dev_priv->drm,
                         "Couldn't add an object ref for the buffer (%d).\n", 
*handle);
                goto out;
-- 
2.34.1