[PATCH 1/2] drm/msm: Defer fd_install in SUBMIT ioctl

[Rob Clark]

Avoid fd_install() until there are no more potential error paths, to
avoid put_unused_fd() after the fd is made visible to userspace.

Fixes: 68dc6c2d5eec ("drm/msm: Fix submit error-path leaks")
Reported-by: Dan Carpenter <dan.carpen...@linaro.org>
Signed-off-by: Rob Clark <robin.cl...@oss.qualcomm.com>
---
 drivers/gpu/drm/msm/msm_gem_submit.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c 
b/drivers/gpu/drm/msm/msm_gem_submit.c
index 0ac4c199ec93..bfea19baf6d9 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -770,12 +770,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void 
*data,
 
        if (ret == 0 && args->flags & MSM_SUBMIT_FENCE_FD_OUT) {
                sync_file = sync_file_create(submit->user_fence);
-               if (!sync_file) {
+               if (!sync_file)
                        ret = -ENOMEM;
-               } else {
-                       fd_install(out_fence_fd, sync_file->file);
-                       args->fence_fd = out_fence_fd;
-               }
        }
 
        if (ret)
@@ -813,10 +809,14 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void 
*data,
 out_unlock:
        mutex_unlock(&queue->lock);
 out_post_unlock:
-       if (ret && (out_fence_fd >= 0)) {
-               put_unused_fd(out_fence_fd);
+       if (ret) {
+               if (out_fence_fd >= 0)
+                       put_unused_fd(out_fence_fd);
                if (sync_file)
                        fput(sync_file->file);
+       } else if (sync_file) {
+               fd_install(out_fence_fd, sync_file->file);
+               args->fence_fd = out_fence_fd;
        }
 
        if (!IS_ERR_OR_NULL(submit)) {
-- 
2.50.1