If creating a BO fails after the GEM handle was created (e.g. the pages
or the iommu mapping cannot be set up), the error path calls
drm_gem_shmem_object_free() directly. That bypasses the driver's
rocket_gem_bo_free() GEM free callback, so rocket_iommu_domain_put() is
never called and the reference taken with rocket_iommu_domain_get()
earlier in the function is leaked.
Drop the iommu domain reference before freeing the shmem object in the
error path.
Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
Cc: [email protected]
Signed-off-by: Wentao Liang <[email protected]>
---
drivers/accel/rocket/rocket_gem.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/accel/rocket/rocket_gem.c
b/drivers/accel/rocket/rocket_gem.c
index c8084719208a..91095d1b3066 100644
--- a/drivers/accel/rocket/rocket_gem.c
+++ b/drivers/accel/rocket/rocket_gem.c
@@ -120,6 +120,7 @@ int rocket_ioctl_create_bo(struct drm_device *dev, void
*data, struct drm_file *
mutex_unlock(&rocket_priv->mm_lock);
err:
+ rocket_iommu_domain_put(rkt_obj->domain);
drm_gem_shmem_object_free(gem_obj);
return ret;
--
2.34.1
