[PATCH] drm/vmwgfx: Fix tfile reference leak in ttm_base_object_init()

[Wentao Liang]

ttm_base_object_init() takes a reference on the caller's ttm_object_file
via ttm_object_file_ref(). The reference is normally released by
ttm_release_base() when the object's refcount drops to zero, but on the
two error paths, idr_alloc() failure and ttm_ref_object_add() failure,
the object is torn down by the caller without ever dropping the
reference.

Drop the tfile reference with ttm_object_file_unref() on both error
paths.

Fixes: 0b8762e997df ("drm/ttm, drm/vmwgfx: Move the lock- and object 
functionality to the vmwgfx driver")
Cc: sta...@vger.kernel.org
Signed-off-by: Wentao Liang <vu...@iscas.ac.cn>
---
 drivers/gpu/drm/vmwgfx/ttm_object.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c 
b/drivers/gpu/drm/vmwgfx/ttm_object.c
index 2421b0dd057c..92433b60e282 100644
--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
+++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
@@ -203,8 +203,10 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
        ret = idr_alloc(&tdev->idr, base, 1, 0, GFP_NOWAIT);
        spin_unlock(&tdev->object_lock);
        idr_preload_end();
-       if (ret < 0)
+       if (ret < 0) {
+               ttm_object_file_unref(&base->tfile);
                return ret;
+       }
 
        base->handle = ret;
        ret = ttm_ref_object_add(tfile, base, NULL, false);
@@ -218,6 +220,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
        spin_lock(&tdev->object_lock);
        idr_remove(&tdev->idr, base->handle);
        spin_unlock(&tdev->object_lock);
+       ttm_object_file_unref(&base->tfile);
        return ret;
 }
 
-- 
2.34.1