If the call to func->dirty_alloc() fails in vmw_resource_do_validate(),
the function returns without releasing the resource created by
func->create() (or the previously existing resource), leaking the
dev_priv->num_fifo_resources reference counter. This counter tracks
active FIFO resources and must be balanced by calling func->destroy()
on failure.

The existing error path for binding failures already jumps to the
out_bind_failed label which calls func->destroy(). Extend this
handling to the dirty_alloc() failure case.

Fix the leak by jumping to out_bind_failed when dirty_alloc() fails.

Cc: stable@vger.kernel.org
Fixes: b7468b15d271 ("drm/vmwgfx: Implement an infrastructure for write-coherent resources")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 388011696941..93a5835e485a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -402,7 +402,7 @@ static int vmw_resource_do_validate(struct vmw_resource *res,
 		if (res->guest_memory_bo->dirty && !res->dirty) {
 			ret = func->dirty_alloc(res);
 			if (ret)
-				return ret;
+				goto out_bind_failed;
 		} else if (!res->guest_memory_bo->dirty && res->dirty) {
 			func->dirty_free(res);
 		}
-- 
2.34.1