ttm_base_object_init() takes a reference on the caller's ttm_object_file
via ttm_object_file_ref(). The reference is normally released by
ttm_release_base() when the object's refcount drops to zero, but on the
two error paths, idr_alloc() failure and ttm_ref_object_add() failure,
the object is torn down by the caller without ever dropping the
reference.

Drop the tfile reference with ttm_object_file_unref() on both error
paths.

Fixes: 0b8762e997df ("drm/ttm, drm/vmwgfx: Move the lock- and object functionality to the vmwgfx driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/vmwgfx/ttm_object.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c
index 2421b0dd057c..92433b60e282 100644
--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
+++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
@@ -203,8 +203,10 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
 	ret = idr_alloc(&tdev->idr, base, 1, 0, GFP_NOWAIT);
 	spin_unlock(&tdev->object_lock);
 	idr_preload_end();
-	if (ret < 0)
+	if (ret < 0) {
+		ttm_object_file_unref(&base->tfile);
 		return ret;
+	}
 
 	base->handle = ret;
 	ret = ttm_ref_object_add(tfile, base, NULL, false);
@@ -218,6 +220,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
 	spin_lock(&tdev->object_lock);
 	idr_remove(&tdev->idr, base->handle);
 	spin_unlock(&tdev->object_lock);
+	ttm_object_file_unref(&base->tfile);
 	return ret;
 }
 
-- 
2.34.1