vmw_lookup_user_surface_for_buffer() returns the surface base object
with an extra reference that the caller must release. When
ttm_ref_object_add() fails in vmw_buffer_prime_to_surface_base(), the
function jumps to out without releasing it, and *base_p is never set,
so the caller cannot clean it up either.

Drop the reference with ttm_base_object_unref() when
ttm_ref_object_add() fails.

Fixes: d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b2d3927b5567..8d3bd34b00f3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -965,6 +965,7 @@ static int vmw_buffer_prime_to_surface_base(struct vmw_private *dev_priv,
 	base = &user_srf->prime.base;
 	ret = ttm_ref_object_add(tfile, base, NULL, false);
 	if (ret) {
+		ttm_base_object_unref(&base);
 		drm_warn(&dev_priv->drm,
 			 "Couldn't add an object ref for the buffer (%d).\n", *handle);
 		goto out;
-- 
2.34.1