When importing a sync file fence into a timeline syncobj with a non-zero
point, drm_syncobj_import_sync_file_fence() allocates a dma_fence_chain
with dma_fence_chain_alloc(). If that allocation fails the function
returns -ENOMEM directly, leaking the reference on the syncobj taken by
drm_syncobj_find() (and the reference on the fence taken by
sync_file_get_fence()).
Jump to a cleanup path that drops both references before returning the
error.
Fixes: c2d3a7300695 ("drm/syncobj: Extend EXPORT_SYNC_FILE for timeline syncobjs")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/gpu/drm/drm_syncobj.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 8d9fd1917c6e..7e1502cbd852 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -742,7 +742,7 @@ static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
struct dma_fence_chain *chain = dma_fence_chain_alloc();
if (!chain)
- return -ENOMEM;
+ goto err_put;
drm_syncobj_add_point(syncobj, chain, fence, point);
} else {
@@ -752,6 +752,10 @@ static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
dma_fence_put(fence);
drm_syncobj_put(syncobj);
return 0;
+err_put:
+ dma_fence_put(fence);
+ drm_syncobj_put(syncobj);
+ return -ENOMEM;
}
static int drm_syncobj_export_sync_file(struct drm_file *file_private,
--
2.34.1