ttm_base_object_init() takes a reference on the caller's ttm_object_file via ttm_object_file_ref(). The reference is normally released by ttm_release_base() when the object's refcount drops to zero, but on the two error paths, idr_alloc() failure and ttm_ref_object_add() failure, the object is torn down by the caller without ever dropping the reference. Drop the tfile reference with ttm_object_file_unref() on both error paths. Fixes: 0b8762e997df ("drm/ttm, drm/vmwgfx: Move the lock- and object functionality to the vmwgfx driver") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/gpu/drm/vmwgfx/ttm_object.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c index 2421b0dd057c..92433b60e282 100644 --- a/drivers/gpu/drm/vmwgfx/ttm_object.c +++ b/drivers/gpu/drm/vmwgfx/ttm_object.c @@ -203,8 +203,10 @@ int ttm_base_object_init(struct ttm_object_file *tfile, ret = idr_alloc(&tdev->idr, base, 1, 0, GFP_NOWAIT); spin_unlock(&tdev->object_lock); idr_preload_end(); - if (ret < 0) + if (ret < 0) { + ttm_object_file_unref(&base->tfile); return ret; + } base->handle = ret; ret = ttm_ref_object_add(tfile, base, NULL, false); @@ -218,6 +220,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile, spin_lock(&tdev->object_lock); idr_remove(&tdev->idr, base->handle); spin_unlock(&tdev->object_lock); + ttm_object_file_unref(&base->tfile); return ret; } -- 2.34.1