If the lookup of the relocation target fails after the command buffer object has been looked up, the reference taken for the latter is not recorded in the caller's refs[] array and is never released. Drop it before returning. Fixes: 961e3beae3b2 ("drm/tegra: Make job submission 64-bit safe") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/gpu/drm/tegra/drm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index 1dcef4e7d104..4e4d41c527c6 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c @@ -159,8 +159,10 @@ static int host1x_reloc_copy_from_user(struct host1x_reloc *dest, return -ENOENT; dest->target.bo = tegra_gem_lookup(file, target); - if (!dest->target.bo) + if (!dest->target.bo) { + drm_gem_object_put(dest->cmdbuf.bo); return -ENOENT; + } return 0; } -- 2.34.1