vmw_lookup_user_surface_for_buffer() returns the surface base object with an extra reference that the caller must release. When ttm_ref_object_add() fails in vmw_buffer_prime_to_surface_base(), the function jumps to out without releasing it, and *base_p is never set, so the caller cannot clean it up either. Drop the reference with ttm_base_object_unref() when ttm_ref_object_add() fails. Fixes: d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index b2d3927b5567..8d3bd34b00f3 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -965,6 +965,7 @@ static int vmw_buffer_prime_to_surface_base(struct vmw_private *dev_priv, base = &user_srf->prime.base; ret = ttm_ref_object_add(tfile, base, NULL, false); if (ret) { + ttm_base_object_unref(&base); drm_warn(&dev_priv->drm, "Couldn't add an object ref for the buffer (%d).\n", *handle); goto out; -- 2.34.1