Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3e49c4f4 authored by Chris Wilson's avatar Chris Wilson Committed by Dave Airlie
Browse files

drm: Free the object ref on error. 



Ensure that the object is unreferenced if we fail to allocate during
drm_gem_flink_ioctl().

Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Signed-off-by: default avatarDave Airlie <airlied@linux.ie>
parent ad45aa9e

drivers/gpu/drm/drm_gem.c

+12 −8
Original line number Diff line number Diff line
@@ -295,8 +295,10 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, 
		return -EBADF;



again:

	if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0)

		return -ENOMEM;

	if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0) {

		ret = -ENOMEM;

		goto err;

	}



	spin_lock(&dev->object_name_lock);

	if (obj->name) {
@@ -310,12 +312,8 @@ again: 
	if (ret == -EAGAIN)

		goto again;



	if (ret != 0) {

		mutex_lock(&dev->struct_mutex);

		drm_gem_object_unreference(obj);

		mutex_unlock(&dev->struct_mutex);

		return ret;

	}

	if (ret != 0)

		goto err;



	/*

	 * Leave the reference from the lookup around as the
@@ -324,6 +322,12 @@ again: 
	args->name = (uint64_t) obj->name;



	return 0;



err:

	mutex_lock(&dev->struct_mutex);

	drm_gem_object_unreference(obj);

	mutex_unlock(&dev->struct_mutex);

	return ret;

}



/**