drm/msm: fix leak in failed submit path

Signed-off-by: Rob Clark <robdclark@gmail.com>

diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 4114a40..5b2963f 100644 (file)
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -161,6 +161,7 @@ int msm_atomic_commit(struct drm_device *dev,
 
 int msm_register_mmu(struct drm_device *dev, struct msm_mmu *mmu);
 
+void msm_gem_submit_free(struct msm_gem_submit *submit);
 int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                struct drm_file *file);
 

diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 96c595c..711a658 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -56,6 +56,13 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
        return submit;
 }
 
+void msm_gem_submit_free(struct msm_gem_submit *submit)
+{
+       fence_put(submit->fence);
+       list_del(&submit->node);
+       kfree(submit);
+}
+
 static int submit_lookup_objects(struct msm_gem_submit *submit,
                struct drm_msm_gem_submit *args, struct drm_file *file)
 {
@@ -324,7 +331,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
        return 0;
 }
 
-static void submit_cleanup(struct msm_gem_submit *submit, bool fail)
+static void submit_cleanup(struct msm_gem_submit *submit)
 {
        unsigned i;
 
@@ -448,7 +455,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
        args->fence = submit->fence->seqno;
 
 out:
-       submit_cleanup(submit, !!ret);
+       submit_cleanup(submit);
+       if (ret)
+               msm_gem_submit_free(submit);
        mutex_unlock(&dev->struct_mutex);
        return ret;
 }

diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 4c4f4b5..5aed93a 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -446,9 +446,7 @@ static void retire_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
                drm_gem_object_unreference(&msm_obj->base);
        }
 
-       fence_put(submit->fence);
-       list_del(&submit->node);
-       kfree(submit);
+       msm_gem_submit_free(submit);
 }
 
 static void retire_submits(struct msm_gpu *gpu)