vmw_lookup_user_surface_for_buffer() returns a pointer with a temporary reference taken via kref_get_unless_zero(). The other two callers (vmw_lookup_surface_for_buffer and vmw_lookup_surface_handle_for_buffer) correctly release it with ttm_base_object_unref(). vmw_buffer_prime_to_surface_base() does not, leaking the reference on both the success and ttm_ref_object_add() failure paths.
Add the missing ttm_base_object_unref() before vmw_user_bo_unref() at the out label. Cc: [email protected] Fixes: d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers") Signed-off-by: Wentao Liang <[email protected]> --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index b2d3927b5567..9e63846fd663 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -972,6 +972,7 @@ static int vmw_buffer_prime_to_surface_base(struct vmw_private *dev_priv, *base_p = base; out: + ttm_base_object_unref(&base); vmw_user_bo_unref(&bo); return ret; -- 2.34.1
