[PATCH] drm: Free the object ref on error.

[Chris Wilson]

Ensure that the object is unreferenced if we fail to allocate during
drm_gem_flink_ioctl().

Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
---
 drivers/gpu/drm/drm_gem.c |   20 ++++++++++++--------
 1 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 308fe1e..e5a8ebf 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -295,8 +295,10 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
 		return -EBADF;
 
 again:
-	if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0)
-		return -ENOMEM;
+	if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0) {
+		ret = -ENOMEM;
+		goto err;
+	}
 
 	spin_lock(&dev->object_name_lock);
 	if (obj->name) {
@@ -310,12 +312,8 @@ again:
 	if (ret == -EAGAIN)
 		goto again;
 
-	if (ret != 0) {
-		mutex_lock(&dev->struct_mutex);
-		drm_gem_object_unreference(obj);
-		mutex_unlock(&dev->struct_mutex);
-		return ret;
-	}
+	if (ret != 0)
+		goto err;
 
 	/*
 	 * Leave the reference from the lookup around as the
@@ -324,6 +322,12 @@ again:
 	args->name = (uint64_t) obj->name;
 
 	return 0;
+
+err:
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(obj);
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
 }
 
 /**
-- 
1.6.0.4


--=-Qk9UKcETSCqWc2OG1HML
Content-Description: 
Content-Disposition: inline; filename="0008-drm-Do-not-leak-a-new-reference-for-flink-on-an-e.patch"
Content-Type: text/x-patch; charset="UTF-8"
Content-Transfer-Encoding: 7bit