[PATCH] drm/nouveau: fix memory leak by deallocating cli/drm

[Dongxing Zhang]

unreferenced object 0xffff8800bd132fe8 (size 256):
  comm "Xorg", pid 1260, jiffies 4294901661 (age 660.504s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 e8 2f 13 bd 00 88 ff ff  ........./......
    01 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff817b756e>] kmemleak_alloc+0x4e/0xb0
    [<ffffffff811d52d4>] __kmalloc+0x204/0x2c0
    [<ffffffffc03b633a>] nouveau_cli_create+0x2a/0xb0 [nouveau]
    [<ffffffffc03b648b>] nouveau_drm_open+0xcb/0x220 [nouveau]
    [<ffffffffc02146c2>] drm_open+0x1b2/0x4d0 [drm]
    [<ffffffffc021b449>] drm_stub_open+0xa9/0x130 [drm]
    [<ffffffff811f88cf>] chrdev_open+0x9f/0x1d0
    [<ffffffff811f1937>] do_dentry_open+0x257/0x350
    [<ffffffff811f1ac9>] vfs_open+0x49/0x50
    [<ffffffff812025dc>] do_last+0x1ec/0x1200
    [<ffffffff81203670>] path_openat+0x80/0x600
    [<ffffffff8120512a>] do_filp_open+0x3a/0x90
    [<ffffffff811f3138>] do_sys_open+0x128/0x220
    [<ffffffff811f324e>] SyS_open+0x1e/0x20
    [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75
    [<ffffffffffffffff>] 0xffffffffffffffff

Signed-off-by: Dongxing Zhang <dongxing.zhang at intel.com>
---
 drivers/gpu/drm/nouveau/nouveau_drm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 8904933..2ead477 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -115,7 +115,8 @@ nouveau_cli_create(u64 name, const char *sname,
 		if (ret == 0) {
 			mutex_init(&cli->mutex);
 			usif_client_init(cli);
-		}
+		} else
+			kfree(cli);
 		return ret;
 	}
 	return -ENOMEM;
@@ -489,6 +490,7 @@ fail_ttm:
 fail_device:
 	nvif_device_fini(&drm->device);
 	nouveau_cli_destroy(&drm->client);
+	kfree(drm);
 	return ret;
 }
 
@@ -517,6 +519,7 @@ nouveau_drm_unload(struct drm_device *dev)
 	if (drm->hdmi_device)
 		pci_dev_put(drm->hdmi_device);
 	nouveau_cli_destroy(&drm->client);
+	kfree(drm);
 	return 0;
 }
 
@@ -836,6 +839,7 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv)
 				  0x1000, &cli->vm);
 		if (ret) {
 			nouveau_cli_destroy(cli);
+			kfree(cli);
 			goto out_suspend;
 		}
 
@@ -877,6 +881,7 @@ nouveau_drm_postclose(struct drm_device *dev, struct drm_file *fpriv)
 {
 	struct nouveau_cli *cli = nouveau_cli(fpriv);
 	nouveau_cli_destroy(cli);
+	kfree(cli);
 	pm_runtime_mark_last_busy(dev->dev);
 	pm_runtime_put_autosuspend(dev->dev);
 }
-- 
1.9.1