[PATCH] drm/panfrost: perfcnt: fix ref count leak in panfrost_perfcnt_enable_locked

[Alyssa Rosenzweig]

Acked-by: Alyssa Rosenzweig <alyssa.rosenzweig at collabora.com>

On Sun, Jun 14, 2020 at 01:36:19AM -0500, Navid Emamdoost wrote:
> in panfrost_perfcnt_enable_locked, pm_runtime_get_sync is called which
> increments the counter even in case of failure, leading to incorrect
> ref count. In case of failure, decrement the ref count before returning.
> 
> Signed-off-by: Navid Emamdoost <navid.emamdoost at gmail.com>
> ---
>  drivers/gpu/drm/panfrost/panfrost_perfcnt.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> index 6913578d5aa7..92c64b20eb29 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> @@ -83,11 +83,13 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev,
>  
>  	ret = pm_runtime_get_sync(pfdev->dev);
>  	if (ret < 0)
> -		return ret;
> +		goto err_put_pm;
>  
>  	bo = drm_gem_shmem_create(pfdev->ddev, perfcnt->bosize);
> -	if (IS_ERR(bo))
> -		return PTR_ERR(bo);
> +	if (IS_ERR(bo)) {
> +		ret = PTR_ERR(bo);
> +		goto err_put_pm;
> +	}
>  
>  	/* Map the perfcnt buf in the address space attached to file_priv. */
>  	ret = panfrost_gem_open(&bo->base, file_priv);
> @@ -168,6 +170,8 @@ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev,
>  	panfrost_gem_close(&bo->base, file_priv);
>  err_put_bo:
>  	drm_gem_object_put_unlocked(&bo->base);
> +err_put_pm:
> +	pm_runtime_put(pfdev->dev);
>  	return ret;
>  }
>  
> -- 
> 2.17.1
>