drm/ttm: fix error handling in ttm_buffer_object_transfer

commit 97e000acf2e20a86a50a0ec8c2739f0846f37509 upstream.

Unlocking the resv object was missing in the error path, additionally to
that we should move over the resource only after the fence slot was
reserved.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Fixes: c8d4c18bfbc4a ("dma-buf/drivers: make reserving a shared slot mandatory v4")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20250616130726.22863-3-christian.koenig@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index dcb2c23dc6de4d7db88df4f4bacaff3c0f228d1e..7f97c97b49bd2ee551486d88c731febc9748088f 100644 (file)
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -244,6 +244,13 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
        ret = dma_resv_trylock(&fbo->base.base._resv);
        WARN_ON(!ret);
 
+       ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1);
+       if (ret) {
+               dma_resv_unlock(&fbo->base.base._resv);
+               kfree(fbo);
+               return ret;
+       }
+
        if (fbo->base.resource) {
                ttm_resource_set_bo(fbo->base.resource, &fbo->base);
                bo->resource = NULL;
@@ -252,12 +259,6 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
                fbo->base.bulk_move = NULL;
        }
 
-       ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1);
-       if (ret) {
-               kfree(fbo);
-               return ret;
-       }
-
        ttm_bo_get(bo);
        fbo->bo = bo;