drm/ttm: fix error handling in ttm_buffer_object_transfer

commit 97e000acf2e20a86a50a0ec8c2739f0846f37509 upstream.

Unlocking the resv object was missing in the error path, additionally to
that we should move over the resource only after the fence slot was
reserved.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Fixes: c8d4c18bfbc4a ("dma-buf/drivers: make reserving a shared slot mandatory v4")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20250616130726.22863-3-christian.koenig@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 0b3f4267130c4569fa04ae8eba4a5b5eefe6a176..64606104551cd851c04c96c2b66af4aef5e67ac5 100644 (file)
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -254,6 +254,13 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
        ret = dma_resv_trylock(&fbo->base.base._resv);
        WARN_ON(!ret);
 
+       ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1);
+       if (ret) {
+               dma_resv_unlock(&fbo->base.base._resv);
+               kfree(fbo);
+               return ret;
+       }
+
        if (fbo->base.resource) {
                ttm_resource_set_bo(fbo->base.resource, &fbo->base);
                bo->resource = NULL;
@@ -262,12 +269,6 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
                fbo->base.bulk_move = NULL;
        }
 
-       ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1);
-       if (ret) {
-               kfree(fbo);
-               return ret;
-       }
-
        ttm_bo_get(bo);
        fbo->bo = bo;