drm/msm: Fix a fence leak in submit error path

[ Upstream commit 5d319f75ccf7f0927425a7545aa1a22b3eedc189 ]

In error paths, we could unref the submit without calling
drm_sched_entity_push_job(), so msm_job_free() will never get
called.  Since drm_sched_job_cleanup() will NULL out the
s_fence, we can use that to detect this case.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Patchwork: https://patchwork.freedesktop.org/patch/653584/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index fc2fb1019ea1c0bdd93a2e5e80b77c89a972320a..2ffb2ca88ffe13d8b7bc755005a1addd8e057365 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -76,6 +76,15 @@ void __msm_gem_submit_destroy(struct kref *kref)
        struct dma_fence *fence;
        unsigned i;
 
+       /*
+        * In error paths, we could unref the submit without calling
+        * drm_sched_entity_push_job(), so msm_job_free() will never
+        * get called.  Since drm_sched_job_cleanup() will NULL out
+        * s_fence, we can use that to detect this case.
+        */
+       if (submit->base.s_fence)
+               drm_sched_job_cleanup(&submit->base);
+
        if (submit->fence_id) {
                mutex_lock(&submit->queue->lock);
                idr_remove(&submit->queue->fence_idr, submit->fence_id);