drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

[ Upstream commit 947a844bb3ebff0f4736d244d792ce129f6700d7 ]

drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo
needs to be put when msm_gem_get_and_pin_iova fails.

Fixes: e172d10a9c4a ("drm/msm/mdp5: Add hardware cursor support")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20220509061125.18585-1-hbh25y@gmail.com
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
index fe2922c8d21bf351f51f2be5a255a46e05852dc0..31447da0af25c08c95402a3be3c2b9e4c34b7a1f 100644 (file)
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
@@ -997,8 +997,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
 
        ret = msm_gem_get_and_pin_iova(cursor_bo, kms->aspace,
                        &mdp5_crtc->cursor.iova);
-       if (ret)
+       if (ret) {
+               drm_gem_object_put(cursor_bo);
                return -EINVAL;
+       }
 
        pm_runtime_get_sync(&pdev->dev);