drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk

Slowly leaking memory one page at a time :)

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

1 files changed, 15 insertions, 8 deletions

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 135d9d8c9506..c5cc648a1b4e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -40,6 +40,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 {
         struct drm_gem_object *gobj;
         unsigned long size;
+        int r;
 
         gobj = drm_gem_object_lookup(p->filp, data->handle);
         if (gobj == NULL)
@@ -51,20 +52,26 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
         p->uf_entry.tv.shared = true;
         p->uf_entry.user_pages = NULL;
 
-        size = amdgpu_bo_size(p->uf_entry.robj);
-        if (size != PAGE_SIZE || (data->offset + 8) > size)
-                return -EINVAL;
-
-        *offset = data->offset;
-
         drm_gem_object_put_unlocked(gobj);
 
+        size = amdgpu_bo_size(p->uf_entry.robj);
+        if (size != PAGE_SIZE || (data->offset + 8) > size) {
+                r = -EINVAL;
+                goto error_unref;
+        }
+
         if (amdgpu_ttm_tt_get_usermm(p->uf_entry.robj->tbo.ttm)) {
-                amdgpu_bo_unref(&p->uf_entry.robj);
-                return -EINVAL;
+                r = -EINVAL;
+                goto error_unref;
         }
 
+        *offset = data->offset;
+
         return 0;
+
+error_unref:
+        amdgpu_bo_unref(&p->uf_entry.robj);
+        return r;
 }
 
 static int amdgpu_cs_bo_handles_chunk(struct amdgpu_cs_parser *p,