drm: Remove two leaks of vblank reference count in error paths.

If the failing paths were hit, the vblank IRQ would never get turned off
again.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

2 files changed, 5 insertions, 1 deletions

diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 4091b9e291f9..212a94f715b2 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -594,11 +594,14 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
                         goto done;
                 }
 
+                /* Get a refcount on the vblank, which will be released by
+                 * drm_vbl_send_signals().
+                 */
                 ret = drm_vblank_get(dev, crtc);
                 if (ret) {
                         drm_free(vbl_sig, sizeof(struct drm_vbl_sig),
                                  DRM_MEM_DRIVER);
-                        return ret;
+                        goto done;
                 }
 
                 atomic_inc(&dev->vbl_signal_pending);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 671dd79d0aac..2cd853b2c562 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -771,6 +771,7 @@ int i915_vblank_swap(struct drm_device *dev, void *data,
                     vbl_swap->plane == plane &&
                     vbl_swap->sequence == swap->sequence) {
                         spin_unlock_irqrestore(&dev_priv->swaps_lock, irqflags);
+                        drm_vblank_put(dev, pipe);
                         DRM_DEBUG("Already scheduled\n");
                         return 0;
                 }