[PATCH 2/2] drm/amdgpu: fix resource leak in amdgpu_userq_create() xa_store_irq error path

[Junrui Luo]

When xa_store_irq() fails in amdgpu_userq_create(), the error path only
calls kfree(queue) but does not clean up resources from the preceding
successful mqd_create() and fence_driver_alloc() calls.

Add the missing mqd_destroy() and amdgpu_userq_fence_driver_free() calls
to match the cleanup order used in other error paths.

Fixes: f18719ef4bb7 ("drm/amdgpu: Convert amdgpu userqueue management from IDR to XArray")
Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 60e1f7541a64..716f9816e067 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -855,6 +855,8 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
 	down_read(&adev->reset_domain->sem);
 	r = xa_err(xa_store_irq(&adev->userq_doorbell_xa, index, queue, GFP_KERNEL));
 	if (r) {
+		amdgpu_userq_fence_driver_free(queue);
+		uq_funcs->mqd_destroy(queue);
 		kfree(queue);
 		up_read(&adev->reset_domain->sem);
 		goto unlock;

-- 
2.51.2