[PATCH] drm/amdgpu: Fix GEM object leak in amdgpu_gem_op_ioctl()

[Wentao Liang]

In the AMDGPU_GEM_OP_GET_MAPPING_INFO case, amdgpu_gem_op_ioctl()
takes a reference to the GEM object with drm_gem_object_lookup() and
holds the buffer object locked through drm_exec.  When the allocation
of the mapping array fails, the function returns -ENOMEM directly,
leaving the exec locks held and leaking the GEM object reference
returned by drm_gem_object_lookup().

Jump to the out_exec label instead so that drm_exec_fini() and
drm_gem_object_put() release the locks and the GEM object reference.

Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 123d4a09114d..06dd2e8a5b47 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -1094,8 +1094,10 @@ int amdgpu_gem_op_ioctl(struct drm_device *dev, void *data,
 		 * be retried.
 		 */
 		vm_entries = kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL);
-		if (!vm_entries)
-			return -ENOMEM;
+		if (!vm_entries) {
+			r = -ENOMEM;
+			goto out_exec;
+		}
 
 		amdgpu_vm_bo_va_for_each_valid_mapping(bo_va, mapping) {
 			if (num_mappings < args->num_entries) {
-- 
2.34.1