[PATCH] drm/vmwgfx: fix ttm_base_object refcount leak in vmw_buffer_prime_to_surface_base()

[Wentao Liang]

vmw_lookup_user_surface_for_buffer() returns a pointer with a
temporary reference taken via kref_get_unless_zero(). The other
two callers (vmw_lookup_surface_for_buffer and
vmw_lookup_surface_handle_for_buffer) correctly release it with
ttm_base_object_unref(). vmw_buffer_prime_to_surface_base() does
not, leaking the reference on both the success and
ttm_ref_object_add() failure paths.

Add the missing ttm_base_object_unref() before vmw_user_bo_unref()
at the out label.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b2d3927b5567..9e63846fd663 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -972,6 +972,7 @@ static int vmw_buffer_prime_to_surface_base(struct vmw_private *dev_priv,
 
 	*base_p = base;
 out:
+	ttm_base_object_unref(&base);
 	vmw_user_bo_unref(&bo);
 
 	return ret;
-- 
2.34.1