[PATCH 3/4] accel/rocket: fix iommu domain leak in rocket_ioctl_create_bo() error path

[Wentao Liang]

If creating a BO fails after the GEM handle was created (e.g. the pages
or the iommu mapping cannot be set up), the error path calls
drm_gem_shmem_object_free() directly.  That bypasses the driver's
rocket_gem_bo_free() GEM free callback, so rocket_iommu_domain_put() is
never called and the reference taken with rocket_iommu_domain_get()
earlier in the function is leaked.

Drop the iommu domain reference before freeing the shmem object in the
error path.

Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/accel/rocket/rocket_gem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/accel/rocket/rocket_gem.c b/drivers/accel/rocket/rocket_gem.c
index c8084719208a..91095d1b3066 100644
--- a/drivers/accel/rocket/rocket_gem.c
+++ b/drivers/accel/rocket/rocket_gem.c
@@ -120,6 +120,7 @@ int rocket_ioctl_create_bo(struct drm_device *dev, void *data, struct drm_file *
 	mutex_unlock(&rocket_priv->mm_lock);
 
 err:
+	rocket_iommu_domain_put(rkt_obj->domain);
 	drm_gem_shmem_object_free(gem_obj);
 
 	return ret;
-- 
2.34.1