If qxl_bo_reserve() succeeds and ttm_bo_validate() fails, qxl_update_area_ioctl() returns without calling qxl_bo_unreserve(). This leaves the buffer object reserved and causes later attempts to reserve it to hang. Fix this by calling qxl_bo_unreserve() in that error path.
This has been detected by the Clang thread-safety analyzer. Compile-tested only. Cc: Dave Airlie <[email protected]> Cc: Gerd Hoffmann <[email protected]> Cc: [email protected] Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Bart Van Assche <[email protected]> --- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 591b026ceff9..40c1eca77b39 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -323,7 +323,7 @@ int qxl_update_area_ioctl(struct drm_device *dev, void *data, struct drm_file *f qxl_ttm_placement_from_domain(qobj, qobj->type); ret = ttm_bo_validate(&qobj->tbo, &qobj->placement, &ctx); if (unlikely(ret)) - goto out; + goto out2; } ret = qxl_bo_check_id(qdev, qobj);
