drm/imagination: Fix error path in pvr_vm_create_context
authorDonald Robson <donald.robson@imgtec.com>
Wed, 13 Dec 2023 14:44:31 +0000 (14:44 +0000)
committerMaxime Ripard <mripard@kernel.org>
Fri, 15 Dec 2023 13:04:21 +0000 (14:04 +0100)
commit8a53e29fe05c56f643eaab285f224c09b9c3dd4c
tree1c544f78b00f29a08567e6c0f6eae7f6621f2d8d
parentf175498378bdae2ebcf61170a2a866cb96e8a69a
drm/imagination: Fix error path in pvr_vm_create_context

It is possible to double free the vm_ctx->mmu_ctx object in this
function.

    630 err_page_table_destroy:
--> 631         pvr_mmu_context_destroy(vm_ctx->mmu_ctx);

The pvr_vm_context_put() function does:

        kref_put(&vm_ctx->ref_count, pvr_vm_context_release);

Here the pvr_vm_context_release() will call:

        pvr_mmu_context_destroy(vm_ctx->mmu_ctx);

Refactor to an unwind style.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Donald Robson <donald.robson@imgtec.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231213144431.94956-2-donald.robson@imgtec.com
drivers/gpu/drm/imagination/pvr_vm.c