[PATCH] drm/tegra: Fix bo reference leak in host1x_reloc_copy_from_user()

[Wentao Liang <vulab@iscas.ac.cn>]

If the lookup of the relocation target fails after the command buffer
object has been looked up, the reference taken for the latter is not
recorded in the caller's refs[] array and is never released.  Drop it
before returning.

Fixes: 961e3beae3b2 ("drm/tegra: Make job submission 64-bit safe")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/tegra/drm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 1dcef4e7d104..4e4d41c527c6 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -159,8 +159,10 @@ static int host1x_reloc_copy_from_user(struct host1x_reloc *dest,
 		return -ENOENT;
 
 	dest->target.bo = tegra_gem_lookup(file, target);
-	if (!dest->target.bo)
+	if (!dest->target.bo) {
+		drm_gem_object_put(dest->cmdbuf.bo);
 		return -ENOENT;
+	}
 
 	return 0;
 }
-- 
2.34.1