Patch "drm/qxl: Do not leak memory if qxl_release_list_add fails" has been added to the 4.1-stable tree

Patch "drm/qxl: Do not leak memory if qxl_release_list_add fails" has been added to the 4.1-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    drm/qxl: Do not leak memory if qxl_release_list_add fails

to the 4.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-qxl-do-not-leak-memory-if-qxl_release_list_add-fails.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 8451cc964c1d193b989c41a44e5e77109cc696f8 Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Wed, 3 Jun 2015 12:09:10 +0100
Subject: drm/qxl: Do not leak memory if qxl_release_list_add fails

From: Frediano Ziglio <fziglio@redhat.com>

commit 8451cc964c1d193b989c41a44e5e77109cc696f8 upstream.

If the function fails reference counter to the object is not decremented
causing leaks.
This is hard to spot as it happens only on very low memory situations.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/qxl/qxl_ioctl.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo
 	qobj = gem_to_qxl_bo(gobj);
 
 	ret = qxl_release_list_add(release, qobj);
-	if (ret)
+	if (ret) {
+		drm_gem_object_unreference_unlocked(gobj);
 		return NULL;
+	}
 
 	return qobj;
 }


Patches currently in stable-queue which might be from fziglio@redhat.com are

queue-4.1/drm-qxl-do-not-leak-memory-if-qxl_release_list_add-fails.patch
queue-4.1/drm-qxl-do-not-cause-spice-server-to-clean-our-objects.patch