drm/syncobj: fix leaking dma_fence in drm_syncobj_query_ioctl

We need to check the context number instead if the previous sequence to detect
an error and if an error is detected we need to drop the reference to the
current fence or otherwise would leak it.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Fixes: 27b575a9aa2f ("drm/syncobj: add timeline payload query ioctl v6")
Link: https://patchwork.freedesktop.org/patch/319123/

diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 75cb4bb7619e93dfd826a4007d335c19e8d4d643..1438dcb3ebb1955fc9f38ca6b96254a5c433b7e8 100644 (file)
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -1298,14 +1298,14 @@ int drm_syncobj_query_ioctl(struct drm_device *dev, void *data,
                        struct dma_fence *iter, *last_signaled = NULL;
 
                        dma_fence_chain_for_each(iter, fence) {
-                               if (!iter)
-                                       break;
-                               dma_fence_put(last_signaled);
-                               last_signaled = dma_fence_get(iter);
-                               if (!to_dma_fence_chain(last_signaled)->prev_seqno)
+                               if (iter->context != fence->context) {
+                                       dma_fence_put(iter);
                                        /* It is most likely that timeline has
                                         * unorder points. */
                                        break;
+                               }
+                               dma_fence_put(last_signaled);
+                               last_signaled = dma_fence_get(iter);
                        }
                        point = dma_fence_is_signaled(last_signaled) ?
                                last_signaled->seqno :