drm/msm: fix leak in failed submit path

Signed-off-by: Rob Clark <[e-mail]>

drivers/gpu/drm/msm/msm_drv.h

···
 
 int msm_register_mmu(struct drm_device *dev, struct msm_mmu *mmu);
 
+void msm_gem_submit_free(struct msm_gem_submit *submit);
 int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
 		struct drm_file *file);
 

drivers/gpu/drm/msm/msm_gem_submit.c

···
 	return submit;
 }
 
+void msm_gem_submit_free(struct msm_gem_submit *submit)
+{
+	fence_put(submit->fence);
+	list_del(&submit->node);
+	kfree(submit);
+}
+
 static int submit_lookup_objects(struct msm_gem_submit *submit,
 		struct drm_msm_gem_submit *args, struct drm_file *file)
 {
···
 	return 0;
 }
 
-static void submit_cleanup(struct msm_gem_submit *submit, bool fail)
+static void submit_cleanup(struct msm_gem_submit *submit)
 {
 	unsigned i;
 
···
 	args->fence = submit->fence->seqno;
 
 out:
-	submit_cleanup(submit, !!ret);
+	submit_cleanup(submit);
+	if (ret)
+		msm_gem_submit_free(submit);
 	mutex_unlock(&dev->struct_mutex);
 	return ret;
 }

drivers/gpu/drm/msm/msm_gpu.c

···
 		drm_gem_object_unreference(&msm_obj->base);
 	}
 
-	fence_put(submit->fence);
-	list_del(&submit->node);
-	kfree(submit);
+	msm_gem_submit_free(submit);
 }
 
 static void retire_submits(struct msm_gpu *gpu)