drm/ttm: fix error handling in ttm_buffer_object_transfer

Unlocking the resv object was missing in the error path, additionally to
that we should move over the resource only after the fence slot was
reserved.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Fixes: c8d4c18bfbc4a ("dma-buf/drivers: make reserving a shared slot mandatory v4")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20250616130726.22863-3-christian.koenig@amd.com

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 15cab9bda17fb98452ce85ecbec196baa962db37..bd90404ea609ca2615418d45b6e07f6a5c4ab937 100644 (file)
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -254,6 +254,13 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
        ret = dma_resv_trylock(&fbo->base.base._resv);
        WARN_ON(!ret);
 
+       ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1);
+       if (ret) {
+               dma_resv_unlock(&fbo->base.base._resv);
+               kfree(fbo);
+               return ret;
+       }
+
        if (fbo->base.resource) {
                ttm_resource_set_bo(fbo->base.resource, &fbo->base);
                bo->resource = NULL;
@@ -262,12 +269,6 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
                fbo->base.bulk_move = NULL;
        }
 
-       ret = dma_resv_reserve_fences(&fbo->base.base._resv, 1);
-       if (ret) {
-               kfree(fbo);
-               return ret;
-       }
-
        ttm_bo_get(bo);
        fbo->bo = bo;