freedreno: fix potential leak at free

If user has emit'd reloc's, and then resets or deletes the ring, we want
to drop the ref's that the ring holds to the bo's to avoid a leak.

Signed-off-by: Rob Clark <robclark@freedesktop.org>

2 files changed, 7 insertions, 6 deletions

diff --git a/freedreno/freedreno_ringbuffer.c b/freedreno/freedreno_ringbuffer.c
index ab5d31fc..34a06d83 100644
--- a/freedreno/freedreno_ringbuffer.c
+++ b/freedreno/freedreno_ringbuffer.c
@@ -57,6 +57,7 @@ fd_ringbuffer_new(struct fd_pipe *pipe, uint32_t size)
 
 void fd_ringbuffer_del(struct fd_ringbuffer *ring)
 {
+	fd_ringbuffer_reset(ring);
 	ring->funcs->destroy(ring);
 }
 
diff --git a/freedreno/msm/msm_ringbuffer.c b/freedreno/msm/msm_ringbuffer.c
index b5a50def..32ed8b49 100644
--- a/freedreno/msm/msm_ringbuffer.c
+++ b/freedreno/msm/msm_ringbuffer.c
@@ -204,6 +204,12 @@ static void flush_reset(struct fd_ringbuffer *ring)
 	struct msm_ringbuffer *msm_ring = to_msm_ringbuffer(ring);
 	unsigned i;
 
+	for (i = 0; i < msm_ring->nr_bos; i++) {
+		struct msm_bo *msm_bo = to_msm_bo(msm_ring->bos[i]);
+		msm_bo->current_ring = NULL;
+		fd_bo_del(&msm_bo->base);
+	}
+
 	/* for each of the cmd buffers, clear their reloc's: */
 	for (i = 0; i < msm_ring->submit.nr_cmds; i++) {
 		struct msm_ringbuffer *target_ring = to_msm_ringbuffer(msm_ring->rings[i]);
@@ -280,12 +286,6 @@ static int msm_ringbuffer_flush(struct fd_ringbuffer *ring, uint32_t *last_start
 		}
 	}
 
-	for (i = 0; i < msm_ring->nr_bos; i++) {
-		struct msm_bo *msm_bo = to_msm_bo(msm_ring->bos[i]);
-		msm_bo->current_ring = NULL;
-		fd_bo_del(&msm_bo->base);
-	}
-
 	flush_reset(ring);
 
 	return ret;