From: Thierry Reding <treding@nvidia.com>
Date: Mon, 8 Jan 2018 16:16:06 +0100
Subject: drm/tegra: dc: Properly cleanup overlay planes
Git-commit: 8f62142e490d761ceb92b55a7c05bb79294d6c6c
Patch-mainline: v4.16-rc1
References: FATE#326289 FATE#326079 FATE#326049 FATE#322398 FATE#326166

The first overlay plane can leak if initialization of the second overlay
plane fails. Fix this by properly destroying the first overlay plane on
error.

Suggested-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Acked-by: Petr Tesarik <ptesarik@suse.com>
---
 drivers/gpu/drm/tegra/dc.c |   18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -937,20 +937,24 @@ static struct drm_plane *tegra_dc_add_sh
 static struct drm_plane *tegra_dc_add_planes(struct drm_device *drm,
 					     struct tegra_dc *dc)
 {
-	struct drm_plane *plane, *primary;
+	struct drm_plane *planes[2], *primary;
 	unsigned int i;
+	int err;
 
 	primary = tegra_primary_plane_create(drm, dc);
 	if (IS_ERR(primary))
 		return primary;
 
 	for (i = 0; i < 2; i++) {
-		plane = tegra_dc_overlay_plane_create(drm, dc, 1 + i);
-		if (IS_ERR(plane)) {
-			/* XXX tegra_plane_destroy() */
-			drm_plane_cleanup(primary);
-			kfree(primary);
-			return plane;
+		planes[i] = tegra_dc_overlay_plane_create(drm, dc, 1 + i);
+		if (IS_ERR(planes[i])) {
+			err = PTR_ERR(planes[i]);
+
+			while (i--)
+				tegra_plane_funcs.destroy(planes[i]);
+
+			tegra_plane_funcs.destroy(primary);
+			return ERR_PTR(err);
 		}
 	}