summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDave Airlie <airlied@redhat.com>2008-11-03 09:41:12 +1000
committerDave Airlie <airlied@redhat.com>2008-11-03 09:41:12 +1000
commite57072b5ee521ec799d0aa0ef84a7d01d8479202 (patch)
tree7901a34c79e7dba8f88e8af66ca557a9ea75783e
parent6000fa686294019e93f815433a1a9b44db511a69 (diff)
radeon: fix free after refcount
-rw-r--r--linux-core/radeon_display.c6
-rw-r--r--linux-core/radeon_fb.c1
2 files changed, 6 insertions, 1 deletions
diff --git a/linux-core/radeon_display.c b/linux-core/radeon_display.c
index 679244a9..f16288ef 100644
--- a/linux-core/radeon_display.c
+++ b/linux-core/radeon_display.c
@@ -601,7 +601,11 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
if (fb->fbdev)
radeonfb_remove(dev, fb);
- drm_gem_object_unreference(radeon_fb->obj);
+ if (radeon_fb->obj) {
+ mutex_lock(&dev->struct_mutex);
+ drm_gem_object_unreference(radeon_fb->obj);
+ mutex_unlock(&dev->struct_mutex);
+ }
drm_framebuffer_cleanup(fb);
kfree(radeon_fb);
}
diff --git a/linux-core/radeon_fb.c b/linux-core/radeon_fb.c
index 405f1da9..d3722c37 100644
--- a/linux-core/radeon_fb.c
+++ b/linux-core/radeon_fb.c
@@ -1149,6 +1149,7 @@ int radeonfb_remove(struct drm_device *dev, struct drm_framebuffer *fb)
drm_bo_kunmap(&radeon_fb->kmap_obj);
mutex_lock(&dev->struct_mutex);
drm_gem_object_unreference(radeon_fb->obj);
+ radeon_fb->obj = NULL;
mutex_unlock(&dev->struct_mutex);
framebuffer_release(info);
}