From e57072b5ee521ec799d0aa0ef84a7d01d8479202 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Mon, 3 Nov 2008 09:41:12 +1000 Subject: radeon: fix free after refcount --- linux-core/radeon_display.c | 6 +++++- linux-core/radeon_fb.c | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/linux-core/radeon_display.c b/linux-core/radeon_display.c index 679244a9..f16288ef 100644 --- a/linux-core/radeon_display.c +++ b/linux-core/radeon_display.c @@ -601,7 +601,11 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb) if (fb->fbdev) radeonfb_remove(dev, fb); - drm_gem_object_unreference(radeon_fb->obj); + if (radeon_fb->obj) { + mutex_lock(&dev->struct_mutex); + drm_gem_object_unreference(radeon_fb->obj); + mutex_unlock(&dev->struct_mutex); + } drm_framebuffer_cleanup(fb); kfree(radeon_fb); } diff --git a/linux-core/radeon_fb.c b/linux-core/radeon_fb.c index 405f1da9..d3722c37 100644 --- a/linux-core/radeon_fb.c +++ b/linux-core/radeon_fb.c @@ -1149,6 +1149,7 @@ int radeonfb_remove(struct drm_device *dev, struct drm_framebuffer *fb) drm_bo_kunmap(&radeon_fb->kmap_obj); mutex_lock(&dev->struct_mutex); drm_gem_object_unreference(radeon_fb->obj); + radeon_fb->obj = NULL; mutex_unlock(&dev->struct_mutex); framebuffer_release(info); } -- cgit v1.2.3