radeon: fix free after refcount

diff --git a/linux-core/radeon_display.c b/linux-core/radeon_display.c
index 679244a98c0828a4e0d4ce2488346ca334a23ce0..f16288efaa3d496154adee77e57e7587aedac456 100644 (file)
--- a/linux-core/radeon_display.c
+++ b/linux-core/radeon_display.c
@@ -601,7 +601,11 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
        if (fb->fbdev)
                radeonfb_remove(dev, fb);
 
-       drm_gem_object_unreference(radeon_fb->obj);
+       if (radeon_fb->obj) {
+               mutex_lock(&dev->struct_mutex);
+               drm_gem_object_unreference(radeon_fb->obj);
+               mutex_unlock(&dev->struct_mutex);
+       }
        drm_framebuffer_cleanup(fb);
        kfree(radeon_fb);
 }

diff --git a/linux-core/radeon_fb.c b/linux-core/radeon_fb.c
index 405f1da914b49d38d14826c0cbd9853cd633305e..d3722c373454dfa053f9cc0b5705153ebb58cce5 100644 (file)
--- a/linux-core/radeon_fb.c
+++ b/linux-core/radeon_fb.c
@@ -1149,6 +1149,7 @@ int radeonfb_remove(struct drm_device *dev, struct drm_framebuffer *fb)
                drm_bo_kunmap(&radeon_fb->kmap_obj);
                mutex_lock(&dev->struct_mutex);
                drm_gem_object_unreference(radeon_fb->obj);
+               radeon_fb->obj = NULL;
                mutex_unlock(&dev->struct_mutex);
                framebuffer_release(info);
        }