diff options
| author | Dave Airlie <airlied@redhat.com> | 2008-11-03 09:41:12 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2008-11-03 09:41:12 +1000 |
| commit | e57072b5ee521ec799d0aa0ef84a7d01d8479202 (patch) | |
| tree | 7901a34c79e7dba8f88e8af66ca557a9ea75783e /linux-core | |
| parent | 6000fa686294019e93f815433a1a9b44db511a69 (diff) | |
radeon: fix free after refcount
Diffstat (limited to 'linux-core')
| -rw-r--r-- | linux-core/radeon_display.c | 6 | ||||
| -rw-r--r-- | linux-core/radeon_fb.c | 1 |
2 files changed, 6 insertions, 1 deletions
diff --git a/linux-core/radeon_display.c b/linux-core/radeon_display.c index 679244a9..f16288ef 100644 --- a/linux-core/radeon_display.c +++ b/linux-core/radeon_display.c @@ -601,7 +601,11 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb) if (fb->fbdev) radeonfb_remove(dev, fb); - drm_gem_object_unreference(radeon_fb->obj); + if (radeon_fb->obj) { + mutex_lock(&dev->struct_mutex); + drm_gem_object_unreference(radeon_fb->obj); + mutex_unlock(&dev->struct_mutex); + } drm_framebuffer_cleanup(fb); kfree(radeon_fb); } diff --git a/linux-core/radeon_fb.c b/linux-core/radeon_fb.c index 405f1da9..d3722c37 100644 --- a/linux-core/radeon_fb.c +++ b/linux-core/radeon_fb.c @@ -1149,6 +1149,7 @@ int radeonfb_remove(struct drm_device *dev, struct drm_framebuffer *fb) drm_bo_kunmap(&radeon_fb->kmap_obj); mutex_lock(&dev->struct_mutex); drm_gem_object_unreference(radeon_fb->obj); + radeon_fb->obj = NULL; mutex_unlock(&dev->struct_mutex); framebuffer_release(info); } |