radeon: fix free after refcount

main
Dave Airlie 2008-11-03 09:41:12 +10:00
parent 6000fa6862
commit e57072b5ee
2 changed files with 6 additions and 1 deletions

View File

@ -601,7 +601,11 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
if (fb->fbdev)
radeonfb_remove(dev, fb);
drm_gem_object_unreference(radeon_fb->obj);
if (radeon_fb->obj) {
mutex_lock(&dev->struct_mutex);
drm_gem_object_unreference(radeon_fb->obj);
mutex_unlock(&dev->struct_mutex);
}
drm_framebuffer_cleanup(fb);
kfree(radeon_fb);
}

View File

@ -1149,6 +1149,7 @@ int radeonfb_remove(struct drm_device *dev, struct drm_framebuffer *fb)
drm_bo_kunmap(&radeon_fb->kmap_obj);
mutex_lock(&dev->struct_mutex);
drm_gem_object_unreference(radeon_fb->obj);
radeon_fb->obj = NULL;
mutex_unlock(&dev->struct_mutex);
framebuffer_release(info);
}