1 files changed, 14 insertions, 5 deletions

diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index f82a299553f..4ccfe4328fa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -51,11 +51,22 @@ struct exynos_drm_fb {
 static void exynos_drm_fb_destroy(struct drm_framebuffer *fb)
 {
         struct exynos_drm_fb *exynos_fb = to_exynos_fb(fb);
+        unsigned int i;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         drm_framebuffer_cleanup(fb);
 
+        for (i = 0; i < ARRAY_SIZE(exynos_fb->exynos_gem_obj); i++) {
+                struct drm_gem_object *obj;
+
+                if (exynos_fb->exynos_gem_obj[i] == NULL)
+                        continue;
+
+                obj = &exynos_fb->exynos_gem_obj[i]->base;
+                drm_gem_object_unreference_unlocked(obj);
+        }
+
         kfree(exynos_fb);
         exynos_fb = NULL;
 }
@@ -134,11 +145,11 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                 return ERR_PTR(-ENOENT);
         }
 
-        drm_gem_object_unreference_unlocked(obj);
-
         fb = exynos_drm_framebuffer_init(dev, mode_cmd, obj);
-        if (IS_ERR(fb))
+        if (IS_ERR(fb)) {
+                drm_gem_object_unreference_unlocked(obj);
                 return fb;
+        }
 
         exynos_fb = to_exynos_fb(fb);
         nr = exynos_drm_format_num_buffers(fb->pixel_format);
@@ -152,8 +163,6 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                         return ERR_PTR(-ENOENT);
                 }
 
-                drm_gem_object_unreference_unlocked(obj);
-
                 exynos_fb->exynos_gem_obj[i] = to_exynos_gem_obj(obj);
         }