drm/i915: Add locking around framebuffer_references--

obj->framebuffer_references isn't an atomic_t so the decrement needs to
be protected by some lock. struct_mutex seems like the appropriate lock
here, and we may already take it for the obj unref anyway.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 1880c18a4e09..b9251c863cd2 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11594,11 +11594,14 @@ static void intel_setup_outputs(struct drm_device *dev)
 
 static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
+        struct drm_device *dev = fb->dev;
         struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
 
         drm_framebuffer_cleanup(fb);
+        mutex_lock(&dev->struct_mutex);
         WARN_ON(!intel_fb->obj->framebuffer_references--);
-        drm_gem_object_unreference_unlocked(&intel_fb->obj->base);
+        drm_gem_object_unreference(&intel_fb->obj->base);
+        mutex_unlock(&dev->struct_mutex);
         kfree(intel_fb);
 }