drm/exynos: Keep a reference to frame buffer GEM objects

GEM objects used by frame buffers must be referenced for the whole life
of the frame buffer. Release the references in the frame buffer
destructor instead of its constructor.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>

1 files changed, 14 insertions, 5 deletions

diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index f82a299553fb..4ccfe4328fab 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -51,11 +51,22 @@ struct exynos_drm_fb {
 static void exynos_drm_fb_destroy(struct drm_framebuffer *fb)
 {
         struct exynos_drm_fb *exynos_fb = to_exynos_fb(fb);
+        unsigned int i;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         drm_framebuffer_cleanup(fb);
 
+        for (i = 0; i < ARRAY_SIZE(exynos_fb->exynos_gem_obj); i++) {
+                struct drm_gem_object *obj;
+
+                if (exynos_fb->exynos_gem_obj[i] == NULL)
+                        continue;
+
+                obj = &exynos_fb->exynos_gem_obj[i]->base;
+                drm_gem_object_unreference_unlocked(obj);
+        }
+
         kfree(exynos_fb);
         exynos_fb = NULL;
 }
@@ -134,11 +145,11 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                 return ERR_PTR(-ENOENT);
         }
 
-        drm_gem_object_unreference_unlocked(obj);
-
         fb = exynos_drm_framebuffer_init(dev, mode_cmd, obj);
-        if (IS_ERR(fb))
+        if (IS_ERR(fb)) {
+                drm_gem_object_unreference_unlocked(obj);
                 return fb;
+        }
 
         exynos_fb = to_exynos_fb(fb);
         nr = exynos_drm_format_num_buffers(fb->pixel_format);
@@ -152,8 +163,6 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                         return ERR_PTR(-ENOENT);
                 }
 
-                drm_gem_object_unreference_unlocked(obj);
-
                 exynos_fb->exynos_gem_obj[i] = to_exynos_gem_obj(obj);
         }