4 files changed, 32 insertions, 22 deletions

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index dcbd2f559e39..b8a8132becef 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -154,7 +154,7 @@ void drm_gem_private_object_init(struct drm_device *dev,
         obj->filp = NULL;
 
         kref_init(&obj->refcount);
-        atomic_set(&obj->handle_count, 0);
+        obj->handle_count = 0;
         obj->size = size;
 }
 EXPORT_SYMBOL(drm_gem_private_object_init);
@@ -218,11 +218,9 @@ static void drm_gem_object_handle_free(struct drm_gem_object *obj)
         struct drm_device *dev = obj->dev;
 
         /* Remove any name for this object */
-        spin_lock(&dev->object_name_lock);
         if (obj->name) {
                 idr_remove(&dev->object_name_idr, obj->name);
                 obj->name = 0;
-                spin_unlock(&dev->object_name_lock);
                 /*
                  * The object name held a reference to this object, drop
                  * that now.
@@ -230,15 +228,13 @@ static void drm_gem_object_handle_free(struct drm_gem_object *obj)
                 * This cannot be the last reference, since the handle holds one too.
                  */
                 kref_put(&obj->refcount, drm_gem_object_ref_bug);
-        } else
-                spin_unlock(&dev->object_name_lock);
-
+        }
 }
 
 void
 drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj)
 {
-        if (WARN_ON(atomic_read(&obj->handle_count) == 0))
+        if (WARN_ON(obj->handle_count == 0))
                 return;
 
         /*
@@ -247,8 +243,11 @@ drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj)
         * checked for a name
         */
 
-        if (atomic_dec_and_test(&obj->handle_count))
+        spin_lock(&obj->dev->object_name_lock);
+        if (--obj->handle_count == 0)
                 drm_gem_object_handle_free(obj);
+        spin_unlock(&obj->dev->object_name_lock);
+
         drm_gem_object_unreference_unlocked(obj);
 }
 
@@ -326,17 +325,21 @@ drm_gem_handle_create(struct drm_file *file_priv,
          * allocation under our spinlock.
          */
         idr_preload(GFP_KERNEL);
+        spin_lock(&dev->object_name_lock);
         spin_lock(&file_priv->table_lock);
 
         ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT);
-
+        drm_gem_object_reference(obj);
+        obj->handle_count++;
         spin_unlock(&file_priv->table_lock);
+        spin_unlock(&dev->object_name_lock);
         idr_preload_end();
-        if (ret < 0)
+        if (ret < 0) {
+                drm_gem_object_handle_unreference_unlocked(obj);
                 return ret;
+        }
         *handlep = ret;
 
-        drm_gem_object_handle_reference(obj);
 
         if (dev->driver->gem_open_object) {
                 ret = dev->driver->gem_open_object(obj, file_priv);
@@ -577,6 +580,12 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
 
         idr_preload(GFP_KERNEL);
         spin_lock(&dev->object_name_lock);
+        /* prevent races with concurrent gem_close. */
+        if (obj->handle_count == 0) {
+                ret = -ENOENT;
+                goto err;
+        }
+
         if (!obj->name) {
                 ret = idr_alloc(&dev->object_name_idr, obj, 1, 0, GFP_NOWAIT);
                 if (ret < 0)
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 9f8fc4c328c9..5351e811c421 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -207,7 +207,7 @@ static int drm_gem_one_name_info(int id, void *ptr, void *data)
 
         seq_printf(m, "%6d %8zd %7d %8d\n",
                    obj->name, obj->size,
-                   atomic_read(&obj->handle_count),
+                   obj->handle_count,
                    atomic_read(&obj->refcount.refcount));
         return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index b904633863e8..f3c6f40666e1 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -136,7 +136,7 @@ void exynos_drm_gem_destroy(struct exynos_drm_gem_obj *exynos_gem_obj)
         obj = &exynos_gem_obj->base;
         buf = exynos_gem_obj->buffer;
 
-        DRM_DEBUG_KMS("handle count = %d\n", atomic_read(&obj->handle_count));
+        DRM_DEBUG_KMS("handle count = %d\n", obj->handle_count);
 
         /*
          * do not release memory region from exporter.
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 1a7a78fdb4b7..57dce6081d73 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -615,8 +615,16 @@ struct drm_gem_object {
         /** Reference count of this object */
         struct kref refcount;
 
-        /** Handle count of this object. Each handle also holds a reference */
-        atomic_t handle_count; /* number of handles on this object */
+        /**
+         * handle_count - gem file_priv handle count of this object
+         *
+         * Each handle also holds a reference. Note that when the handle_count
+         * drops to 0 any global names (e.g. the id in the flink namespace) will
+         * be cleared.
+         *
+         * Protected by dev->object_name_lock.
+         * */
+        unsigned handle_count;
 
         /** Related drm device */
         struct drm_device *dev;
@@ -1572,13 +1580,6 @@ int drm_gem_handle_create(struct drm_file *file_priv,
                           u32 *handlep);
 int drm_gem_handle_delete(struct drm_file *filp, u32 handle);
 
-static inline void
-drm_gem_object_handle_reference(struct drm_gem_object *obj)
-{
-        drm_gem_object_reference(obj);
-        atomic_inc(&obj->handle_count);
-}
-
 void drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj);
 
 void drm_gem_free_mmap_offset(struct drm_gem_object *obj);