14 files changed, 55 insertions, 9 deletions

diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
index d9ec77959dff..3e6584b940dc 100644
--- a/drivers/gpu/drm/ast/ast_fb.c
+++ b/drivers/gpu/drm/ast/ast_fb.c
@@ -290,6 +290,7 @@ static void ast_fbdev_destroy(struct drm_device *dev,
         drm_fb_helper_fini(&afbdev->helper);
 
         vfree(afbdev->sysram);
+        drm_framebuffer_unregister_private(&afb->base);
         drm_framebuffer_cleanup(&afb->base);
 }
 
diff --git a/drivers/gpu/drm/cirrus/cirrus_fbdev.c b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
index 6c6b4c87d309..3daea0f638c3 100644
--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
@@ -258,6 +258,7 @@ static int cirrus_fbdev_destroy(struct drm_device *dev,
 
         vfree(gfbdev->sysram);
         drm_fb_helper_fini(&gfbdev->helper);
+        drm_framebuffer_unregister_private(&gfb->base);
         drm_framebuffer_cleanup(&gfb->base);
 
         return 0;
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index f2ccda85309f..3eddfabeba96 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -68,6 +68,7 @@ void drm_modeset_unlock_all(struct drm_device *dev)
 
         mutex_unlock(&dev->mode_config.mutex);
 }
+
 EXPORT_SYMBOL(drm_modeset_unlock_all);
 
 /* Avoid boilerplate.  I'm tired of typing. */
@@ -430,11 +431,34 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
 EXPORT_SYMBOL(drm_framebuffer_reference);
 
 /**
+ * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+ * @fb: fb to unregister
+ *
+ * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
+ * those used for fbdev. Note that the caller must hold a reference of it's own,
+ * i.e. the object may not be destroyed through this call (since it'll lead to a
+ * locking inversion).
+ */
+void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
+{
+}
+EXPORT_SYMBOL(drm_framebuffer_unregister_private);
+
+/**
  * drm_framebuffer_cleanup - remove a framebuffer object
  * @fb: framebuffer to remove
  *
- * Scans all the CRTCs in @dev's mode_config.  If they're using @fb, removes
- * it, setting it to NULL.
+ * Cleanup references to a user-created framebuffer. This function is intended
+ * to be used from the drivers ->destroy callback.
+ *
+ * Note that this function does not remove the fb from active usuage - if it is
+ * still used anywhere, hilarity can ensue since userspace could call getfb on
+ * the id and get back -EINVAL. Obviously no concern at driver unload time.
+ *
+ * Also, the framebuffer will not be removed from the lookup idr - for
+ * user-created framebuffers this will happen in in the rmfb ioctl. For
+ * driver-private objects (e.g. for fbdev) drivers need to explicitly call
+ * drm_framebuffer_unregister_private.
  */
 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 {
@@ -460,7 +484,8 @@ EXPORT_SYMBOL(drm_framebuffer_cleanup);
  * @fb: framebuffer to remove
  *
  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
- * using @fb, removes it, setting it to NULL.
+ * using @fb, removes it, setting it to NULL. Then drops the reference to the
+ * passed-in framebuffer.
  */
 void drm_framebuffer_remove(struct drm_framebuffer *fb)
 {
diff --git a/drivers/gpu/drm/drm_fb_cma_helper.c b/drivers/gpu/drm/drm_fb_cma_helper.c
index e1e0cb0d531a..3742bc96421e 100644
--- a/drivers/gpu/drm/drm_fb_cma_helper.c
+++ b/drivers/gpu/drm/drm_fb_cma_helper.c
@@ -266,6 +266,7 @@ static int drm_fbdev_cma_create(struct drm_fb_helper *helper,
         return 0;
 
 err_drm_fb_cma_destroy:
+        drm_framebuffer_unregister_private(fb);
         drm_fb_cma_destroy(fb);
 err_framebuffer_release:
         framebuffer_release(fbi);
@@ -370,8 +371,10 @@ void drm_fbdev_cma_fini(struct drm_fbdev_cma *fbdev_cma)
                 framebuffer_release(info);
         }
 
-        if (fbdev_cma->fb)
+        if (fbdev_cma->fb) {
+                drm_framebuffer_unregister_private(&fbdev_cma->fb->fb);
                 drm_fb_cma_destroy(&fbdev_cma->fb->fb);
+        }
 
         drm_fb_helper_fini(&fbdev_cma->fb_helper);
         kfree(fbdev_cma);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index 71f867340a88..90d335cfb8c0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -326,8 +326,10 @@ static void exynos_drm_fbdev_destroy(struct drm_device *dev,
         /* release drm framebuffer and real buffer */
         if (fb_helper->fb && fb_helper->fb->funcs) {
                 fb = fb_helper->fb;
-                if (fb)
+                if (fb) {
+                        drm_framebuffer_unregister_private(fb);
                         drm_framebuffer_remove(fb);
+                }
         }
 
         /* release linux framebuffer */
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index 49800d2b79dd..c1ef37e2efdf 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -590,6 +590,7 @@ static int psb_fbdev_destroy(struct drm_device *dev, struct psb_fbdev *fbdev)
                 framebuffer_release(info);
         }
         drm_fb_helper_fini(&fbdev->psb_fb_helper);
+        drm_framebuffer_unregister_private(&psbfb->base);
         drm_framebuffer_cleanup(&psbfb->base);
 
         if (psbfb->gtt)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 26fa6a795afe..df51203dcebd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6789,8 +6789,10 @@ void intel_release_load_detect_pipe(struct drm_connector *connector,
                 intel_encoder->new_crtc = NULL;
                 intel_set_mode(crtc, NULL, 0, 0, NULL);
 
-                if (old->release_fb)
-                        old->release_fb->funcs->destroy(old->release_fb);
+                if (old->release_fb) {
+                        drm_framebuffer_unregister_private(old->release_fb);
+                        drm_framebuffer_unreference(old->release_fb);
+                }
 
                 return;
         }
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index a9f7280f87fb..c7b8316137e9 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -212,6 +212,7 @@ static void intel_fbdev_destroy(struct drm_device *dev,
 
         drm_fb_helper_fini(&ifbdev->helper);
 
+        drm_framebuffer_unregister_private(&ifb->base);
         drm_framebuffer_cleanup(&ifb->base);
         if (ifb->obj) {
                 drm_gem_object_unreference_unlocked(&ifb->obj->base);
diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c
index 2f486481d79a..5c69b432f99a 100644
--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
+++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
@@ -247,6 +247,7 @@ static int mga_fbdev_destroy(struct drm_device *dev,
         }
         drm_fb_helper_fini(&mfbdev->helper);
         vfree(mfbdev->sysram);
+        drm_framebuffer_unregister_private(&mfb->base);
         drm_framebuffer_cleanup(&mfb->base);
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 67a1a069de28..d4ecb4deb484 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -433,6 +433,7 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *fbcon)
                 nouveau_fb->nvbo = NULL;
         }
         drm_fb_helper_fini(&fbcon->helper);
+        drm_framebuffer_unregister_private(&nouveau_fb->base);
         drm_framebuffer_cleanup(&nouveau_fb->base);
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index cc8489d8c6d1..515e5ee1f9ee 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -293,6 +293,7 @@ out_unref:
         }
         if (fb && ret) {
                 drm_gem_object_unreference(gobj);
+                drm_framebuffer_unregister_private(fb);
                 drm_framebuffer_cleanup(fb);
                 kfree(fb);
         }
@@ -339,6 +340,7 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
                 rfb->obj = NULL;
         }
         drm_fb_helper_fini(&rfbdev->helper);
+        drm_framebuffer_unregister_private(&rfb->base);
         drm_framebuffer_cleanup(&rfb->base);
 
         return 0;
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index f8904b4e68de..caa84f1de9c1 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -555,6 +555,7 @@ static void udl_fbdev_destroy(struct drm_device *dev,
                 framebuffer_release(info);
         }
         drm_fb_helper_fini(&ufbdev->helper);
+        drm_framebuffer_unregister_private(&ufbdev->ufb.base);
         drm_framebuffer_cleanup(&ufbdev->ufb.base);
         drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base);
 }
diff --git a/drivers/staging/omapdrm/omap_fbdev.c b/drivers/staging/omapdrm/omap_fbdev.c
index 8a027bb77d97..2728e37e02be 100644
--- a/drivers/staging/omapdrm/omap_fbdev.c
+++ b/drivers/staging/omapdrm/omap_fbdev.c
@@ -275,8 +275,10 @@ fail:
         if (ret) {
                 if (fbi)
                         framebuffer_release(fbi);
-                if (fb)
+                if (fb) {
+                        drm_framebuffer_unregister_private(fb);
                         drm_framebuffer_remove(fb);
+                }
         }
 
         return ret;
@@ -400,8 +402,10 @@ void omap_fbdev_free(struct drm_device *dev)
         fbdev = to_omap_fbdev(priv->fbdev);
 
         /* this will free the backing object */
-        if (fbdev->fb)
+        if (fbdev->fb) {
+                drm_framebuffer_unregister_private(fbdev->fb);
                 drm_framebuffer_remove(fbdev->fb);
+        }
 
         kfree(fbdev);
 
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 7dc1b31059d4..66b2732f175a 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -964,6 +964,7 @@ extern void drm_framebuffer_unreference(struct drm_framebuffer *fb);
 extern void drm_framebuffer_reference(struct drm_framebuffer *fb);
 extern void drm_framebuffer_remove(struct drm_framebuffer *fb);
 extern void drm_framebuffer_cleanup(struct drm_framebuffer *fb);
+extern void drm_framebuffer_unregister_private(struct drm_framebuffer *fb);
 extern int drmfb_probe(struct drm_device *dev, struct drm_crtc *crtc);
 extern int drmfb_remove(struct drm_device *dev, struct drm_framebuffer *fb);
 extern void drm_crtc_probe_connector_modes(struct drm_device *dev, int maxX, int maxY);