1 files changed, 19 insertions, 16 deletions

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6b6b07ff720b..f6d04c7b5115 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -43,9 +43,10 @@
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv);
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv);
 
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)                          \
@@ -2908,13 +2909,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
          */
         if (req->flags & DRM_MODE_CURSOR_BO) {
                 if (req->handle) {
-                        fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+                        fb = internal_framebuffer_create(dev, &fbreq, file_priv);
                         if (IS_ERR(fb)) {
                                 DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
                                 return PTR_ERR(fb);
                         }
-
-                        drm_framebuffer_reference(fb);
                 } else {
                         fb = NULL;
                 }
@@ -3267,9 +3266,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
         return 0;
 }
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv)
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv)
 {
         struct drm_mode_config *config = &dev->mode_config;
         struct drm_framebuffer *fb;
@@ -3301,12 +3301,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
                 return fb;
         }
 
-        mutex_lock(&file_priv->fbs_lock);
-        r->fb_id = fb->base.id;
-        list_add(&fb->filp_head, &file_priv->fbs);
-        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-        mutex_unlock(&file_priv->fbs_lock);
-
         return fb;
 }
 
@@ -3328,15 +3322,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
 int drm_mode_addfb2(struct drm_device *dev,
                     void *data, struct drm_file *file_priv)
 {
+        struct drm_mode_fb_cmd2 *r = data;
         struct drm_framebuffer *fb;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        fb = add_framebuffer_internal(dev, data, file_priv);
+        fb = internal_framebuffer_create(dev, r, file_priv);
         if (IS_ERR(fb))
                 return PTR_ERR(fb);
 
+        /* Transfer ownership to the filp for reaping on close */
+
+        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_lock(&file_priv->fbs_lock);
+        r->fb_id = fb->base.id;
+        list_add(&fb->filp_head, &file_priv->fbs);
+        mutex_unlock(&file_priv->fbs_lock);
+
         return 0;
 }