1 files changed, 10 insertions, 2 deletions

diff --git a/drivers/gpu/drm/gma500/gma_display.c b/drivers/gpu/drm/gma500/gma_display.c
index 24e8af3d22bf..386de2c9dc86 100644
--- a/drivers/gpu/drm/gma500/gma_display.c
+++ b/drivers/gpu/drm/gma500/gma_display.c
@@ -349,6 +349,7 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
         /* If we didn't get a handle then turn the cursor off */
         if (!handle) {
                 temp = CURSOR_MODE_DISABLE;
+                mutex_lock(&dev->struct_mutex);
 
                 if (gma_power_begin(dev, false)) {
                         REG_WRITE(control, temp);
@@ -365,6 +366,7 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
                         gma_crtc->cursor_obj = NULL;
                 }
 
+                mutex_unlock(&dev->struct_mutex);
                 return 0;
         }
 
@@ -374,9 +376,12 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
                 return -EINVAL;
         }
 
+        mutex_lock(&dev->struct_mutex);
         obj = drm_gem_object_lookup(dev, file_priv, handle);
-        if (!obj)
-                return -ENOENT;
+        if (!obj) {
+                ret = -ENOENT;
+                goto unlock;
+        }
 
         if (obj->size < width * height * 4) {
                 dev_dbg(dev->dev, "Buffer is too small\n");
@@ -440,10 +445,13 @@ int gma_crtc_cursor_set(struct drm_crtc *crtc,
         }
 
         gma_crtc->cursor_obj = obj;
+unlock:
+        mutex_unlock(&dev->struct_mutex);
         return ret;
 
 unref_cursor:
         drm_gem_object_unreference(obj);
+        mutex_unlock(&dev->struct_mutex);
         return ret;
 }