kref_init(handlecount) initialises the number of handles to 1 upon creation when it should remain 0 until the first allocation. All the drivers were working around this by deleting the extra count when they created the first handle for the object in spite of the documentation saying that it was unecessary.

Signed-off-by: Chris Wilson chris@chris-wilson.co.uk --- drivers/gpu/drm/drm_gem.c | 1 - drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +--- drivers/gpu/drm/radeon/radeon_gem.c | 3 +-- 3 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index bf92d07..295618c 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -148,7 +148,6 @@ int drm_gem_object_init(struct drm_device *dev, return -ENOMEM;

kref_init(&obj->refcount); - kref_init(&obj->handlecount); obj->size = size;

atomic_inc(&dev->object_count); diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c index 581c67c..a50aaaf 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -168,10 +168,8 @@ nouveau_gem_ioctl_new(struct drm_device *dev, void *data,

ret = drm_gem_handle_create(file_priv, nvbo->gem, &req->info.handle); out: - drm_gem_object_handle_unreference_unlocked(nvbo->gem); + drm_gem_object_unreference_unlocked(nvbo->gem);

- if (ret) - drm_gem_object_unreference_unlocked(nvbo->gem); return ret; }

diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c index c578f26..d4f6b8f 100644 --- a/drivers/gpu/drm/radeon/radeon_gem.c +++ b/drivers/gpu/drm/radeon/radeon_gem.c @@ -201,11 +201,10 @@ int radeon_gem_create_ioctl(struct drm_device *dev, void *data, return r; } r = drm_gem_handle_create(filp, gobj, &handle); + drm_gem_object_unreference_unlocked(gobj); if (r) { - drm_gem_object_unreference_unlocked(gobj); return r; } - drm_gem_object_handle_unreference_unlocked(gobj); args->handle = handle; return 0; }