6 files changed, 46 insertions, 12 deletions
diff --git a/shared-core/mga_dma.c b/shared-core/mga_dma.c
index 96fd97ff..71b9f3a3 100644
--- a/shared-core/mga_dma.c
+++ b/shared-core/mga_dma.c
@@ -639,6 +639,14 @@ int mga_do_cleanup_dma( drm_device_t *dev )
 {
 	DRM_DEBUG( "\n" );
 
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_mga_private_t *dev_priv = dev->dev_private;
 
@@ -666,6 +674,8 @@ int mga_dma_init( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_mga_init_t init;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared-core/mga_irq.c b/shared-core/mga_irq.c
index 28e9a262..a2a4db53 100644
--- a/shared-core/mga_irq.c
+++ b/shared-core/mga_irq.c
@@ -93,8 +93,9 @@ void mga_driver_irq_postinstall( drm_device_t *dev ) {
 void mga_driver_irq_uninstall( drm_device_t *dev ) {
   	drm_mga_private_t *dev_priv = 
 	   (drm_mga_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		MGA_WRITE( MGA_IEN, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	MGA_WRITE( MGA_IEN, 0 );
 }
diff --git a/shared-core/r128_cce.c b/shared-core/r128_cce.c
index ad03f4f9..608b7da6 100644
--- a/shared-core/r128_cce.c
+++ b/shared-core/r128_cce.c
@@ -613,6 +613,15 @@ static int r128_do_init_cce( drm_device_t *dev, drm_r128_init_t *init )
 
 int r128_do_cleanup_cce( drm_device_t *dev )
 {
+
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_r128_private_t *dev_priv = dev->dev_private;
 
@@ -649,6 +658,8 @@ int r128_cce_init( DRM_IOCTL_ARGS )
 
 	DRM_DEBUG( "\n" );
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_r128_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared-core/r128_irq.c b/shared-core/r128_irq.c
index bfc30405..f3f84d8c 100644
--- a/shared-core/r128_irq.c
+++ b/shared-core/r128_irq.c
@@ -93,8 +93,9 @@ void r128_driver_irq_postinstall( drm_device_t *dev ) {
 void r128_driver_irq_uninstall( drm_device_t *dev ) {
   	drm_r128_private_t *dev_priv = 
 	   (drm_r128_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		R128_WRITE( R128_GEN_INT_CNTL, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	R128_WRITE( R128_GEN_INT_CNTL, 0 );
 }
diff --git a/shared-core/radeon_cp.c b/shared-core/radeon_cp.c
index fce148a0..281b0cf0 100644
--- a/shared-core/radeon_cp.c
+++ b/shared-core/radeon_cp.c
@@ -1266,6 +1266,14 @@ int radeon_do_cleanup_cp( drm_device_t *dev )
 {
 	DRM_DEBUG( "\n" );
 
+#if _HAVE_DMA_IRQ
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if ( dev->irq ) DRM(irq_uninstall)(dev);
+#endif
+
 	if ( dev->dev_private ) {
 		drm_radeon_private_t *dev_priv = dev->dev_private;
 
@@ -1298,6 +1306,8 @@ int radeon_cp_init( DRM_IOCTL_ARGS )
 	DRM_DEVICE;
 	drm_radeon_init_t init;
 
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t *)data, sizeof(init) );
 
 	switch ( init.func ) {
diff --git a/shared-core/radeon_irq.c b/shared-core/radeon_irq.c
index 9199fbbf..c6bd90e5 100644
--- a/shared-core/radeon_irq.c
+++ b/shared-core/radeon_irq.c
@@ -249,8 +249,9 @@ void DRM(driver_irq_postinstall)( drm_device_t *dev ) {
 void DRM(driver_irq_uninstall)( drm_device_t *dev ) {
 	drm_radeon_private_t *dev_priv =
 		(drm_radeon_private_t *)dev->dev_private;
-	if ( dev_priv ) {
-		/* Disable *all* interrupts */
-		RADEON_WRITE( RADEON_GEN_INT_CNTL, 0 );
-	}
+	if (!dev_priv)
+		return;
+
+	/* Disable *all* interrupts */
+	RADEON_WRITE( RADEON_GEN_INT_CNTL, 0 );
 }