For drm_gem_object_unreference callers are required to hold
dev->struct_mutex, which these paths don't. Enforcing this requirement
has become a bit more strict with
commit 
ef4c6270bf2867e2f8032e9614d1a8cfc6c71663
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Thu Oct 15 09:36:25 2015 +0200
    drm/gem: Check locking in drm_gem_object_unreference
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
        struct armada_private *priv = crtc->dev->dev_private;
 
        if (dcrtc->cursor_obj)
-               drm_gem_object_unreference(&dcrtc->cursor_obj->obj);
+               drm_gem_object_unreference_unlocked(&dcrtc->cursor_obj->obj);
 
        priv->dcrtc[dcrtc->num] = NULL;
        drm_crtc_cleanup(&dcrtc->crtc);
 
                return -ENOENT;
 
        if (!dobj->obj.filp) {
-               drm_gem_object_unreference(&dobj->obj);
+               drm_gem_object_unreference_unlocked(&dobj->obj);
                return -EINVAL;
        }
 
        addr = vm_mmap(dobj->obj.filp, 0, args->size, PROT_READ | PROT_WRITE,
                       MAP_SHARED, args->offset);
-       drm_gem_object_unreference(&dobj->obj);
+       drm_gem_object_unreference_unlocked(&dobj->obj);
        if (IS_ERR_VALUE(addr))
                return addr;