--- /dev/null
+From 30cd85dd6edc86ea8d8589efb813f1fad41ef233 Mon Sep 17 00:00:00 2001
+From: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Date: Wed, 19 Oct 2016 15:48:32 -0200
+Subject: dma-buf/sync_file: hold reference to fence when creating sync_file
+
+From: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+
+commit 30cd85dd6edc86ea8d8589efb813f1fad41ef233 upstream.
+
+fence referencing was out of balance. It was not taking any ref to the
+fence at creating time, but it was putting a reference when freeing the
+sync file.
+
+This patch fixes the balancing issue by getting a reference for the fence
+when creating the sync_file.
+
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: http://patchwork.freedesktop.org/patch/msgid/1476899313-22241-1-git-send-email-gustavo@padovan.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma-buf/sync_file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma-buf/sync_file.c
++++ b/drivers/dma-buf/sync_file.c
+@@ -79,7 +79,7 @@ struct sync_file *sync_file_create(struc
+ if (!sync_file)
+ return NULL;
+
+- sync_file->fence = fence;
++ sync_file->fence = fence_get(fence);
+
+ snprintf(sync_file->name, sizeof(sync_file->name), "%s-%s%llu-%d",
+ fence->ops->get_driver_name(fence),
--- /dev/null
+From 24a367348a017555f982a9ee137070a7a821fa97 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 9 Dec 2016 19:53:06 +0100
+Subject: dma-buf: Update kerneldoc for sync_file_create
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 24a367348a017555f982a9ee137070a7a821fa97 upstream.
+
+This was missed when adding a dma_fence_get call. While at it also
+remove the kerneldoc for the static inline helper - no point
+documenting internals down to every detail.
+
+Fixes: 30cd85dd6edc ("dma-buf/sync_file: hold reference to fence when creating sync_file")
+Cc: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Cc: Sean Paul <seanpaul@chromium.org>
+Cc: linux-doc@vger.kernel.org
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Reviewed-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161209185309.1682-3-daniel.vetter@ffwll.ch
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma-buf/sync_file.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/dma-buf/sync_file.c
++++ b/drivers/dma-buf/sync_file.c
+@@ -67,9 +67,10 @@ static void fence_check_cb_func(struct f
+ * sync_file_create() - creates a sync file
+ * @fence: fence to add to the sync_fence
+ *
+- * Creates a sync_file containg @fence. Once this is called, the sync_file
+- * takes ownership of @fence. The sync_file can be released with
+- * fput(sync_file->file). Returns the sync_file or NULL in case of error.
++ * Creates a sync_file containg @fence. This function acquires and additional
++ * reference of @fence for the newly-created &sync_file, if it succeeds. The
++ * sync_file can be released with fput(sync_file->file). Returns the
++ * sync_file or NULL in case of error.
+ */
+ struct sync_file *sync_file_create(struct fence *fence)
+ {
+@@ -90,13 +91,6 @@ struct sync_file *sync_file_create(struc
+ }
+ EXPORT_SYMBOL(sync_file_create);
+
+-/**
+- * sync_file_fdget() - get a sync_file from an fd
+- * @fd: fd referencing a fence
+- *
+- * Ensures @fd references a valid sync_file, increments the refcount of the
+- * backing file. Returns the sync_file or NULL in case of error.
+- */
+ static struct sync_file *sync_file_fdget(int fd)
+ {
+ struct file *file = fget(fd);