drm/i915: Move fd_install after last use of fence

Because eb_composite_fence_create() drops the fence_array reference
after creation of the sync_file, only the sync_file holds a ref to the
fence.  But fd_install() makes that reference visable to userspace, so
it must be the last thing we do with the fence.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Fixes: 00dae4d3d35d ("drm/i915: Implement SINGLE_TIMELINE with a syncobj (v4)")
Cc: <stable@vger.kernel.org> # v5.15+
[tursulin: Added stable tag.]
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230203164937.4035503-1-robdclark@gmail.com

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 94d86ee..9dce295 100644 (file)
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -3486,6 +3486,13 @@ err_request:
                                   eb.composite_fence :
                                   &eb.requests[0]->fence);
 
+       if (unlikely(eb.gem_context->syncobj)) {
+               drm_syncobj_replace_fence(eb.gem_context->syncobj,
+                                         eb.composite_fence ?
+                                         eb.composite_fence :
+                                         &eb.requests[0]->fence);
+       }
+
        if (out_fence) {
                if (err == 0) {
                        fd_install(out_fence_fd, out_fence->file);
@@ -3497,13 +3504,6 @@ err_request:
                }
        }
 
-       if (unlikely(eb.gem_context->syncobj)) {
-               drm_syncobj_replace_fence(eb.gem_context->syncobj,
-                                         eb.composite_fence ?
-                                         eb.composite_fence :
-                                         &eb.requests[0]->fence);
-       }
-
        if (!out_fence && eb.composite_fence)
                dma_fence_put(eb.composite_fence);