drm/radeon: fix fence locking in the pageflip callback

We need to hold bdev->fence_lock while grabbing a reference to
the fence, to prevent concurrent clearing/changing of the
ttm_bo->sync_obj field.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index bfa2a60..310c0e5 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -378,8 +378,12 @@ static int radeon_crtc_page_flip(struct drm_crtc *crtc,
        work->old_rbo = rbo;
        obj = new_radeon_fb->obj;
        rbo = gem_to_radeon_bo(obj);
+
+       spin_lock(&rbo->tbo.bdev->fence_lock);
        if (rbo->tbo.sync_obj)
                work->fence = radeon_fence_ref(rbo->tbo.sync_obj);
+       spin_unlock(&rbo->tbo.bdev->fence_lock);
+
        INIT_WORK(&work->work, radeon_unpin_work_func);
 
        /* We borrow the event spin lock for protecting unpin_work */