drm/i915: Unpin stolen pages

The way the stolen handling works is we take a pin on the backing pages,
but we never actually get a reference to the bo. On freeing objects
allocated with stolen memory, the final unref will end up freeing the
object with pinned pages count left. To enable an assertion to catch
bugs in this code path, this patch cleans up that remaining pin.

Signed-off-by: Ben Widawsky <ben@bwidawsk.net>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

1 files changed, 5 insertions, 0 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 84d2aa21435a..28642a9d77cd 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3860,6 +3860,11 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
                 dev_priv->mm.interruptible = was_interruptible;
         }
 
+        /* Stolen objects don't hold a ref, but do hold pin count. Fix that up
+         * before progressing. */
+        if (obj->stolen)
+                i915_gem_object_unpin_pages(obj);
+
         obj->pages_pin_count = 0;
         i915_gem_object_put_pages(obj);
         i915_gem_object_free_mmap_offset(obj);