drm/ttm: Delayed delete fixes.

1) Remove from lru before reserving so we avoid competing with
evicting processes.
2) Avoid calling kref_put() on bo::list_kref while spinlocked.
3) Additional refcounting bug-checking.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 4cd4007e68fa..7927fe99d017 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -465,6 +465,8 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
                 spin_unlock(&bo->lock);
 
                 spin_lock(&glob->lru_lock);
+                put_count = ttm_bo_del_from_lru(bo);
+
                 ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
                 BUG_ON(ret);
                 if (bo->ttm)
@@ -472,20 +474,19 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
 
                 if (!list_empty(&bo->ddestroy)) {
                         list_del_init(&bo->ddestroy);
-                        kref_put(&bo->list_kref, ttm_bo_ref_bug);
+                        ++put_count;
                 }
                 if (bo->mem.mm_node) {
                         bo->mem.mm_node->private = NULL;
                         drm_mm_put_block(bo->mem.mm_node);
                         bo->mem.mm_node = NULL;
                 }
-                put_count = ttm_bo_del_from_lru(bo);
                 spin_unlock(&glob->lru_lock);
 
                 atomic_set(&bo->reserved, 0);
 
                 while (put_count--)
-                        kref_put(&bo->list_kref, ttm_bo_release_list);
+                        kref_put(&bo->list_kref, ttm_bo_ref_bug);
 
                 return 0;
         }