drm/radeon: fix fence locking in the pageflip callback

We need to hold bdev->fence_lock while grabbing a reference to
the fence, to prevent concurrent clearing/changing of the
ttm_bo->sync_obj field.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index bfa2a6015727..310c0e5254ba 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -378,8 +378,12 @@ static int radeon_crtc_page_flip(struct drm_crtc *crtc,
         work->old_rbo = rbo;
         obj = new_radeon_fb->obj;
         rbo = gem_to_radeon_bo(obj);
+
+        spin_lock(&rbo->tbo.bdev->fence_lock);
         if (rbo->tbo.sync_obj)
                 work->fence = radeon_fence_ref(rbo->tbo.sync_obj);
+        spin_unlock(&rbo->tbo.bdev->fence_lock);
+
         INIT_WORK(&work->work, radeon_unpin_work_func);
 
         /* We borrow the event spin lock for protecting unpin_work */