drm: Add locking around cursor gem operations.

We need to hold the struct_mutex around pinning and the phys object
operations.

Signed-off-by: Kristian Høgsberg <krh@redhat.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index ac92799fa8a1..94c7c098c4ff 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1043,18 +1043,19 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
         }
 
         /* we only need to pin inside GTT if cursor is non-phy */
+        mutex_lock(&dev->struct_mutex);
         if (!dev_priv->cursor_needs_physical) {
                 ret = i915_gem_object_pin(bo, PAGE_SIZE);
                 if (ret) {
                         DRM_ERROR("failed to pin cursor bo\n");
-                        goto fail;
+                        goto fail_locked;
                 }
                 addr = obj_priv->gtt_offset;
         } else {
                 ret = i915_gem_attach_phys_object(dev, bo, (pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1);
                 if (ret) {
                         DRM_ERROR("failed to attach phys object\n");
-                        goto fail;
+                        goto fail_locked;
                 }
                 addr = obj_priv->phys_obj->handle->busaddr;
         }
@@ -1074,10 +1075,9 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                                 i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
                 } else
                         i915_gem_object_unpin(intel_crtc->cursor_bo);
-                mutex_lock(&dev->struct_mutex);
                 drm_gem_object_unreference(intel_crtc->cursor_bo);
-                mutex_unlock(&dev->struct_mutex);
         }
+        mutex_unlock(&dev->struct_mutex);
 
         intel_crtc->cursor_addr = addr;
         intel_crtc->cursor_bo = bo;
@@ -1085,6 +1085,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
         return 0;
 fail:
         mutex_lock(&dev->struct_mutex);
+fail_locked:
         drm_gem_object_unreference(bo);
         mutex_unlock(&dev->struct_mutex);
         return ret;