1 files changed, 17 insertions, 10 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 51d4c1a0f544..4461336205ed 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2388,16 +2388,6 @@ static void i915_gem_reset_ring_status(struct drm_i915_private *dev_priv,
 static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
                                         struct intel_ring_buffer *ring)
 {
-        while (!list_empty(&ring->request_list)) {
-                struct drm_i915_gem_request *request;
-
-                request = list_first_entry(&ring->request_list,
-                                           struct drm_i915_gem_request,
-                                           list);
-
-                i915_gem_free_request(request);
-        }
-
         while (!list_empty(&ring->active_list)) {
                 struct drm_i915_gem_object *obj;
 
@@ -2407,6 +2397,23 @@ static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
 
                 i915_gem_object_move_to_inactive(obj);
         }
+
+        /*
+         * We must free the requests after all the corresponding objects have
+         * been moved off active lists. Which is the same order as the normal
+         * retire_requests function does. This is important if object hold
+         * implicit references on things like e.g. ppgtt address spaces through
+         * the request.
+         */
+        while (!list_empty(&ring->request_list)) {
+                struct drm_i915_gem_request *request;
+
+                request = list_first_entry(&ring->request_list,
+                                           struct drm_i915_gem_request,
+                                           list);
+
+                i915_gem_free_request(request);
+        }
 }
 
 void i915_gem_restore_fences(struct drm_device *dev)