drm/amdgpu: grab a BO reference in vm_lock_done_list.

Otherwise it is possible that between dropping the status lock and
locking the BO that the BO is freed up.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 9309830821b7d9d5cd7747d15e171c061beed72f..453d3b576456c9e1dbba1ed1c63fbdba2560d178 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -484,15 +484,19 @@ int amdgpu_vm_lock_done_list(struct amdgpu_vm *vm, struct drm_exec *exec,
        spin_lock(&vm->status_lock);
        while (!list_is_head(prev->next, &vm->done)) {
                bo_va = list_entry(prev->next, typeof(*bo_va), base.vm_status);
-               spin_unlock(&vm->status_lock);
 
                bo = bo_va->base.bo;
                if (bo) {
+                       amdgpu_bo_ref(bo);
+                       spin_unlock(&vm->status_lock);
+
                        ret = drm_exec_prepare_obj(exec, &bo->tbo.base, 1);
+                       amdgpu_bo_unref(&bo);
                        if (unlikely(ret))
                                return ret;
+
+                       spin_lock(&vm->status_lock);
                }
-               spin_lock(&vm->status_lock);
                prev = prev->next;
        }
        spin_unlock(&vm->status_lock);