[kernel/f15] fix oops on pageflipping sometimes (#680651)

[Dave Airlie]

commit de4207af711d4873db6bf774e3527a8684ad81e6
Author: Dave Airlie <airlied at redhat.com>
Date:   Sun May 29 16:43:12 2011 -0400

    fix oops on pageflipping sometimes (#680651)

 drm-radeon-pageflip-oops-fix.patch |   69 ++++++++++++++++++++++++++++++++++++
 kernel.spec                        |    5 +++
 2 files changed, 74 insertions(+), 0 deletions(-)
---
diff --git a/drm-radeon-pageflip-oops-fix.patch b/drm-radeon-pageflip-oops-fix.patch
new file mode 100644
index 0000000..785b612
--- /dev/null
+++ b/drm-radeon-pageflip-oops-fix.patch
@@ -0,0 +1,69 @@
+From ee11d4db3389aab9df38edb3eed4d5822320d5f1 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied at redhat.com>
+Date: Sun, 29 May 2011 17:48:32 +1000
+Subject: [PATCH] drm/radeon: fix oops in ttm reserve when pageflipping (v2)
+
+We need to take a reference to this object, pinning doesn't take a reference
+so if userspace deletes the object it can disappear even if pinned.
+
+v2: fix error paths to unreference properly also.
+
+should fix:
+https://bugzilla.kernel.org/show_bug.cgi?id=32402
+and
+https://bugzilla.redhat.com/show_bug.cgi?id=680651
+
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+---
+ drivers/gpu/drm/radeon/radeon_display.c |   13 ++++++++-----
+ 1 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index ae247ee..292f73f 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -264,6 +264,8 @@ static void radeon_unpin_work_func(struct work_struct *__work)
+ 		radeon_bo_unreserve(work->old_rbo);
+ 	} else
+ 		DRM_ERROR("failed to reserve buffer after flip\n");
++
++	drm_gem_object_unreference_unlocked(work->old_rbo->gobj);
+ 	kfree(work);
+ }
+ 
+@@ -371,6 +373,8 @@ static int radeon_crtc_page_flip(struct drm_crtc *crtc,
+ 	new_radeon_fb = to_radeon_framebuffer(fb);
+ 	/* schedule unpin of the old buffer */
+ 	obj = old_radeon_fb->obj;
++	/* take a reference to the old object */
++	drm_gem_object_reference(obj);
+ 	rbo = obj->driver_private;
+ 	work->old_rbo = rbo;
+ 	INIT_WORK(&work->work, radeon_unpin_work_func);
+@@ -378,12 +382,9 @@ static int radeon_crtc_page_flip(struct drm_crtc *crtc,
+ 	/* We borrow the event spin lock for protecting unpin_work */
+ 	spin_lock_irqsave(&dev->event_lock, flags);
+ 	if (radeon_crtc->unpin_work) {
+-		spin_unlock_irqrestore(&dev->event_lock, flags);
+-		kfree(work);
+-		radeon_fence_unref(&fence);
+-
+ 		DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
+-		return -EBUSY;
++		r = -EBUSY;
++		goto unlock_free;
+ 	}
+ 	radeon_crtc->unpin_work = work;
+ 	radeon_crtc->deferred_flip_completion = 0;
+@@ -497,6 +498,8 @@ pflip_cleanup1:
+ pflip_cleanup:
+ 	spin_lock_irqsave(&dev->event_lock, flags);
+ 	radeon_crtc->unpin_work = NULL;
++unlock_free:
++	drm_gem_object_unreference_unlocked(old_radeon_fb->obj);
+ 	spin_unlock_irqrestore(&dev->event_lock, flags);
+ 	radeon_fence_unref(&fence);
+ 	kfree(work);
+-- 
+1.7.4.4
+
diff --git a/kernel.spec b/kernel.spec
index 4ef6550..43c2352 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -688,6 +688,7 @@ Patch1829: drm-intel-restore-mode.patch
 Patch1839: drm-radeon-fix-regression-on-atom-cards-with-hardcoded-EDID-record.patch
 Patch1840: drm-radeon-update.patch
 Patch1841: drm-radeon-update2.patch
+Patch1842: drm-radeon-pageflip-oops-fix.patch
 
 Patch1900: linux-2.6-intel-iommu-igfx.patch
 
@@ -1346,6 +1347,7 @@ ApplyPatch drm-intel-restore-mode.patch
 ApplyPatch drm-radeon-fix-regression-on-atom-cards-with-hardcoded-EDID-record.patch -R
 ApplyPatch drm-radeon-update.patch
 ApplyPatch drm-radeon-update2.patch
+ApplyPatch drm-radeon-pageflip-oops-fix.patch
 
 # linux1394 git patches
 #ApplyPatch linux-2.6-firewire-git-update.patch
@@ -2017,6 +2019,9 @@ fi
 # and build.
 
 %changelog
+* Sun May 29 2011 Dave Airlie <airlied at redhat.com>
+- fix oops on pageflipping sometimes (#680651)
+
 * Fri May 27 2011 Ben Skeggs <bskeggs at redhat.com> 2.6.38.7-30
 - nouveau: minor fixes for various issues from upstream
 - nv40 modesetting fix (rhbz#708235)