[Intel-gfx] [PATCH] drm/i915: hold ref on flip object until it completes

[Jesse Barnes]

This will prevent things from falling over if the user frees the flip
buffer before we complete the flip, since we'll hold an internal
reference.

Reported-by: Kristian Høgsberg <krh at bitplanet.net>
Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2476fb4..372a2f5 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4039,6 +4039,9 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
 	    atomic_dec_and_test(&obj_priv->pending_flip))
 		DRM_WAKEUP(&dev_priv->pending_flip_queue);
 	schedule_work(&work->work);
+
+	/* Drop the flip ref we took when the ioctl was called */
+	drm_gem_object_unreference(work->pending_flip_obj);
 }
 
 void intel_prepare_page_flip(struct drm_device *dev, int plane)
@@ -4109,8 +4112,9 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
 		return ret;
 	}
 
-	/* Reference the old fb object for the scheduled work. */
+	/* Reference the objects for the scheduled work. */
 	drm_gem_object_reference(work->old_fb_obj);
+	drm_gem_object_reference(obj);
 
 	crtc->fb = fb;
 	i915_gem_object_flush_write_domain(obj);