drm/nouveau/fence: fix a race where fence->channel can disappear

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

drivers/gpu/drm/nouveau/nouveau_fence.c

@@ -147,15 +147,19 @@ nouveau_fence_wait(struct nouveau_fence *fence, bool lazy, bool intr)
 int
 nouveau_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
 {
-	struct nouveau_channel *prev = fence ? fence->channel : NULL;
 	struct drm_device *dev = chan->dev;
 	struct nouveau_fence_priv *priv = nv_engine(dev, NVOBJ_ENGINE_FENCE);
+	struct nouveau_channel *prev;
 	int ret = 0;
 
-	if (unlikely(prev && prev != chan && !nouveau_fence_done(fence))) {
+	prev = fence ? nouveau_channel_get_unlocked(fence->channel) : NULL;
-		ret = priv->sync(fence, chan);
+	if (prev) {
-		if (unlikely(ret))
+		if (unlikely(prev != chan && !nouveau_fence_done(fence))) {
-			ret = nouveau_fence_wait(fence, true, false);
+			ret = priv->sync(fence, prev, chan);
+			if (unlikely(ret))
+				ret = nouveau_fence_wait(fence, true, false);
+		}
+		nouveau_channel_put_unlocked(&prev);
 	}
 
 	return ret;

drivers/gpu/drm/nouveau/nouveau_fence.h

@@ -34,7 +34,8 @@ struct nouveau_fence_chan {
 struct nouveau_fence_priv {
 	struct nouveau_exec_engine engine;
 	int (*emit)(struct nouveau_fence *);
-	int (*sync)(struct nouveau_fence *, struct nouveau_channel *);
+	int (*sync)(struct nouveau_fence *, struct nouveau_channel *,
+		    struct nouveau_channel *);
 	u32 (*read)(struct nouveau_channel *);
 };
 

drivers/gpu/drm/nouveau/nv04_fence.c

@@ -51,7 +51,8 @@ nv04_fence_emit(struct nouveau_fence *fence)
 }
 
 static int
-nv04_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv04_fence_sync(struct nouveau_fence *fence,
+		struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
 	return -ENODEV;
 }

drivers/gpu/drm/nouveau/nv10_fence.c

@@ -52,17 +52,19 @@ nv10_fence_emit(struct nouveau_fence *fence)
 	return ret;
 }
 
+
 static int
-nv10_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv10_fence_sync(struct nouveau_fence *fence,
+		struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
 	return -ENODEV;
 }
 
 static int
-nv17_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv17_fence_sync(struct nouveau_fence *fence,
+		struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
 	struct nv10_fence_priv *priv = nv_engine(chan->dev, NVOBJ_ENGINE_FENCE);
-	struct nouveau_channel *prev = fence->channel;
 	u32 value;
 	int ret;
 

drivers/gpu/drm/nouveau/nv84_fence.c

@@ -55,16 +55,18 @@ nv84_fence_emit(struct nouveau_fence *fence)
 	return ret;
 }
 
+
 static int
-nv84_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nv84_fence_sync(struct nouveau_fence *fence,
+		struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
 	int ret = RING_SPACE(chan, 7);
 	if (ret == 0) {
 		BEGIN_NV04(chan, 0, NV11_SUBCHAN_DMA_SEMAPHORE, 1);
 		OUT_RING  (chan, NvSema);
 		BEGIN_NV04(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-		OUT_RING  (chan, upper_32_bits(fence->channel->id * 16));
+		OUT_RING  (chan, upper_32_bits(prev->id * 16));
-		OUT_RING  (chan, lower_32_bits(fence->channel->id * 16));
+		OUT_RING  (chan, lower_32_bits(prev->id * 16));
 		OUT_RING  (chan, fence->sequence);
 		OUT_RING  (chan, NV84_SUBCHAN_SEMAPHORE_TRIGGER_ACQUIRE_GEQUAL);
 		FIRE_RING (chan);

drivers/gpu/drm/nouveau/nvc0_fence.c

@@ -60,10 +60,11 @@ nvc0_fence_emit(struct nouveau_fence *fence)
 }
 
 static int
-nvc0_fence_sync(struct nouveau_fence *fence, struct nouveau_channel *chan)
+nvc0_fence_sync(struct nouveau_fence *fence,
+		struct nouveau_channel *prev, struct nouveau_channel *chan)
 {
 	struct nvc0_fence_chan *fctx = chan->engctx[NVOBJ_ENGINE_FENCE];
-	u64 addr = fctx->vma.offset + fence->channel->id * 16;
+	u64 addr = fctx->vma.offset + prev->id * 16;
 	int ret;
 
 	ret = RING_SPACE(chan, 5);