drm/i915: Fix potential bit_17 double-free

From Rob Clark
0769f997a7b6d5cb8336db0b4ec3d2d311b8097c in linux-6.1.y/6.1.11
7057a8f126f14f14b040faecfa220fd27c6c2f85 in mainline linux

diff --git a/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c b/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c
index 023f34e..b25cd2b 100644 (file)
--- a/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c
+++ b/sys/dev/pci/drm/i915/gem/i915_gem_tiling.c
@@ -305,10 +305,6 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
        spin_unlock(&obj->vma.lock);
 
        obj->tiling_and_stride = tiling | stride;
-       i915_gem_object_unlock(obj);
-
-       /* Force the fence to be reacquired for GTT access */
-       i915_gem_object_release_mmap_gtt(obj);
 
        /* Try to preallocate memory required to save swizzling on put-pages */
        if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -321,6 +317,11 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
                obj->bit_17 = NULL;
        }
 
+       i915_gem_object_unlock(obj);
+
+       /* Force the fence to be reacquired for GTT access */
+       i915_gem_object_release_mmap_gtt(obj);
+
        return 0;
 }