i915: take struct_mutex in i915_dma_cleanup()

intel_cleanup_ring_buffer() calls drm_gem_object_unreference() (as opposed to drm_gem_object_unreference_unlocked()) so it needs to be called with "struct_mutex" held. If we don't hold the lock, it triggers a BUG_ON(!mutex_is_locked(&dev->struct_mutex));

I also audited the other places that call intel_cleanup_ring_buffer() and they all hold the lock so they're OK.

This was introduced in: 8187a2b70e3 "drm/i915: introduce intel_ring_buffer structure (V2)" and it's a regression from v2.6.34.

Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=16247

index 59a2bf8..3325af1 100644
@@ -128,9 +128,11 @@ static int i915_dma_cleanup(struct drm_device * dev)
 	if (dev->irq_enabled)
 		drm_irq_uninstall(dev);
 
+	mutex_lock(&dev->struct_mutex);
 	intel_cleanup_ring_buffer(dev, &dev_priv->render_ring);
 	if (HAS_BSD(dev))
 		intel_cleanup_ring_buffer(dev, &dev_priv->bsd_ring);
+	mutex_unlock(&dev->struct_mutex);
 
 	/* Clear the HWS virtual address at teardown */
 	if (I915_NEED_GFX_HWS(dev))

Reminds me, Gordon can you add module unload testing to your set of basic daily tests? To unload you need to unbind the fbcon interface first, my script is like this:

echo 0 > /sys/class/vtconsole/vtcon1/bind
rmmod i915
rmmod drm_kms_helper
rmmod drm
modprobe i915
echo 1 > /sys/class/vtconsole/vtcon1/bind

If unload and re-load doesn't work please file a bug and see if you can bisect it.

Thanks,

Jesse Barnes, Intel Open Source Technology Center

To which we could even add a kmemleak check. After rmmod drm and before reloading i915:
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak > hostname-leaks.txt

If the output is not empty, file a bug. [Of course this means having to compile kmemleak into the kernel. The DEBUG_KMEMLEAK option is found under Kernel Hacking.] And since each generation has slightly different initialization stanzas, we need to repeat the test on all platforms.

Chris Wilson, Intel Open Source Technology Centre

Applied to for-linus. Thanks!