xen/drm: race condition while freeing GEM objects

[andr2000]

[ 25.157177] [drm:xdrv_shbuf_free_by_dumb_cookie] ERROR Freeing shared buffer dumb_cookie ffff8000294dc900

[ 25.158712] CPU: 2 PID: 1143 Comm: pvr_defer_free Tainted: G O 4.9.0-domu+ xen-troops#76
[ 25.158713] Hardware name: XENVM-4.8 (DT)
[ 25.158715] Call trace:
[ 25.158720] [] dump_backtrace+0x0/0x1a8
[ 25.158723] [] show_stack+0x14/0x20
[ 25.158726] [] dump_stack+0x94/0xb8
[ 25.158827] [] OSReleasePhysPageAddr+0x34/0x1b0 [pvrsrvkm]
[ 25.158910] [] PMRFinalizeWrap+0x28/0x40 [pvrsrvkm]
[ 25.158984] [] _UnrefAndMaybeDestroy+0x44/0x80 [pvrsrvkm]
[ 25.159057] [] PMRUnrefPMR+0xc/0x18 [pvrsrvkm]
[ 25.159128] [] FreeHandleDataWrapper+0xb8/0x1a0 [pvrsrvkm]
[ 25.159197] [] HandleIterFuncWrapper+0x14/0x20 [pvrsrvkm]
[ 25.159201] [] idr_for_each+0xa4/0x108
[ 25.159271] [] IterateOverHandles+0x18/0x28 [pvrsrvkm]
[ 25.159342] [] PVRSRVFreeHandleBase+0x7c/0x110 [pvrsrvkm]
[ 25.159414] [] ConnectionDataDestroy+0x80/0x140 [pvrsrvkm]
[ 25.159485] [] _CleanupThreadPurgeConnectionData+0x28/0x60 [pvrsrvkm]
[ 25.159558] [] CleanupThread+0xb4/0x158 [pvrsrvkm]
[ 25.159625] [] OSThreadRun+0x24/0x68 [pvrsrvkm]
[ 25.159629] [] kthread+0xd0/0xe8
[ 25.159631] [] ret_from_fork+0x10/0x50
[ 25.159699] ----------- put_page N= 469

[ 25.178675] CPU: 3 PID: 1229 Comm: kmscube Tainted: G O 4.9.0-domu+ xen-troops#76
[ 25.178697] Hardware name: XENVM-4.8 (DT)
[ 25.178706] Call trace:
[ 25.178718] [] dump_backtrace+0x0/0x1a8
[ 25.178731] [] show_stack+0x14/0x20
[ 25.178745] [] dump_stack+0x94/0xb8
[ 25.178760] [] xendrm_free_object+0x108/0x1a0
[ 25.178776] [] drm_gem_object_free+0x1c/0x58
[ 25.178790] [] drm_gem_object_unreference_unlocked+0x54/0x130
[ 25.178811] [] drm_gem_dmabuf_release+0x1c/0x30
[ 25.178827] [] dma_buf_release+0x5c/0x170
[ 25.178840] [] __fput+0x90/0x1d0
[ 25.178852] [] ____fput+0xc/0x18
[ 25.178867] [] task_work_run+0xbc/0xd8
[ 25.178881] [] do_exit+0x2d0/0x978
[ 25.178894] [] do_group_exit+0x38/0xa0
[ 25.178907] [] get_signal+0x20c/0x510
[ 25.178920] [] do_signal+0x74/0x550
[ 25.178932] [] do_notify_resume+0x90/0xb0
[ 25.178944] [] work_pending+0x8/0x10