drm/i915: hold ref on flip object until it completes

This will prevent things from falling over if the user frees the flip
buffer before we complete the flip, since we'll hold an internal
reference.

Reported-by: Kristian Høgsberg <[e-mail]>
Signed-off-by: Jesse Barnes <[e-mail]>
Signed-off-by: Eric Anholt <[e-mail]>

drivers/gpu/drm/i915/intel_display.c

···
 
 	mutex_lock(&work->dev->struct_mutex);
 	i915_gem_object_unpin(work->old_fb_obj);
+	drm_gem_object_unreference(work->pending_flip_obj);
 	drm_gem_object_unreference(work->old_fb_obj);
 	mutex_unlock(&work->dev->struct_mutex);
 	kfree(work);
···
 		return ret;
 	}
 
-	/* Reference the old fb object for the scheduled work. */
+	/* Reference the objects for the scheduled work. */
 	drm_gem_object_reference(work->old_fb_obj);
+	drm_gem_object_reference(obj);
 
 	crtc->fb = fb;
 	i915_gem_object_flush_write_domain(obj);