drm/ttm: delay freeing of old node during move_memcpy until after iounmap

Drivers using their own implementation of io_mem_reserve/io_mem_free are
likely to store the tracking information for the map in mem.mm_node, so
it can't be freed while still mapped.

Signed-off-by: Ben Skeggs<bskeggs@redhat.com>
Reviewed-by: NThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

drivers/gpu/drm/ttm/ttm_bo_util.c

@@ -370,7 +370,6 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
 	}
 	mb();
 out2:
-	ttm_bo_free_old_node(bo);
 	old_copy = *old_mem;
 	*old_mem = *new_mem;
 	new_mem->mm_node = NULL;
@@ -385,6 +384,7 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
 	ttm_mem_reg_iounmap(bdev, old_mem, new_iomap);
 out:
 	ttm_mem_reg_iounmap(bdev, &old_copy, old_iomap);
+	ttm_bo_mem_put(bo, &old_copy);
 	return ret;
 }
 EXPORT_SYMBOL(ttm_bo_move_memcpy);