Since we now run process_csb() outside of the engine->active.lock, we
can process a CS-event immediately upon our ELSP write. As we currently
inspect the pending queue *after* the ELSP write, there is an
opportunity for a CS-event to update the pending queue before we can
read it, making ourselves chases an invalid pointer.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111427
Fixes: df403069029d ("drm/i915/execlists: Lift process_csb() out of the irq-off spinlock")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190821142336.21609-1-chris@chris-wilson.co.uk
 
        if (submit) {
                *port = execlists_schedule_in(last, port - execlists->pending);
                memset(port + 1, 0, (last_port - port) * sizeof(*port));
-               execlists_submit_ports(engine);
                execlists->switch_priority_hint =
                        switch_prio(engine, *execlists->pending);
+               execlists_submit_ports(engine);
        } else {
                ring_set_paused(engine, 0);
        }