Quoting Jason Ekstrand (2017-08-03 19:06:02)
> I'm not concerned about what happens to racy clients.  They get what they get. 
> What concerns me is what happens if somehow the fence is replaced and deleted
> before i915_gem_request_await_dma_fence takes it's reference.  Can this cause
> the kernel to segfault?

Gotcha, yup nothing prevents that.

        fence = dma_fence_get_rcu_safe(&syncobj->fence);
        if (!fence)
                return -EINVAL;

        err = await_fence();
        dma_fence_put(fence);
        if (err < 0)
                return;

Happy?