drm/amdgpu: Fix potential fence use-after-free v2

jira VULN-7613
cve CVE-2023-51042
commit-author shanzhulig <shanzhulig@gmail.com>
commit 2e54154

fence Decrements the reference count before exiting.
Avoid Race Vulnerabilities for fence use-after-free.

v2 (chk): actually fix the use after free and not just move it.

	Signed-off-by: shanzhulig <shanzhulig@gmail.com>
	Signed-off-by: Christian König <christian.koenig@amd.com>
	Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
	Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 2e54154)
	Signed-off-by: Pratham Patel <ppatel@ciq.com>

Author: thefossguy-ciq

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

@@ -1502,15 +1502,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,
 			continue;
 
 		r = dma_fence_wait_timeout(fence, true, timeout);
+		if (r > 0 && fence->error)
+			r = fence->error;
+
 		dma_fence_put(fence);
 		if (r < 0)
 			return r;
 
 		if (r == 0)
 			break;
-
-		if (fence->error)
-			return fence->error;
 	}
 
 	memset(wait, 0, sizeof(*wait));