drm/ttm: fix fence locking in ttm_buffer_object_transfer