gpu: arm: midgard: Fix the removal method of the fence

Fix the fence removal method because of the fence list is removed
twice. This change is also updated from mali midgard r15p0 by ARM.

The GL application calls the flip ioctl and then calls the
eglFrontBufferSetSEC function to use the user space front
buffer. At this time, if the user space application is terminated,
in Kernel, the link is removed from the kbase_dma_fence_cancel_all_atoms() function, a following error occurs referring to the wrong link.

   Unable to handle kernel paging request at virtual address dead000000000108
   pgd = ffffffc09e385000
   [dead000000000108] *pgd=0000000000000000, *pud=0000000000000000
   Internal error: Oops: 96000044 [#1] PREEMPT SMP
   ...
   task: ffffffc09952ad00 ti: ffffffc086c70000 task.ti: ffffffc086c70000
   PC is at kbase_dma_fence_cancel_all_atoms+0x64/0xf8
   LR is at kbase_dma_fence_cancel_all_atoms+0xac/0xf8
   ...
   Call trace:
   [<ffffffc0004c9df8>] kbase_dma_fence_cancel_all_atoms+0x64/0xf8
   [<ffffffc0004b170c>] kbase_jd_zap_context+0x74/0xa0
   [<ffffffc0004b6078>] kbase_destroy_context+0x40/0x1e0
   [<ffffffc0004c0468>] kbase_release+0xe4/0x168
   ...

Change-Id: Ief351783808e63e01797fdfa2d7460dec013bff4
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

diff --git a/drivers/gpu/arm/midgard/r12p0_04rel0/mali_kbase_dma_fence.c b/drivers/gpu/arm/midgard/r12p0_04rel0/mali_kbase_dma_fence.c
index 29f3324a9ddd3f910106c9ad89ba63421aae95c6..f361495a5338ff2b13dd665f2ed6a4e3b07ac9a6 100644 (file)
--- a/drivers/gpu/arm/midgard/r12p0_04rel0/mali_kbase_dma_fence.c
+++ b/drivers/gpu/arm/midgard/r12p0_04rel0/mali_kbase_dma_fence.c
@@ -475,10 +475,12 @@ end:
 
 void kbase_dma_fence_cancel_all_atoms(struct kbase_context *kctx)
 {
-       struct kbase_jd_atom *katom, *katom_tmp;
+       struct list_head *list = &kctx->dma_fence.waiting_resource;
 
-       list_for_each_entry_safe(katom, katom_tmp,
-                                &kctx->dma_fence.waiting_resource, queue) {
+       while (!list_empty(list)) {
+               struct kbase_jd_atom *katom;
+
+               katom = list_first_entry(list, struct kbase_jd_atom, queue);
                kbase_dma_fence_waiters_remove(katom);
                kbase_dma_fence_cancel_atom(katom);
        }