[COMMON] g2d: cancel callback of acquire fence

If the user request has error parameter, the acquire
fence was put but the callback of fence is remained.
The new request on the same task structure registers
the callback to another fence, the list was corrupted.

It makes panic or hard lockup on system, so fix it.

Change-Id: I19ccbc06668c0d418fee675bf53188c6c37db3f9
Signed-off-by: hyesoo.yu <hyesoo.yu@samsung.com>

diff --git a/drivers/gpu/exynos/g2d/g2d_uapi_process.c b/drivers/gpu/exynos/g2d/g2d_uapi_process.c
index 3e4f677ab2291659dc666a75e688016ba4964dc4..0e8ed16d5141bffe3bb4ebe87455ff8ea07a5949 100644 (file)
--- a/drivers/gpu/exynos/g2d/g2d_uapi_process.c
+++ b/drivers/gpu/exynos/g2d/g2d_uapi_process.c
@@ -524,6 +524,8 @@ static void g2d_put_image(struct g2d_device *g2d_dev, struct g2d_layer *layer,
        g2d_put_buffer(g2d_dev, layer->buffer_type,
                        layer->buffer, layer->num_buffers, dir);
 
+       if (layer->fence)
+               dma_fence_remove_callback(layer->fence, &layer->fence_cb);
        dma_fence_put(layer->fence);
 
        layer->buffer_type = G2D_BUFTYPE_NONE;
@@ -591,7 +593,9 @@ err_prepare:
        g2d_put_buffer(g2d_dev, layer->buffer_type, layer->buffer,
                       layer->num_buffers, DMA_TO_DEVICE);
 err_buffer:
-       dma_fence_put(layer->fence); /* fence_put() checkes NULL */
+       if (layer->fence)
+               dma_fence_remove_callback(layer->fence, &layer->fence_cb);
+       dma_fence_put(layer->fence); /* dma_fence_put() checkes NULL */
 
        return ret;
 }
@@ -737,7 +741,9 @@ err_prepare:
        g2d_put_buffer(g2d_dev, target->buffer_type, target->buffer,
                                target->num_buffers, DMA_FROM_DEVICE);
 err_buffer:
-       dma_fence_put(target->fence); /* fence_put() checkes NULL */
+       if (target->fence)
+               dma_fence_remove_callback(target->fence, &target->fence_cb);
+       dma_fence_put(target->fence); /* dma_fence_put() checkes NULL */
 
        return ret;
 }