MGS-327 [#ccc] Unexpected exit like Ctrl-C cause Kernel crash

 Issue in MGS-327 happens when Apps exit unexpectedly such as receiving
 Ctrl-C terminated signal. This is caused by some operations like memory
 free are done twice. If the exit happens when ioctl back from kernel
 space, the event queue will have no chance to be freed but the events
 in
 the queue have been put to GPU. To prevent memory leak, when Apps exit
 GPU driver will clean the resource it occupied. So when flush the
 command buffer, the original event queue will be put to kernel again.
 This will lead the events in the queue will be redo.

 To avoid this problem, after the AddList operation in Kernel, clean the
 iface and copy it to user space. Once the same iface is transfered to
 kernel again, its key information will be null and it will not pass
 Addlist parameter check. So it will not be done twice.

 Date Dec 15, 2014

 Signed-off-by: Shawn Xiao <b49994@freescale.com>

2 files changed, 24 insertions, 2 deletions

diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
index 73dab8117525..7c2d6a395288 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_command.c
@@ -2080,6 +2080,9 @@ gckCOMMAND_Commit(
             Command->kernel->eventObj, &eventRecord->iface, gcvKERNEL_PIXEL, gcvTRUE, gcvFALSE
             ));
 
+        /* Clear the record iface. */
+	gcmkONERROR(gckOS_ZeroMemory(&eventRecord->iface,gcmSIZEOF(gcsHAL_INTERFACE)));
+
         /* Next record in the queue. */
         nextEventRecord = gcmUINT64_TO_PTR(eventRecord->next);
 
@@ -2091,7 +2094,14 @@ gckCOMMAND_Commit(
                 ));
 
             eventRecord = gcvNULL;
-        }
+        }else
+	{
+	    /* Copy the record back to user space */
+	    gcmkONERROR(gckOS_CopyToUserData(Command->os,
+	    			             eventRecord,
+	    			             EventQueue,
+	    			             gcmSIZEOF(gcsQUEUE)));
+	}
 
         EventQueue = nextEventRecord;
     }
diff --git a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
index aa066063e586..7b84245badc6 100644
--- a/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
+++ b/drivers/mxc/gpu-viv/hal/kernel/gc_hal_kernel_event.c
@@ -1701,6 +1701,10 @@ gckEVENT_Commit(
         gcmkONERROR(
             gckEVENT_AddList(Event, &record->iface, gcvKERNEL_PIXEL, gcvTRUE, gcvFALSE));
 
+	/* Clear the record iface */
+	gcmkONERROR(
+	    gckOS_ZeroMemory(&record->iface,gcmSIZEOF(gcsHAL_INTERFACE)));
+
         /* Next record in the queue. */
         next = gcmUINT64_TO_PTR(record->next);
 
@@ -1713,7 +1717,15 @@ gckEVENT_Commit(
                                        gcmSIZEOF(gcsQUEUE),
                                        (gctPOINTER *) record));
             record = gcvNULL;
-        }
+        }else
+	{
+	    /* Copy the record back to User space */
+	    gcmkONERROR(gckOS_CopyToUserData(Event->os,
+	    			    	     record,
+	    			    	     Queue,
+	    			    	     gcmSIZEOF(gcsQUEUE)));
+	    record = gcvNULL;
+	}
 
         Queue = next;
     }