--- /dev/null
+From ea4d5a270b57fa8d4871f372ca9b97b7697fdfda Mon Sep 17 00:00:00 2001
+From: Dominik Behr <dbehr@chromium.org>
+Date: Thu, 7 Sep 2017 16:02:46 -0300
+Subject: dma-buf/sw_sync: force signal all unsignaled fences on dying timeline
+
+From: Dominik Behr <dbehr@chromium.org>
+
+commit ea4d5a270b57fa8d4871f372ca9b97b7697fdfda upstream.
+
+To avoid hanging userspace components that might have been waiting on the
+active fences of the destroyed timeline we need to signal with error all
+remaining fences on such timeline.
+
+This restore the default behaviour of the Android sw_sync framework, which
+Android still relies on. It was broken on the dma fence conversion a few
+years ago and never fixed.
+
+v2: Do not bother with cleanup do the list (Chris Wilson)
+
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Dominik Behr <dbehr@chromium.org>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20170907190246.16425-2-gustavo@padovan.org
+Cc: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma-buf/sw_sync.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -321,8 +321,16 @@ static int sw_sync_debugfs_open(struct i
+ static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
+ {
+ struct sync_timeline *obj = file->private_data;
++ struct sync_pt *pt, *next;
+
+- smp_wmb();
++ spin_lock_irq(&obj->lock);
++
++ list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
++ dma_fence_set_error(&pt->base, -ENOENT);
++ dma_fence_signal_locked(&pt->base);
++ }
++
++ spin_unlock_irq(&obj->lock);
+
+ sync_timeline_put(obj);
+ return 0;