drm: amd: drop "next" commit that isn't an issue until v5.7-rc1
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
diff --git a/queue-next/drm-amd-display-Clear-dm_state-for-fast-updates.patch b/queue-next/drm-amd-display-Clear-dm_state-for-fast-updates.patch
deleted file mode 100644
index 7d2f836..0000000
--- a/queue-next/drm-amd-display-Clear-dm_state-for-fast-updates.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 7619517598ad5ba04beb855cde6558e72c73dbb5 Mon Sep 17 00:00:00 2001
-From: Mazin Rezk <mnrzk@protonmail.com>
-Date: Mon, 27 Jul 2020 05:40:46 +0000
-Subject: [PATCH] drm/amd/display: Clear dm_state for fast updates
-
-commit 7619517598ad5ba04beb855cde6558e72c73dbb5 upstream.
-
-This patch fixes a race condition that causes a use-after-free during
-amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits
-are requested and the second one finishes before the first. Essentially,
-this bug occurs when the following sequence of events happens:
-
-1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is
-deferred to the workqueue.
-
-2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is
-deferred to the workqueue.
-
-3. Commit #2 starts before commit #1, dm_state #1 is used in the
-commit_tail and commit #2 completes, freeing dm_state #1.
-
-4. Commit #1 starts after commit #2 completes, uses the freed dm_state
-1 and dereferences a freelist pointer while setting the context.
-
-Since this bug has only been spotted with fast commits, this patch fixes
-the bug by clearing the dm_state instead of using the old dc_state for
-fast updates. In addition, since dm_state is only used for its dc_state
-and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found,
-removing the dm_state should not have any consequences in fast updates.
-
-This use-after-free bug has existed for a while now, but only caused a
-noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub: relocate
-freelist pointer to middle of object") moving the freelist pointer from
-dm_state->base (which was unused) to dm_state->context (which is
-dereferenced).
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383
-Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state for fast updates")
-Reported-by: Duncan <1i5t5.duncan@cox.net>
-Signed-off-by: Mazin Rezk <mnrzk@protonmail.com>
-Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-
-diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-index 09da24e8806f..4b3286287913 100644
---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-@@ -8901,20 +8901,38 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
- * the same resource. If we have a new DC context as part of
- * the DM atomic state from validation we need to free it and
- * retain the existing one instead.
-+ *
-+ * Furthermore, since the DM atomic state only contains the DC
-+ * context and can safely be annulled, we can free the state
-+ * and clear the associated private object now to free
-+ * some memory and avoid a possible use-after-free later.
- */
-- struct dm_atomic_state *new_dm_state, *old_dm_state;
-
-- new_dm_state = dm_atomic_get_new_state(state);
-- old_dm_state = dm_atomic_get_old_state(state);
-+ for (i = 0; i < state->num_private_objs; i++) {
-+ struct drm_private_obj *obj = state->private_objs[i].ptr;
-
-- if (new_dm_state && old_dm_state) {
-- if (new_dm_state->context)
-- dc_release_state(new_dm_state->context);
-+ if (obj->funcs == adev->dm.atomic_obj.funcs) {
-+ int j = state->num_private_objs-1;
-
-- new_dm_state->context = old_dm_state->context;
-+ dm_atomic_destroy_state(obj,
-+ state->private_objs[i].state);
-+
-+ /* If i is not at the end of the array then the
-+ * last element needs to be moved to where i was
-+ * before the array can safely be truncated.
-+ */
-+ if (i != j)
-+ state->private_objs[i] =
-+ state->private_objs[j];
-
-- if (old_dm_state->context)
-- dc_retain_state(old_dm_state->context);
-+ state->private_objs[j].ptr = NULL;
-+ state->private_objs[j].state = NULL;
-+ state->private_objs[j].old_state = NULL;
-+ state->private_objs[j].new_state = NULL;
-+
-+ state->num_private_objs = j;
-+ break;
-+ }
- }
- }
-
---
-2.27.0
-
