Updated to 5.7.11

5 files changed, 110 insertions, 40 deletions

diff --git a/0003-iwlwifi-Make-some-Killer-Wireless-AC-1550-cards-work.patch b/0003-iwlwifi-Make-some-Killer-Wireless-AC-1550-cards-work.patch
deleted file mode 100644
index 598403c..0000000
--- a/0003-iwlwifi-Make-some-Killer-Wireless-AC-1550-cards-work.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 2fadccbdd143a95db9ba06110261142c9bb2acbd Mon Sep 17 00:00:00 2001
-From: Alessio Bonfiglio <alessio.bonfiglio@mail.polimi.it>
-Date: Thu, 2 Jul 2020 17:05:52 +0200
-Subject: iwlwifi: Make some Killer Wireless-AC 1550 cards working again
-
-Fix the regression introduced by commit c8685937d07f ("iwlwifi: move pu devices to new table") by add the ids and the configurations of two missing Killer 1550 cards in order to make these cards being configured and working correctly again (following the new table convention).
-Resolve bug 208141 ("Wireless ac 9560 not working kernel 5.7.2", https://bugzilla.kernel.org/show_bug.cgi?id=208141).
-
-Fixes: c8685937d07f ("iwlwifi: move pu devices to new table")
-Signed-off-by: Alessio Bonfiglio <alessio.bonfiglio@mail.polimi.it>
----
- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-index 29971c25dba4..9ea3e5634672 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-@@ -577,6 +577,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {
- 	IWL_DEV_INFO(0x30DC, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name),
- 	IWL_DEV_INFO(0x31DC, 0x1551, iwl9560_2ac_cfg_soc, iwl9560_killer_1550s_name),
- 	IWL_DEV_INFO(0x31DC, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name),
-+	IWL_DEV_INFO(0xA370, 0x1551, iwl9560_2ac_cfg_soc, iwl9560_killer_1550s_name),
-+	IWL_DEV_INFO(0xA370, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name),
- 
- 	IWL_DEV_INFO(0x271C, 0x0214, iwl9260_2ac_cfg, iwl9260_1_name),
- 
--- 
-cgit v1.2.3-1-gf6bb5
-
diff --git a/0004-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch b/0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
index 4fd4ec0..4fd4ec0 100644
--- a/0004-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
+++ b/0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
diff --git a/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch b/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
new file mode 100644
index 0000000..8608e91
--- /dev/null
+++ b/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
@@ -0,0 +1,97 @@
+From 6ab7cba72fbdc4eb3c3547eb278924e06dd68fe4 Mon Sep 17 00:00:00 2001
+From: Mazin Rezk <mnrzk@protonmail.com>
+Date: Mon, 27 Jul 2020 05:40:46 +0000
+Subject: drm/amd/display: Clear dm_state for fast updates
+
+This patch fixes a race condition that causes a use-after-free during
+amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits
+are requested and the second one finishes before the first. Essentially,
+this bug occurs when the following sequence of events happens:
+
+1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is
+deferred to the workqueue.
+
+2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is
+deferred to the workqueue.
+
+3. Commit #2 starts before commit #1, dm_state #1 is used in the
+commit_tail and commit #2 completes, freeing dm_state #1.
+
+4. Commit #1 starts after commit #2 completes, uses the freed dm_state
+1 and dereferences a freelist pointer while setting the context.
+
+Since this bug has only been spotted with fast commits, this patch fixes
+the bug by clearing the dm_state instead of using the old dc_state for
+fast updates. In addition, since dm_state is only used for its dc_state
+and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found,
+removing the dm_state should not have any consequences in fast updates.
+
+This use-after-free bug has existed for a while now, but only caused a
+noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub: relocate
+freelist pointer to middle of object") moving the freelist pointer from
+dm_state->base (which was unused) to dm_state->context (which is
+dereferenced).
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383
+Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state for fast updates")
+Reported-by: Duncan <1i5t5.duncan@cox.net>
+Signed-off-by: Mazin Rezk <mnrzk@protonmail.com>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 36 +++++++++++++++++------
+ 1 file changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 837a286469ec..d50751ae73f1 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8489,20 +8489,38 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
+ 		 * the same resource. If we have a new DC context as part of
+ 		 * the DM atomic state from validation we need to free it and
+ 		 * retain the existing one instead.
++		 *
++		 * Furthermore, since the DM atomic state only contains the DC
++		 * context and can safely be annulled, we can free the state
++		 * and clear the associated private object now to free
++		 * some memory and avoid a possible use-after-free later.
+ 		 */
+-		struct dm_atomic_state *new_dm_state, *old_dm_state;
+ 
+-		new_dm_state = dm_atomic_get_new_state(state);
+-		old_dm_state = dm_atomic_get_old_state(state);
++		for (i = 0; i < state->num_private_objs; i++) {
++			struct drm_private_obj *obj = state->private_objs[i].ptr;
+ 
+-		if (new_dm_state && old_dm_state) {
+-			if (new_dm_state->context)
+-				dc_release_state(new_dm_state->context);
++			if (obj->funcs == adev->dm.atomic_obj.funcs) {
++				int j = state->num_private_objs-1;
+ 
+-			new_dm_state->context = old_dm_state->context;
++				dm_atomic_destroy_state(obj,
++						state->private_objs[i].state);
++
++				/* If i is not at the end of the array then the
++				 * last element needs to be moved to where i was
++				 * before the array can safely be truncated.
++				 */
++				if (i != j)
++					state->private_objs[i] =
++						state->private_objs[j];
+ 
+-			if (old_dm_state->context)
+-				dc_retain_state(old_dm_state->context);
++				state->private_objs[j].ptr = NULL;
++				state->private_objs[j].state = NULL;
++				state->private_objs[j].old_state = NULL;
++				state->private_objs[j].new_state = NULL;
++
++				state->num_private_objs = j;
++				break;
++			}
+ 		}
+ 	}
+ 
+-- 
+cgit v1.2.3-1-gf6bb5
+
diff --git a/PKGBUILD b/PKGBUILD
index 79100b5..efd533c 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -21,7 +21,7 @@ _custom=1
 pkgbase=linux-ck
 _supver=5
 _majver=7
-_minver=10
+_minver=11
 _gccpatchver='20200615'
 _gccpatchger='10.1'
 _gccpatchker='5.7'
@@ -47,8 +47,8 @@ source=(
   https://www.kernel.org/pub/linux/kernel/v${_supver}.x/${_srcname}.tar.{xz,sign}
   0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
   0002-PCI-EDR-Log-only-ACPI_NOTIFY_DISCONNECT_RECOVER-even.patch
-  0003-iwlwifi-Make-some-Killer-Wireless-AC-1550-cards-work.patch
-  0004-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
+  0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
+  0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
   linux-ck-patch-${_supver}.${_majver}-${_ckpatchversion}.xz::http://ck.kolivas.org/patches/${_supver}.0/${_supver}.${_majver}/${_supver}.${_majver}-${_ckpatchversion}/patch-${_supver}.${_majver}-${_ckpatchversion}.xz
   kernel_gcc_patch-${_gccpatchver}.tar.gz::https://github.com/graysky2/kernel_gcc_patch/archive/${_gccpatchver}.tar.gz
   ath9k-regdom-hack.patch
@@ -63,17 +63,17 @@ validpgpkeys=(
   '647F28654894E3BD457199BE38DBBDC86092693E'  # Greg Kroah-Hartman
 )
 # https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
-b2sums=('5b76a6b99ea0b1e38278db62951147edd2f0dcbc7c28d6fbf955beaa25344c62ee5b4d8c1c80e9e980a44d77b31dfc152b7e1d0fe0e57f5968f25b0d8a6d2dca'
+b2sums=('0454beb9661783ab7880d387699bd33aba43f4de90ce5b5cf64c9acf59853848e4e4f3dc1e5d37597f73cbf3ad6b9ce38b21aac29afe7a558f4ece149948b75a'
         'SKIP'
         'ab1fb19c67d4c107f75767581c33d9c1458b4d9fdb88f4adb41d30a36f5a2f95f1c48ef079eb87e1e6e8ce2f98b293195cb2c0f2a8ec975aa817453289158c6e'
         '490c7d188215f1d24b5807a744853fa308c2cd17c9eb8668918a50a0c58cab9cbc9ee13ac9abbb614eb010a4a56e9092fea4440d44c80c8e67f2d9abdf19a83f'
-        'a0f3b060d344746d7cd02b9b8b0f6e13a4367d41aa92ef7db4b6d01d2a0389b63da3e19484ac809952ef6ee13479a54ad205017c9ead72c4ee6738ae04cb7c4b'
         '00900ec68ad9ebdf5b9103cb8383ee94b97d2b243cb4458f04f877a1b294817e8a140ce2832d424030d039c48f37eaa5bc5fae7a158da495d78e659b8b3006dc'
+        '66966ff5c49638074f1bf2981b4becb9a86961cdfda4834d8a690c43091e12e55b93cb7f7f29670d969fafa140c2f668bdda79dbc20f4aaac5dd93ff95f472af'
         '29b2530e91a7c0f75c47d75361a94ec92fec398cef1b3e213e97c8f9e0ed210711c4c63ae7717f59273105a83e30397cbd5b7252cb94c06d9b328a24c70ad444'
         'c8d0697f99fe6105815217b8ec059d8f587415ea8dd2b88a65e1087feedf697341a64cd56810fde9e7aeada79125fc8235faccc7e7b06492c099e27a8abbe99c'
         '2e58bb89b247b1678355368956e67c1de51fcde97a227b2162f6771e30f17fa5520faafe7be4b6816a542e7ae10d05f64c6b6354f352c12746d4b8da632936dd'
         'fde132f3705d908e6f2147c78a2193289916d72304ca5efa2229d79fc3e57a857314ce94e71425caef2f7f7b6cf87f05ef86335dc8bd4be78e7035afe608005a'
-        'd154b0ad1ff59660db0f1f7cfd654a47afe69034c40382d6968a4d838a96ae3cbe2d1e1368ab6d48a13f5ba1a913aaa6a45b74d52f42362112f7af35fddd9980'
+        '4c6da586168ebc0892146146221919c49091c6298cdc653b9ce9547924f08427d592aa4c95ba75760aecb77c8157e18fd95a8b83a1cc6f9e1c80e6832aaa5fe7'
         'b4e1377d97ad7e8144d6e55b6d43731e3271a5aec65b65ca6d81026a95f15f549b9303fb3c6f492099ca691e3f65f4cf7f0c3aa742df03b396d7f6d81813aa95'
         '84c9438120100bb5b21122a29344b9e818514d94a31b6d57519a6e25385cb7f91a7f87c930da55c828c7a4330959a94b8a3a3d56773c46b335e1380cd00180b1'
         '5dfb38f2096f27cf436afa6ac41d432f4e23295deb26d12146b31c57db85a8be59819f08f9c5197183c26c557b32e967edded22206c1abb9b89b83e61450ec5c')
@@ -96,8 +96,8 @@ prepare() {
   echo "Applying hotfixes"
   patch -p1 -i ../0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
   patch -p1 -i ../0002-PCI-EDR-Log-only-ACPI_NOTIFY_DISCONNECT_RECOVER-even.patch
-  patch -p1 -i ../0003-iwlwifi-Make-some-Killer-Wireless-AC-1550-cards-work.patch
-  patch -p1 -i ../0004-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
+  patch -p1 -i ../0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
+  patch -p1 -i ../0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
   patch -p1 -i ../sphinx-workaround.patch
 
 
diff --git a/config b/config
index ea7d937..f6ac9f8 100644
--- a/config
+++ b/config
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.7.6 Kernel Configuration
+# Linux/x86 5.7.11 Kernel Configuration
 #
 
 #
@@ -1642,7 +1642,10 @@ CONFIG_VLAN_8021Q_MVRP=y
 # CONFIG_DECNET is not set
 CONFIG_LLC=m
 CONFIG_LLC2=m
-# CONFIG_ATALK is not set
+CONFIG_ATALK=m
+CONFIG_DEV_APPLETALK=m
+CONFIG_IPDDP=m
+CONFIG_IPDDP_ENCAP=y
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
 CONFIG_PHONET=m