From 6b87b5e4528738ea02b7eb5acee3e102ebc42439 Mon Sep 17 00:00:00 2001 From: Aqua-sama Date: Thu, 6 Aug 2020 08:40:00 +0300 Subject: Updated to 5.7.13 --- ...d-display-Clear-dm_state-for-fast-updates.patch | 97 ---------------------- PKGBUILD | 16 ++-- 2 files changed, 6 insertions(+), 107 deletions(-) delete mode 100644 0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch diff --git a/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch b/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch deleted file mode 100644 index 8608e91..0000000 --- a/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 6ab7cba72fbdc4eb3c3547eb278924e06dd68fe4 Mon Sep 17 00:00:00 2001 -From: Mazin Rezk -Date: Mon, 27 Jul 2020 05:40:46 +0000 -Subject: drm/amd/display: Clear dm_state for fast updates - -This patch fixes a race condition that causes a use-after-free during -amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits -are requested and the second one finishes before the first. Essentially, -this bug occurs when the following sequence of events happens: - -1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is -deferred to the workqueue. - -2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is -deferred to the workqueue. - -3. Commit #2 starts before commit #1, dm_state #1 is used in the -commit_tail and commit #2 completes, freeing dm_state #1. - -4. Commit #1 starts after commit #2 completes, uses the freed dm_state -1 and dereferences a freelist pointer while setting the context. - -Since this bug has only been spotted with fast commits, this patch fixes -the bug by clearing the dm_state instead of using the old dc_state for -fast updates. In addition, since dm_state is only used for its dc_state -and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found, -removing the dm_state should not have any consequences in fast updates. - -This use-after-free bug has existed for a while now, but only caused a -noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub: relocate -freelist pointer to middle of object") moving the freelist pointer from -dm_state->base (which was unused) to dm_state->context (which is -dereferenced). - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383 -Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state for fast updates") -Reported-by: Duncan <1i5t5.duncan@cox.net> -Signed-off-by: Mazin Rezk ---- - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 36 +++++++++++++++++------ - 1 file changed, 27 insertions(+), 9 deletions(-) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 837a286469ec..d50751ae73f1 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -8489,20 +8489,38 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, - * the same resource. If we have a new DC context as part of - * the DM atomic state from validation we need to free it and - * retain the existing one instead. -+ * -+ * Furthermore, since the DM atomic state only contains the DC -+ * context and can safely be annulled, we can free the state -+ * and clear the associated private object now to free -+ * some memory and avoid a possible use-after-free later. - */ -- struct dm_atomic_state *new_dm_state, *old_dm_state; - -- new_dm_state = dm_atomic_get_new_state(state); -- old_dm_state = dm_atomic_get_old_state(state); -+ for (i = 0; i < state->num_private_objs; i++) { -+ struct drm_private_obj *obj = state->private_objs[i].ptr; - -- if (new_dm_state && old_dm_state) { -- if (new_dm_state->context) -- dc_release_state(new_dm_state->context); -+ if (obj->funcs == adev->dm.atomic_obj.funcs) { -+ int j = state->num_private_objs-1; - -- new_dm_state->context = old_dm_state->context; -+ dm_atomic_destroy_state(obj, -+ state->private_objs[i].state); -+ -+ /* If i is not at the end of the array then the -+ * last element needs to be moved to where i was -+ * before the array can safely be truncated. -+ */ -+ if (i != j) -+ state->private_objs[i] = -+ state->private_objs[j]; - -- if (old_dm_state->context) -- dc_retain_state(old_dm_state->context); -+ state->private_objs[j].ptr = NULL; -+ state->private_objs[j].state = NULL; -+ state->private_objs[j].old_state = NULL; -+ state->private_objs[j].new_state = NULL; -+ -+ state->num_private_objs = j; -+ break; -+ } - } - } - --- -cgit v1.2.3-1-gf6bb5 - diff --git a/PKGBUILD b/PKGBUILD index 870bc92..dc9e6f8 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -21,7 +21,7 @@ _custom=1 pkgbase=linux-ck _supver=5 _majver=7 -_minver=12 +_minver=13 _gccpatchver='20200615' _gccpatchger='10.1' _gccpatchker='5.7' @@ -48,7 +48,6 @@ source=( 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch 0002-PCI-EDR-Log-only-ACPI_NOTIFY_DISCONNECT_RECOVER-even.patch 0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch - 0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch linux-ck-patch-${_supver}.${_majver}-${_ckpatchversion}.xz::http://ck.kolivas.org/patches/${_supver}.0/${_supver}.${_majver}/${_supver}.${_majver}-${_ckpatchversion}/patch-${_supver}.${_majver}-${_ckpatchversion}.xz kernel_gcc_patch-${_gccpatchver}.tar.gz::https://github.com/graysky2/kernel_gcc_patch/archive/${_gccpatchver}.tar.gz ath9k-regdom-hack.patch @@ -63,12 +62,11 @@ validpgpkeys=( '647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman ) # https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc -b2sums=('fb8f51e370f420a6f18329945addb05df3c264d06bcd7f03b6a9582ab2a13f843cd3ce99f6ce39546f882775ef473f335185ea54f38aab03e8956ae946f1e28f' +b2sums=('8999dcaa23bf6c07e456b8fcb4b8d07a621737e72eb4f69db02b07bde0a3e73131019751d1c257434ef7380c583a914f5b81d802b82103800f6b44bde0ba4439' 'SKIP' 'ab1fb19c67d4c107f75767581c33d9c1458b4d9fdb88f4adb41d30a36f5a2f95f1c48ef079eb87e1e6e8ce2f98b293195cb2c0f2a8ec975aa817453289158c6e' '490c7d188215f1d24b5807a744853fa308c2cd17c9eb8668918a50a0c58cab9cbc9ee13ac9abbb614eb010a4a56e9092fea4440d44c80c8e67f2d9abdf19a83f' '00900ec68ad9ebdf5b9103cb8383ee94b97d2b243cb4458f04f877a1b294817e8a140ce2832d424030d039c48f37eaa5bc5fae7a158da495d78e659b8b3006dc' - '66966ff5c49638074f1bf2981b4becb9a86961cdfda4834d8a690c43091e12e55b93cb7f7f29670d969fafa140c2f668bdda79dbc20f4aaac5dd93ff95f472af' '29b2530e91a7c0f75c47d75361a94ec92fec398cef1b3e213e97c8f9e0ed210711c4c63ae7717f59273105a83e30397cbd5b7252cb94c06d9b328a24c70ad444' 'c8d0697f99fe6105815217b8ec059d8f587415ea8dd2b88a65e1087feedf697341a64cd56810fde9e7aeada79125fc8235faccc7e7b06492c099e27a8abbe99c' '2e58bb89b247b1678355368956e67c1de51fcde97a227b2162f6771e30f17fa5520faafe7be4b6816a542e7ae10d05f64c6b6354f352c12746d4b8da632936dd' @@ -93,13 +91,11 @@ prepare() { # Hotfixes - echo "Applying hotfixes" - patch -p1 -i ../0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch - patch -p1 -i ../0002-PCI-EDR-Log-only-ACPI_NOTIFY_DISCONNECT_RECOVER-even.patch - patch -p1 -i ../0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch - patch -p1 -i ../0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch - patch -p1 -i ../sphinx-workaround.patch + msg2 "Applying hotfixes" + for p in ../00*.patch; do echo "Applying $p"; patch -p1 -i $p; done + msg2 "Applying sphinx-workaround.patch" + patch -p1 -i ../sphinx-workaround.patch # fix naming schema in EXTRAVERSION of ck patch set sed -i -re "s/^(.EXTRAVERSION).*$/\1 = /" "../linux-ck-patch-${_supver}.${_majver}-${_ckpatchversion}" -- cgit v1.2.1