Updated to 5.7.15.a

2 files changed, 3 insertions, 103 deletions

diff --git a/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch b/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
deleted file mode 100644
index 8608e91..0000000
--- a/0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From 6ab7cba72fbdc4eb3c3547eb278924e06dd68fe4 Mon Sep 17 00:00:00 2001
-From: Mazin Rezk <mnrzk@protonmail.com>
-Date: Mon, 27 Jul 2020 05:40:46 +0000
-Subject: drm/amd/display: Clear dm_state for fast updates
-
-This patch fixes a race condition that causes a use-after-free during
-amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits
-are requested and the second one finishes before the first. Essentially,
-this bug occurs when the following sequence of events happens:
-
-1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is
-deferred to the workqueue.
-
-2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is
-deferred to the workqueue.
-
-3. Commit #2 starts before commit #1, dm_state #1 is used in the
-commit_tail and commit #2 completes, freeing dm_state #1.
-
-4. Commit #1 starts after commit #2 completes, uses the freed dm_state
-1 and dereferences a freelist pointer while setting the context.
-
-Since this bug has only been spotted with fast commits, this patch fixes
-the bug by clearing the dm_state instead of using the old dc_state for
-fast updates. In addition, since dm_state is only used for its dc_state
-and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found,
-removing the dm_state should not have any consequences in fast updates.
-
-This use-after-free bug has existed for a while now, but only caused a
-noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub: relocate
-freelist pointer to middle of object") moving the freelist pointer from
-dm_state->base (which was unused) to dm_state->context (which is
-dereferenced).
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383
-Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state for fast updates")
-Reported-by: Duncan <1i5t5.duncan@cox.net>
-Signed-off-by: Mazin Rezk <mnrzk@protonmail.com>
----
- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 36 +++++++++++++++++------
- 1 file changed, 27 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-index 837a286469ec..d50751ae73f1 100644
---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-@@ -8489,20 +8489,38 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
- 		 * the same resource. If we have a new DC context as part of
- 		 * the DM atomic state from validation we need to free it and
- 		 * retain the existing one instead.
-+		 *
-+		 * Furthermore, since the DM atomic state only contains the DC
-+		 * context and can safely be annulled, we can free the state
-+		 * and clear the associated private object now to free
-+		 * some memory and avoid a possible use-after-free later.
- 		 */
--		struct dm_atomic_state *new_dm_state, *old_dm_state;
- 
--		new_dm_state = dm_atomic_get_new_state(state);
--		old_dm_state = dm_atomic_get_old_state(state);
-+		for (i = 0; i < state->num_private_objs; i++) {
-+			struct drm_private_obj *obj = state->private_objs[i].ptr;
- 
--		if (new_dm_state && old_dm_state) {
--			if (new_dm_state->context)
--				dc_release_state(new_dm_state->context);
-+			if (obj->funcs == adev->dm.atomic_obj.funcs) {
-+				int j = state->num_private_objs-1;
- 
--			new_dm_state->context = old_dm_state->context;
-+				dm_atomic_destroy_state(obj,
-+						state->private_objs[i].state);
-+
-+				/* If i is not at the end of the array then the
-+				 * last element needs to be moved to where i was
-+				 * before the array can safely be truncated.
-+				 */
-+				if (i != j)
-+					state->private_objs[i] =
-+						state->private_objs[j];
- 
--			if (old_dm_state->context)
--				dc_retain_state(old_dm_state->context);
-+				state->private_objs[j].ptr = NULL;
-+				state->private_objs[j].state = NULL;
-+				state->private_objs[j].old_state = NULL;
-+				state->private_objs[j].new_state = NULL;
-+
-+				state->num_private_objs = j;
-+				break;
-+			}
- 		}
- 	}
- 
--- 
-cgit v1.2.3-1-gf6bb5
-
diff --git a/PKGBUILD b/PKGBUILD
index e5bdd4a..21a3fe8 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -19,7 +19,7 @@ _pkgbase=linux-hardened
 pkgbase=linux-libre-hardened
 _supver=5
 _majver=7
-_minver=11
+_minver=15
 _hardenedver=a
 _gccpatchver='20200615'
 _gccpatchger='10.1'
@@ -50,7 +50,6 @@ source=(
   https://github.com/anthraxx/${_pkgbase}/releases/download/${pkgver}/${_pkgbase}-${pkgver}.patch{,.sig}
   0002-PCI-EDR-Log-only-ACPI_NOTIFY_DISCONNECT_RECOVER-even.patch
   0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
-  0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
   kernel_gcc_patch-${_gccpatchver}.tar.gz::https://github.com/graysky2/kernel_gcc_patch/archive/${_gccpatchver}.tar.gz
   ath9k-regdom-hack.patch
   raid6-default-algo.patch
@@ -66,17 +65,16 @@ validpgpkeys=(
 )
 b2sums=('bb65e65c69d1c38943327a0859028c843439590e9f1af66705a0fe01aaf006daf14a5a0adfaef6d1de53511e50b2f6b8ee13caa63dd7cf4065253599fe524998'
         'SKIP'
-        'c97757a2b621898f5b3f2939d4aa32c68ae150e7c501a076f9ad80a6b72b11e5073c4718d6f4d6c050d6104743fd1ca41963df51857dc5aadc4c14f678a5b488'
+        'a1dfffdf8fc0241171b21d6949e9bb3a512cbe0f4a9a245bd8c07fdd92d64dc5878bb9ecbead36640c8243ae64ad13b279aa7c4dc54dca368fb56af78c6e68e6'
         'SKIP'
         '490c7d188215f1d24b5807a744853fa308c2cd17c9eb8668918a50a0c58cab9cbc9ee13ac9abbb614eb010a4a56e9092fea4440d44c80c8e67f2d9abdf19a83f'
         '00900ec68ad9ebdf5b9103cb8383ee94b97d2b243cb4458f04f877a1b294817e8a140ce2832d424030d039c48f37eaa5bc5fae7a158da495d78e659b8b3006dc'
-        '66966ff5c49638074f1bf2981b4becb9a86961cdfda4834d8a690c43091e12e55b93cb7f7f29670d969fafa140c2f668bdda79dbc20f4aaac5dd93ff95f472af'
         'c8d0697f99fe6105815217b8ec059d8f587415ea8dd2b88a65e1087feedf697341a64cd56810fde9e7aeada79125fc8235faccc7e7b06492c099e27a8abbe99c'
         '2e58bb89b247b1678355368956e67c1de51fcde97a227b2162f6771e30f17fa5520faafe7be4b6816a542e7ae10d05f64c6b6354f352c12746d4b8da632936dd'
         'fde132f3705d908e6f2147c78a2193289916d72304ca5efa2229d79fc3e57a857314ce94e71425caef2f7f7b6cf87f05ef86335dc8bd4be78e7035afe608005a'
         '3def34e611207d118a0488747397fe25d9cfcfed303ca10f21ebe1d6149755d478779a264a906550ce1a4c40dc7aeace895b03f4ea0ecd51cd1aa8f0de167d94'
         'b4e1377d97ad7e8144d6e55b6d43731e3271a5aec65b65ca6d81026a95f15f549b9303fb3c6f492099ca691e3f65f4cf7f0c3aa742df03b396d7f6d81813aa95'
-        '2813bc6fb8ef0853bbdbd050e3084eca0b44f5c863e8ab9821af5c160bfaf1a5dc74c82245ca7a8e2dfa7fb89aa3a76d62c96b8da8449cac5504bc814e0be851'
+        '82df648fddb5d90fade01ea6aa6d8b1143f30aa56ef5bd492f7c3d75a291c1e61168b7c66de33e08d03532f627ddb567ad46a0d9ed0c6420054c1970dc2f70d8'
         'SKIP')
 
 export KBUILD_BUILD_HOST=$pkgbase
@@ -97,7 +95,6 @@ prepare() {
   echo "Applying hotfixes"
   patch -p1 -i ../0002-PCI-EDR-Log-only-ACPI_NOTIFY_DISCONNECT_RECOVER-even.patch
   patch -p1 -i ../0003-virt-vbox-Add-support-for-the-new-VBG_IOCTL_ACQUIRE_.patch
-  patch -p1 -i ../0004-drm-amd-display-Clear-dm_state-for-fast-updates.patch
   patch -p1 -i ../sphinx-workaround.patch