[PATCH 3/4] Revert "UBUNTU: SAUCE: drm/i915: Synchronize active and retire callbacks"

[Sultan Alsawaf]

BugLink: https://bugs.launchpad.net/bugs/1877394

This reverts commit 26178734ddf4c4517108ce6ef1e7620cc43aa336.

Get rid of this so it can be replaced by an upstream fix.

Signed-off-by: Sultan Alsawaf <sultan.alsawaf at canonical.com>
---
 drivers/gpu/drm/i915/i915_active.c       | 48 ++++--------------------
 drivers/gpu/drm/i915/i915_active.h       | 10 +++--
 drivers/gpu/drm/i915/i915_active_types.h |  3 --
 3 files changed, 13 insertions(+), 48 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
index d0df1e0881c2..51dc8753b527 100644
--- a/drivers/gpu/drm/i915/i915_active.c
+++ b/drivers/gpu/drm/i915/i915_active.c
@@ -149,22 +149,8 @@ __active_retire(struct i915_active *ref, bool lock)
 	}
 
 	/* After the final retire, the entire struct may be freed */
-	if (ref->retire) {
-		if (ref->active) {
-			bool freed = false;
-
-			/* Don't race with the active callback, and avoid UaF */
-			down_write(&ref->rwsem);
-			ref->freed = &freed;
-			ref->retire(ref);
-			if (!freed) {
-				ref->freed = NULL;
-				up_write(&ref->rwsem);
-			}
-		} else {
-			ref->retire(ref);
-		}
-	}
+	if (ref->retire)
+		ref->retire(ref);
 }
 
 static void
@@ -255,8 +241,7 @@ void __i915_active_init(struct drm_i915_private *i915,
 			struct i915_active *ref,
 			int (*active)(struct i915_active *ref),
 			void (*retire)(struct i915_active *ref),
-			struct lock_class_key *key,
-			struct lock_class_key *rkey)
+			struct lock_class_key *key)
 {
 	debug_active_init(ref);
 
@@ -269,9 +254,6 @@ void __i915_active_init(struct drm_i915_private *i915,
 	init_llist_head(&ref->preallocated_barriers);
 	atomic_set(&ref->count, 0);
 	__mutex_init(&ref->mutex, "i915_active", key);
-	ref->freed = NULL;
-	if (ref->active && ref->retire)
-		__init_rwsem(&ref->rwsem, "i915_active.rwsem", rkey);
 }
 
 static bool ____active_del_barrier(struct i915_active *ref,
@@ -375,20 +357,8 @@ int i915_active_acquire(struct i915_active *ref)
 	if (err)
 		return err;
 
-	if (!atomic_read(&ref->count) && ref->active) {
-		if (ref->retire) {
-			/*
-			 * This can be a recursive call, and the mutex above
-			 * already protects from concurrent active callbacks, so
-			 * a read lock fits best.
-			 */
-			down_read(&ref->rwsem);
-			err = ref->active(ref);
-			up_read(&ref->rwsem);
-		} else {
-			err = ref->active(ref);
-		}
-	}
+	if (!atomic_read(&ref->count) && ref->active)
+		err = ref->active(ref);
 	if (!err) {
 		debug_active_activate(ref);
 		atomic_inc(&ref->count);
@@ -512,19 +482,15 @@ int i915_request_await_active(struct i915_request *rq, struct i915_active *ref)
 	return err;
 }
 
+#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)
 void i915_active_fini(struct i915_active *ref)
 {
-	if (ref->freed) {
-		*ref->freed = true;
-		up_write(&ref->rwsem);
-	}
-#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)
 	debug_active_fini(ref);
 	GEM_BUG_ON(!RB_EMPTY_ROOT(&ref->tree));
 	GEM_BUG_ON(atomic_read(&ref->count));
 	mutex_destroy(&ref->mutex);
-#endif
 }
+#endif
 
 static inline bool is_idle_barrier(struct active_node *node, u64 idx)
 {
diff --git a/drivers/gpu/drm/i915/i915_active.h b/drivers/gpu/drm/i915/i915_active.h
index aaec0a773551..0ad7ef60d15f 100644
--- a/drivers/gpu/drm/i915/i915_active.h
+++ b/drivers/gpu/drm/i915/i915_active.h
@@ -362,13 +362,11 @@ void __i915_active_init(struct drm_i915_private *i915,
 			struct i915_active *ref,
 			int (*active)(struct i915_active *ref),
 			void (*retire)(struct i915_active *ref),
-			struct lock_class_key *key,
-			struct lock_class_key *rkey);
+			struct lock_class_key *key);
 #define i915_active_init(i915, ref, active, retire) do {		\
 	static struct lock_class_key __key;				\
-	static struct lock_class_key __rkey;				\
 									\
-	__i915_active_init(i915, ref, active, retire, &__key, &__rkey);	\
+	__i915_active_init(i915, ref, active, retire, &__key);		\
 } while (0)
 
 int i915_active_ref(struct i915_active *ref,
@@ -395,7 +393,11 @@ i915_active_is_idle(const struct i915_active *ref)
 	return !atomic_read(&ref->count);
 }
 
+#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)
 void i915_active_fini(struct i915_active *ref);
+#else
+static inline void i915_active_fini(struct i915_active *ref) { }
+#endif
 
 int i915_active_acquire_preallocate_barrier(struct i915_active *ref,
 					    struct intel_engine_cs *engine);
diff --git a/drivers/gpu/drm/i915/i915_active_types.h b/drivers/gpu/drm/i915/i915_active_types.h
index 6619342eaa0d..1854e7d168c1 100644
--- a/drivers/gpu/drm/i915/i915_active_types.h
+++ b/drivers/gpu/drm/i915/i915_active_types.h
@@ -12,7 +12,6 @@
 #include <linux/mutex.h>
 #include <linux/rbtree.h>
 #include <linux/rcupdate.h>
-#include <linux/rwsem.h>
 
 struct drm_i915_private;
 struct i915_active_request;
@@ -51,8 +50,6 @@ struct i915_active {
 	struct rb_root tree;
 	struct mutex mutex;
 	atomic_t count;
-	struct rw_semaphore rwsem;
-	bool *freed;
 
 	unsigned long flags;
 #define I915_ACTIVE_GRAB_BIT 0
-- 
2.20.1