drm/vmwgfx: Cleanup the vmw bo usage in the cursor paths

jira VULN-8161
cve CVE-2023-5633
commit-author Zack Rusin <zackr@vmware.com>
commit cb8097a

Base mapped count is useless because the ttm unmap functions handle
null maps just fine so completely remove all the code related to it.

	Signed-off-by: Zack Rusin <zackr@vmware.com>
	Reviewed-by: Martin Krastev <krastevm@vmware.com>
	Reviewed-by: Maaz Mombasawala <mombasawalam@vmware.com>
	Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230131033542.953249-6-zack@kde.org
(cherry picked from commit cb8097a)
	Signed-off-by: Sultan Alsawaf <sultan@ciq.com>

Author: kerneltoast

drivers/gpu/drm/vmwgfx/vmwgfx_bo.h

@@ -44,7 +44,6 @@ struct vmw_resource;
  * struct vmw_bo - TTM buffer object with vmwgfx additions
  * @base: The TTM buffer object
  * @res_tree: RB tree of resources using this buffer object as a backing MOB
- * @base_mapped_count: ttm BO mapping count; used by KMS atomic helpers.
  * @cpu_writers: Number of synccpu write grabs. Protected by reservation when
  * increased. May be decreased without reservation.
  * @dx_query_ctx: DX context if this buffer object is used as a DX query MOB
@@ -55,8 +54,6 @@ struct vmw_resource;
 struct vmw_bo {
 	struct ttm_buffer_object base;
 	struct rb_root res_tree;
-	/* For KMS atomic helpers: ttm bo mapping count */
-	atomic_t base_mapped_count;
 
 	atomic_t cpu_writers;
 	/* Not ref-counted.  Protected by binding_mutex */

drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

@@ -669,8 +669,7 @@ vmw_du_cursor_plane_cleanup_fb(struct drm_plane *plane,
 		const int ret = ttm_bo_reserve(&vps->bo->base, true, false, NULL);
 
 		if (likely(ret == 0)) {
-			if (atomic_read(&vps->bo->base_mapped_count) == 0)
-			    ttm_bo_kunmap(&vps->bo->map);
+			ttm_bo_kunmap(&vps->bo->map);
 			ttm_bo_unreserve(&vps->bo->base);
 		}
 	}
@@ -744,9 +743,6 @@ vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
 
 		ret = ttm_bo_kmap(&vps->bo->base, 0, PFN_UP(size), &vps->bo->map);
 
-		if (likely(ret == 0))
-			atomic_inc(&vps->bo->base_mapped_count);
-
 		ttm_bo_unreserve(&vps->bo->base);
 
 		if (unlikely(ret != 0))
@@ -786,7 +782,6 @@ vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
 	struct vmw_plane_state *vps = vmw_plane_state_to_vps(new_state);
 	struct vmw_plane_state *old_vps = vmw_plane_state_to_vps(old_state);
 	s32 hotspot_x, hotspot_y;
-	bool dummy;
 
 	hotspot_x = du->hotspot_x;
 	hotspot_y = du->hotspot_y;
@@ -828,11 +823,6 @@ vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
 						hotspot_x, hotspot_y);
 	}
 
-	if (vps->bo) {
-		if (ttm_kmap_obj_virtual(&vps->bo->map, &dummy))
-			atomic_dec(&vps->bo->base_mapped_count);
-	}
-
 	du->cursor_x = new_state->crtc_x + du->set_gui_x;
 	du->cursor_y = new_state->crtc_y + du->set_gui_y;