dp_retrain_link_dp_test walks dc->current_state with no lock and no state reference while concurrent atomic commits release it — use-after-free driven by unauthenticated HPD-RX automated-test input from a malicious DP sink

Summary

The retrain path (reachable from an unauthenticated HPD-RX AUTOMATED_TEST/LINK_TRAINING from a malicious ~$20 DP sink, under only the I2C hpd_lock) walks current_state->pipe_ctx[] unlocked and unreferenced while dc_commit_state releases the same object - with tens of ms of udelay/msleep/training-retry window the race is wide. UAF indirect calls through freed stream_enc->funcs and hwss.disable_stream. Upstream later added the DM dc_lock; this 4.15-era vintage has none. Hardware-gated (no AMD GPU on guest). Retain/release + DM dc_lock fix.