In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops [Why] The

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Atomize IRQ register read/modify/write ops

[Why]

The OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for
the output timing generator (OTG). VUPDATE_NO_LOCK is one of them.

To enable the IRQ, driver sets the VUPDATE_NO_LOCK_EN bit in the
GLOBAL_SYNC_STATUS register.

To ack the IRQ after it fires, the driver sets the VUPDATE_NO_LOCK_CLEAR
bit in the same GLOBAL_SYNC_STATUS register.

The bit sets are done through read/modify/write operations, which are
not atomic. Thus, the following race is possible:

 1Thread A:                       IRQ handler:
 2                                *HW IRQ fires*
 3# IRQ disable
 4val = read(GLOBAL_SYNC_STATUS)
 5unset(val, VUPDATE_NO_LOCK_EN)
 6write(val, GLOBAL_SYNC_STATUS)
 7                                # ACK reads VUPDATE_NO_LOCK_EN unset
 8                                val1 = read(GLOBAL_SYNC_STATUS)
 9                                set(val1, VUPDATE_NO_LOCK_CLEAR)
10# IRQ enable
11val = read(GLOBAL_SYNC_STATUS)
12set(val, VUPDATE_NO_LOCK_EN)
13write(val, GLOBAL_SYNC_STATUS)
14                                # BAD! clears VUPDATE_NO_LOCK_EN
15                                write(val1, GLOBAL_SYNC_STATUS)

Regarding the tagged Fixes: change, it appears the change made this race
more likely to occur. Since VUPDATE_NO_LOCK is now the sole IRQ source
for vblank handling, a single race on high refresh panels can lead to a
time out.

[How]

The GLOBAL_SYNC_STATUS register is only one example, other IRQ control
registers also share the same scheme. On top of GLOBAL_SYNC_STATUS,
let's clean up those as well.

To keep things simple, Let's atomize the IRQ rmw ops via a single
driver-wide spinlock. Due to the small scope of this lock, it is
unlikely to cause noticeable overhead on top of all the existing locking
within the IRQ set/handle paths.

Since DM is responsible for locking, wrap dc_interrupt_set/ack with the
spinlock in the new amdgpu_dm_irq_set/ack functions. Migrate/drop all
references in DM to dc_interrupt_set/ack to use amdgpu_dm_irq_set/ack
instead.

(cherry picked from commit 70de0a0216583a53c946155f8c8adedfdca6b4e7)