In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: Atomize IRQ register read\/modify\/write ops<\/p>\n
[Why]<\/p>\n
The OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for
\nthe output timing generator (OTG). VUPDATE_NO_LOCK is one of them.<\/p>\n
To enable the IRQ, driver sets the VUPDATE_NO_LOCK_EN bit in the
\nGLOBAL_SYNC_STATUS register.<\/p>\n
To ack the IRQ after it fires, the driver sets the VUPDATE_NO_LOCK_CLEAR
\nbit in the same GLOBAL_SYNC_STATUS register.<\/p>\n
The bit sets are done through read\/modify\/write operations, which are
\nnot atomic. Thus, the following race is possible:<\/p>\n
Thread A: IRQ handler:
\n *HW IRQ fires*
\n # IRQ disable
\n val = read(GLOBAL_SYNC_STATUS)
\n unset(val, VUPDATE_NO_LOCK_EN)
\n write(val, GLOBAL_SYNC_STATUS)
\n # ACK reads VUPDATE_NO_LOCK_EN unset
\n val1 = read(GLOBAL_SYNC_STATUS)
\n set(val1, VUPDATE_NO_LOCK_CLEAR)
\n # IRQ enable
\n val = read(GLOBAL_SYNC_STATUS)
\n set(val, VUPDATE_NO_LOCK_EN)
\n write(val, GLOBAL_SYNC_STATUS)
\n # BAD! clears VUPDATE_NO_LOCK_EN
\n write(val1, GLOBAL_SYNC_STATUS)<\/p>\n
Regarding the tagged Fixes: change, it appears the change made this race
\nmore likely to occur. Since VUPDATE_NO_LOCK is now the sole IRQ source
\nfor vblank handling, a single race on high refresh panels can lead to a
\ntime out.<\/p>\n
[How]<\/p>\n
The GLOBAL_SYNC_STATUS register is only one example, other IRQ control
\nregisters also share the same scheme. On top of GLOBAL_SYNC_STATUS,
\nlet’s clean up those as well.<\/p>\n
To keep things simple, Let’s atomize the IRQ rmw ops via a single
\ndriver-wide spinlock. Due to the small scope of this lock, it is
\nunlikely to cause noticeable overhead on top of all the existing locking
\nwithin the IRQ set\/handle paths.<\/p>\n
Since DM is responsible for locking, wrap dc_interrupt_set\/ack with the
\nspinlock in the new amdgpu_dm_irq_set\/ack functions. Migrate\/drop all
\nreferences in DM to dc_interrupt_set\/ack to use amdgpu_dm_irq_set\/ack
\ninstead.<\/p>\n
(cherry picked from commit 70de0a0216583a53c946155f8c8adedfdca6b4e7)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: Atomize IRQ register read\/modify\/write ops<\/p>\n
[Why]<\/p>\n
The OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sou<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41126","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}