drm/tidss: Fix race condition while handling interrupt registers

[ Upstream commit a9a73f2661e6f625d306c9b0ef082e4593f45a21 ]

The driver has a spinlock for protecting the irq_masks field and irq
enable registers. However, the driver misses protecting the irq status
registers which can lead to races.

Take the spinlock when accessing irqstatus too.

Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
Cc: stable@vger.kernel.org
Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
[Tomi: updated the desc]
Reviewed-by: Jonathan Cormier <jcormier@criticallink.com>
Tested-by: Jonathan Cormier <jcormier@criticallink.com>
Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241021-tidss-irq-fix-v1-6-82ddaec94e4a@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
index d3e57e6de5dbbf8e810e95b247b031a32a81c49b..38b2ae0d7ec1d529b77066ffc2069845a58f185f 100644 (file)
--- a/drivers/gpu/drm/tidss/tidss_dispc.c
+++ b/drivers/gpu/drm/tidss/tidss_dispc.c
@@ -2661,8 +2661,12 @@ static void dispc_init_errata(struct dispc_device *dispc)
  */
 static void dispc_softreset_k2g(struct dispc_device *dispc)
 {
+       unsigned long flags;
+
+       spin_lock_irqsave(&dispc->tidss->wait_lock, flags);
        dispc_set_irqenable(dispc, 0);
        dispc_read_and_clear_irqstatus(dispc);
+       spin_unlock_irqrestore(&dispc->tidss->wait_lock, flags);
 
        for (unsigned int vp_idx = 0; vp_idx < dispc->feat->num_vps; ++vp_idx)
                VP_REG_FLD_MOD(dispc, vp_idx, DISPC_VP_CONTROL, 0, 0, 0);

diff --git a/drivers/gpu/drm/tidss/tidss_irq.c b/drivers/gpu/drm/tidss/tidss_irq.c
index 0c681c7600bcb290afc0eae3c626ed9c943bc85a..f13c7e434f8ede429e10fe49d13fb378bb4dc079 100644 (file)
--- a/drivers/gpu/drm/tidss/tidss_irq.c
+++ b/drivers/gpu/drm/tidss/tidss_irq.c
@@ -60,7 +60,9 @@ static irqreturn_t tidss_irq_handler(int irq, void *arg)
        unsigned int id;
        dispc_irq_t irqstatus;
 
+       spin_lock(&tidss->wait_lock);
        irqstatus = dispc_read_and_clear_irqstatus(tidss->dispc);
+       spin_unlock(&tidss->wait_lock);
 
        for (id = 0; id < tidss->num_crtcs; id++) {
                struct drm_crtc *crtc = tidss->crtcs[id];