CVE-2022-48898

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer<br /> <br /> There are 3 possible interrupt sources are handled by DP controller,<br /> HPDstatus, Controller state changes and Aux read/write transaction.<br /> At every irq, DP controller have to check isr status of every interrupt<br /> sources and service the interrupt if its isr status bits shows interrupts<br /> are pending. There is potential race condition may happen at current aux<br /> isr handler implementation since it is always complete dp_aux_cmd_fifo_tx()<br /> even irq is not for aux read or write transaction. This may cause aux read<br /> transaction return premature if host aux data read is in the middle of<br /> waiting for sink to complete transferring data to host while irq happen.<br /> This will cause host&amp;#39;s receiving buffer contains unexpected data. This<br /> patch fixes this problem by checking aux isr and return immediately at<br /> aux isr handler if there are no any isr status bits set.<br /> <br /> Current there is a bug report regrading eDP edid corruption happen during<br /> system booting up. After lengthy debugging to found that VIDEO_READY<br /> interrupt was continuously firing during system booting up which cause<br /> dp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve data<br /> from aux hardware buffer which is not yet contains complete data transfer<br /> from sink. This cause edid corruption.<br /> <br /> Follows are the signature at kernel logs when problem happen,<br /> EDID has corrupt header<br /> panel-simple-dp-aux aux-aea0000.edp: Couldn&amp;#39;t identify panel via EDID<br /> <br /> Changes in v2:<br /> -- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr()<br /> -- add more commit text<br /> <br /> Changes in v3:<br /> -- add Stephen suggested<br /> -- dp_aux_isr() return IRQ_XXX back to caller<br /> -- dp_ctrl_isr() return IRQ_XXX back to caller<br /> <br /> Changes in v4:<br /> -- split into two patches<br /> <br /> Changes in v5:<br /> -- delete empty line between tags<br /> <br /> Changes in v6:<br /> -- remove extra "that" and fixed line more than 75 char at commit text<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/516121/