CVE-2026-68438: smp: Make CSD lock acquisition atomic for debug mode

In the Linux kernel, the following vulnerability has been resolved:

smp: Make CSD lock acquisition atomic for debug mode

Commit b0473dcd4b1d ("smp: Improve smpcallfunctionsingle() CSD-lock diagnostics") changed smpcallfunctionsingle() so that, when CSD lock debugging is enabled, async !wait calls use the destination CPU csddata. That improves diagnostics, but it also removes the single-writer property that made the old csdlock() safe: multiple CPUs can now prepare the same destination CPU CSD concurrently.

csdlock() currently waits for CSDFLAGLOCK to clear and then sets the bit with a non-atomic read-modify-write. Two senders can both see an unlocked CSD, set the bit, overwrite the callback fields, and enqueue the same llist node. Re-adding a node that is already the queue head can make node->next point to itself, leaving the target CPU stuck walking callsinglequeue. Later synchronous work, such as a TLB shootdown, can then remain queued and trigger soft-lockup warnings or panics.

Keep the single csdlock() implementation, but when CSD lock debugging is enabled, acquire CSDFLAGLOCK with trycmpxchgacquire(). This makes the destination CPU CSD a real atomic lock in the only configuration where it can be shared by multiple remote senders, while preserving the existing non-debug fast path.