6.12-stable patches

added patches:
	kernel-fork-clear-pf_block_ts-in-copy_process.patch

diff --git a/queue-6.12/kernel-fork-clear-pf_block_ts-in-copy_process.patch b/queue-6.12/kernel-fork-clear-pf_block_ts-in-copy_process.patch
new file mode 100644 (file)
index 0000000..5453c8d
--- /dev/null
+++ b/queue-6.12/kernel-fork-clear-pf_block_ts-in-copy_process.patch
@@ -0,0 +1,39 @@
+From fd38b75c4b43295b10d69772a46d1c74dbd6fc81 Mon Sep 17 00:00:00 2001
+From: Usama Arif <usama.arif@linux.dev>
+Date: Tue, 16 Jun 2026 07:15:17 -0700
+Subject: kernel/fork: clear PF_BLOCK_TS in copy_process()
+
+From: Usama Arif <usama.arif@linux.dev>
+
+commit fd38b75c4b43295b10d69772a46d1c74dbd6fc81 upstream.
+
+PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
+non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
+before NULLing the plug pointer.  copy_process() breaks the
+invariant by inheriting PF_BLOCK_TS from the parent while resetting
+the child's plug to NULL.
+
+Clear PF_BLOCK_TS alongside that assignment so callers can rely on
+"PF_BLOCK_TS set implies current->plug != NULL" and dereference
+current->plug unguarded.
+
+Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption")
+Cc: stable@vger.kernel.org
+Signed-off-by: Usama Arif <usama.arif@linux.dev>
+Link: https://patch.msgid.link/20260616141604.328820-2-usama.arif@linux.dev
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/fork.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2450,6 +2450,7 @@ __latent_entropy struct task_struct *cop
+ 
+ #ifdef CONFIG_BLOCK
+       p->plug = NULL;
++      p->flags &= ~PF_BLOCK_TS;
+ #endif
+       futex_init_task(p);
+ 

diff --git a/queue-6.12/series b/queue-6.12/series
index 675dbeb790d316e0b91609e1f1bff2274f0cacdb..4412b86d7ea6ddbc0b473e4fb3f2dddf50ca5df5 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -139,6 +139,7 @@ apparmor-mediate-the-implicit-connect-of-tcp-fast-open-sendmsg.patch
 apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch
 ntb-epf-avoid-pci_iounmap-with-offset-when-peer_spad-and-config-share-bar.patch
 fbdev-fix-use-after-free-in-store_modes.patch
+kernel-fork-clear-pf_block_ts-in-copy_process.patch
 block-invalidate-cached-plug-timestamp-after-task-switch.patch
 err.h-use-__always_inline-on-all-error-pointer-helpers.patch
 keys-fix-overflow-in-keyctl_pkey_params_get_2.patch