6.18-stable patches

added patches:
	kernel-fork-clear-pf_block_ts-in-copy_process.patch

diff --git a/queue-6.18/kernel-fork-clear-pf_block_ts-in-copy_process.patch b/queue-6.18/kernel-fork-clear-pf_block_ts-in-copy_process.patch
new file mode 100644 (file)
index 0000000..2371bf9
--- /dev/null
+++ b/queue-6.18/kernel-fork-clear-pf_block_ts-in-copy_process.patch
@@ -0,0 +1,39 @@
+From fd38b75c4b43295b10d69772a46d1c74dbd6fc81 Mon Sep 17 00:00:00 2001
+From: Usama Arif <usama.arif@linux.dev>
+Date: Tue, 16 Jun 2026 07:15:17 -0700
+Subject: kernel/fork: clear PF_BLOCK_TS in copy_process()
+
+From: Usama Arif <usama.arif@linux.dev>
+
+commit fd38b75c4b43295b10d69772a46d1c74dbd6fc81 upstream.
+
+PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
+non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
+before NULLing the plug pointer.  copy_process() breaks the
+invariant by inheriting PF_BLOCK_TS from the parent while resetting
+the child's plug to NULL.
+
+Clear PF_BLOCK_TS alongside that assignment so callers can rely on
+"PF_BLOCK_TS set implies current->plug != NULL" and dereference
+current->plug unguarded.
+
+Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption")
+Cc: stable@vger.kernel.org
+Signed-off-by: Usama Arif <usama.arif@linux.dev>
+Link: https://patch.msgid.link/20260616141604.328820-2-usama.arif@linux.dev
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/fork.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2230,6 +2230,7 @@ __latent_entropy struct task_struct *cop
+ 
+ #ifdef CONFIG_BLOCK
+       p->plug = NULL;
++      p->flags &= ~PF_BLOCK_TS;
+ #endif
+       futex_init_task(p);
+ 

diff --git a/queue-6.18/series b/queue-6.18/series
index 66132625bf79462916c1350362ce2b7b11c4fb4d..bc69ceb873ae53a496c4b0e1c8cc1e05eea46273 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -41,6 +41,7 @@ apparmor-mediate-the-implicit-connect-of-tcp-fast-open-sendmsg.patch
 apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch
 ntb-epf-avoid-pci_iounmap-with-offset-when-peer_spad-and-config-share-bar.patch
 fbdev-fix-use-after-free-in-store_modes.patch
+kernel-fork-clear-pf_block_ts-in-copy_process.patch
 block-invalidate-cached-plug-timestamp-after-task-switch.patch
 kvm-arm64-omit-tag-sync-on-stage-2-mappings-of-the-zero-page.patch
 err.h-use-__always_inline-on-all-error-pointer-helpers.patch