From: Greg Kroah-Hartman Date: Fri, 3 Jul 2026 07:26:39 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v5.10.260~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=430e473db695aa5c7c22d6f59a458202bb3c51b4;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: riscv-mm-extract-helper-mark_new_valid_map.patch --- diff --git a/queue-6.18/riscv-mm-extract-helper-mark_new_valid_map.patch b/queue-6.18/riscv-mm-extract-helper-mark_new_valid_map.patch new file mode 100644 index 0000000000..68ecc43c7e --- /dev/null +++ b/queue-6.18/riscv-mm-extract-helper-mark_new_valid_map.patch @@ -0,0 +1,61 @@ +From 9ee25d0a70ff4494b4e1d266b962d0a574ef318a Mon Sep 17 00:00:00 2001 +From: Vivian Wang +Date: Tue, 3 Mar 2026 13:29:45 +0800 +Subject: riscv: mm: Extract helper mark_new_valid_map() + +From: Vivian Wang + +commit 9ee25d0a70ff4494b4e1d266b962d0a574ef318a upstream. + +In preparation of a future patch using the same mechanism for +non-vmalloc addresses, extract the mark_new_valid_map() helper from +flush_cache_vmap(). + +No functional change intended. + +Cc: stable@vger.kernel.org +Signed-off-by: Vivian Wang +Link: https://patch.msgid.link/20260303-handle-kfence-protect-spurious-fault-v2-1-f80d8354d79d@iscas.ac.cn +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/cacheflush.h | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +--- a/arch/riscv/include/asm/cacheflush.h ++++ b/arch/riscv/include/asm/cacheflush.h +@@ -43,20 +43,23 @@ do { \ + #ifdef CONFIG_64BIT + extern u64 new_vmalloc[NR_CPUS / sizeof(u64) + 1]; + extern char _end[]; ++static inline void mark_new_valid_map(void) ++{ ++ int i; ++ ++ /* ++ * We don't care if concurrently a cpu resets this value since ++ * the only place this can happen is in handle_exception() where ++ * an sfence.vma is emitted. ++ */ ++ for (i = 0; i < ARRAY_SIZE(new_vmalloc); ++i) ++ new_vmalloc[i] = -1ULL; ++} + #define flush_cache_vmap flush_cache_vmap + static inline void flush_cache_vmap(unsigned long start, unsigned long end) + { +- if (is_vmalloc_or_module_addr((void *)start)) { +- int i; +- +- /* +- * We don't care if concurrently a cpu resets this value since +- * the only place this can happen is in handle_exception() where +- * an sfence.vma is emitted. +- */ +- for (i = 0; i < ARRAY_SIZE(new_vmalloc); ++i) +- new_vmalloc[i] = -1ULL; +- } ++ if (is_vmalloc_or_module_addr((void *)start)) ++ mark_new_valid_map(); + } + #define flush_cache_vmap_early(start, end) local_flush_tlb_kernel_range(start, end) + #endif diff --git a/queue-6.18/series b/queue-6.18/series index 22bfb61651..66132625bf 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -87,6 +87,7 @@ mips-smp-report-dying-cpu-to-rcu-in-stop_this_cpu.patch kvm-x86-hyper-v-bound-the-bank-index-when-querying-sparse-banks.patch kvm-svm-fix-page-overflow-in-sev_dbg_crypt-for-encrypt-path.patch power-reset-linkstation-poweroff-fix-use-after-free-in-the-linkstation_poweroff_init.patch +riscv-mm-extract-helper-mark_new_valid_map.patch riscv-kfence-call-mark_new_valid_map-for-kfence_unprotect.patch fbdev-fix-fb_new_modelist-to-prevent-null-ptr-deref-in-fb_videomode_to_var.patch fbdev-modedb-fix-a-possible-uaf-in-fb_find_mode.patch