From: Greg Kroah-Hartman Date: Sat, 4 Jul 2026 08:28:40 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v5.10.260~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f5b06381895c39af0410aa36a573012f54998350;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: kernel-fork-clear-pf_block_ts-in-copy_process.patch --- diff --git a/queue-6.18/kernel-fork-clear-pf_block_ts-in-copy_process.patch b/queue-6.18/kernel-fork-clear-pf_block_ts-in-copy_process.patch new file mode 100644 index 0000000000..2371bf94ba --- /dev/null +++ b/queue-6.18/kernel-fork-clear-pf_block_ts-in-copy_process.patch @@ -0,0 +1,39 @@ +From fd38b75c4b43295b10d69772a46d1c74dbd6fc81 Mon Sep 17 00:00:00 2001 +From: Usama Arif +Date: Tue, 16 Jun 2026 07:15:17 -0700 +Subject: kernel/fork: clear PF_BLOCK_TS in copy_process() + +From: Usama Arif + +commit fd38b75c4b43295b10d69772a46d1c74dbd6fc81 upstream. + +PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is +non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() +before NULLing the plug pointer. copy_process() breaks the +invariant by inheriting PF_BLOCK_TS from the parent while resetting +the child's plug to NULL. + +Clear PF_BLOCK_TS alongside that assignment so callers can rely on +"PF_BLOCK_TS set implies current->plug != NULL" and dereference +current->plug unguarded. + +Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption") +Cc: stable@vger.kernel.org +Signed-off-by: Usama Arif +Link: https://patch.msgid.link/20260616141604.328820-2-usama.arif@linux.dev +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + kernel/fork.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2230,6 +2230,7 @@ __latent_entropy struct task_struct *cop + + #ifdef CONFIG_BLOCK + p->plug = NULL; ++ p->flags &= ~PF_BLOCK_TS; + #endif + futex_init_task(p); + diff --git a/queue-6.18/series b/queue-6.18/series index 66132625bf..bc69ceb873 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -41,6 +41,7 @@ apparmor-mediate-the-implicit-connect-of-tcp-fast-open-sendmsg.patch apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch ntb-epf-avoid-pci_iounmap-with-offset-when-peer_spad-and-config-share-bar.patch fbdev-fix-use-after-free-in-store_modes.patch +kernel-fork-clear-pf_block_ts-in-copy_process.patch block-invalidate-cached-plug-timestamp-after-task-switch.patch kvm-arm64-omit-tag-sync-on-stage-2-mappings-of-the-zero-page.patch err.h-use-__always_inline-on-all-error-pointer-helpers.patch