From: Usama Arif <usama.arif@linux.dev>
Date: Tue, 16 Jun 2026 14:15:17 +0000 (-0700)
Subject: kernel/fork: clear PF_BLOCK_TS in copy_process()
X-Git-Tag: v7.2-rc1~31^2~20
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fd38b75c4b43295b10d69772a46d1c74dbd6fc81;p=thirdparty%2Flinux.git

kernel/fork: clear PF_BLOCK_TS in copy_process()

PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
before NULLing the plug pointer.  copy_process() breaks the
invariant by inheriting PF_BLOCK_TS from the parent while resetting
the child's plug to NULL.

Clear PF_BLOCK_TS alongside that assignment so callers can rely on
"PF_BLOCK_TS set implies current->plug != NULL" and dereference
current->plug unguarded.

Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption")
Cc: stable@vger.kernel.org
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Link: https://patch.msgid.link/20260616141604.328820-2-usama.arif@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/kernel/fork.c b/kernel/fork.c
index addc555a10770..1fafcb9bb0473 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2337,6 +2337,7 @@ __latent_entropy struct task_struct *copy_process(
 
 #ifdef CONFIG_BLOCK
 	p->plug = NULL;
+	p->flags &= ~PF_BLOCK_TS;
 #endif
 	futex_init_task(p);