diff options
| author | Brian Ruley <brian.ruley@gehealthcare.com> | 2026-04-15 18:12:48 +0100 |
|---|---|---|
| committer | Russell King (Oracle) <rmk+kernel@armlinux.org.uk> | 2026-04-24 15:12:52 +0100 |
| commit | 75f9a484e817adea211c73f89ed938a2b2f90953 (patch) | |
| tree | f20c71037ce487744ac320ef4cf2fe14980249dc /arch/arm | |
| parent | 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f (diff) | |
| download | lwn-75f9a484e817adea211c73f89ed938a2b2f90953.tar.gz lwn-75f9a484e817adea211c73f89ed938a2b2f90953.zip | |
ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()
This bug was already discovered and fixed for arm64 in
commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in
__sync_icache_dcache()").
Verified with added instrumentation to track dcache flushes in a ring
buffer, as shown by the (distilled) output:
kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte=8eff659f
hw_pte=8eff6e7e young=1 exec=1
kernel: dcache flush START cpu0 pfn=8eff6 ts=48629557020154
kernel: dcache flush SKIPPED cpu1 pfn=8eff6 ts=48629557020154
kernel: dcache flush FINISH cpu0 pfn=8eff6 ts=48629557036154
audisp-syslog: comm="journalctl" exe="/usr/bin/journalctl" sig=4 [...]
Discussions in the mailing list mentioned that arch/arm is also affected
but the fix was never applied to it [1][2]. Apply the change now, since
the race condition can cause sporadic SIGILL's and SEGV's especially
while under high memory pressure.
Link: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1]
Link: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2]
Signed-off-by: Brian Ruley <brian.ruley@gehealthcare.com>
Reviewed-by: Will Deacon <will@kernel.org>
Cc: <stable@vger.kernel.org>
Fixes: 6012191aa9c6 ("ARM: 6380/1: Introduce __sync_icache_dcache() for VIPT caches")
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Diffstat (limited to 'arch/arm')
| -rw-r--r-- | arch/arm/mm/flush.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c index 19470d938b23..4d7ef5cc36b6 100644 --- a/arch/arm/mm/flush.c +++ b/arch/arm/mm/flush.c @@ -304,8 +304,10 @@ void __sync_icache_dcache(pte_t pteval) else mapping = NULL; - if (!test_and_set_bit(PG_dcache_clean, &folio->flags.f)) + if (!test_bit(PG_dcache_clean, &folio->flags.f)) { __flush_dcache_folio(mapping, folio); + set_bit(PG_dcache_clean, &folio->flags.f); + } if (pte_exec(pteval)) __flush_icache_all(); |