[PATCH] arm: fix race condition on PG_dcache_clean in __sync_icache_dcache()

[PATCH] arm: fix race condition on PG_dcache_clean in __sync_icache_dcache()

[Brian Ruley]

This bug was already discovered and fixed for arm64 in
commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in
__sync_icache_dcache()").

Verified with added instrumentation to track dcache flushes in a ring
buffer, as shown by the (distilled) output:

  kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte=8eff659f
          hw_pte=8eff6e7e young=1 exec=1
  kernel: dcache flush START   cpu0 pfn=8eff6 ts=48629557020154
  kernel: dcache flush SKIPPED cpu1 pfn=8eff6 ts=48629557020154
  kernel: dcache flush FINISH  cpu0 pfn=8eff6 ts=48629557036154
  audisp-syslog: comm="journalctl" exe="/usr/bin/journalctl" sig=4 [...]

Discussions in the mailing list mentioned that arch/arm is also affected
but the fix was never applied to it [1][2]. Apply the change now, since
the race condition can cause sporadic SIGILL's and SEGV's especially
while under high memory pressure.

Link: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1]
Link: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2]
Signed-off-by: Brian Ruley <brian.ruley@gehealthcare.com>
---
 arch/arm/mm/flush.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 19470d938b23..4d7ef5cc36b6 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -304,8 +304,10 @@ void __sync_icache_dcache(pte_t pteval)
 	else
 		mapping = NULL;
 
-	if (!test_and_set_bit(PG_dcache_clean, &folio->flags.f))
+	if (!test_bit(PG_dcache_clean, &folio->flags.f)) {
 		__flush_dcache_folio(mapping, folio);
+		set_bit(PG_dcache_clean, &folio->flags.f);
+	}
 
 	if (pte_exec(pteval))
 		__flush_icache_all();
-- 
2.47.3

Re: [PATCH] arm: fix race condition on PG_dcache_clean in __sync_icache_dcache()

[Will Deacon]

On Tue, Apr 14, 2026 at 02:39:18PM +0300, Brian Ruley wrote:
> This bug was already discovered and fixed for arm64 in
> commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in
> __sync_icache_dcache()").
> 
> Verified with added instrumentation to track dcache flushes in a ring
> buffer, as shown by the (distilled) output:
> 
>   kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte=8eff659f
>           hw_pte=8eff6e7e young=1 exec=1
>   kernel: dcache flush START   cpu0 pfn=8eff6 ts=48629557020154
>   kernel: dcache flush SKIPPED cpu1 pfn=8eff6 ts=48629557020154
>   kernel: dcache flush FINISH  cpu0 pfn=8eff6 ts=48629557036154
>   audisp-syslog: comm="journalctl" exe="/usr/bin/journalctl" sig=4 [...]
> 
> Discussions in the mailing list mentioned that arch/arm is also affected
> but the fix was never applied to it [1][2]. Apply the change now, since
> the race condition can cause sporadic SIGILL's and SEGV's especially
> while under high memory pressure.
> 
> Link: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1]
> Link: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2]
> Signed-off-by: Brian Ruley <brian.ruley@gehealthcare.com>
> ---
>  arch/arm/mm/flush.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
> index 19470d938b23..4d7ef5cc36b6 100644
> --- a/arch/arm/mm/flush.c
> +++ b/arch/arm/mm/flush.c
> @@ -304,8 +304,10 @@ void __sync_icache_dcache(pte_t pteval)
>  	else
>  		mapping = NULL;
>  
> -	if (!test_and_set_bit(PG_dcache_clean, &folio->flags.f))
> +	if (!test_bit(PG_dcache_clean, &folio->flags.f)) {
>  		__flush_dcache_folio(mapping, folio);
> +		set_bit(PG_dcache_clean, &folio->flags.f);
> +	}
>  
>  	if (pte_exec(pteval))
>  		__flush_icache_all();

Thanks, Brian:

Reviewed-by: Will Deacon <will@kernel.org>

Will

Re: [PATCH] arm: fix race condition on PG_dcache_clean in __sync_icache_dcache()

[Will Deacon]

On Wed, Apr 15, 2026 at 06:07:34PM +0100, Will Deacon wrote:
> On Tue, Apr 14, 2026 at 02:39:18PM +0300, Brian Ruley wrote:
> > This bug was already discovered and fixed for arm64 in
> > commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in
> > __sync_icache_dcache()").
> > 
> > Verified with added instrumentation to track dcache flushes in a ring
> > buffer, as shown by the (distilled) output:
> > 
> >   kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte=8eff659f
> >           hw_pte=8eff6e7e young=1 exec=1
> >   kernel: dcache flush START   cpu0 pfn=8eff6 ts=48629557020154
> >   kernel: dcache flush SKIPPED cpu1 pfn=8eff6 ts=48629557020154
> >   kernel: dcache flush FINISH  cpu0 pfn=8eff6 ts=48629557036154
> >   audisp-syslog: comm="journalctl" exe="/usr/bin/journalctl" sig=4 [...]
> > 
> > Discussions in the mailing list mentioned that arch/arm is also affected
> > but the fix was never applied to it [1][2]. Apply the change now, since
> > the race condition can cause sporadic SIGILL's and SEGV's especially
> > while under high memory pressure.
> > 
> > Link: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1]
> > Link: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2]
> > Signed-off-by: Brian Ruley <brian.ruley@gehealthcare.com>
> > ---
> >  arch/arm/mm/flush.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
> > index 19470d938b23..4d7ef5cc36b6 100644
> > --- a/arch/arm/mm/flush.c
> > +++ b/arch/arm/mm/flush.c
> > @@ -304,8 +304,10 @@ void __sync_icache_dcache(pte_t pteval)
> >  	else
> >  		mapping = NULL;
> >  
> > -	if (!test_and_set_bit(PG_dcache_clean, &folio->flags.f))
> > +	if (!test_bit(PG_dcache_clean, &folio->flags.f)) {
> >  		__flush_dcache_folio(mapping, folio);
> > +		set_bit(PG_dcache_clean, &folio->flags.f);
> > +	}
> >  
> >  	if (pte_exec(pteval))
> >  		__flush_icache_all();
> 
> Thanks, Brian:
> 
> Reviewed-by: Will Deacon <will@kernel.org>

I've uploaded this to the patch tracker [1] as 9472/1.

Will

[1] https://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=9472/1