linux-stable.git/arch/loongarch, branch linux-rolling-stable

LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

2026-07-24T14:21:16+00:00

commit 018e9828eb523c638fa3d9bdf0fd4956b74555b2 upstream.

When hardware page table walker (PTW) is enabled on LoongArch, the CPU
may set _PAGE_DIRTY directly in the page table entry during a write TLB
miss, without going through the software TLB store handler. The software
TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED
together:

    ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)

Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e.
_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has
_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED
clear (software is unaware).

When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls
pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and
_PAGE_DIRTY bits:

    pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);

Since _PAGE_MODIFIED was never set, the dirtiness information is lost
completely. Subsequently, when memory pressure triggers page reclaim,
page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty()
returns false) and the page may be freed without writeback, causing data
corruption.

Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in
both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits:

    if (pte_val(pte) & _PAGE_DIRTY)
        pte_val(pte) |= _PAGE_MODIFIED;

The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case,
where pmd entries need the same treatment.

This ensures the software dirty tracking bit (checked by pte_dirty() and
pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is
preserved across fork COW write-protection.

The issue was found by the LTP madvise09 test case, which exercises page
reclaim after "madvise(MADV_FREE), write and fork" operation sequence on
private anonymous mappings.

Cc: stable@vger.kernel.org
Fixes: 09cfefb7fa70 ("LoongArch: Add memory management")
Co-developed-by: Tianyang Zhang 
Signed-off-by: Tianyang Zhang 
Signed-off-by: Hongchen Zhang 
Signed-off-by: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

LoongArch: Fix nr passing in set_direct_map_valid_noflush()

2026-07-24T14:21:16+00:00

commit 70378a710598432f13509bdc16a1c0f06b3ecb53 upstream.

set_direct_map_valid_noflush() incorrectly passes 1 to __set_memory()
instead of nr. This causes only the first page's attr to be updated when
nr > 1.

Other architectures all pass nr correctly.

Cc: stable@vger.kernel.org
Fixes: 0c6378a71574 ("arch: introduce set_direct_map_valid_noflush()")
Signed-off-by: Xuewen Wang 
Signed-off-by: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()

2026-07-24T14:20:49+00:00

commit ebd50de14f1a06b7e0206083904bcc62b9ba65be upstream.

The LoongArch CSRXCHG instruction returns the full old CSR value in rd
after applying the masked update. kvm_emu_xchg_csr() currently masks
the saved value before returning it to the guest, so rd receives only
the bits selected by the write mask.

That breaks the architectural behavior and makes a zero mask return 0
instead of the previous CSR value. So, keep the masked CSR update, but
return the unmodified old CSR value.

Cc: stable@vger.kernel.org
Fixes: da50f5a693ff ("LoongArch: KVM: Implement handle csr exception")
Reviewed-by: Bibo Mao 
Signed-off-by: Qiang Ma 
Signed-off-by: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

LoongArch: KVM: Fix FPU register width with user access API

2026-07-24T14:20:49+00:00

commit f4caaac76379daf4a617d9134b6087fb2636fb31 upstream.

At the beginning, only 64 bit FPU is supported. With FPU register get
interface, 64 bit FPU data is copied to user space, the same with FPU
register set API. However with LSX and LASX supported in later, there
should be FPU data copied with bigger width. So here fixes this issue,
copy the whole 256 bit FPU data from/to user space.

Cc: stable@vger.kernel.org
Fixes: db1ecca22edf ("LoongArch: KVM: Add LSX (128bit SIMD) support")
Signed-off-by: Bibo Mao 
Signed-off-by: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

LoongArch: KVM: Check the return values for put_user()

2026-07-24T14:20:49+00:00

commit fb89e0fe2dc4246c86ad0eb0fa2b7cb2f8ba9728 upstream.

put_user() may return -EFAULT, so, when the user space address is
invalid, the caller should return -EFAULT.

Cc: stable@vger.kernel.org
Reviewed-by: Bibo Mao 
Signed-off-by: Qiang Ma 
Signed-off-by: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()

2026-07-24T14:20:49+00:00

commit 09b318ab77b7a4fc9987fd98d1525fc55ddc2617 upstream.

Function kvm_vcpu_ioctl_interrupt() can be called from userspace, here
add irq validility cheking in kvm_vcpu_ioctl_interrupt().

Cc: stable@vger.kernel.org
Fixes: f45ad5b8aa93 ("LoongArch: KVM: Implement vcpu interrupt operations")
Signed-off-by: Bibo Mao 
Signed-off-by: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

LoongArch: KVM: Validate irqchip index in irqfd routing

2026-07-24T14:20:49+00:00

commit 3474037904c20ff915e3ebab0ab5c1e41bbe549e upstream.

Sashiko reported that the irqchip index is not validated for LoongArch.
Add validation and reject out-of-range irqchip indexes to avoid indexing
past the routing table's chip array.

Cc: stable@vger.kernel.org
Fixes: 1928254c5ccb ("LoongArch: KVM: Add irqfd support")
Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel.org/
Reported-by: Sashiko 
Reviewed-by: Bibo Mao 
Signed-off-by: Yanfei Xu 
Signed-off-by: Huacai Chen 
Signed-off-by: Greg Kroah-Hartman

LoongArch: BPF: Fix off-by-one error in tail call

2026-07-24T14:20:30+00:00

[ Upstream commit 0379d10f09bc21ba739636796669dfb4936172a3 ]

The current code updates the tail call counter (TCC) using a pre-increment
approach, it stores the incremented value back to memory before performing
any boundary or target validation checks.

This causes two major issues:
1. When a tail call fails because the target program is NULL, the TCC is
   incorrectly incremented and saved in memory anyway.
2. This dummy increment implicitly consumes one slot of the allowed tail
   call budget. As a result, the subsequent loop reaches the maximum limit
   prematurely, leading to a test failure where the actual loop count is
   32 instead of the expected 33.

Fix this by deferring the counter update. Change the branch condition to
BPF_JSGE (greater or equal) so that we check the boundary first. The TCC
is only incremented and stored back to memory after the boundary check
and the NULL-target check both pass.

Before:

  $ sudo ./test_progs -t tailcalls/tailcall_3
  ...
  test_tailcall_count:FAIL:tailcall count unexpected tailcall count: actual 32 != expected 33
  ...
  #465/3   tailcalls/tailcall_3:FAIL
  #465     tailcalls:FAIL

After:

  $ sudo ./test_progs -t tailcalls/tailcall_3
  #465/3   tailcalls/tailcall_3:OK
  #465     tailcalls:OK
  Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED

Fixes: c0fcc955ff82 ("LoongArch: BPF: Fix the tailcall hierarchy")
Signed-off-by: Tiezhu Yang 
Signed-off-by: Huacai Chen 
Signed-off-by: Sasha Levin

LoongArch: BPF: Fix outdated tail call comments

2026-07-24T14:20:30+00:00

[ Upstream commit 25d9127bb0e27275d55a5b3d0fd30b04bafffd5a ]

The current LoongArch BPF JIT implementation hardcodes the number of
prologue instructions skipped during a tail call as a magic number '7'
in the jirl instruction. However, the accompanying comment explaining
this offset is completely outdated. It inaccurately states that only
a single TCC initialization instruction is bypassed, but in reality,
multiple setup slots are skipped, so fix these outdated comments in
__build_epilogue().

While at it, refine the comments in build_prologue() to describe the
skipped setup slots (RA saving, fentry nops, and the TCC register slot)
using proper dynamic tracing context. Also, remove the magic number '7'
by introducing descriptive macros to formally define the prologue layout
and make the tail call jump offset self-documenting.

Fixes: 61319d15a560 ("LoongArch: BPF: Adjust the jump offset of tail calls")
Signed-off-by: Tiezhu Yang 
Signed-off-by: Huacai Chen 
Signed-off-by: Sasha Levin

LoongArch: Move struct kimage forward declaration before use

2026-07-24T14:20:30+00:00

[ Upstream commit d4e58d2c21d94282d512979dfa7e045c5034b0be ]

arch_kimage_file_post_load_cleanup() and load_other_segments(), both
inside the CONFIG_KEXEC_FILE block, take a struct kimage pointer before
the forward declaration appears. Move the forward declaration above so
it precedes its first use instead of relying on a transitive include.

Fixes: d162feec6b6e ("LoongArch: Add preparatory infrastructure for kexec_file")
Signed-off-by: 谢致邦 (XIE Zhibang) 
Signed-off-by: Huacai Chen 
Signed-off-by: Sasha Levin