Commit 75f9a484e817 for kernel

commit 75f9a484e817adea211c73f89ed938a2b2f90953
Author: Brian Ruley <brian.ruley@gehealthcare.com>
Date:   Wed Apr 15 18:12:48 2026 +0100

    ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()

    This bug was already discovered and fixed for arm64 in
    commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in
    __sync_icache_dcache()").

    Verified with added instrumentation to track dcache flushes in a ring
    buffer, as shown by the (distilled) output:

      kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte=8eff659f
              hw_pte=8eff6e7e young=1 exec=1
      kernel: dcache flush START   cpu0 pfn=8eff6 ts=48629557020154
      kernel: dcache flush SKIPPED cpu1 pfn=8eff6 ts=48629557020154
      kernel: dcache flush FINISH  cpu0 pfn=8eff6 ts=48629557036154
      audisp-syslog: comm="journalctl" exe="/usr/bin/journalctl" sig=4 [...]

    Discussions in the mailing list mentioned that arch/arm is also affected
    but the fix was never applied to it [1][2]. Apply the change now, since
    the race condition can cause sporadic SIGILL's and SEGV's especially
    while under high memory pressure.

    Link: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1]
    Link: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2]
    Signed-off-by: Brian Ruley <brian.ruley@gehealthcare.com>
    Reviewed-by: Will Deacon <will@kernel.org>
    Cc: <stable@vger.kernel.org>
    Fixes: 6012191aa9c6 ("ARM: 6380/1: Introduce __sync_icache_dcache() for VIPT caches")
    Signed-off-by: Will Deacon <will@kernel.org>
    Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>

diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 19470d938b23..4d7ef5cc36b6 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -304,8 +304,10 @@ void __sync_icache_dcache(pte_t pteval)
 	else
 		mapping = NULL;

-	if (!test_and_set_bit(PG_dcache_clean, &folio->flags.f))
+	if (!test_bit(PG_dcache_clean, &folio->flags.f)) {
 		__flush_dcache_folio(mapping, folio);
+		set_bit(PG_dcache_clean, &folio->flags.f);
+	}

 	if (pte_exec(pteval))
 		__flush_icache_all();