CVE-2026-72043: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

When hardware page table walker (PTW) is enabled on LoongArch, the CPU
may set _PAGE_DIRTY directly in the page table entry during a write TLB
miss, without going through the software TLB store handler. The software
TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED
together:

    ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)

Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e.
_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has
_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED
clear (software is unaware).

When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls
pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and
_PAGE_DIRTY bits:

    pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);

Since _PAGE_MODIFIED was never set, the dirtiness information is lost
completely. Subsequently, when memory pressure triggers page reclaim,
page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty()
returns false) and the page may be freed without writeback, causing data
corruption.

Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in
both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits:

    if (pte_val(pte) & _PAGE_DIRTY)
        pte_val(pte) |= _PAGE_MODIFIED;

The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case,
where pmd entries need the same treatment.

This ensures the software dirty tracking bit (checked by pte_dirty() and
pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is
preserved across fork COW write-protection.

The issue was found by the LTP madvise09 test case, which exercises page
reclaim after "madvise(MADV_FREE), write and fork" operation sequence on
private anonymous mappings.

The Linux kernel CVE team has assigned CVE-2026-72043 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit 09cfefb7fa70c3af011b0db0a513fd80b2f18abc and fixed in 6.1.178 with commit 76f88650763a35cbf1384c65d66d096fa31cc58d
	Issue introduced in 5.19 with commit 09cfefb7fa70c3af011b0db0a513fd80b2f18abc and fixed in 6.6.145 with commit e8a916579e427af32f2de8213dfa23c5df6e6664
	Issue introduced in 5.19 with commit 09cfefb7fa70c3af011b0db0a513fd80b2f18abc and fixed in 6.12.97 with commit 39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9
	Issue introduced in 5.19 with commit 09cfefb7fa70c3af011b0db0a513fd80b2f18abc and fixed in 6.18.40 with commit a65f49b6f7ece756394f8f0e85570020e7fd0e35
	Issue introduced in 5.19 with commit 09cfefb7fa70c3af011b0db0a513fd80b2f18abc and fixed in 7.1.5 with commit e483da960892c41fa7f0cf0d2fc2410d65a483d6
	Issue introduced in 5.19 with commit 09cfefb7fa70c3af011b0db0a513fd80b2f18abc and fixed in 7.2-rc1 with commit 018e9828eb523c638fa3d9bdf0fd4956b74555b2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72043
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/loongarch/include/asm/pgtable.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/76f88650763a35cbf1384c65d66d096fa31cc58d
	https://git.kernel.org/stable/c/e8a916579e427af32f2de8213dfa23c5df6e6664
	https://git.kernel.org/stable/c/39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9
	https://git.kernel.org/stable/c/a65f49b6f7ece756394f8f0e85570020e7fd0e35
	https://git.kernel.org/stable/c/e483da960892c41fa7f0cf0d2fc2410d65a483d6
	https://git.kernel.org/stable/c/018e9828eb523c638fa3d9bdf0fd4956b74555b2