Patch "io_uring: clear TIF_NOTIFY_SIGNAL when running task work" has been added to the 5.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    io_uring: clear TIF_NOTIFY_SIGNAL when running task work

to the 5.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-clear-tif_notify_signal-when-running-task-w.patch
and it can be found in the queue-5.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3bd1d80318a9736f4809128ded5bdbb849b058c9
Author: Nadav Amit <namit@xxxxxxxxxx>
Date:   Sat Aug 7 17:13:41 2021 -0700

    io_uring: clear TIF_NOTIFY_SIGNAL when running task work
    
    [ Upstream commit ef98eb0409c31c39ab55ff46b2721c3b4f84c122 ]
    
    When using SQPOLL, the submission queue polling thread calls
    task_work_run() to run queued work. However, when work is added with
    TWA_SIGNAL - as done by io_uring itself - the TIF_NOTIFY_SIGNAL remains
    set afterwards and is never cleared.
    
    Consequently, when the submission queue polling thread checks whether
    signal_pending(), it may always find a pending signal, if
    task_work_add() was ever called before.
    
    The impact of this bug might be different on different kernel versions.
    It appears that on 5.14 it would only cause unnecessary calculation and
    prevent the polling thread from sleeping. On 5.13, where the bug was
    found, it stops the polling thread from finding newly submitted work.
    
    Instead of task_work_run(), use tracehook_notify_signal() that clears
    TIF_NOTIFY_SIGNAL. Test for TIF_NOTIFY_SIGNAL in addition to
    current->task_works to avoid a race in which task_works is cleared but
    the TIF_NOTIFY_SIGNAL is set.
    
    Fixes: 685fe7feedb96 ("io-wq: eliminate the need for a manager thread")
    Cc: Jens Axboe <axboe@xxxxxxxxx>
    Cc: Pavel Begunkov <asml.silence@xxxxxxxxx>
    Signed-off-by: Nadav Amit <namit@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20210808001342.964634-2-namit@xxxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 32f3df13a812..8a8507cab580 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -78,6 +78,7 @@
 #include <linux/task_work.h>
 #include <linux/pagemap.h>
 #include <linux/io_uring.h>
+#include <linux/tracehook.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/io_uring.h>
@@ -2250,9 +2251,9 @@ static inline unsigned int io_put_rw_kbuf(struct io_kiocb *req)
 
 static inline bool io_run_task_work(void)
 {
-	if (current->task_works) {
+	if (test_thread_flag(TIF_NOTIFY_SIGNAL) || current->task_works) {
 		__set_current_state(TASK_RUNNING);
-		task_work_run();
+		tracehook_notify_signal();
 		return true;
 	}