Patch "io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-don-t-gate-task_work-run-on-tif_notify_sign.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit cae906b2050cb549d1c47db5f24adfa64ab587c9
Author: Jens Axboe <axboe@xxxxxxxxx>
Date:   Thu Sep 29 15:29:13 2022 -0600

    io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
    
    [ Upstream commit 46a525e199e4037516f7e498c18f065b09df32ac ]
    
    This isn't a reliable mechanism to tell if we have task_work pending, we
    really should be looking at whether we have any items queued. This is
    problematic if forward progress is gated on running said task_work. One
    such example is reading from a pipe, where the write side has been closed
    right before the read is started. The fput() of the file queues TWA_RESUME
    task_work, and we need that task_work to be run before ->release() is
    called for the pipe. If ->release() isn't called, then the read will sit
    forever waiting on data that will never arise.
    
    Fix this by io_run_task_work() so it checks if we have task_work pending
    rather than rely on TIF_NOTIFY_SIGNAL for that. The latter obviously
    doesn't work for task_work that is queued without TWA_SIGNAL.
    
    Reported-by: Christiano Haesbaert <haesbaert@xxxxxxxxxxxxx>
    Cc: stable@xxxxxxxxxxxxxxx
    Link: https://github.com/axboe/liburing/issues/665
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 45809ae6f64e..5121b20a9193 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -229,12 +229,12 @@ static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx)
 
 static inline bool io_run_task_work(void)
 {
-	if (test_thread_flag(TIF_NOTIFY_SIGNAL)) {
+	if (task_work_pending(current)) {
+		if (test_thread_flag(TIF_NOTIFY_SIGNAL))
+			clear_notify_signal();
 		__set_current_state(TASK_RUNNING);
-		clear_notify_signal();
-		if (task_work_pending(current))
-			task_work_run();
-		return true;
+		task_work_run();
+		return 1;
 	}
 
 	return false;