This is a note to let you know that I've just added the patch titled io_uring: clear TIF_NOTIFY_SIGNAL if set and task_work not available to the 6.0-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: io_uring-clear-tif_notify_signal-if-set-and-task_work-not-available.patch and it can be found in the queue-6.0 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 7cfe7a09489c1cefee7181e07b5f2bcbaebd9f41 Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe@xxxxxxxxx> Date: Fri, 25 Nov 2022 09:36:29 -0700 Subject: io_uring: clear TIF_NOTIFY_SIGNAL if set and task_work not available From: Jens Axboe <axboe@xxxxxxxxx> commit 7cfe7a09489c1cefee7181e07b5f2bcbaebd9f41 upstream. With how task_work is added and signaled, we can have TIF_NOTIFY_SIGNAL set and no task_work pending as it got run in a previous loop. Treat TIF_NOTIFY_SIGNAL like get_signal(), always clear it if set regardless of whether or not task_work is pending to run. Cc: stable@xxxxxxxxxxxxxxx Fixes: 46a525e199e4 ("io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL") Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- io_uring/io_uring.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/io_uring/io_uring.h +++ b/io_uring/io_uring.h @@ -229,9 +229,14 @@ static inline unsigned int io_sqring_ent static inline bool io_run_task_work(void) { + /* + * Always check-and-clear the task_work notification signal. With how + * signaling works for task_work, we can find it set with nothing to + * run. We need to clear it for that case, like get_signal() does. + */ + if (test_thread_flag(TIF_NOTIFY_SIGNAL)) + clear_notify_signal(); if (task_work_pending(current)) { - if (test_thread_flag(TIF_NOTIFY_SIGNAL)) - clear_notify_signal(); __set_current_state(TASK_RUNNING); task_work_run(); return 1; Patches currently in stable-queue which might be from axboe@xxxxxxxxx are queue-6.0/block-bfq-fix-null-pointer-dereference-in-bfq_bio_bf.patch queue-6.0/blk-mq-fix-queue-reference-leak-on-blk_mq_alloc_disk.patch queue-6.0/selftests-net-don-t-tests-batched-tcp-io_uring-zc.patch queue-6.0/io_uring-make-poll-refs-more-robust.patch queue-6.0/s390-dasd-fix-no-record-found-for-raw_track_access.patch queue-6.0/io_uring-cmpxchg-for-poll-arm-refs-release.patch queue-6.0/io_uring-poll-fix-poll_refs-race-with-cancelation.patch queue-6.0/io_uring-filetable-fix-file-reference-underflow.patch queue-6.0/nvme-quiet-user-passthrough-command-errors.patch queue-6.0/io_uring-clear-tif_notify_signal-if-set-and-task_work-not-available.patch queue-6.0/io_uring-poll-lockdep-annote-io_poll_req_insert_lock.patch