task_work: Fix NMI race condition

[ Upstream commit ef1ea98c8fffe227e5319215d84a53fa2a4bcebc ]

  __schedule()
  // disable irqs
      <NMI>
	  task_work_add(current, work, TWA_NMI_CURRENT);
      </NMI>
  // current = next;
  // enable irqs
      <IRQ>
	  task_work_set_notify_irq()
	  test_and_set_tsk_thread_flag(current,
                                       TIF_NOTIFY_RESUME); // wrong task!
      </IRQ>
  // original task skips task work on its next return to user (or exit!)

Fixes: 466e4d801cd4 ("task_work: Add TWA_NMI_CURRENT as an additional notify mode.")
Reported-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://patch.msgid.link/20250924080118.425949403@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/kernel/task_work.c b/kernel/task_work.c
index c969f1f26be58a87babfb7f05464e612bec1bc98..48ab6275e6e7e7b09383bea82580545fdb6ff8f1 100644 (file)
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -9,7 +9,12 @@ static struct callback_head work_exited; /* all we need is ->next == NULL */
 #ifdef CONFIG_IRQ_WORK
 static void task_work_set_notify_irq(struct irq_work *entry)
 {
-       test_and_set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
+       /*
+        * no-op IPI
+        *
+        * TWA_NMI_CURRENT will already have set the TIF flag, all
+        * this interrupt does it tickle the return-to-user path.
+        */
 }
 static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) =
        IRQ_WORK_INIT_HARD(task_work_set_notify_irq);
@@ -98,6 +103,7 @@ int task_work_add(struct task_struct *task, struct callback_head *work,
                break;
 #ifdef CONFIG_IRQ_WORK
        case TWA_NMI_CURRENT:
+               set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
                irq_work_queue(this_cpu_ptr(&irq_work_NMI_resume));
                break;
 #endif