io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL

[ Upstream commit 46a525e199e4037516f7e498c18f065b09df32ac ]

This isn't a reliable mechanism to tell if we have task_work pending, we
really should be looking at whether we have any items queued. This is
problematic if forward progress is gated on running said task_work. One
such example is reading from a pipe, where the write side has been closed
right before the read is started. The fput() of the file queues TWA_RESUME
task_work, and we need that task_work to be run before ->release() is
called for the pipe. If ->release() isn't called, then the read will sit
forever waiting on data that will never arise.

Fix this by io_run_task_work() so it checks if we have task_work pending
rather than rely on TIF_NOTIFY_SIGNAL for that. The latter obviously
doesn't work for task_work that is queued without TWA_SIGNAL.

Reported-by: Christiano Haesbaert <haesbaert@haesbaert.org>
Cc: stable@vger.kernel.org
Link: https://github.com/axboe/liburing/issues/665
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 45809ae6f64ef37f47f15c69a1b1e37c679bece2..5121b20a9193681d2da2b3d83495077d28d15dd0 100644 (file)
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -229,12 +229,12 @@ static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx)
 
 static inline bool io_run_task_work(void)
 {
-       if (test_thread_flag(TIF_NOTIFY_SIGNAL)) {
+       if (task_work_pending(current)) {
+               if (test_thread_flag(TIF_NOTIFY_SIGNAL))
+                       clear_notify_signal();
                __set_current_state(TASK_RUNNING);
-               clear_notify_signal();
-               if (task_work_pending(current))
-                       task_work_run();
-               return true;
+               task_work_run();
+               return 1;
        }
 
        return false;