task_work: Fix NMI race condition

  __schedule()
  // disable irqs
      <NMI>
	  task_work_add(current, work, TWA_NMI_CURRENT);
      </NMI>
  // current = next;
  // enable irqs
      <IRQ>
	  task_work_set_notify_irq()
	  test_and_set_tsk_thread_flag(current,
                                       TIF_NOTIFY_RESUME); // wrong task!
      </IRQ>
  // original task skips task work on its next return to user (or exit!)

Fixes: 466e4d801cd4 ("task_work: Add TWA_NMI_CURRENT as an additional notify mode.")
Reported-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://patch.msgid.link/20250924080118.425949403@infradead.org

diff --git a/kernel/task_work.c b/kernel/task_work.c
index d1efec571a4a479268b5c444ab399654d0cecf9e..0f7519f8e7c93f9a4536c26a341255799c320432 100644 (file)
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -9,7 +9,12 @@ static struct callback_head work_exited; /* all we need is ->next == NULL */
 #ifdef CONFIG_IRQ_WORK
 static void task_work_set_notify_irq(struct irq_work *entry)
 {
-       test_and_set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
+       /*
+        * no-op IPI
+        *
+        * TWA_NMI_CURRENT will already have set the TIF flag, all
+        * this interrupt does it tickle the return-to-user path.
+        */
 }
 static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) =
        IRQ_WORK_INIT_HARD(task_work_set_notify_irq);
@@ -86,6 +91,7 @@ int task_work_add(struct task_struct *task, struct callback_head *work,
                break;
 #ifdef CONFIG_IRQ_WORK
        case TWA_NMI_CURRENT:
+               set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
                irq_work_queue(this_cpu_ptr(&irq_work_NMI_resume));
                break;
 #endif