Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

task_work: Fix NMI race condition 

__schedule()
  // disable irqs
      <NMI>
	  task_work_add(current, work, TWA_NMI_CURRENT);
      </NMI>
  // current = next;
  // enable irqs
      <IRQ>
	  task_work_set_notify_irq()
	  test_and_set_tsk_thread_flag(current,
                                       TIF_NOTIFY_RESUME); // wrong task!
      </IRQ>
  // original task skips task work on its next return to user (or exit!)

Fixes: 466e4d801c ("task_work: Add TWA_NMI_CURRENT as an additional notify mode.")
Reported-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://patch.msgid.link/20250924080118.425949403@infradead.org
This commit is contained in:
Peter Zijlstra 2025-09-22 15:47:00 +02:00
parent 34976eaf5f
commit ef1ea98c8f
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
kernel/task_work.c
View File

@ -9,7 +9,12 @@ static struct callback_head work_exited; /* all we need is ->next == NULL */
#ifdef CONFIG_IRQ_WORK #ifdef CONFIG_IRQ_WORK
static void task_work_set_notify_irq(struct irq_work *entry) static void task_work_set_notify_irq(struct irq_work *entry)
{ {
test_and_set_tsk_thread_flag(current, TIF_NOTIFY_RESUME); /*
* no-op IPI
*
* TWA_NMI_CURRENT will already have set the TIF flag, all
* this interrupt does it tickle the return-to-user path.
*/
} }
static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) = static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) =
IRQ_WORK_INIT_HARD(task_work_set_notify_irq); IRQ_WORK_INIT_HARD(task_work_set_notify_irq);
@ -86,6 +91,7 @@ int task_work_add(struct task_struct *task, struct callback_head *work,
break; break;
#ifdef CONFIG_IRQ_WORK #ifdef CONFIG_IRQ_WORK
case TWA_NMI_CURRENT: case TWA_NMI_CURRENT:
set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
irq_work_queue(this_cpu_ptr(&irq_work_NMI_resume)); irq_work_queue(this_cpu_ptr(&irq_work_NMI_resume));
break; break;
#endif #endif