CVE-2026-99243: io-wq: order the exit bit against worker creation task work

In the Linux kernel, the following vulnerability has been resolved:

io-wq: order the exit bit against worker creation task work

iowqexitworkers() cancels task work for queued worker creation with taskworkcancelmatch(). That has a plain load of task->taskworks.

ioqueueworkercreate() adds the new entry and tests IOWQBITEXIT to cancel it if the workqueue is already on its way out.

That must be ordered. taskworkadd() has a full barrier via cmpxchg(). But iowqexitstart() sets the bit with setbit() which doesn't have any memory ordering.

So afaict, on weakly ordered architectures the exiting task may load taskworks before the store of the bit is visible. The other side tests the bit before the store is visible as well. So the entry remains queued with workerrefs and the exiting task waits on workerdone indefinitely.

If the task still has rings then iouringdeltctxnode() provides the barrier via testandsetbit() in iowqsetexitonidle(). When it has closed all rings though that barrier is gone.

Add the barrier after the setbit().