CVE-2024-40922

In the Linux kernel, the following vulnerability has been resolved:

iouring/rsrc: don't lock while !TASKRUNNING

There is a report of iorsrcrefquiesce() locking a mutex while not TASKRUNNING, which is due to forgetting restoring the state back after ioruntaskworksig() and attempts to break out of the waiting loop.

do not call blocking ops when !TASKRUNNING; state=1 set at [<ffffffff815d2494>] prepareto_wait+0xa4/0x380 kernel/sched/wait.c:237 WARNING: CPU: 2 PID: 397056 at kernel/sched/core.c:10099 __might_sleep+0x114/0x160 kernel/sched/core.c:10099 RIP: 0010:__might_sleep+0x114/0x160 kernel/sched/core.c:10099 Call Trace: <TASK> __mutexlockcommon kernel/locking/mutex.c:585 [inline] __mutexlock+0xb4/0x940 kernel/locking/mutex.c:752 iorsrcrefquiesce+0x590/0x940 iouring/rsrc.c:253 iosqebuffersunregister+0xa2/0x340 io_uring/rsrc.c:799 __iouringregister io_uring/register.c:424 [inline] _dosysiouringregister+0x5b9/0x2400 iouring/register.c:613 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xd8/0x270 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x6f/0x77