CVE-2024-40922

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rsrc: don't lock while !TASK_RUNNING

There is a report of io_rsrc_ref_quiesce() locking a mutex while not

TASK_RUNNING, which is due to forgetting restoring the state back after

io_run_task_work_sig() and attempts to break out of the waiting loop.

do not call blocking ops when !TASK_RUNNING; state=1 set at

[<ffffffff815d2494>] prepare_to_wait+0xa4/0x380

kernel/sched/wait.c:237

WARNING: CPU: 2 PID: 397056 at kernel/sched/core.c:10099

__might_sleep+0x114/0x160 kernel/sched/core.c:10099

RIP: 0010:__might_sleep+0x114/0x160 kernel/sched/core.c:10099

Call Trace:

<TASK>

__mutex_lock_common kernel/locking/mutex.c:585 [inline]

__mutex_lock+0xb4/0x940 kernel/locking/mutex.c:752

io_rsrc_ref_quiesce+0x590/0x940 io_uring/rsrc.c:253

io_sqe_buffers_unregister+0xa2/0x340 io_uring/rsrc.c:799

__io_uring_register io_uring/register.c:424 [inline]

__do_sys_io_uring_register+0x5b9/0x2400 io_uring/register.c:613

do_syscal

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References