| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-50079: io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work |
| |
| When the sqpoll is exiting and cancels pending work items, it may need |
| to run task_work. If this happens from within io_uring_cancel_generic(), |
| then it may be under waiting for the io_uring_task waitqueue. This |
| results in the below splat from the scheduler, as the ring mutex may be |
| attempted grabbed while in a TASK_INTERRUPTIBLE state. |
| |
| Ensure that the task state is set appropriately for that, just like what |
| is done for the other cases in io_run_task_work(). |
| |
| do not call blocking ops when !TASK_RUNNING; state=1 set at [<0000000029387fd2>] prepare_to_wait+0x88/0x2fc |
| WARNING: CPU: 6 PID: 59939 at kernel/sched/core.c:8561 __might_sleep+0xf4/0x140 |
| Modules linked in: |
| CPU: 6 UID: 0 PID: 59939 Comm: iou-sqp-59938 Not tainted 6.12.0-rc3-00113-g8d020023b155 #7456 |
| Hardware name: linux,dummy-virt (DT) |
| pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) |
| pc : __might_sleep+0xf4/0x140 |
| lr : __might_sleep+0xf4/0x140 |
| sp : ffff80008c5e7830 |
| x29: ffff80008c5e7830 x28: ffff0000d93088c0 x27: ffff60001c2d7230 |
| x26: dfff800000000000 x25: ffff0000e16b9180 x24: ffff80008c5e7a50 |
| x23: 1ffff000118bcf4a x22: ffff0000e16b9180 x21: ffff0000e16b9180 |
| x20: 000000000000011b x19: ffff80008310fac0 x18: 1ffff000118bcd90 |
| x17: 30303c5b20746120 x16: 74657320313d6574 x15: 0720072007200720 |
| x14: 0720072007200720 x13: 0720072007200720 x12: ffff600036c64f0b |
| x11: 1fffe00036c64f0a x10: ffff600036c64f0a x9 : dfff800000000000 |
| x8 : 00009fffc939b0f6 x7 : ffff0001b6327853 x6 : 0000000000000001 |
| x5 : ffff0001b6327850 x4 : ffff600036c64f0b x3 : ffff8000803c35bc |
| x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000e16b9180 |
| Call trace: |
| __might_sleep+0xf4/0x140 |
| mutex_lock+0x84/0x124 |
| io_handle_tw_list+0xf4/0x260 |
| tctx_task_work_run+0x94/0x340 |
| io_run_task_work+0x1ec/0x3c0 |
| io_uring_cancel_generic+0x364/0x524 |
| io_sq_thread+0x820/0x124c |
| ret_from_fork+0x10/0x20 |
| |
| The Linux kernel CVE team has assigned CVE-2024-50079 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.9 with commit af5d68f8892f8ee8f137648b79ceb2abc153a19b and fixed in 6.11.5 with commit 887ba598d9cfb537bdb3dfd95f087ff8a08cb74d |
| Issue introduced in 6.9 with commit af5d68f8892f8ee8f137648b79ceb2abc153a19b and fixed in 6.12 with commit 8f7033aa4089fbaf7a33995f0f2ee6c9d7b9ca1b |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-50079 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| io_uring/io_uring.h |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/887ba598d9cfb537bdb3dfd95f087ff8a08cb74d |
| https://git.kernel.org/stable/c/8f7033aa4089fbaf7a33995f0f2ee6c9d7b9ca1b |
