CVE-2024-56584

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> io_uring/tctx: work around xa_store() allocation error issue<br /> <br /> syzbot triggered the following WARN_ON:<br /> <br /> WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51<br /> <br /> which is the<br /> <br /> WARN_ON_ONCE(!xa_empty(&amp;tctx-&gt;xa));<br /> <br /> sanity check in __io_uring_free() when a io_uring_task is going through<br /> its final put. The syzbot test case includes injecting memory allocation<br /> failures, and it very much looks like xa_store() can fail one of its<br /> memory allocations and end up with -&gt;head being non-NULL even though no<br /> entries exist in the xarray.<br /> <br /> Until this issue gets sorted out, work around it by attempting to<br /> iterate entries in our xarray, and WARN_ON_ONCE() if one is found.