Local denial of service via exit-loop spinning

Denial of service in Linux io_uring allows local users to exhaust a CPU or crash the kernel via crafted ring operations. In io_uring/cancel.c, io_uring_cancel_generic() skips sleeping for pending deferred work even when only another task can execute it, leaving the exiting task spinning. Unprivileged access to io_uring is sufficient: a child enables a disabled ring and stops, keeping the parent spinning until the child runs or dies; panic_on_warn converts the warning into a kernel panic.