In the Linux kernel, the following vulnerability has been resolved:
block: release rq qos structures for queue without disk
blkcginitqueue() may add rq qos structures to request queue, previously blkcleanupqueue() calls rqqosexit() to release them, but commit 8e141f9eb803 ("block: drain file system I/O on delgendisk") moves rqqosexit() into delgendisk(), so memory leak is caused because queues may not have disk, such as un-present scsi luns, nvme admin queue, ...
Fixes the issue by adding rqqosexit() to blkcleanupqueue() back.
BTW, v5.18 won't need this patch any more since we move blkcginitqueue()/blkcgexitqueue() into disk allocation/release handler, and patches have been in for-5.18/block.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 569.0, "function_hash": "107432175246841569158372271057591090194" }, "id": "CVE-2022-48846-0d2c7a2e", "deprecated": false, "target": { "file": "block/blk-core.c", "function": "blk_cleanup_queue" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c2c8e2ef3a3ec79de8cbc80a06ca0c21df8c29" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "169610268665500395048411235718635433157", "106944787450741439426935382937288189312", "154950779633559416520438082515408500888", "239574291356161640869230270181254844233", "100649618383731441368751400155054467126", "83871975652732001006961703602377812916", "9511140839249228093338640684817464137" ] }, "id": "CVE-2022-48846-273f084f", "deprecated": false, "target": { "file": "block/blk-core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60c2c8e2ef3a3ec79de8cbc80a06ca0c21df8c29" }, { "signature_version": "v1", "digest": { "length": 569.0, "function_hash": "107432175246841569158372271057591090194" }, "id": "CVE-2022-48846-2b5fd4e9", "deprecated": false, "target": { "file": "block/blk-core.c", "function": "blk_cleanup_queue" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4ad8736ac982111bb0be8306bf19c8207f6600e" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "289936853590547145967356073827903011414", "106944787450741439426935382937288189312", "154950779633559416520438082515408500888", "239574291356161640869230270181254844233", "100649618383731441368751400155054467126", "83871975652732001006961703602377812916", "9511140839249228093338640684817464137" ] }, "id": "CVE-2022-48846-31e5bf61", "deprecated": false, "target": { "file": "block/blk-core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@daaca3522a8e67c46e39ef09c1d542e866f85f3b" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "83915082143718307015851913865040509085", "248018259788741585552745556622357670954", "27922886188618613472470922227666187173", "259546725456802968832047524253529652749", "100649618383731441368751400155054467126", "83871975652732001006961703602377812916", "9511140839249228093338640684817464137" ] }, "id": "CVE-2022-48846-5e40126e", "deprecated": false, "target": { "file": "block/blk-core.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4ad8736ac982111bb0be8306bf19c8207f6600e" }, { "signature_version": "v1", "digest": { "length": 569.0, "function_hash": "107432175246841569158372271057591090194" }, "id": "CVE-2022-48846-e9e1cf07", "deprecated": false, "target": { "file": "block/blk-core.c", "function": "blk_cleanup_queue" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@daaca3522a8e67c46e39ef09c1d542e866f85f3b" } ] }