CVE-2022-49901
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49901
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49901.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49901
- Downstream
- Related
- Published
- 2025-05-01T14:10:46Z
- Modified
- 2025-10-16T01:29:24.305605Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: Fix kmemleak in blkmqinitallocatedqueue
There is a kmemleak caused by modprobe null_blk.ko
unreferenced object 0xffff8881acb1f000 (size 1024): comm "modprobe", pid 836, jiffies 4294971190 (age 27.068s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff 00 53 99 9e ff ff ff ff .........S...... backtrace: [<000000004a10c249>] kmallocnodetrace+0x22/0x60 [<00000000648f7950>] blkmqallocandinithctx+0x289/0x350 [<00000000af06de0e>] blkmqreallochwctxs+0x2fe/0x3d0 [<00000000e00c1872>] blkmqinitallocatedqueue+0x48c/0x1440 [<00000000d16b4e68>] _blkmqallocdisk+0xc8/0x1c0 [<00000000d10c98c3>] 0xffffffffc450d69d [<00000000b9299f48>] 0xffffffffc4538392 [<0000000061c39ed6>] dooneinitcall+0xd0/0x4f0 [<00000000b389383b>] doinitmodule+0x1a4/0x680 [<0000000087cf3542>] loadmodule+0x6249/0x7110 [<00000000beba61b8>] _dosysfinitmodule+0x140/0x200 [<00000000fdcfff51>] dosyscall64+0x35/0x80 [<000000003c0f1f71>] entrySYSCALL64afterhwframe+0x46/0xb0
That is because q->maops is set to NULL before blkrelease_queue is called.
blkmqinitqueuedata blkmqinitallocatedqueue blkmqreallochwctxs for (i = 0; i < set->nrhwqueues; i++) { oldhctx = xaload(&q->hctxtable, i); if (!blkmqallocandinithctx(.., i, ..)) [1] if (!old_hctx) break;
xa_for_each_start(&q->hctx_table, j, hctx, j) blk_mq_exit_hctx(q, set, hctx, j); [2] if (!q->nr_hw_queues) [3] goto err_hctxs;errexit: q->mqops = NULL; [4]
blkputqueue blkreleasequeue if (queueismq(q)) [5] blkmqrelease(q);
will be cleaned up in blkmqrelease. will not be called. The hctxs in q->unusedhctxlist are leaked.
To fix it, call blkreleasequeue in exception path.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2f8f1336a48bd5186de3476da0a3e2ec06d0533aFixed2dc97e15a54b7bdf457848aa8c663c98a24e58a6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2f8f1336a48bd5186de3476da0a3e2ec06d0533aFixed943f45b9399ed8b2b5190cbc797995edaa97f58f