In the Linux kernel, the following vulnerability has been resolved:
block: don't allow the same type rq_qos add more than once
In our test of iocost, we encountered some list add/del corruptions of innerwalk list in ioctimer_fn.
The reason can be described as follows:
cpu 0 cpu 1 iocqoswrite iocqoswrite
ioc = qtoioc(queue); if (!ioc) { ioc = kzalloc(); ioc = qtoioc(queue); if (!ioc) { ioc = kzalloc(); ... rqqosadd(q, rqos); } ... rqqosadd(q, rqos); ... }
When the io.cost.qos file is written by two cpus concurrently, rqqos may be added to one disk twice. In that case, there will be two iocs enabled and running on one disk. They own different iocgs on their active list. In the ioctimerfn function, because of the iocgs from two iocs have the same root iocg, the root iocg's walklist may be overwritten by each other and this leads to list add/del corruptions in building or destroying the inner_walk list.
And so far, the blk-rq-qos framework works in case that one instance for one type rq_qos per queue by default. This patch make this explicit and also fix the crash above.
{ "vanir_signatures": [ { "signature_type": "Function", "target": { "file": "block/blk-wbt.c", "function": "wbt_init" }, "id": "CVE-2022-50086-06225fbb", "digest": { "length": 876.0, "function_hash": "9724893693850915502794813307866893825" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-rq-qos.h", "function": "rq_qos_add" }, "id": "CVE-2022-50086-1788c3a6", "digest": { "length": 300.0, "function_hash": "10232410658167251972773593791507677812" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iocost.c", "function": "blk_iocost_init" }, "id": "CVE-2022-50086-17d9c3bb", "digest": { "length": 1417.0, "function_hash": "207288776165440245432489579962972195252" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iolatency.c", "function": "blk_iolatency_init" }, "id": "CVE-2022-50086-23581c17", "digest": { "length": 558.0, "function_hash": "201761130239581525480534703723073646940" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iocost.c", "function": "blk_iocost_init" }, "id": "CVE-2022-50086-249b37e7", "digest": { "length": 1417.0, "function_hash": "207288776165440245432489579962972195252" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-wbt.c", "function": "wbt_init" }, "id": "CVE-2022-50086-30e0604a", "digest": { "length": 876.0, "function_hash": "9724893693850915502794813307866893825" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-wbt.c" }, "id": "CVE-2022-50086-37bee222", "digest": { "threshold": 0.9, "line_hashes": [ "150421849850128126898902471239300869315", "237138639756750745358609288491551828231", "66095259362976026764228103455354552312", "222827200322344229355257746862396053553", "200681046854316664608405337324475530696", "195588736114493095713106389220610494718", "261122690518157122871474958414463932487", "268804487944571765095810320715738084227", "227502303917918435524492187024127478983", "96179158108161861458418901380595294498" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-wbt.c", "function": "wbt_init" }, "id": "CVE-2022-50086-3cc648f1", "digest": { "length": 876.0, "function_hash": "9724893693850915502794813307866893825" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iocost.c" }, "id": "CVE-2022-50086-57be4b19", "digest": { "threshold": 0.9, "line_hashes": [ "145049250421738764665699868734540587874", "60845763605407085106746063405957558188", "167930680272675375296116300997890050886", "25432391329415614074515760560826458154", "203103901922942279002778359549477661363", "165518094284555016022106784628111080212", "108499893967599302006976884757554140117", "120524649030717355725549428716542943301", "275400455804944226267925367846985674116", "52679289906913760892833483748799127539", "107787034696261908172918936566915360007", "212304462202401657083860337088895802176" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iolatency.c" }, "id": "CVE-2022-50086-59ecfa8b", "digest": { "threshold": 0.9, "line_hashes": [ "72034587446654799090628908011119651175", "336626043282850951643799876894398999009", "169501063959218111640446266844549120879", "72947965404995464576530610685285254283", "204634754943178782804375683618754782957", "188512847803791616674581974474644624269", "88182666436330420017182382220073295113", "204202547628290443426228357900345005500", "337436839518409590434676566554376263763", "56686619857109814916764414536067576043", "77310558707976532537901498967398494069", "165200664067575205960928175326582284805", "42665889392420953111773293324375917323" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iocost.c" }, "id": "CVE-2022-50086-5b771cdd", "digest": { "threshold": 0.9, "line_hashes": [ "145049250421738764665699868734540587874", "60845763605407085106746063405957558188", "167930680272675375296116300997890050886", "25432391329415614074515760560826458154", "203103901922942279002778359549477661363", "165518094284555016022106784628111080212", "108499893967599302006976884757554140117", "120524649030717355725549428716542943301", "275400455804944226267925367846985674116", "52679289906913760892833483748799127539", "107787034696261908172918936566915360007", "212304462202401657083860337088895802176" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-rq-qos.h", "function": "rq_qos_add" }, "id": "CVE-2022-50086-6231d62f", "digest": { "length": 384.0, "function_hash": "235271189185449059741300411478772975177" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iolatency.c", "function": "blk_iolatency_init" }, "id": "CVE-2022-50086-739fa1bd", "digest": { "length": 558.0, "function_hash": "201761130239581525480534703723073646940" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iocost.c", "function": "blk_iocost_init" }, "id": "CVE-2022-50086-750d23a4", "digest": { "length": 1417.0, "function_hash": "207288776165440245432489579962972195252" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-rq-qos.h" }, "id": "CVE-2022-50086-76b123cd", "digest": { "threshold": 0.9, "line_hashes": [ "268214611275325396804853936939286434760", "215935537527452277981978444804544334644", "182812626173470405969666716460855473462", "118620663863117414753596317348442312816", "160780860580223950139494053949165576825", "98228175514485527903669429660793342204", "236607987189956404447612051481136223224", "43281963028967268772128671875418159835", "211428139221820122683180951108818231688", "161029248106678250530064210686735799401", "287063386316531712288270353377885295409" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iocost.c" }, "id": "CVE-2022-50086-7babb190", "digest": { "threshold": 0.9, "line_hashes": [ "145049250421738764665699868734540587874", "60845763605407085106746063405957558188", "167930680272675375296116300997890050886", "25432391329415614074515760560826458154", "203103901922942279002778359549477661363", "165518094284555016022106784628111080212", "108499893967599302006976884757554140117", "120524649030717355725549428716542943301", "275400455804944226267925367846985674116", "52679289906913760892833483748799127539", "107787034696261908172918936566915360007", "212304462202401657083860337088895802176" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iocost.c", "function": "blk_iocost_init" }, "id": "CVE-2022-50086-899e3e07", "digest": { "length": 1417.0, "function_hash": "207288776165440245432489579962972195252" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-wbt.c" }, "id": "CVE-2022-50086-8b6beba8", "digest": { "threshold": 0.9, "line_hashes": [ "150421849850128126898902471239300869315", "237138639756750745358609288491551828231", "66095259362976026764228103455354552312", "222827200322344229355257746862396053553", "200681046854316664608405337324475530696", "195588736114493095713106389220610494718", "261122690518157122871474958414463932487", "268804487944571765095810320715738084227", "227502303917918435524492187024127478983", "96179158108161861458418901380595294498" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-rq-qos.h" }, "id": "CVE-2022-50086-8ec9b6cb", "digest": { "threshold": 0.9, "line_hashes": [ "268214611275325396804853936939286434760", "215935537527452277981978444804544334644", "182812626173470405969666716460855473462", "118620663863117414753596317348442312816", "160780860580223950139494053949165576825", "98228175514485527903669429660793342204", "236607987189956404447612051481136223224", "281627076535223725697700989834451284027", "201141743592707177066494718541965353714", "75897772142513668370630165620974366217", "313882251460715853872073345049688132690" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iolatency.c", "function": "blk_iolatency_init" }, "id": "CVE-2022-50086-92cbd429", "digest": { "length": 558.0, "function_hash": "201761130239581525480534703723073646940" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-wbt.c" }, "id": "CVE-2022-50086-96629b65", "digest": { "threshold": 0.9, "line_hashes": [ "150421849850128126898902471239300869315", "237138639756750745358609288491551828231", "66095259362976026764228103455354552312", "222827200322344229355257746862396053553", "200681046854316664608405337324475530696", "195588736114493095713106389220610494718", "261122690518157122871474958414463932487", "268804487944571765095810320715738084227", "227502303917918435524492187024127478983", "96179158108161861458418901380595294498" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-rq-qos.h", "function": "rq_qos_add" }, "id": "CVE-2022-50086-a0607ed1", "digest": { "length": 384.0, "function_hash": "235271189185449059741300411478772975177" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iocost.c" }, "id": "CVE-2022-50086-a1d33e75", "digest": { "threshold": 0.9, "line_hashes": [ "145049250421738764665699868734540587874", "60845763605407085106746063405957558188", "167930680272675375296116300997890050886", "25432391329415614074515760560826458154", "203103901922942279002778359549477661363", "165518094284555016022106784628111080212", "108499893967599302006976884757554140117", "120524649030717355725549428716542943301", "275400455804944226267925367846985674116", "52679289906913760892833483748799127539", "107787034696261908172918936566915360007", "212304462202401657083860337088895802176" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-rq-qos.h", "function": "rq_qos_add" }, "id": "CVE-2022-50086-a9440f15", "digest": { "length": 384.0, "function_hash": "235271189185449059741300411478772975177" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iolatency.c" }, "id": "CVE-2022-50086-b7bc10f8", "digest": { "threshold": 0.9, "line_hashes": [ "72034587446654799090628908011119651175", "336626043282850951643799876894398999009", "169501063959218111640446266844549120879", "72947965404995464576530610685285254283", "204634754943178782804375683618754782957", "188512847803791616674581974474644624269", "88182666436330420017182382220073295113", "204202547628290443426228357900345005500", "337436839518409590434676566554376263763", "56686619857109814916764414536067576043", "77310558707976532537901498967398494069", "165200664067575205960928175326582284805", "42665889392420953111773293324375917323" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iolatency.c" }, "id": "CVE-2022-50086-c53d9c3b", "digest": { "threshold": 0.9, "line_hashes": [ "72034587446654799090628908011119651175", "336626043282850951643799876894398999009", "169501063959218111640446266844549120879", "72947965404995464576530610685285254283", "204634754943178782804375683618754782957", "188512847803791616674581974474644624269", "88182666436330420017182382220073295113", "204202547628290443426228357900345005500", "337436839518409590434676566554376263763", "56686619857109814916764414536067576043", "77310558707976532537901498967398494069", "165200664067575205960928175326582284805", "42665889392420953111773293324375917323" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-wbt.c" }, "id": "CVE-2022-50086-cae0f16d", "digest": { "threshold": 0.9, "line_hashes": [ "150421849850128126898902471239300869315", "237138639756750745358609288491551828231", "66095259362976026764228103455354552312", "222827200322344229355257746862396053553", "200681046854316664608405337324475530696", "195588736114493095713106389220610494718", "261122690518157122871474958414463932487", "268804487944571765095810320715738084227", "227502303917918435524492187024127478983", "96179158108161861458418901380595294498" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-rq-qos.h" }, "id": "CVE-2022-50086-d73553f2", "digest": { "threshold": 0.9, "line_hashes": [ "268214611275325396804853936939286434760", "215935537527452277981978444804544334644", "182812626173470405969666716460855473462", "118620663863117414753596317348442312816", "160780860580223950139494053949165576825", "98228175514485527903669429660793342204", "236607987189956404447612051481136223224", "43281963028967268772128671875418159835", "211428139221820122683180951108818231688", "161029248106678250530064210686735799401", "287063386316531712288270353377885295409" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-wbt.c", "function": "wbt_init" }, "id": "CVE-2022-50086-db1e235a", "digest": { "length": 876.0, "function_hash": "9724893693850915502794813307866893825" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-rq-qos.h" }, "id": "CVE-2022-50086-dd9134d3", "digest": { "threshold": 0.9, "line_hashes": [ "268214611275325396804853936939286434760", "215935537527452277981978444804544334644", "182812626173470405969666716460855473462", "118620663863117414753596317348442312816", "160780860580223950139494053949165576825", "98228175514485527903669429660793342204", "236607987189956404447612051481136223224", "43281963028967268772128671875418159835", "211428139221820122683180951108818231688", "161029248106678250530064210686735799401", "287063386316531712288270353377885295409" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Function", "target": { "file": "block/blk-iolatency.c", "function": "blk_iolatency_init" }, "id": "CVE-2022-50086-e7c6d9c5", "digest": { "length": 558.0, "function_hash": "201761130239581525480534703723073646940" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e", "signature_version": "v1" }, { "signature_type": "Line", "target": { "file": "block/blk-iolatency.c" }, "id": "CVE-2022-50086-fdc225ce", "digest": { "threshold": 0.9, "line_hashes": [ "72034587446654799090628908011119651175", "336626043282850951643799876894398999009", "169501063959218111640446266844549120879", "72947965404995464576530610685285254283", "204634754943178782804375683618754782957", "188512847803791616674581974474644624269", "88182666436330420017182382220073295113", "204202547628290443426228357900345005500", "337436839518409590434676566554376263763", "56686619857109814916764414536067576043", "77310558707976532537901498967398494069", "165200664067575205960928175326582284805", "42665889392420953111773293324375917323" ] }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6", "signature_version": "v1" } ] }