CVE-2022-50530

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: fix null pointer dereference in blkmqclearrqmapping()

Our syzkaller report a null pointer dereference, root cause is following:

_blkmqallocmapandrqs set->tags[hctxidx] = blkmqallocmapandrqs blkmqallocmapandrqs blkmqallocrqs // failed due to oom allocpagesnode // set->tags[hctxidx] is still NULL blkmqfreerqs drvtags = set->tags[hctxidx]; // null pointer dereference is triggered blkmqclearrqmapping(drv_tags, ...)

This is because commit 63064be150e4 ("blk-mq: Add blkmqallocmapand_rqs()") merged the two steps:

1) set->tags[hctxidx] = blkmqallocrqmap() 2) blkmqallocrqs(..., set->tags[hctx_idx])

into one step:

set->tags[hctxidx] = blkmqallocmapandrqs()

Since tags is not initialized yet in this case, fix the problem by checking if tags is NULL pointer in blkmqclearrqmapping().