CVE-2022-49080

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix mpolnew leak in sharedpolicy_replace

If mpolnew is allocated but not used in restart loop, mpolnew will be freed via mpolput before returning to the caller. But refcnt is not initialized yet, so mpolput could not do the right things and might leak the unused mpol_new. This would happen if mempolicy was updated on the shared shmem file while the sp->lock has been dropped during the memory allocation.

This issue could be triggered easily with the below code snippet if there are many processes doing the below work at the same time:

shmid = shmget((keyt)5566, 1024 * PAGESIZE, 0666|IPCCREAT); shm = shmat(shmid, 0, 0); loop many times { mbind(shm, 1024 * PAGESIZE, MPOLLOCAL, mask, maxnode, 0); mbind(shm + 128 * PAGESIZE, 128 * PAGESIZE, MPOLDEFAULT, mask, maxnode, 0); }