CVE-2022-50452

In the Linux kernel, the following vulnerability has been resolved:

net: sched: cake: fix null pointer access issue when cake_init() fails

When the default qdisc is cake, if the qdisc of devqueue fails to be inited during mqprioinit(), cake_reset() is invoked to clear resources. In this case, the tins is NULL, and it will cause gpf issue.

The process is as follows: qdisccreatedflt() cakeinit() q->tins = kvcalloc(...) --->failed, q->tins is NULL ... qdiscput() ... cakereset() ... cakedequeue_one() b = &q->tins[...] --->q->tins is NULL

The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:cakedequeueone+0xc9/0x3c0 Call Trace: <TASK> cakereset+0xb1/0x140 qdiscreset+0xed/0x6f0 qdiscdestroy+0x82/0x4c0 qdiscput+0x9e/0xb0 qdisccreatedflt+0x2c3/0x4a0 mqprioinit+0xa71/0x1760 qdisccreate+0x3eb/0x1000 tcmodifyqdisc+0x408/0x1720 rtnetlinkrcvmsg+0x38e/0xac0 netlinkrcvskb+0x12d/0x3a0 netlinkunicast+0x4a2/0x740 netlinksendmsg+0x826/0xcc0 sock_sendmsg+0xc5/0x100 ____sys_sendmsg+0x583/0x690 ___sys_sendmsg+0xe8/0x160 _syssendmsg+0xbf/0x160 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0 RIP: 0033:0x7f89e5122d04 </TASK>