CVE-2022-49257
- Source
- https://cve.org/CVERecord?id=CVE-2022-49257
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49257.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49257
- Downstream
- Related
- Published
- 2025-02-26T01:56:11.072Z
- Modified
- 2026-03-11T04:22:38.284916Z
- Summary
- watch_queue: Fix NULL dereference in error cleanup
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
watch_queue: Fix NULL dereference in error cleanup
In watchqueueset_size(), the error cleanup code doesn't take account of the fact that _freepage() can't handle a NULL pointer when trying to free up buffer pages that did get allocated.
Fix this by only calling _freepage() on the pages actually allocated.
Without the fix, this can lead to something like the following:
BUG: KASAN: null-ptr-deref in __freepages+0x1f/0x1b0 mm/pagealloc.c:5473 Read of size 4 at addr 0000000000000034 by task syz-executor168/3599 ... Call Trace: <TASK> __dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dump_stack.c:106 __kasanreport mm/kasan/report.c:446 [inline] kasanreport.cold+0x66/0xdf mm/kasan/report.c:459 checkregioninline mm/kasan/generic.c:183 [inline] kasancheckrange+0x13d/0x180 mm/kasan/generic.c:189 instrumentatomicread include/linux/instrumented.h:71 [inline] atomicread include/linux/atomic/atomic-instrumented.h:27 [inline] pagerefcount include/linux/pageref.h:67 [inline] putpagetestzero include/linux/mm.h:717 [inline] __freepages+0x1f/0x1b0 mm/pagealloc.c:5473 watchqueuesetsize+0x499/0x630 kernel/watchqueue.c:275 pipeioctl+0xac/0x2b0 fs/pipe.c:632 vfsioctl fs/ioctl.c:51 [inline] __dosysioctl fs/ioctl.c:874 [inline] __sesysioctl fs/ioctl.c:860 [inline] __x64sysioctl+0x193/0x200 fs/ioctl.c:860 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49257.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/112a2f9b0a8457794095a0450598f150724ec456
- https://git.kernel.org/stable/c/5ae75b4ed30322b42abaa75ef1b784addfdb7dc9
- https://git.kernel.org/stable/c/695c47cea02b9101e2fc2e7d36d552128592b347
- https://git.kernel.org/stable/c/a635415a064e77bcfbf43da413fd9dfe0bbed9cb
- https://git.kernel.org/stable/c/b6f5ad3e45d19f9c4ee3e8a2aff829f28d68591d
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49257.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-49257
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc73be61cede5882f9605a852414db559c0ebedfdFixed5ae75b4ed30322b42abaa75ef1b784addfdb7dc9Fixed695c47cea02b9101e2fc2e7d36d552128592b347Fixed112a2f9b0a8457794095a0450598f150724ec456Fixedb6f5ad3e45d19f9c4ee3e8a2aff829f28d68591dFixeda635415a064e77bcfbf43da413fd9dfe0bbed9cb
Affected versions
v5.*
Database specific
vanir_signatures
[
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49257-35a5bb5c",
"target": {
"file": "kernel/watch_queue.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"43262517691715942257670191058740776878",
"275112086765420350613866260230741757028",
"242087733265366431217218807782885859929",
"71047390175725218241309330336171080411"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@695c47cea02b9101e2fc2e7d36d552128592b347"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49257-61588e5b",
"target": {
"file": "kernel/watch_queue.c",
"function": "watch_queue_set_size"
},
"digest": {
"length": 1447.0,
"function_hash": "282780513518245143971803437731879579721"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@695c47cea02b9101e2fc2e7d36d552128592b347"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49257-9c4a2622",
"target": {
"file": "kernel/watch_queue.c",
"function": "watch_queue_set_size"
},
"digest": {
"length": 1447.0,
"function_hash": "282780513518245143971803437731879579721"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112a2f9b0a8457794095a0450598f150724ec456"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49257-ee122640",
"target": {
"file": "kernel/watch_queue.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"43262517691715942257670191058740776878",
"275112086765420350613866260230741757028",
"242087733265366431217218807782885859929",
"71047390175725218241309330336171080411"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@112a2f9b0a8457794095a0450598f150724ec456"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49257.json"