CVE-2022-49901
- Source
- https://cve.org/CVERecord?id=CVE-2022-49901
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49901.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49901
- Downstream
- Related
- Published
- 2025-05-01T14:10:46.974Z
- Modified
- 2026-03-11T07:52:27.552772Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: Fix kmemleak in blkmqinitallocatedqueue
There is a kmemleak caused by modprobe null_blk.ko
unreferenced object 0xffff8881acb1f000 (size 1024): comm "modprobe", pid 836, jiffies 4294971190 (age 27.068s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff 00 53 99 9e ff ff ff ff .........S...... backtrace: [<000000004a10c249>] kmallocnodetrace+0x22/0x60 [<00000000648f7950>] blkmqallocandinithctx+0x289/0x350 [<00000000af06de0e>] blkmqreallochwctxs+0x2fe/0x3d0 [<00000000e00c1872>] blkmqinitallocated_queue+0x48c/0x1440 [<00000000d16b4e68>] __blkmqallocdisk+0xc8/0x1c0 [<00000000d10c98c3>] 0xffffffffc450d69d [<00000000b9299f48>] 0xffffffffc4538392 [<0000000061c39ed6>] dooneinitcall+0xd0/0x4f0 [<00000000b389383b>] doinitmodule+0x1a4/0x680 [<0000000087cf3542>] loadmodule+0x6249/0x7110 [<00000000beba61b8>] _dosysfinitmodule+0x140/0x200 [<00000000fdcfff51>] dosyscall64+0x35/0x80 [<000000003c0f1f71>] entrySYSCALL64afterhwframe+0x46/0xb0
That is because q->maops is set to NULL before blkrelease_queue is called.
blkmqinitqueuedata blkmqinitallocatedqueue blkmqreallochwctxs for (i = 0; i < set->nrhwqueues; i++) { oldhctx = xaload(&q->hctxtable, i); if (!blkmqallocandinithctx(.., i, ..)) [1] if (!old_hctx) break;
xa_for_each_start(&q->hctx_table, j, hctx, j) blk_mq_exit_hctx(q, set, hctx, j); [2] if (!q->nr_hw_queues) [3] goto err_hctxs;errexit: q->mqops = NULL; [4]
blkputqueue blkreleasequeue if (queueismq(q)) [5] blkmqrelease(q);
will be cleaned up in blkmqrelease. will not be called. The hctxs in q->unusedhctxlist are leaked.
To fix it, call blkreleasequeue in exception path.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49901.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/2dc97e15a54b7bdf457848aa8c663c98a24e58a6
- https://git.kernel.org/stable/c/943f45b9399ed8b2b5190cbc797995edaa97f58f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49901.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-49901
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2f8f1336a48bd5186de3476da0a3e2ec06d0533aFixed2dc97e15a54b7bdf457848aa8c663c98a24e58a6Fixed943f45b9399ed8b2b5190cbc797995edaa97f58f
Affected versions
v5.*
v6.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49901.json"
vanir_signatures
[
{
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "blk_mq_init_allocated_queue",
"file": "block/blk-mq.c"
},
"digest": {
"function_hash": "252587641826448591775800530211590866371",
"length": 1363.0
},
"id": "CVE-2022-49901-364d4d71",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@943f45b9399ed8b2b5190cbc797995edaa97f58f",
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "block/blk-mq.c"
},
"digest": {
"line_hashes": [
"146053412050483418118980813579496572110",
"6811432938238698353798628003096187514",
"276374457388253915257325565157655084280",
"340162986989691966336517648209247606394",
"25372939894916511056883852811850527747",
"73118017550601019498733970480234591954"
],
"threshold": 0.9
},
"id": "CVE-2022-49901-81a6e87c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@943f45b9399ed8b2b5190cbc797995edaa97f58f",
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "block/blk-mq.c"
},
"digest": {
"line_hashes": [
"146053412050483418118980813579496572110",
"6811432938238698353798628003096187514",
"276374457388253915257325565157655084280",
"340162986989691966336517648209247606394",
"25372939894916511056883852811850527747",
"73118017550601019498733970480234591954"
],
"threshold": 0.9
},
"id": "CVE-2022-49901-9d28b080",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dc97e15a54b7bdf457848aa8c663c98a24e58a6",
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "blk_mq_init_allocated_queue",
"file": "block/blk-mq.c"
},
"digest": {
"function_hash": "252587641826448591775800530211590866371",
"length": 1363.0
},
"id": "CVE-2022-49901-fce808fa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dc97e15a54b7bdf457848aa8c663c98a24e58a6",
"signature_version": "v1"
}
]