In the Linux kernel, the following vulnerability has been resolved:
block: don't allow the same type rq_qos add more than once
In our test of iocost, we encountered some list add/del corruptions of innerwalk list in ioctimer_fn.
The reason can be described as follows:
cpu 0 cpu 1 iocqoswrite iocqoswrite
ioc = qtoioc(queue); if (!ioc) { ioc = kzalloc(); ioc = qtoioc(queue); if (!ioc) { ioc = kzalloc(); ... rqqosadd(q, rqos); } ... rqqosadd(q, rqos); ... }
When the io.cost.qos file is written by two cpus concurrently, rqqos may be added to one disk twice. In that case, there will be two iocs enabled and running on one disk. They own different iocgs on their active list. In the ioctimerfn function, because of the iocgs from two iocs have the same root iocg, the root iocg's walklist may be overwritten by each other and this leads to list add/del corruptions in building or destroying the inner_walk list.
And so far, the blk-rq-qos framework works in case that one instance for one type rq_qos per queue by default. This patch make this explicit and also fix the crash above.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50086.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "9724893693850915502794813307866893825",
"length": 876.0
},
"id": "CVE-2022-50086-06225fbb",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"target": {
"file": "block/blk-wbt.c",
"function": "wbt_init"
}
},
{
"signature_type": "Function",
"target": {
"file": "block/blk-rq-qos.h",
"function": "rq_qos_add"
},
"deprecated": false,
"id": "CVE-2022-50086-1788c3a6",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"digest": {
"function_hash": "10232410658167251972773593791507677812",
"length": 300.0
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "207288776165440245432489579962972195252",
"length": 1417.0
},
"id": "CVE-2022-50086-17d9c3bb",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"target": {
"file": "block/blk-iocost.c",
"function": "blk_iocost_init"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "201761130239581525480534703723073646940",
"length": 558.0
},
"id": "CVE-2022-50086-23581c17",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"target": {
"file": "block/blk-iolatency.c",
"function": "blk_iolatency_init"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "207288776165440245432489579962972195252",
"length": 1417.0
},
"id": "CVE-2022-50086-249b37e7",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"target": {
"file": "block/blk-iocost.c",
"function": "blk_iocost_init"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "block/blk-wbt.c",
"function": "wbt_init"
},
"id": "CVE-2022-50086-30e0604a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"digest": {
"function_hash": "9724893693850915502794813307866893825",
"length": 876.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "block/blk-wbt.c"
},
"id": "CVE-2022-50086-37bee222",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"digest": {
"line_hashes": [
"150421849850128126898902471239300869315",
"237138639756750745358609288491551828231",
"66095259362976026764228103455354552312",
"222827200322344229355257746862396053553",
"200681046854316664608405337324475530696",
"195588736114493095713106389220610494718",
"261122690518157122871474958414463932487",
"268804487944571765095810320715738084227",
"227502303917918435524492187024127478983",
"96179158108161861458418901380595294498"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "9724893693850915502794813307866893825",
"length": 876.0
},
"signature_version": "v1",
"id": "CVE-2022-50086-3cc648f1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"target": {
"file": "block/blk-wbt.c",
"function": "wbt_init"
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"145049250421738764665699868734540587874",
"60845763605407085106746063405957558188",
"167930680272675375296116300997890050886",
"25432391329415614074515760560826458154",
"203103901922942279002778359549477661363",
"165518094284555016022106784628111080212",
"108499893967599302006976884757554140117",
"120524649030717355725549428716542943301",
"275400455804944226267925367846985674116",
"52679289906913760892833483748799127539",
"107787034696261908172918936566915360007",
"212304462202401657083860337088895802176"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50086-57be4b19",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"target": {
"file": "block/blk-iocost.c"
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"72034587446654799090628908011119651175",
"336626043282850951643799876894398999009",
"169501063959218111640446266844549120879",
"72947965404995464576530610685285254283",
"204634754943178782804375683618754782957",
"188512847803791616674581974474644624269",
"88182666436330420017182382220073295113",
"204202547628290443426228357900345005500",
"337436839518409590434676566554376263763",
"56686619857109814916764414536067576043",
"77310558707976532537901498967398494069",
"165200664067575205960928175326582284805",
"42665889392420953111773293324375917323"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50086-59ecfa8b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"target": {
"file": "block/blk-iolatency.c"
}
},
{
"signature_type": "Line",
"target": {
"file": "block/blk-iocost.c"
},
"deprecated": false,
"id": "CVE-2022-50086-5b771cdd",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"digest": {
"line_hashes": [
"145049250421738764665699868734540587874",
"60845763605407085106746063405957558188",
"167930680272675375296116300997890050886",
"25432391329415614074515760560826458154",
"203103901922942279002778359549477661363",
"165518094284555016022106784628111080212",
"108499893967599302006976884757554140117",
"120524649030717355725549428716542943301",
"275400455804944226267925367846985674116",
"52679289906913760892833483748799127539",
"107787034696261908172918936566915360007",
"212304462202401657083860337088895802176"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "235271189185449059741300411478772975177",
"length": 384.0
},
"id": "CVE-2022-50086-6231d62f",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"target": {
"file": "block/blk-rq-qos.h",
"function": "rq_qos_add"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "201761130239581525480534703723073646940",
"length": 558.0
},
"signature_version": "v1",
"id": "CVE-2022-50086-739fa1bd",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"target": {
"file": "block/blk-iolatency.c",
"function": "blk_iolatency_init"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "block/blk-iocost.c",
"function": "blk_iocost_init"
},
"id": "CVE-2022-50086-750d23a4",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"digest": {
"function_hash": "207288776165440245432489579962972195252",
"length": 1417.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "block/blk-rq-qos.h"
},
"id": "CVE-2022-50086-76b123cd",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"digest": {
"line_hashes": [
"268214611275325396804853936939286434760",
"215935537527452277981978444804544334644",
"182812626173470405969666716460855473462",
"118620663863117414753596317348442312816",
"160780860580223950139494053949165576825",
"98228175514485527903669429660793342204",
"236607987189956404447612051481136223224",
"43281963028967268772128671875418159835",
"211428139221820122683180951108818231688",
"161029248106678250530064210686735799401",
"287063386316531712288270353377885295409"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"145049250421738764665699868734540587874",
"60845763605407085106746063405957558188",
"167930680272675375296116300997890050886",
"25432391329415614074515760560826458154",
"203103901922942279002778359549477661363",
"165518094284555016022106784628111080212",
"108499893967599302006976884757554140117",
"120524649030717355725549428716542943301",
"275400455804944226267925367846985674116",
"52679289906913760892833483748799127539",
"107787034696261908172918936566915360007",
"212304462202401657083860337088895802176"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50086-7babb190",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"target": {
"file": "block/blk-iocost.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "207288776165440245432489579962972195252",
"length": 1417.0
},
"id": "CVE-2022-50086-899e3e07",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"target": {
"file": "block/blk-iocost.c",
"function": "blk_iocost_init"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "block/blk-wbt.c"
},
"id": "CVE-2022-50086-8b6beba8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"digest": {
"line_hashes": [
"150421849850128126898902471239300869315",
"237138639756750745358609288491551828231",
"66095259362976026764228103455354552312",
"222827200322344229355257746862396053553",
"200681046854316664608405337324475530696",
"195588736114493095713106389220610494718",
"261122690518157122871474958414463932487",
"268804487944571765095810320715738084227",
"227502303917918435524492187024127478983",
"96179158108161861458418901380595294498"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"268214611275325396804853936939286434760",
"215935537527452277981978444804544334644",
"182812626173470405969666716460855473462",
"118620663863117414753596317348442312816",
"160780860580223950139494053949165576825",
"98228175514485527903669429660793342204",
"236607987189956404447612051481136223224",
"281627076535223725697700989834451284027",
"201141743592707177066494718541965353714",
"75897772142513668370630165620974366217",
"313882251460715853872073345049688132690"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50086-8ec9b6cb",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"target": {
"file": "block/blk-rq-qos.h"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "201761130239581525480534703723073646940",
"length": 558.0
},
"signature_version": "v1",
"id": "CVE-2022-50086-92cbd429",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"target": {
"file": "block/blk-iolatency.c",
"function": "blk_iolatency_init"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"150421849850128126898902471239300869315",
"237138639756750745358609288491551828231",
"66095259362976026764228103455354552312",
"222827200322344229355257746862396053553",
"200681046854316664608405337324475530696",
"195588736114493095713106389220610494718",
"261122690518157122871474958414463932487",
"268804487944571765095810320715738084227",
"227502303917918435524492187024127478983",
"96179158108161861458418901380595294498"
],
"threshold": 0.9
},
"id": "CVE-2022-50086-96629b65",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"target": {
"file": "block/blk-wbt.c"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "235271189185449059741300411478772975177",
"length": 384.0
},
"deprecated": false,
"id": "CVE-2022-50086-a0607ed1",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"target": {
"file": "block/blk-rq-qos.h",
"function": "rq_qos_add"
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"145049250421738764665699868734540587874",
"60845763605407085106746063405957558188",
"167930680272675375296116300997890050886",
"25432391329415614074515760560826458154",
"203103901922942279002778359549477661363",
"165518094284555016022106784628111080212",
"108499893967599302006976884757554140117",
"120524649030717355725549428716542943301",
"275400455804944226267925367846985674116",
"52679289906913760892833483748799127539",
"107787034696261908172918936566915360007",
"212304462202401657083860337088895802176"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50086-a1d33e75",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"target": {
"file": "block/blk-iocost.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "235271189185449059741300411478772975177",
"length": 384.0
},
"id": "CVE-2022-50086-a9440f15",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"target": {
"file": "block/blk-rq-qos.h",
"function": "rq_qos_add"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "block/blk-iolatency.c"
},
"id": "CVE-2022-50086-b7bc10f8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
"digest": {
"line_hashes": [
"72034587446654799090628908011119651175",
"336626043282850951643799876894398999009",
"169501063959218111640446266844549120879",
"72947965404995464576530610685285254283",
"204634754943178782804375683618754782957",
"188512847803791616674581974474644624269",
"88182666436330420017182382220073295113",
"204202547628290443426228357900345005500",
"337436839518409590434676566554376263763",
"56686619857109814916764414536067576043",
"77310558707976532537901498967398494069",
"165200664067575205960928175326582284805",
"42665889392420953111773293324375917323"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"72034587446654799090628908011119651175",
"336626043282850951643799876894398999009",
"169501063959218111640446266844549120879",
"72947965404995464576530610685285254283",
"204634754943178782804375683618754782957",
"188512847803791616674581974474644624269",
"88182666436330420017182382220073295113",
"204202547628290443426228357900345005500",
"337436839518409590434676566554376263763",
"56686619857109814916764414536067576043",
"77310558707976532537901498967398494069",
"165200664067575205960928175326582284805",
"42665889392420953111773293324375917323"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50086-c53d9c3b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"target": {
"file": "block/blk-iolatency.c"
}
},
{
"signature_type": "Line",
"target": {
"file": "block/blk-wbt.c"
},
"deprecated": false,
"id": "CVE-2022-50086-cae0f16d",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"digest": {
"line_hashes": [
"150421849850128126898902471239300869315",
"237138639756750745358609288491551828231",
"66095259362976026764228103455354552312",
"222827200322344229355257746862396053553",
"200681046854316664608405337324475530696",
"195588736114493095713106389220610494718",
"261122690518157122871474958414463932487",
"268804487944571765095810320715738084227",
"227502303917918435524492187024127478983",
"96179158108161861458418901380595294498"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"268214611275325396804853936939286434760",
"215935537527452277981978444804544334644",
"182812626173470405969666716460855473462",
"118620663863117414753596317348442312816",
"160780860580223950139494053949165576825",
"98228175514485527903669429660793342204",
"236607987189956404447612051481136223224",
"43281963028967268772128671875418159835",
"211428139221820122683180951108818231688",
"161029248106678250530064210686735799401",
"287063386316531712288270353377885295409"
],
"threshold": 0.9
},
"id": "CVE-2022-50086-d73553f2",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c9bb1acd1d103a3070b2126870eb52761d606ce",
"target": {
"file": "block/blk-rq-qos.h"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "9724893693850915502794813307866893825",
"length": 876.0
},
"signature_version": "v1",
"id": "CVE-2022-50086-db1e235a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"target": {
"file": "block/blk-wbt.c",
"function": "wbt_init"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"268214611275325396804853936939286434760",
"215935537527452277981978444804544334644",
"182812626173470405969666716460855473462",
"118620663863117414753596317348442312816",
"160780860580223950139494053949165576825",
"98228175514485527903669429660793342204",
"236607987189956404447612051481136223224",
"43281963028967268772128671875418159835",
"211428139221820122683180951108818231688",
"161029248106678250530064210686735799401",
"287063386316531712288270353377885295409"
],
"threshold": 0.9
},
"id": "CVE-2022-50086-dd9134d3",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"target": {
"file": "block/blk-rq-qos.h"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "block/blk-iolatency.c",
"function": "blk_iolatency_init"
},
"id": "CVE-2022-50086-e7c6d9c5",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ef66e800a85afc6b54cb95841f6502627eee2e",
"digest": {
"function_hash": "201761130239581525480534703723073646940",
"length": 558.0
}
},
{
"signature_type": "Line",
"target": {
"file": "block/blk-iolatency.c"
},
"deprecated": false,
"id": "CVE-2022-50086-fdc225ce",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
"digest": {
"line_hashes": [
"72034587446654799090628908011119651175",
"336626043282850951643799876894398999009",
"169501063959218111640446266844549120879",
"72947965404995464576530610685285254283",
"204634754943178782804375683618754782957",
"188512847803791616674581974474644624269",
"88182666436330420017182382220073295113",
"204202547628290443426228357900345005500",
"337436839518409590434676566554376263763",
"56686619857109814916764414536067576043",
"77310558707976532537901498967398494069",
"165200664067575205960928175326582284805",
"42665889392420953111773293324375917323"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50086.json"