CVE-2022-50752

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: Remove unnecessary bioput() in raid5readonechunk()

When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed:

============================================================================= BUG bio-200 (Not tainted): Object already free

Allocated in mempoolallocslab+0x17/0x20 age=3 cpu=2 pid=7504 _slaballoc.constprop.0+0x5a/0xb0 kmemcachealloc+0x31e/0x330 mempoolallocslab+0x17/0x20 mempoolalloc+0x100/0x2b0 bioallocbioset+0x181/0x460 dompagereadpage+0x776/0xd00 mpagereadahead+0x166/0x320 blkdevreadahead+0x15/0x20 readpages+0x13f/0x5f0 pagecacheraunbounded+0x18d/0x220 forcepagecachera+0x181/0x1c0 pagecachesyncra+0x65/0xb0 filemapgetpages+0x1df/0xaf0 filemapread+0x1e1/0x700 blkdevreaditer+0x1e5/0x330 vfsread+0x42a/0x570 Freed in mempoolfreeslab+0x17/0x20 age=3 cpu=2 pid=7504 kmemcachefree+0x46d/0x490 mempoolfreeslab+0x17/0x20 mempoolfree+0x66/0x190 biofree+0x78/0x90 bioput+0x100/0x1a0 raid5makerequest+0x2259/0x2450 mdhandlerequest+0x402/0x600 mdsubmitbio+0xd9/0x120 _submitbio+0x11f/0x1b0 submitbionoacctnocheck+0x204/0x480 submitbionoacct+0x32e/0xc70 submitbio+0x98/0x1a0 mpagereadahead+0x250/0x320 blkdevreadahead+0x15/0x20 readpages+0x13f/0x5f0 pagecacheraunbounded+0x18d/0x220 Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: raid5wq raid5dowork Call Trace: <TASK> dumpstacklvl+0x5a/0x78 dumpstack+0x10/0x16 printtrailer+0x158/0x165 objecterr+0x35/0x50 freedebugprocessing.cold+0xb7/0xbe _slabfree+0x1ae/0x330 kmemcachefree+0x46d/0x490 mempoolfreeslab+0x17/0x20 mempoolfree+0x66/0x190 biofree+0x78/0x90 bioput+0x100/0x1a0 mpageendio+0x36/0x150 bioendio+0x2fd/0x360 mdendioacct+0x7e/0x90 bioendio+0x2fd/0x360 handlefailedstripe+0x960/0xb80 handlestripe+0x1348/0x3760 handleactivestripes.constprop.0+0x72a/0xaf0 raid5dowork+0x177/0x330 processonework+0x616/0xb20 workerthread+0x2bd/0x6f0 kthread+0x179/0x1b0 retfrom_fork+0x22/0x30 </TASK>

The double free is caused by an unnecessary bioput() in the if(isbadblock(...)) error path in raid5readone_chunk().

The error path was moved ahead of bioallocclone() in c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5readonechunk"). The previous code checked and freed alignbio which required a bioput. After the move that is no longer needed as raidbio is returned to the control of the common io path which performs its own endio resulting in a double free on bad device blocks.