CVE-2022-50086 (GCVE-0-2022-50086)
Vulnerability from cvelistv5
Published
2025-06-18 11:02
Modified
2025-06-18 11:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: block: don't allow the same type rq_qos add more than once In our test of iocost, we encountered some list add/del corruptions of inner_walk list in ioc_timer_fn. The reason can be described as follows: cpu 0 cpu 1 ioc_qos_write ioc_qos_write ioc = q_to_ioc(queue); if (!ioc) { ioc = kzalloc(); ioc = q_to_ioc(queue); if (!ioc) { ioc = kzalloc(); ... rq_qos_add(q, rqos); } ... rq_qos_add(q, rqos); ... } When the io.cost.qos file is written by two cpus concurrently, rq_qos may be added to one disk twice. In that case, there will be two iocs enabled and running on one disk. They own different iocgs on their active list. In the ioc_timer_fn function, because of the iocgs from two iocs have the same root iocg, the root iocg's walk_list may be overwritten by each other and this leads to list add/del corruptions in building or destroying the inner_walk list. And so far, the blk-rq-qos framework works in case that one instance for one type rq_qos per queue by default. This patch make this explicit and also fix the crash above.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-iocost.c",
            "block/blk-iolatency.c",
            "block/blk-rq-qos.h",
            "block/blk-wbt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "08ef66e800a85afc6b54cb95841f6502627eee2e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0c9bb1acd1d103a3070b2126870eb52761d606ce",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-iocost.c",
            "block/blk-iolatency.c",
            "block/blk-rq-qos.h",
            "block/blk-wbt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don\u0027t allow the same type rq_qos add more than once\n\nIn our test of iocost, we encountered some list add/del corruptions of\ninner_walk list in ioc_timer_fn.\n\nThe reason can be described as follows:\n\ncpu 0\t\t\t\t\tcpu 1\nioc_qos_write\t\t\t\tioc_qos_write\n\nioc = q_to_ioc(queue);\nif (!ioc) {\n        ioc = kzalloc();\n\t\t\t\t\tioc = q_to_ioc(queue);\n\t\t\t\t\tif (!ioc) {\n\t\t\t\t\t\tioc = kzalloc();\n\t\t\t\t\t\t...\n\t\t\t\t\t\trq_qos_add(q, rqos);\n\t\t\t\t\t}\n        ...\n        rq_qos_add(q, rqos);\n        ...\n}\n\nWhen the io.cost.qos file is written by two cpus concurrently, rq_qos may\nbe added to one disk twice. In that case, there will be two iocs enabled\nand running on one disk. They own different iocgs on their active list. In\nthe ioc_timer_fn function, because of the iocgs from two iocs have the\nsame root iocg, the root iocg\u0027s walk_list may be overwritten by each other\nand this leads to list add/del corruptions in building or destroying the\ninner_walk list.\n\nAnd so far, the blk-rq-qos framework works in case that one instance for\none type rq_qos per queue by default. This patch make this explicit and\nalso fix the crash above."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-18T11:02:27.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638"
        },
        {
          "url": "https://git.kernel.org/stable/c/08ef66e800a85afc6b54cb95841f6502627eee2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c9bb1acd1d103a3070b2126870eb52761d606ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/14a6e2eb7df5c7897c15b109cba29ab0c4a791b6"
        }
      ],
      "title": "block: don\u0027t allow the same type rq_qos add more than once",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50086",
    "datePublished": "2025-06-18T11:02:27.283Z",
    "dateReserved": "2025-06-18T10:57:27.410Z",
    "dateUpdated": "2025-06-18T11:02:27.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50086\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:37.690\",\"lastModified\":\"2025-06-18T13:47:40.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock: don\u0027t allow the same type rq_qos add more than once\\n\\nIn our test of iocost, we encountered some list add/del corruptions of\\ninner_walk list in ioc_timer_fn.\\n\\nThe reason can be described as follows:\\n\\ncpu 0\\t\\t\\t\\t\\tcpu 1\\nioc_qos_write\\t\\t\\t\\tioc_qos_write\\n\\nioc = q_to_ioc(queue);\\nif (!ioc) {\\n        ioc = kzalloc();\\n\\t\\t\\t\\t\\tioc = q_to_ioc(queue);\\n\\t\\t\\t\\t\\tif (!ioc) {\\n\\t\\t\\t\\t\\t\\tioc = kzalloc();\\n\\t\\t\\t\\t\\t\\t...\\n\\t\\t\\t\\t\\t\\trq_qos_add(q, rqos);\\n\\t\\t\\t\\t\\t}\\n        ...\\n        rq_qos_add(q, rqos);\\n        ...\\n}\\n\\nWhen the io.cost.qos file is written by two cpus concurrently, rq_qos may\\nbe added to one disk twice. In that case, there will be two iocs enabled\\nand running on one disk. They own different iocgs on their active list. In\\nthe ioc_timer_fn function, because of the iocgs from two iocs have the\\nsame root iocg, the root iocg\u0027s walk_list may be overwritten by each other\\nand this leads to list add/del corruptions in building or destroying the\\ninner_walk list.\\n\\nAnd so far, the blk-rq-qos framework works in case that one instance for\\none type rq_qos per queue by default. This patch make this explicit and\\nalso fix the crash above.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: no permitir que el mismo tipo rq_qos se agregue m\u00e1s de una vez En nuestra prueba de iocost, encontramos algunas corrupciones de lista add/del de la lista inner_walk en ioc_timer_fn. La raz\u00f3n puede describirse de la siguiente manera: cpu 0 cpu 1 ioc_qos_write ioc_qos_write ioc = q_to_ioc(queue); if (!ioc) { ioc = kzalloc(); ioc = q_to_ioc(queue); if (!ioc) { ioc = kzalloc(); ... rq_qos_add(q, rqos); } ... rq_qos_add(q, rqos); ... } Cuando dos CPU escriben el archivo io.cost.qos simult\u00e1neamente, es posible que se agregue rq_qos a un disco dos veces. En ese caso, habr\u00e1 dos ioc habilitados y ejecut\u00e1ndose en un disco. Poseen diferentes iocgs en su lista activa. En la funci\u00f3n ioc_timer_fn, dado que los iocgs de dos iocs tienen el mismo iocg ra\u00edz, la lista walk_list de cada iocg ra\u00edz puede sobrescribirse entre s\u00ed, lo que provoca errores al agregar o eliminar listas al crear o destruir la lista inner_walk. Hasta ahora, el framework blk-rq-qos funciona con una instancia de un tipo rq_qos por cola por defecto. Este parche lo aclara y corrige el fallo mencionado.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08ef66e800a85afc6b54cb95841f6502627eee2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0c9bb1acd1d103a3070b2126870eb52761d606ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/14a6e2eb7df5c7897c15b109cba29ab0c4a791b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.