CVE-2022-49406
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/02/2025
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
block: Fix potential deadlock in blk_ia_range_sysfs_show()<br />
<br />
When being read, a sysfs attribute is already protected against removal<br />
with the kobject node active reference counter. As a result, in<br />
blk_ia_range_sysfs_show(), there is no need to take the queue sysfs<br />
lock when reading the value of a range attribute. Using the queue sysfs<br />
lock in this function creates a potential deadlock situation with the<br />
disk removal, something that a lockdep signals with a splat when the<br />
device is removed:<br />
<br />
[ 760.703551] Possible unsafe locking scenario:<br />
[ 760.703551]<br />
[ 760.703554] CPU0 CPU1<br />
[ 760.703556] ---- ----<br />
[ 760.703558] lock(&q->sysfs_lock);<br />
[ 760.703565] lock(kn->active#385);<br />
[ 760.703573] lock(&q->sysfs_lock);<br />
[ 760.703579] lock(kn->active#385);<br />
[ 760.703587]<br />
[ 760.703587] *** DEADLOCK ***<br />
<br />
Solve this by removing the mutex_lock()/mutex_unlock() calls from<br />
blk_ia_range_sysfs_show().
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 5.17.14 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.18 (including) | 5.18.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



