CVE-2022-49270

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dm: fix use-after-free in dm_cleanup_zoned_dev()<br /> <br /> dm_cleanup_zoned_dev() uses queue, so it must be called<br /> before blk_cleanup_disk() starts its killing:<br /> <br /> blk_cleanup_disk-&gt;blk_cleanup_queue()-&gt;kobject_put()-&gt;blk_release_queue()-&gt;<br /> -&gt;...RCU...-&gt;blk_free_queue_rcu()-&gt;kmem_cache_free()<br /> <br /> Otherwise, RCU callback may be executed first and<br /> dm_cleanup_zoned_dev() will touch free&amp;#39;d memory:<br /> <br /> BUG: KASAN: use-after-free in dm_cleanup_zoned_dev+0x33/0xd0<br /> Read of size 8 at addr ffff88805ac6e430 by task dmsetup/681<br /> <br /> CPU: 4 PID: 681 Comm: dmsetup Not tainted 5.17.0-rc2+ #6<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x57/0x7d<br /> print_address_description.constprop.0+0x1f/0x150<br /> ? dm_cleanup_zoned_dev+0x33/0xd0<br /> kasan_report.cold+0x7f/0x11b<br /> ? dm_cleanup_zoned_dev+0x33/0xd0<br /> dm_cleanup_zoned_dev+0x33/0xd0<br /> __dm_destroy+0x26a/0x400<br /> ? dm_blk_ioctl+0x230/0x230<br /> ? up_write+0xd8/0x270<br /> dev_remove+0x156/0x1d0<br /> ctl_ioctl+0x269/0x530<br /> ? table_clear+0x140/0x140<br /> ? lock_release+0xb2/0x750<br /> ? remove_all+0x40/0x40<br /> ? rcu_read_lock_sched_held+0x12/0x70<br /> ? lock_downgrade+0x3c0/0x3c0<br /> ? rcu_read_lock_sched_held+0x12/0x70<br /> dm_ctl_ioctl+0xa/0x10<br /> __x64_sys_ioctl+0xb9/0xf0<br /> do_syscall_64+0x3b/0x90<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> RIP: 0033:0x7fb6dfa95c27