CVE-2022-49412

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bfq: Avoid merging queues with different parents<br /> <br /> It can happen that the parent of a bfqq changes between the moment we<br /> decide two queues are worth to merge (and set bic-&gt;stable_merge_bfqq)<br /> and the moment bfq_setup_merge() is called. This can happen e.g. because<br /> the process submitted IO for a different cgroup and thus bfqq got<br /> reparented. It can even happen that the bfqq we are merging with has<br /> parent cgroup that is already offline and going to be destroyed in which<br /> case the merge can lead to use-after-free issues such as:<br /> <br /> BUG: KASAN: use-after-free in __bfq_deactivate_entity+0x9cb/0xa50<br /> Read of size 8 at addr ffff88800693c0c0 by task runc:[2:INIT]/10544<br /> <br /> CPU: 0 PID: 10544 Comm: runc:[2:INIT] Tainted: G E 5.15.2-0.g5fb85fd-default #1 openSUSE Tumbleweed (unreleased) f1f3b891c72369aebecd2e43e4641a6358867c70<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x46/0x5a<br /> print_address_description.constprop.0+0x1f/0x140<br /> ? __bfq_deactivate_entity+0x9cb/0xa50<br /> kasan_report.cold+0x7f/0x11b<br /> ? __bfq_deactivate_entity+0x9cb/0xa50<br /> __bfq_deactivate_entity+0x9cb/0xa50<br /> ? update_curr+0x32f/0x5d0<br /> bfq_deactivate_entity+0xa0/0x1d0<br /> bfq_del_bfqq_busy+0x28a/0x420<br /> ? resched_curr+0x116/0x1d0<br /> ? bfq_requeue_bfqq+0x70/0x70<br /> ? check_preempt_wakeup+0x52b/0xbc0<br /> __bfq_bfqq_expire+0x1a2/0x270<br /> bfq_bfqq_expire+0xd16/0x2160<br /> ? try_to_wake_up+0x4ee/0x1260<br /> ? bfq_end_wr_async_queues+0xe0/0xe0<br /> ? _raw_write_unlock_bh+0x60/0x60<br /> ? _raw_spin_lock_irq+0x81/0xe0<br /> bfq_idle_slice_timer+0x109/0x280<br /> ? bfq_dispatch_request+0x4870/0x4870<br /> __hrtimer_run_queues+0x37d/0x700<br /> ? enqueue_hrtimer+0x1b0/0x1b0<br /> ? kvm_clock_get_cycles+0xd/0x10<br /> ? ktime_get_update_offsets_now+0x6f/0x280<br /> hrtimer_interrupt+0x2c8/0x740<br /> <br /> Fix the problem by checking that the parent of the two bfqqs we are<br /> merging in bfq_setup_merge() is the same.