CVE-2022-50752: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
In the Linux kernel, the following vulnerability has been resolved:
md/raid5: Remove unnecessary bioput() in raid5readonechunk()
When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed:
============================================================================= BUG bio-200 (Not tainted): Object already free ----------------------------------------------------------------------------- Allocated in mempoolallocslab+0x17/0x20 age=3 cpu=2 pid=7504 slaballoc.constprop.0+0x5a/0xb0 kmemcachealloc+0x31e/0x330 mempoolallocslab+0x17/0x20 mempoolalloc+0x100/0x2b0 bioallocbioset+0x181/0x460 dompagereadpage+0x776/0xd00 mpagereadahead+0x166/0x320 blkdevreadahead+0x15/0x20 readpages+0x13f/0x5f0 pagecacheraunbounded+0x18d/0x220 forcepagecachera+0x181/0x1c0 pagecachesyncra+0x65/0xb0 filemapgetpages+0x1df/0xaf0 filemapread+0x1e1/0x700 blkdevreaditer+0x1e5/0x330 vfsread+0x42a/0x570 Freed in mempoolfreeslab+0x17/0x20 age=3 cpu=2 pid=7504 kmemcachefree+0x46d/0x490 mempoolfreeslab+0x17/0x20 mempoolfree+0x66/0x190 biofree+0x78/0x90 bioput+0x100/0x1a0 raid5makerequest+0x2259/0x2450 mdhandlerequest+0x402/0x600 mdsubmitbio+0xd9/0x120 submitbio+0x11f/0x1b0 submitbionoacctnocheck+0x204/0x480 submitbionoacct+0x32e/0xc70 submitbio+0x98/0x1a0 mpagereadahead+0x250/0x320 blkdevreadahead+0x15/0x20 readpages+0x13f/0x5f0 pagecacheraunbounded+0x18d/0x220 Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: raid5wq raid5dowork Call Trace: <TASK> dumpstacklvl+0x5a/0x78 dumpstack+0x10/0x16 printtrailer+0x158/0x165 objecterr+0x35/0x50 freedebugprocessing.cold+0xb7/0xbe slabfree+0x1ae/0x330 kmemcachefree+0x46d/0x490 mempoolfreeslab+0x17/0x20 mempoolfree+0x66/0x190 biofree+0x78/0x90 bioput+0x100/0x1a0 mpageendio+0x36/0x150 bioendio+0x2fd/0x360 mdendioacct+0x7e/0x90 bioendio+0x2fd/0x360 handlefailedstripe+0x960/0xb80 handlestripe+0x1348/0x3760 handleactivestripes.constprop.0+0x72a/0xaf0 raid5dowork+0x177/0x330 processonework+0x616/0xb20 workerthread+0x2bd/0x6f0 kthread+0x179/0x1b0 retfromfork+0x22/0x30 </TASK>
The double free is caused by an unnecessary bioput() in the if(isbadblock(...)) error path in raid5readonechunk().
The error path was moved ahead of bioallocclone() in c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5readonechunk"). The previous code checked and freed alignbio which required a bioput. After the move that is no longer needed as raidbio is returned to the control of the common io path which performs its own endio resulting in a double free on bad device blocks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel md/raid5to a version that resolves this vulnerability.Patch c82aa1b76787c
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50752?
CVE-2022-50752 is considered to have a moderate severity due to its effects on system stability.
What systems are affected by CVE-2022-50752?
CVE-2022-50752 affects the Linux kernel specifically when handling RAID5 configurations.
How do I fix CVE-2022-50752?
To fix CVE-2022-50752, ensure your Linux kernel is updated to the latest stable version where the vulnerability has been patched.
What type of vulnerability is CVE-2022-50752?
CVE-2022-50752 is a vulnerability related to improper handling of bio structures in the Linux kernel RAID5 implementation.
What exploits are associated with CVE-2022-50752?
Currently, CVE-2022-50752 does not have publicly known exploits targeting it, but potential impacts include system crashes.