CVE-2022-49257

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

watch_queue: Fix NULL dereference in error cleanup

In watch_queue_set_size(), the error cleanup code doesn't take account of

the fact that __free_page() can't handle a NULL pointer when trying to free

up buffer pages that did get allocated.

Fix this by only calling __free_page() on the pages actually allocated.

Without the fix, this can lead to something like the following:

BUG: KASAN: null-ptr-deref in __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473

Read of size 4 at addr 0000000000000034 by task syz-executor168/3599

...

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106

__kasan_report mm/kasan/report.c:446 [inline]

kasan_report.cold+0x66/0xdf mm/kasan/report.c:459

check_region_inline mm/kasan/generic.c:183 [inline]

kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189

instrument_atomic_read include/linux/instrumented.h:71 [inline]

atomic_read include/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References