CVE-2022-49266

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block: fix rq-qos breakage from skipping rq_qos_done_bio()

a647a524a467 ("block: don't call rq_qos_ops->done_bio if the bio isn't

tracked") made bio_endio() skip rq_qos_done_bio() if BIO_TRACKED is not set.

While this fixed a potential oops, it also broke blk-iocost by skipping the

done_bio callback for merged bios.

Before, whether a bio goes through rq_qos_throttle() or rq_qos_merge(),

rq_qos_done_bio() would be called on the bio on completion with BIO_TRACKED

distinguishing the former from the latter. rq_qos_done_bio() is not called

for bios which wenth through rq_qos_merge(). This royally confuses

blk-iocost as the merged bios never finish and are considered perpetually

in-flight.

One reliably reproducible failure mode is an intermediate cgroup geting

stuck active preventing its children from being activated due to the

leaf-only rule, leading to loss of control. The following is from

resctl-bench protection scen

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References