CVE-2022-49902

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block: Fix possible memory leak for rq_wb on add_disk failure

kmemleak reported memory leaks in device_add_disk():

kmemleak: 3 new suspected memory leaks

unreferenced object 0xffff88800f420800 (size 512):

comm "modprobe", pid 4275, jiffies 4295639067 (age 223.512s)

hex dump (first 32 bytes):

04 00 00 00 08 00 00 00 01 00 00 00 00 00 00 00 ................

00 e1 f5 05 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace:

[<00000000d3662699>] kmalloc_trace+0x26/0x60

[<00000000edc7aadc>] wbt_init+0x50/0x6f0

[<0000000069601d16>] wbt_enable_default+0x157/0x1c0

[<0000000028fc393f>] blk_register_queue+0x2a4/0x420

[<000000007345a042>] device_add_disk+0x6fd/0xe40

[<0000000060e6aab0>] nbd_dev_add+0x828/0xbf0 [nbd]

...

It is because the memory allocated in wbt_enable_default() is not

released in device_add_disk() error path.

Normally, these memory are freed in:

del_gendi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References