Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]block: don't allow the same type rq_qos add more than once[EOL][EOL]In our test of iocost, we encountered some list add/del corruptions of[EOL]inner_walk list in ioc_timer_fn.[EOL][EOL]The reason can be described as follows:[EOL][EOL]cpu 0\t\t\t\t\tcpu 1[EOL]ioc_qos_write\t\t\t\tioc_qos_write[EOL][EOL]ioc = q_to_ioc(queue);[EOL]if (!ioc) {[EOL]        ioc = kzalloc();[EOL]\t\t\t\t\tioc = q_to_ioc(queue);[EOL]\t\t\t\t\tif (!ioc) {[EOL]\t\t\t\t\t\tioc = kzalloc();[EOL]\t\t\t\t\t\t...[EOL]\t\t\t\t\t\trq_qos_add(q, rqos);[EOL]\t\t\t\t\t}[EOL]        ...[EOL]        rq_qos_add(q, rqos);[EOL]        ...[EOL]}[EOL][EOL]When the io.cost.qos file is written by two cpus concurrently, rq_qos may[EOL]be added to one disk twice. In that case, there will be two iocs enabled[EOL]and running on one disk. They own different iocgs on their active list. In[EOL]the ioc_timer_fn function, because of the iocgs from two iocs have the[EOL]same root iocg, the root iocg's walk_list may be overwritten by each other[EOL]and this leads to list add/del corruptions in building or destroying the[EOL]inner_walk list.[EOL][EOL]And so far, the blk-rq-qos framework works in case that one instance for[EOL]one type rq_qos per queue by default. This patch make this explicit and[EOL]also fix the crash above.

CREATE(Triage):(User=lchen-cn) [CVE-2022-50086 (https://nvd.nist.gov/vuln/detail/CVE-2022-50086)