ghsa-86r4-3x7h-8gh4
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
floppy: Fix memory leak in do_floppy_init()
A memory leak was reported when floppy_alloc_disk() failed in do_floppy_init().
unreferenced object 0xffff888115ed25a0 (size 8): comm "modprobe", pid 727, jiffies 4295051278 (age 25.529s) hex dump (first 8 bytes): 00 ac 67 5b 81 88 ff ff ..g[.... backtrace: [<000000007f457abb>] __kmalloc_node+0x4c/0xc0 [<00000000a87bfa9e>] blk_mq_realloc_tag_set_tags.part.0+0x6f/0x180 [<000000006f02e8b1>] blk_mq_alloc_tag_set+0x573/0x1130 [<0000000066007fd7>] 0xffffffffc06b8b08 [<0000000081f5ac40>] do_one_initcall+0xd0/0x4f0 [<00000000e26d04ee>] do_init_module+0x1a4/0x680 [<000000001bb22407>] load_module+0x6249/0x7110 [<00000000ad31ac4d>] __do_sys_finit_module+0x140/0x200 [<000000007bddca46>] do_syscall_64+0x35/0x80 [<00000000b5afec39>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810fc30540 (size 32): comm "modprobe", pid 727, jiffies 4295051278 (age 25.529s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000007f457abb>] __kmalloc_node+0x4c/0xc0 [<000000006b91eab4>] blk_mq_alloc_tag_set+0x393/0x1130 [<0000000066007fd7>] 0xffffffffc06b8b08 [<0000000081f5ac40>] do_one_initcall+0xd0/0x4f0 [<00000000e26d04ee>] do_init_module+0x1a4/0x680 [<000000001bb22407>] load_module+0x6249/0x7110 [<00000000ad31ac4d>] __do_sys_finit_module+0x140/0x200 [<000000007bddca46>] do_syscall_64+0x35/0x80 [<00000000b5afec39>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
If the floppy_alloc_disk() failed, disks of current drive will not be set, thus the lastest allocated set->tag cannot be freed in the error handling path. A simple call graph shown as below:
floppy_module_init() floppy_init() do_floppy_init() for (drive = 0; drive < N_DRIVE; drive++) blk_mq_alloc_tag_set() blk_mq_alloc_tag_set_tags() blk_mq_realloc_tag_set_tags() # set->tag allocated floppy_alloc_disk() blk_mq_alloc_disk() # error occurred, disks failed to allocated
->out_put_disk:
for (drive = 0; drive < N_DRIVE; drive++)
if (!disks[drive][0]) # the last disks is not set and loop break
break;
blk_mq_free_tag_set() # the latest allocated set->tag leaked
Fix this problem by free the set->tag of current drive before jump to error handling path.
[efremov: added stable list, changed title]
{
"affected": [],
"aliases": [
"CVE-2022-50342"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-16T17:15:33Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfloppy: Fix memory leak in do_floppy_init()\n\nA memory leak was reported when floppy_alloc_disk() failed in\ndo_floppy_init().\n\nunreferenced object 0xffff888115ed25a0 (size 8):\n comm \"modprobe\", pid 727, jiffies 4295051278 (age 25.529s)\n hex dump (first 8 bytes):\n 00 ac 67 5b 81 88 ff ff ..g[....\n backtrace:\n [\u003c000000007f457abb\u003e] __kmalloc_node+0x4c/0xc0\n [\u003c00000000a87bfa9e\u003e] blk_mq_realloc_tag_set_tags.part.0+0x6f/0x180\n [\u003c000000006f02e8b1\u003e] blk_mq_alloc_tag_set+0x573/0x1130\n [\u003c0000000066007fd7\u003e] 0xffffffffc06b8b08\n [\u003c0000000081f5ac40\u003e] do_one_initcall+0xd0/0x4f0\n [\u003c00000000e26d04ee\u003e] do_init_module+0x1a4/0x680\n [\u003c000000001bb22407\u003e] load_module+0x6249/0x7110\n [\u003c00000000ad31ac4d\u003e] __do_sys_finit_module+0x140/0x200\n [\u003c000000007bddca46\u003e] do_syscall_64+0x35/0x80\n [\u003c00000000b5afec39\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\nunreferenced object 0xffff88810fc30540 (size 32):\n comm \"modprobe\", pid 727, jiffies 4295051278 (age 25.529s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003c000000007f457abb\u003e] __kmalloc_node+0x4c/0xc0\n [\u003c000000006b91eab4\u003e] blk_mq_alloc_tag_set+0x393/0x1130\n [\u003c0000000066007fd7\u003e] 0xffffffffc06b8b08\n [\u003c0000000081f5ac40\u003e] do_one_initcall+0xd0/0x4f0\n [\u003c00000000e26d04ee\u003e] do_init_module+0x1a4/0x680\n [\u003c000000001bb22407\u003e] load_module+0x6249/0x7110\n [\u003c00000000ad31ac4d\u003e] __do_sys_finit_module+0x140/0x200\n [\u003c000000007bddca46\u003e] do_syscall_64+0x35/0x80\n [\u003c00000000b5afec39\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nIf the floppy_alloc_disk() failed, disks of current drive will not be set,\nthus the lastest allocated set-\u003etag cannot be freed in the error handling\npath. A simple call graph shown as below:\n\n floppy_module_init()\n floppy_init()\n do_floppy_init()\n for (drive = 0; drive \u003c N_DRIVE; drive++)\n blk_mq_alloc_tag_set()\n blk_mq_alloc_tag_set_tags()\n blk_mq_realloc_tag_set_tags() # set-\u003etag allocated\n floppy_alloc_disk()\n blk_mq_alloc_disk() # error occurred, disks failed to allocated\n\n -\u003eout_put_disk:\n for (drive = 0; drive \u003c N_DRIVE; drive++)\n if (!disks[drive][0]) # the last disks is not set and loop break\n break;\n blk_mq_free_tag_set() # the latest allocated set-\u003etag leaked\n\nFix this problem by free the set-\u003etag of current drive before jump to\nerror handling path.\n\n[efremov: added stable list, changed title]",
"id": "GHSA-86r4-3x7h-8gh4",
"modified": "2025-09-16T18:31:25Z",
"published": "2025-09-16T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50342"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/55b3c66a0d441cd37154ae95e44d0b82ccfd580e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/75d8c8851a4da0190c2480e84315b5fd3d0356c5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f36d8c8651506aea5f09899f5356ece5d1384f50"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f8ace2e304c5dd8a7328db9cd2b8a4b1b98d83ec"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.