Executive brief
The Linux kernel's block I/O multi-queue (blk-mq) subsystem fails to free memory allocated for hardware queue tags when the number of queues is reduced. This causes memory leaks that accumulate over time as devices are reconfigured, potentially consuming system memory and degrading performance or causing out-of-memory conditions on long-running servers.
Technical details
A memory leak exists in the block-mq tag set reallocation function when the number of hardware queues is reduced (shrunk). When set->nr_hw_queues is greater than or equal to new_nr_hw_queues, the function returns early without freeing tag structures that are no longer needed. The vulnerable code path is triggered during block device reconfiguration (e.g., reducing submit_queues via sysfs). An unprivileged local attacker with access to configfs/sysfs can repeatedly trigger queue shrinking to leak memory. A fix was committed to free unused tags via __blk_mq_free_map_and_rqs() before the early return.
Affected products
- Linux Linux Kernel Linux 4.0 through 6.x (prior to fix in August 2023)
Timeline
- 2023-08-21: disclosed
- 2023-08-22: patched
- 2023-09-23: other: Backported to stable kernels