CVE-2024-36908: blk-iocost: do not WARN if iocg was already offlined
In the Linux kernel, the following vulnerability has been resolved:
blk-iocost: do not WARN if iocg was already offlined
In iocgpaydebt(), warn is triggered if 'activelist' is empty, which is intended to confirm iocg is active when it has debt. However, warn can be triggered during a blkcg or disk removal, if iocgwaitqtimerfn() is run at that time:
WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocgpaydebt+0x14c/0x190 Call trace: iocgpaydebt+0x14c/0x190 iocgkickwaitq+0x438/0x4c0 iocgwaitqtimerfn+0xd8/0x130 runhrtimer+0x144/0x45c hrtimerrunqueues+0x16c/0x244 hrtimerinterrupt+0x2cc/0x7b0
The warn in this situation is meaningless. Since this iocg is being removed, the state of the 'activelist' is irrelevant, and 'waitqtimer' is canceled after removing 'activelist' in iocpdfree(), which ensures iocg is freed after iocgwaitqtimerfn() returns.
Therefore, add the check if iocg was already offlined to avoid warn when removing a blkcg or disk.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36908?
CVE-2024-36908 has a medium severity level due to the potential for warning messages that affect system performance.
How do I fix CVE-2024-36908?
To fix CVE-2024-36908, upgrade to the Linux kernel version 6.12.12-1 or later.
Which versions of the Linux kernel are affected by CVE-2024-36908?
CVE-2024-36908 affects Linux kernel versions up to 5.10.226-1 and 6.1.128-1.
What components are impacted by CVE-2024-36908?
CVE-2024-36908 impacts the blk-iocost component within the Linux kernel.
Is there an exploit available for CVE-2024-36908?
Currently, there is no public information indicating an active exploit for CVE-2024-36908.