CVE-2024-36908

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

blk-iocost: do not WARN if iocg was already offlined

In iocg_pay_debt(), warn is triggered if 'active_list' is empty, which

is intended to confirm iocg is active when it has debt. However, warn

can be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()

is run at that time:

WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190

Call trace:

iocg_pay_debt+0x14c/0x190

iocg_kick_waitq+0x438/0x4c0

iocg_waitq_timer_fn+0xd8/0x130

__run_hrtimer+0x144/0x45c

__hrtimer_run_queues+0x16c/0x244

hrtimer_interrupt+0x2cc/0x7b0

The warn in this situation is meaningless. Since this iocg is being

removed, the state of the 'active_list' is irrelevant, and 'waitq_timer'

is canceled after removing 'active_list' in ioc_pd_free(), which ensures

iocg is freed after iocg_waitq_timer_fn() returns.

Therefore, add the check if iocg was already offlined to avoid warn

when removing a blkcg

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References