CVE-2024-36908
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
30/05/2024
Last modified:
03/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
blk-iocost: do not WARN if iocg was already offlined<br />
<br />
In iocg_pay_debt(), warn is triggered if &#39;active_list&#39; is empty, which<br />
is intended to confirm iocg is active when it has debt. However, warn<br />
can be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()<br />
is run at that time:<br />
<br />
WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190<br />
Call trace:<br />
iocg_pay_debt+0x14c/0x190<br />
iocg_kick_waitq+0x438/0x4c0<br />
iocg_waitq_timer_fn+0xd8/0x130<br />
__run_hrtimer+0x144/0x45c<br />
__hrtimer_run_queues+0x16c/0x244<br />
hrtimer_interrupt+0x2cc/0x7b0<br />
<br />
The warn in this situation is meaningless. Since this iocg is being<br />
removed, the state of the &#39;active_list&#39; is irrelevant, and &#39;waitq_timer&#39;<br />
is canceled after removing &#39;active_list&#39; in ioc_pd_free(), which ensures<br />
iocg is freed after iocg_waitq_timer_fn() returns.<br />
<br />
Therefore, add the check if iocg was already offlined to avoid warn<br />
when removing a blkcg or disk.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.4 (including) | 5.10.237 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.181 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.135 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.31 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.8.10 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6
- https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e
- https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67
- https://git.kernel.org/stable/c/56a9d07f427378eeb75b917bb49c6fbea8204126
- https://git.kernel.org/stable/c/7d215e013d097ed6fc4b0ad0272c9514214dc408
- https://git.kernel.org/stable/c/aed0aac18f039dd4af13c143063754efca358cb0
- https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6
- https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e
- https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html



