[PATCH] blk-iocost: Fix overflow in donation weight calculation

[PATCH] blk-iocost: Fix overflow in donation weight calculation

[Alex Kazinsky]

hweight_after_donation() receives usage as u32, clamped to the range
[1, WEIGHT_ONE]. Since WEIGHT_ONE is 1 << 16, multiplying it by usage
equal to WEIGHT_ONE wraps the 32-bit unsigned result to zero before
it is passed to div64_s64().

This makes new_hwi zero, which is then clamped to 1, incorrectly
reducing the cgroup's in-use weight to the minimum.

Cast WEIGHT_ONE to s64 before multiplication to preserve the full
product.

Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.

Fixes: f1de2439ec43 ("blk-iocost: revamp donation amount determination")
Cc: stable@vger.kernel.org
Signed-off-by: Alex Kazinsky <a.kazinsky@ideco.ru>
---
 block/blk-iocost.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 1c1025157d8e..0ffe34bd95b7 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -1853,7 +1853,8 @@ static u32 hweight_after_donation(struct ioc_gq *iocg, u32 old_hwi, u32 hwm,
 	delta = div64_s64(WEIGHT_ONE * (now->vnow - vtime),
 			  now->vnow - ioc->period_at_vtime);
 	target = WEIGHT_ONE * MARGIN_TARGET_PCT / 100;
-	new_hwi = div64_s64(WEIGHT_ONE * usage, WEIGHT_ONE - target + delta);
+	new_hwi = div64_s64((s64)WEIGHT_ONE * usage,
+			    WEIGHT_ONE - target + delta);
 
 	return clamp_t(s64, new_hwi, 1, hwm);
 }
-- 
2.56.0

Re: [PATCH] blk-iocost: Fix overflow in donation weight calculation

[Tejun Heo]

On Fri, Nov 13, 2026 at 03:08:40PM +0400, Alex Kazinsky wrote:
> hweight_after_donation() receives usage as u32, clamped to the range
> [1, WEIGHT_ONE]. Since WEIGHT_ONE is 1 << 16, multiplying it by usage
> equal to WEIGHT_ONE wraps the 32-bit unsigned result to zero before
> it is passed to div64_s64().
>
> This makes new_hwi zero, which is then clamped to 1, incorrectly
> reducing the cgroup's in-use weight to the minimum.
>
> Cast WEIGHT_ONE to s64 before multiplication to preserve the full
> product.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE static
> analysis tool.
>
> Fixes: f1de2439ec43 ("blk-iocost: revamp donation amount determination")
> Cc: stable@vger.kernel.org
> Signed-off-by: Alex Kazinsky <a.kazinsky@ideco.ru>

Acked-by: Tejun Heo <tj@kernel.org>

Thanks.

--
tejun

Re: [PATCH] blk-iocost: Fix overflow in donation weight calculation

[Jens Axboe]

On Fri, 13 Nov 2026 15:08:40 +0400, Alex Kazinsky wrote:
> hweight_after_donation() receives usage as u32, clamped to the range
> [1, WEIGHT_ONE]. Since WEIGHT_ONE is 1 << 16, multiplying it by usage
> equal to WEIGHT_ONE wraps the 32-bit unsigned result to zero before
> it is passed to div64_s64().
> 
> This makes new_hwi zero, which is then clamped to 1, incorrectly
> reducing the cgroup's in-use weight to the minimum.
> 
> [...]

Applied, thanks!

[1/1] blk-iocost: Fix overflow in donation weight calculation
      commit: a56d5a485be4a9d52f0d7b3ed0dc3521367cb986

Best regards,
-- 
Jens Axboe