Re: [PATCH] blk-iocost: Fix overflow in donation weight calculation

[Tejun Heo]

On Fri, Nov 13, 2026 at 03:08:40PM +0400, Alex Kazinsky wrote:
> hweight_after_donation() receives usage as u32, clamped to the range
> [1, WEIGHT_ONE]. Since WEIGHT_ONE is 1 << 16, multiplying it by usage
> equal to WEIGHT_ONE wraps the 32-bit unsigned result to zero before
> it is passed to div64_s64().
>
> This makes new_hwi zero, which is then clamped to 1, incorrectly
> reducing the cgroup's in-use weight to the minimum.
>
> Cast WEIGHT_ONE to s64 before multiplication to preserve the full
> product.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE static
> analysis tool.
>
> Fixes: f1de2439ec43 ("blk-iocost: revamp donation amount determination")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Alex Kazinsky <a.kazinsky@xxxxxxxx>

Acked-by: Tejun Heo <tj@xxxxxxxxxx>

Thanks.

--
tejun