From c810ee88cdab27f443c32270dc7c0eaad2cca3f8 Mon Sep 17 00:00:00 2001 From: Kunhai Dai Date: Mon, 19 Oct 2026 08:54:11 -0400 Subject: [PATCH] blk-iocost: abort weight transfer on invalid donation weights transfer_surpluses() warns and then keeps going when the donation calculation produced invalid weights. The following propagation can then divide by a zero hweight_inuse, so the warning is immediately followed by a divide error. When the check trips, abandon this period's donation transfer and release the walk lists. This trades one period without donation for not crashing; the invalid state is not expected on the normal path. Developed with assistance from Claude Code (Anthropic): the assistant analysed the failure path, drafted the change and ran the checks listed below. The author reviewed the result and remains responsible for it. Fixes: e08d02aa5fc9 ("blk-iocost: implement Andy's method for donation weight updates") Cc: stable@vger.kernel.org Signed-off-by: Kunhai Dai Tested-by: Tao Cui Reviewed-by: Tao Cui Acked-by: Tejun Heo Link: https://patch.msgid.link/20261019125412.3123895-2-daikunhai@didiglobal.com Signed-off-by: Jens Axboe --- block/blk-iocost.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 47bea7f31408..1118a8a1f079 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -1961,6 +1961,7 @@ static void transfer_surpluses(struct list_head *surpluses, struct ioc_now *now) pr_cont(": active=%u donating=%u after=%u\n", iocg->hweight_active, iocg->hweight_donating, iocg->hweight_after_donation); + goto out; } } @@ -2059,6 +2060,7 @@ static void transfer_surpluses(struct list_head *surpluses, struct ioc_now *now) __propagate_weights(iocg, iocg->active, inuse, true, now); } +out: /* walk list should be dissolved after use */ list_for_each_entry_safe(iocg, tiocg, &inner_walk, walk_list) list_del_init(&iocg->walk_list);