tg_set_conf(), used for blkio.throttle.{read,write}_iops_device legacy
blkio cgroup sysfs knobs, parses limits as u64 but stores them in
unsigned int, silently truncating values above UINT_MAX. In addition
to being an obvios correctness issue, this may result in division by
zero in tg_within_iops_limit(), if the value is truncated to zero.

Reject such values with -EINVAL and explicitly use UINT_MAX as
a sentinel value for IOPS limits.

Fixes: 3a8b31d396b2 ("blkcg: restructure blkio_group configruation setting")
Cc: stable@vger.kernel.org
Signed-off-by: Mikhail Rudenko <xyzzy@yandex-team.ru>
---
This was found by a local Sashiko instance when reviewing an unrelated
patch. Idk if Assisted-by: is required in this case. This patch was
written manually, though.

Exact commit for Fixes: was a bit difficult to track, since the code
went through multiple refactorings. I believe that it's 3a8b31d396b2,
where (temp > THROTL_IOPS_MAX) check was dropped. Anyway, all the
maintained LTS releases are affected.
---
 block/blk-throttle.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index ffc3b70065d4..d2d46aeb24e1 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1377,8 +1377,12 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of,
 	ret = -EINVAL;
 	if (sscanf(ctx.body, "%llu", &v) != 1)
 		goto unprep;
+
+	if (!is_u64 && v > UINT_MAX)
+		goto unprep;
+
 	if (!v)
-		v = U64_MAX;
+		v = is_u64 ? U64_MAX : UINT_MAX;
 
 	tg = blkg_to_tg(ctx.blkg);
 	tg_update_carryover(tg);

---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260903-throttl-truncation-fix-34bc0b99a242

Best regards,
--  
Mikhail Rudenko <xyzzy@yandex-team.ru>

On 2026-09-03 at 14:54 +03, Mikhail Rudenko <xyzzy@yandex-team.ru> wrote:

> tg_set_conf(), used for blkio.throttle.{read,write}_iops_device legacy
> blkio cgroup sysfs knobs, parses limits as u64 but stores them in
> unsigned int, silently truncating values above UINT_MAX. In addition
> to being an obvios correctness issue, this may result in division by
> zero in tg_within_iops_limit(), if the value is truncated to zero.

Nevermind, there is a patch under review [1] which solves this.

[1] https://lore.kernel.org/r/20260722102459.253189-1-cui.tao@linux.dev

--
Best regards,
Mikhail Rudenko