Hello, syzbot found the following issue on:
HEAD commit: ddfe51b0a0f5 Add linux-next specific files for 20261105 git tree: linux-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=15c38e55580000 kernel config: https://syzkaller.appspot.com/x/.config?x=3dffa811bfeed6b4 dashboard link: https://syzkaller.appspot.com/bug?extid=3e16980543e238b95bd1 compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172a6bdd580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10aa6bdd580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/181043a4bd52/disk-ddfe51b0.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/a69d8b670c38/vmlinux-ddfe51b0.xz kernel image: https://storage.googleapis.com/syzbot-assets/906d515c0893/bzImage-ddfe51b0.xz AI-generated root cause summary: In drivers/md/dm-cache-target.c, calculate_discard_block_size() repeatedly doubles discard_block_size in a loop until the origin device has no more than MAX_DISCARD_BLOCKS (16384) discard blocks. When creating a cache target with a sufficiently large origin length (ti->len >= 2^45 sectors), discard_block_size doubles until it reaches 2^32 (1ULL << 32). Because too_many_discard_blocks() uses sector_div(), which expects a 32-bit divisor (uint32_t), passing 2^32 causes the divisor to truncate to zero. This triggers an unhandled kernel divide error (#DE), crashing the system with an Oops: divide error. full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=3e16980543e238b95bd1 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: [email protected] Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 5654 Comm: syz-executor515 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline] RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline] RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline] RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649 Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d RSP: 0018:ffffc900038bf860 EFLAGS: 00010246 RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff88807f1c3e80 RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000 RBP: ffffc900038bfa38 R08: ffffc90000bbe007 R09: 0000000000000000 R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000 R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff1100fec2462 FS: 000055557cd07400(0000) GS:ffff888123259000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004697f0 CR3: 0000000078996000 CR4: 00000000003526f0 Call Trace: <TASK> dm_table_add_target+0x58d/0xc70 drivers/md/dm-table.c:749 populate_table drivers/md/dm-ioctl.c:1602 [inline] table_load+0x325/0x8a0 drivers/md/dm-ioctl.c:1645 ctl_ioctl drivers/md/dm-ioctl.c:2221 [inline] dm_ctl_ioctl+0x9ec/0xe10 drivers/md/dm-ioctl.c:2243 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x00007fdd52f9b8c9 Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdc56ed528 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 6d61722f7665642f RCX: 00007fdd52f9b8c9 RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000013 R09: 0000000000000006 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffdc56ed698 R13: 431bde82d7b634db R14: 00007fdd5302ec40 R15: 0000000000000002 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline] RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline] RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline] RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649 Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d RSP: 0018:ffffc900038bf860 EFLAGS: 00010246 RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff88807f1c3e80 RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000 RBP: ffffc900038bfa38 R08: ffffc90000bbe007 R09: 0000000000000000 R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000 R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff1100fec2462 FS: 000055557cd07400(0000) GS:ffff888123259000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004697f0 CR3: 0000000078996000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 4c 8b 30 mov (%rax),%r14 3: 31 ff xor %edi,%edi 5: 4c 89 f6 mov %r14,%rsi 8: e8 87 30 f5 f8 call 0xf8f53094 d: 4d 85 f6 test %r14,%r14 10: 0f 84 81 00 00 00 je 0x97 16: 4c 89 f3 mov %r14,%rbx 19: 48 c1 eb 20 shr $0x20,%rbx 1d: 45 89 ec mov %r13d,%r12d 20: 48 85 db test %rbx,%rbx 23: 74 0a je 0x2f 25: 4c 89 f0 mov %r14,%rax 28: 31 d2 xor %edx,%edx * 2a: 49 f7 f4 div %r12 <-- trapping instruction 2d: eb 08 jmp 0x37 2f: 44 89 f0 mov %r14d,%eax 32: 31 d2 xor %edx,%edx 34: 41 f7 f4 div %r12d 37: 48 3d 00 40 00 00 cmp $0x4000,%rax 3d: 76 14 jbe 0x53 3f: 4d rex.WRB --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected]. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
