divide error in damon_reclaim_timer_fn

Status: premoderation: reported on 2026/08/20 04:56
Reported-by: syzbot+220e5c5eca98b58a1b7d@syzkaller.appspotmail.com
First crash: 9d15h, last: 9d15h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 divide error in damon_reclaim_timer_fn 2 syz, C 5 12d 12d 0/2 upstream: reported C repro on 2026/08/17 09:03

Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 319 Comm: kworker/0:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events damon_reclaim_timer_fn
RIP: 0010:damon_reclaim_new_scheme mm/damon/reclaim.c:281 [inline]
RIP: 0010:damon_reclaim_turn mm/damon/reclaim.c:323 [inline]
RIP: 0010:damon_reclaim_timer_fn+0x33e/0x530 mm/damon/reclaim.c:354
Code: 3a 05 48 89 44 24 78 48 8b 05 de 2f 3a 05 48 89 84 24 80 00 00 00 c7 84 24 90 00 00 00 01 00 00 00 48 8b 05 ac 2f 3a 05 31 d2 <48> f7 35 eb 2f 3a 05 bf 00 10 00 00 48 c7 c6 ff ff ff ff 31 d2 31
RSP: 0018:ffffc900077f7800 EFLAGS: 00010246
RAX: 0000000007270e00 RBX: fffff52000efef00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900077f7bf8
RBP: ffffc900077f7d08 R08: ffffc900077f7bf7 R09: ffffc900077f7888
R10: dffffc0000000000 R11: fffff52000efef7f R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88812a139c00 R15: ffffc900077f7870
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000011432b000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Modules linked in:
---[ end trace 2e7ff1bffb695b52 ]---
RIP: 0010:damon_reclaim_new_scheme mm/damon/reclaim.c:281 [inline]
RIP: 0010:damon_reclaim_turn mm/damon/reclaim.c:323 [inline]
RIP: 0010:damon_reclaim_timer_fn+0x33e/0x530 mm/damon/reclaim.c:354
Code: 3a 05 48 89 44 24 78 48 8b 05 de 2f 3a 05 48 89 84 24 80 00 00 00 c7 84 24 90 00 00 00 01 00 00 00 48 8b 05 ac 2f 3a 05 31 d2 <48> f7 35 eb 2f 3a 05 bf 00 10 00 00 48 c7 c6 ff ff ff ff 31 d2 31
RSP: 0018:ffffc900077f7800 EFLAGS: 00010246
RAX: 0000000007270e00 RBX: fffff52000efef00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900077f7bf8
RBP: ffffc900077f7d08 R08: ffffc900077f7bf7 R09: ffffc900077f7888
R10: dffffc0000000000 R11: fffff52000efef7f R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88812a139c00 R15: ffffc900077f7870
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2c32d6 CR3: 000000010dea2000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	3a 05 48 89 44 24    	cmp    0x24448948(%rip),%al        # 0x2444894e
   6:	78 48                	js     0x50
   8:	8b 05 de 2f 3a 05    	mov    0x53a2fde(%rip),%eax        # 0x53a2fec
   e:	48 89 84 24 80 00 00 	mov    %rax,0x80(%rsp)
  15:	00
  16:	c7 84 24 90 00 00 00 	movl   $0x1,0x90(%rsp)
  1d:	01 00 00 00
  21:	48 8b 05 ac 2f 3a 05 	mov    0x53a2fac(%rip),%rax        # 0x53a2fd4
  28:	31 d2                	xor    %edx,%edx
* 2a:	48 f7 35 eb 2f 3a 05 	divq   0x53a2feb(%rip)        # 0x53a301c <-- trapping instruction
  31:	bf 00 10 00 00       	mov    $0x1000,%edi
  36:	48 c7 c6 ff ff ff ff 	mov    $0xffffffffffffffff,%rsi
  3d:	31 d2                	xor    %edx,%edx
  3f:	31                   	.byte 0x31

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/20 04:55 android13-5.15-lts dd960aad97f0 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15 divide error in damon_reclaim_timer_fn
2026/08/20 04:55 android13-5.15-lts dd960aad97f0 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15 divide error in damon_reclaim_timer_fn
* Struck through repros no longer work on HEAD.