syzbot
divide error in damon_reclaim_timer_fn
Status:
premoderation: reported on 2026/08/20 04:56
Reported-by: syzbot+220e5c5eca98b58a1b7d@syzkaller.appspotmail.com
First crash: 9d15h, last: 9d15h
Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 319 Comm: kworker/0:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events damon_reclaim_timer_fn
RIP: 0010:damon_reclaim_new_scheme mm/damon/reclaim.c:281 [inline]
RIP: 0010:damon_reclaim_turn mm/damon/reclaim.c:323 [inline]
RIP: 0010:damon_reclaim_timer_fn+0x33e/0x530 mm/damon/reclaim.c:354
Code: 3a 05 48 89 44 24 78 48 8b 05 de 2f 3a 05 48 89 84 24 80 00 00 00 c7 84 24 90 00 00 00 01 00 00 00 48 8b 05 ac 2f 3a 05 31 d2 <48> f7 35 eb 2f 3a 05 bf 00 10 00 00 48 c7 c6 ff ff ff ff 31 d2 31
RSP: 0018:ffffc900077f7800 EFLAGS: 00010246
RAX: 0000000007270e00 RBX: fffff52000efef00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900077f7bf8
RBP: ffffc900077f7d08 R08: ffffc900077f7bf7 R09: ffffc900077f7888
R10: dffffc0000000000 R11: fffff52000efef7f R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88812a139c00 R15: ffffc900077f7870
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000011432b000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
kthread+0x3f5/0x4f0 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace 2e7ff1bffb695b52 ]---
RIP: 0010:damon_reclaim_new_scheme mm/damon/reclaim.c:281 [inline]
RIP: 0010:damon_reclaim_turn mm/damon/reclaim.c:323 [inline]
RIP: 0010:damon_reclaim_timer_fn+0x33e/0x530 mm/damon/reclaim.c:354
Code: 3a 05 48 89 44 24 78 48 8b 05 de 2f 3a 05 48 89 84 24 80 00 00 00 c7 84 24 90 00 00 00 01 00 00 00 48 8b 05 ac 2f 3a 05 31 d2 <48> f7 35 eb 2f 3a 05 bf 00 10 00 00 48 c7 c6 ff ff ff ff 31 d2 31
RSP: 0018:ffffc900077f7800 EFLAGS: 00010246
RAX: 0000000007270e00 RBX: fffff52000efef00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900077f7bf8
RBP: ffffc900077f7d08 R08: ffffc900077f7bf7 R09: ffffc900077f7888
R10: dffffc0000000000 R11: fffff52000efef7f R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88812a139c00 R15: ffffc900077f7870
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2c32d6 CR3: 000000010dea2000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 3a 05 48 89 44 24 cmp 0x24448948(%rip),%al # 0x2444894e
6: 78 48 js 0x50
8: 8b 05 de 2f 3a 05 mov 0x53a2fde(%rip),%eax # 0x53a2fec
e: 48 89 84 24 80 00 00 mov %rax,0x80(%rsp)
15: 00
16: c7 84 24 90 00 00 00 movl $0x1,0x90(%rsp)
1d: 01 00 00 00
21: 48 8b 05 ac 2f 3a 05 mov 0x53a2fac(%rip),%rax # 0x53a2fd4
28: 31 d2 xor %edx,%edx
* 2a: 48 f7 35 eb 2f 3a 05 divq 0x53a2feb(%rip) # 0x53a301c <-- trapping instruction
31: bf 00 10 00 00 mov $0x1000,%edi
36: 48 c7 c6 ff ff ff ff mov $0xffffffffffffffff,%rsi
3d: 31 d2 xor %edx,%edx
3f: 31 .byte 0x31
* Struck through repros no longer work on HEAD.