syzbot
divide error in cache_ctr
Status:
upstream: reported C repro on 2026/11/06 15:33
Subsystems:
dm
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+3e16980543e238b95bd1@syzkaller.appspotmail.com
First crash: 6h39m, last: 5h01m
✨ AI-generated root cause summary:
In drivers/md/dm-cache-target.c, calculate_discard_block_size() repeatedly doubles discard_block_size in a loop until the origin device has no more than MAX_DISCARD_BLOCKS (16384) discard blocks. When creating a cache target with a sufficiently large origin length (ti->len >= 2^45 sectors), discard_block_size doubles until it reaches 2^32 (1ULL << 32). Because too_many_discard_blocks() uses sector_div(), which expects a 32-bit divisor (uint32_t), passing 2^32 causes the divisor to truncate to zero. This triggers an unhandled kernel divide error (#DE), crashing the system with an Oops: divide error.
▶
▼
✨ Full AI root cause analysis
Root Cause Analysis
Involved Components
- File:
drivers/md/dm-cache-target.c
- Functions:
too_many_discard_blocks(), calculate_discard_block_size(), cache_create(), cache_ctr()
- Structs & Fields:
Detailed Technical Mechanism
-
Target Construction and Parameter Propagation:
When loading a Device Mapper table via ioctl (DM_TABLE_LOAD), dm_table_add_target() creates a dm_target whose length in sectors (ti->len) is supplied by userspace. For the cache target, cache_ctr() invokes cache_create(), which sets the origin device size:
origin_blocks = cache->origin_sectors = ti->len;
At this stage of table creation, ti->len has not yet been validated against the underlying physical block device boundaries.
-
Discard Block Size Calculation:
cache_create() subsequently computes the discard block size for the cache target:
cache->discard_block_size =
calculate_discard_block_size(cache->sectors_per_block,
cache->origin_sectors);
In calculate_discard_block_size(), the driver attempts to keep the total number of discard blocks across the origin device at or below MAX_DISCARD_BLOCKS (1 << 14, or 16384):
static sector_t calculate_discard_block_size(sector_t cache_block_size,
sector_t origin_size)
{
sector_t discard_block_size = cache_block_size;
if (origin_size)
while (too_many_discard_blocks(discard_block_size, origin_size))
discard_block_size *= 2;
return discard_block_size;
}
-
32-Bit Truncation in sector_div():
The helper too_many_discard_blocks() checks whether the number of discard blocks exceeds MAX_DISCARD_BLOCKS:
static bool too_many_discard_blocks(sector_t discard_block_size,
sector_t origin_size)
{
(void) sector_div(origin_size, discard_block_size);
return origin_size > MAX_DISCARD_BLOCKS;
}
sector_div(n, base) is defined as do_div(n, base). In the Linux kernel (including on 64-bit architectures like x86_64), do_div() divides a 64-bit dividend n by a 32-bit divisor base (uint32_t __base = (base);).
-
Triggering Division by Zero:
When cache->origin_sectors (ti->len) is very large (e.g. 0x003fffffffffffff in the crash report, where origin_size >= MAX_DISCARD_BLOCKS * 2^31 sectors = 2^45 sectors), origin_size / discard_block_size > MAX_DISCARD_BLOCKS continues to evaluate to true when discard_block_size reaches 2^31.
The while loop then multiplies discard_block_size by 2, causing it to become 2^32 (1ULL << 32 / 0x0000000100000000, visible in register %r13 in the crash report).
In the next loop iteration, too_many_discard_blocks() passes discard_block_size = 2^32 to sector_div(). Inside do_div(), casting 2^32 to a 32-bit unsigned integer truncates the divisor to 0:
mov %r13d, %r12d ; r13d is lower 32-bits of 1ULL << 32 == 0
...
div %r12 ; div by zero (#DE)
Executing the div instruction with a zero divisor generates an x86 hardware divide error exception (#DE), causing an immediate kernel panic with Oops: divide error: 0000 [#1] SMP.
▶
▼
Last patch testing requests (2)
Sample crash report:
Oops: divide error: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5651 Comm: syz-executor201 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline]
RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline]
RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline]
RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649
Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d
RSP: 0018:ffffc90003a9f860 EFLAGS: 00010246
RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff8880337addc0
RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000
RBP: ffffc90003a9fa38 R08: ffffc90000bbe007 R09: 0000000000000000
R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000
R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff11004e11c62
FS: 000055556d48e400(0000) GS:ffff888123159000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004697f0 CR3: 00000000745fa000 CR4: 00000000003526f0
Call Trace:
<TASK>
dm_table_add_target+0x58d/0xc70 drivers/md/dm-table.c:749
populate_table drivers/md/dm-ioctl.c:1602 [inline]
table_load+0x325/0x8a0 drivers/md/dm-ioctl.c:1645
ctl_ioctl drivers/md/dm-ioctl.c:2221 [inline]
dm_ctl_ioctl+0x9ec/0xe10 drivers/md/dm-ioctl.c:2243
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x00007f0d2b0498c9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe1d3e7778 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 6d61722f7665642f RCX: 00007f0d2b0498c9
RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000000013 R09: 0000000000000006
R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffe1d3e78e8
R13: 431bde82d7b634db R14: 00007f0d2b0dcc40 R15: 0000000000000002
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline]
RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline]
RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline]
RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649
Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d
RSP: 0018:ffffc90003a9f860 EFLAGS: 00010246
RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff8880337addc0
RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000
RBP: ffffc90003a9fa38 R08: ffffc90000bbe007 R09: 0000000000000000
R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000
R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff11004e11c62
FS: 000055556d48e400(0000) GS:ffff888123159000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004697f0 CR3: 00000000745fa000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 4c 8b 30 mov (%rax),%r14
3: 31 ff xor %edi,%edi
5: 4c 89 f6 mov %r14,%rsi
8: e8 87 30 f5 f8 call 0xf8f53094
d: 4d 85 f6 test %r14,%r14
10: 0f 84 81 00 00 00 je 0x97
16: 4c 89 f3 mov %r14,%rbx
19: 48 c1 eb 20 shr $0x20,%rbx
1d: 45 89 ec mov %r13d,%r12d
20: 48 85 db test %rbx,%rbx
23: 74 0a je 0x2f
25: 4c 89 f0 mov %r14,%rax
28: 31 d2 xor %edx,%edx
* 2a: 49 f7 f4 div %r12 <-- trapping instruction
2d: eb 08 jmp 0x37
2f: 44 89 f0 mov %r14d,%eax
32: 31 d2 xor %edx,%edx
34: 41 f7 f4 div %r12d
37: 48 3d 00 40 00 00 cmp $0x4000,%rax
3d: 76 14 jbe 0x53
3f: 4d rex.WRB
Struck through repros no longer work on HEAD.