syzbot
divide error in damon_reclaim_timer_fn
Status:
upstream: reported C repro on 2026/08/17 09:03
Reported-by: syzbot+51bb3b376fdcb6cbd1b0@syzkaller.appspotmail.com
First crash: 12d, last: 12d
Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events damon_reclaim_timer_fn
RIP: 0010:damon_reclaim_new_scheme mm/damon/reclaim.c:281 [inline]
RIP: 0010:damon_reclaim_turn mm/damon/reclaim.c:323 [inline]
RIP: 0010:damon_reclaim_timer_fn+0x33e/0x530 mm/damon/reclaim.c:354
Code: 1e 05 48 89 44 24 78 48 8b 05 46 33 1e 05 48 89 84 24 80 00 00 00 c7 84 24 90 00 00 00 01 00 00 00 48 8b 05 14 33 1e 05 31 d2 <48> f7 35 53 33 1e 05 bf 00 10 00 00 48 c7 c6 ff ff ff ff 31 d2 31
RSP: 0018:ffffc900000f7800 EFLAGS: 00010246
RAX: 0000000007270e00 RBX: fffff5200001ef00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900000f7bf8
RBP: ffffc900000f7d20 R08: ffffc900000f7bf7 R09: ffffc900000f7888
R10: dffffc0000000000 R11: fffff5200001ef7f R12: 0000000000000001
R13: dffffc0000000000 R14: ffff888109b67f00 R15: ffffc900000f7870
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000000 CR3: 0000000121d1e000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
kthread+0x324/0x3b0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 05 48 89 44 24 add $0x24448948,%eax
5: 78 48 js 0x4f
7: 8b 05 46 33 1e 05 mov 0x51e3346(%rip),%eax # 0x51e3353
d: 48 89 84 24 80 00 00 mov %rax,0x80(%rsp)
14: 00
15: c7 84 24 90 00 00 00 movl $0x1,0x90(%rsp)
1c: 01 00 00 00
20: 48 8b 05 14 33 1e 05 mov 0x51e3314(%rip),%rax # 0x51e333b
27: 31 d2 xor %edx,%edx
* 29: 48 f7 35 53 33 1e 05 divq 0x51e3353(%rip) # 0x51e3383 <-- trapping instruction
30: bf 00 10 00 00 mov $0x1000,%edi
35: 48 c7 c6 ff ff ff ff mov $0xffffffffffffffff,%rsi
3c: 31 d2 xor %edx,%edx
3e: 31 .byte 0x31
* Struck through repros no longer work on HEAD.