syzbot
divide error in ath9k_htc_swba
Status:
auto-obsoleted due to no activity on 2024/06/23 08:10
Subsystems:
usb
wireless
[Documentation on labels]
Reported-by: syzbot+90d241d7661ca2493f0b@syzkaller.appspotmail.com
First crash: 1882d, last: 882d
▶
▼
Last patch testing requests (11)
▶
▼
Fix bisection attempts (10)
Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
RIP: 0010:ath9k_htc_choose_bslot drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:277 [inline]
RIP: 0010:ath9k_htc_swba+0x1be/0xc70 drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:310
Code: 00 48 8b 13 0f b7 c9 bb 01 00 00 00 4d 8d bd b0 03 00 00 4c 89 ff 48 0f ca 48 89 d0 c1 ea 0a 48 c1 e8 20 c1 e0 16 09 d0 31 d2 <f7> f1 8d 04 12 31 d2 f7 f1 29 c3 e8 72 57 5c 04 48 63 c3 48 83 f8
RSP: 0018:ffffc90000157c18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880605b33f0
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880605b3040 R14: 0000000000000210 R15: ffff8880605b33f0
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc2dff8ff8 CR3: 0000000028fe6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ath9k_wmi_event_tasklet+0x34e/0x460 drivers/net/wireless/ath/ath9k/wmi.c:165
tasklet_action_common.constprop.0+0x242/0x3d0 kernel/softirq.c:780
__do_softirq+0x21a/0x8de kernel/softirq.c:553
run_ksoftirqd kernel/softirq.c:921 [inline]
run_ksoftirqd+0x31/0x60 kernel/softirq.c:913
smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ath9k_htc_choose_bslot drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:277 [inline]
RIP: 0010:ath9k_htc_swba+0x1be/0xc70 drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:310
Code: 00 48 8b 13 0f b7 c9 bb 01 00 00 00 4d 8d bd b0 03 00 00 4c 89 ff 48 0f ca 48 89 d0 c1 ea 0a 48 c1 e8 20 c1 e0 16 09 d0 31 d2 <f7> f1 8d 04 12 31 d2 f7 f1 29 c3 e8 72 57 5c 04 48 63 c3 48 83 f8
RSP: 0018:ffffc90000157c18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880605b33f0
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880605b3040 R14: 0000000000000210 R15: ffff8880605b33f0
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc2dff8ff8 CR3: 000000000cf79000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 48 8b add %cl,-0x75(%rax)
3: 13 0f adc (%rdi),%ecx
5: b7 c9 mov $0xc9,%bh
7: bb 01 00 00 00 mov $0x1,%ebx
c: 4d 8d bd b0 03 00 00 lea 0x3b0(%r13),%r15
13: 4c 89 ff mov %r15,%rdi
16: 48 0f ca bswap %rdx
19: 48 89 d0 mov %rdx,%rax
1c: c1 ea 0a shr $0xa,%edx
1f: 48 c1 e8 20 shr $0x20,%rax
23: c1 e0 16 shl $0x16,%eax
26: 09 d0 or %edx,%eax
28: 31 d2 xor %edx,%edx
* 2a: f7 f1 div %ecx <-- trapping instruction
2c: 8d 04 12 lea (%rdx,%rdx,1),%eax
2f: 31 d2 xor %edx,%edx
31: f7 f1 div %ecx
33: 29 c3 sub %eax,%ebx
35: e8 72 57 5c 04 call 0x45c57ac
3a: 48 63 c3 movslq %ebx,%rax
3d: 48 rex.W
3e: 83 .byte 0x83
3f: f8 clc
* Struck through repros no longer work on HEAD.