syzbot
divide error in alauda_transport
Status:
upstream: reported C repro on 2026/08/24 05:35
Subsystems:
usb-storage
[Documentation on labels]
Reported-by: syzbot+dc208a8cf8d37cf3e5ac@syzkaller.appspotmail.com
First crash: 5d06h, last: 10h58m
▶
▼
✨ AI Patch Versions (1)
▶
▼
Last patch testing requests (1)
Sample crash report:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 6620 Comm: usb-storage Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:953 [inline]
RIP: 0010:alauda_transport+0xe5a/0x35c0 drivers/usb/storage/alauda.c:1187
Code: 01 45 85 ed 0f 84 6d 1c 00 00 c7 04 24 00 00 00 00 8b 5c 24 20 e8 46 38 53 fa 31 d2 48 8b 7c 24 08 89 d8 89 5c 24 20 41 89 df <f7> 74 24 70 89 c3 89 54 24 10 89 de e8 05 c1 ff ff 44 0f b7 74 24
RSP: 0018:ffffc900044ff9d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87b7c98a RDI: ffff8880578f8e90
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f741d1ca6e4 CR3: 0000000054fb4000 CR4: 0000000000352ef0
Call Trace:
<TASK>
usb_stor_invoke_transport+0xe7/0x15c0 drivers/usb/storage/transport.c:611
usb_stor_control_thread+0x5e4/0xae0 drivers/usb/storage/usb.c:462
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:953 [inline]
RIP: 0010:alauda_transport+0xe5a/0x35c0 drivers/usb/storage/alauda.c:1187
Code: 01 45 85 ed 0f 84 6d 1c 00 00 c7 04 24 00 00 00 00 8b 5c 24 20 e8 46 38 53 fa 31 d2 48 8b 7c 24 08 89 d8 89 5c 24 20 41 89 df <f7> 74 24 70 89 c3 89 54 24 10 89 de e8 05 c1 ff ff 44 0f b7 74 24
RSP: 0018:ffffc900044ff9d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87b7c98a RDI: ffff8880578f8e90
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f741d1ca6e4 CR3: 0000000054fb4000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 01 45 85 add %eax,-0x7b(%rbp)
3: ed in (%dx),%eax
4: 0f 84 6d 1c 00 00 je 0x1c77
a: c7 04 24 00 00 00 00 movl $0x0,(%rsp)
11: 8b 5c 24 20 mov 0x20(%rsp),%ebx
15: e8 46 38 53 fa call 0xfa533860
1a: 31 d2 xor %edx,%edx
1c: 48 8b 7c 24 08 mov 0x8(%rsp),%rdi
21: 89 d8 mov %ebx,%eax
23: 89 5c 24 20 mov %ebx,0x20(%rsp)
27: 41 89 df mov %ebx,%r15d
* 2a: f7 74 24 70 divl 0x70(%rsp) <-- trapping instruction
2e: 89 c3 mov %eax,%ebx
30: 89 54 24 10 mov %edx,0x10(%rsp)
34: 89 de mov %ebx,%esi
36: e8 05 c1 ff ff call 0xffffc140
3b: 44 rex.R
3c: 0f .byte 0xf
3d: b7 74 mov $0x74,%bh
3f: 24 .byte 0x24
* Struck through repros no longer work on HEAD.