Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 9361 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:comedi_buf_munge drivers/comedi/comedi_buf.c:347 [inline] RIP: 0010:comedi_buf_write_free+0x3c8/0x7e0 drivers/comedi/comedi_buf.c:391 Code: 41 03 45 00 48 8b 4c 24 78 42 0f b6 0c 21 84 c9 4c 8b bc 24 90 00 00 00 44 8b 74 24 54 0f 85 02 01 00 00 31 d2 48 8b 4c 24 30 31 41 89 55 00 48 8b 44 24 70 42 0f b6 04 20 84 c0 0f 85 09 01 RSP: 0000:ffffc90000007bd8 EFLAGS: 00010046 RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888078488080 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888055df4000 RBP: 0000000000000002 R08: 0000000000000000 R09: 00000000000000ff R10: dffffc0000000000 R11: ffffffff88f15210 R12: dffffc0000000000 R13: ffff888078488038 R14: 0000000000000000 R15: ffff888078488000 FS: 00007f6ee2467c80(0000) GS:ffff8881259f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564d89680c08 CR3: 0000000078f36000 CR4: 00000000003526f0 Call Trace: comedi_buf_write_samples+0x369/0x5a0 drivers/comedi/comedi_buf.c:602 das16m1_handler+0x213/0x4b0 drivers/comedi/drivers/das16m1.c:413 das16m1_interrupt+0xaf/0x180 drivers/comedi/drivers/das16m1.c:470 __handle_irq_event_percpu+0x289/0x980 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x23b/0xa10 kernel/irq/chip.c:855 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:254 [inline] call_irq_handler arch/x86/kernel/irq.c:-1 [inline] __common_interrupt+0x13e/0x1f0 arch/x86/kernel/irq.c:325 common_interrupt+0xb6/0xe0 arch/x86/kernel/irq.c:318 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688 RIP: 0010:lock_acquire+0x175/0x360 kernel/locking/lockdep.c:5872 Code: 00 00 00 00 9c 8f 44 24 30 f7 44 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 0b 24 24 11 <48> 3b 44 24 58 0f 85 f2 00 00 00 48 83 c4 60 5b 41 5c 41 5d 41 5e RSP: 0000:ffffc90002f06ff8 EFLAGS: 00000206 RAX: 0cce491c4782ee00 RBX: 0000000000000000 RCX: 0cce491c4782ee00 RDX: 0000000000000000 RSI: ffffffff8ddaf5a8 RDI: ffffffff8c037980 RBP: ffffffff8173b9e5 R08: 0000000000000000 R09: ffffffff8173b9e5 R10: ffffc90002f07218 R11: fffff520005e0e45 R12: 0000000000000002 R13: ffffffff8e33cd60 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:841 [inline] class_rcu_constructor include/linux/rcupdate.h:1155 [inline] unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479 __unwind_start+0x5b9/0x760 arch/x86/kernel/unwind_orc.c:758 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xe4/0x150 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 save_stack+0xf5/0x1f0 mm/page_owner.c:156 __set_page_owner+0x8d/0x4a0 mm/page_owner.c:329 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850 prep_new_page mm/page_alloc.c:1858 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3857 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5147 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 folio_alloc_mpol_noprof mm/mempolicy.c:2435 [inline] vma_alloc_folio_noprof+0xe4/0x200 mm/mempolicy.c:2470 folio_prealloc+0x30/0x180 mm/memory.c:-1 wp_page_copy mm/memory.c:3680 [inline] do_wp_page+0x1231/0x5800 mm/memory.c:4141 handle_pte_fault mm/memory.c:6198 [inline] __handle_mm_fault+0x1033/0x5400 mm/memory.c:6323 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6492 do_user_addr_fault+0xa81/0x1390 arch/x86/mm/fault.c:1336 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7f6ee275780e Code: df e8 d7 c4 ff ff 48 8d 3d 9c 92 05 00 31 c0 e8 e1 ca ff ff 95 75 24 48 8d 05 5e 9c 07 00 44 89 f2 4c 89 e6 48 89 df 48 8b 00 <83> a0 f8 02 00 00 00 e8 de eb ff ff e9 a8 00 00 00 48 85 db 0f 84 RSP: 002b:00007ffce7b8b9a0 EFLAGS: 00010246 RAX: 0000564d89680910 RBX: 0000564d89681c60 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000564d8968e380 RDI: 0000564d89681c60 RBP: 0000000000000000 R08: 00007f6ee2702b60 R09: 0000000000000000 R10: 0000000000000008 R11: 0000000000000246 R12: 0000564d8968e380 R13: 0000564d89680c30 R14: 0000000000000002 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:comedi_buf_munge drivers/comedi/comedi_buf.c:347 [inline] RIP: 0010:comedi_buf_write_free+0x3c8/0x7e0 drivers/comedi/comedi_buf.c:391 Code: 41 03 45 00 48 8b 4c 24 78 42 0f b6 0c 21 84 c9 4c 8b bc 24 90 00 00 00 44 8b 74 24 54 0f 85 02 01 00 00 31 d2 48 8b 4c 24 30 31 41 89 55 00 48 8b 44 24 70 42 0f b6 04 20 84 c0 0f 85 09 01 RSP: 0000:ffffc90000007bd8 EFLAGS: 00010046 RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff888078488080 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888055df4000 RBP: 0000000000000002 R08: 0000000000000000 R09: 00000000000000ff R10: dffffc0000000000 R11: ffffffff88f15210 R12: dffffc0000000000 R13: ffff888078488038 R14: 0000000000000000 R15: ffff888078488000 FS: 00007f6ee2467c80(0000) GS:ffff8881259f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564d89680c08 CR3: 0000000078f36000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 41 03 45 00 add 0x0(%r13),%eax 4: 48 8b 4c 24 78 mov 0x78(%rsp),%rcx 9: 42 0f b6 0c 21 movzbl (%rcx,%r12,1),%ecx e: 84 c9 test %cl,%cl 10: 4c 8b bc 24 90 00 00 mov 0x90(%rsp),%r15 17: 00 18: 44 8b 74 24 54 mov 0x54(%rsp),%r14d 1d: 0f 85 02 01 00 00 jne 0x125 23: 31 d2 xor %edx,%edx 25: 48 8b 4c 24 30 mov 0x30(%rsp),%rcx * 2a: f7 31 divl (%rcx) <-- trapping instruction 2c: 41 89 55 00 mov %edx,0x0(%r13) 30: 48 8b 44 24 70 mov 0x70(%rsp),%rax 35: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax 3a: 84 c0 test %al,%al 3c: 0f .byte 0xf 3d: 85 09 test %ecx,(%rcx) 3f: 01 .byte 0x1