divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 5703 Comm: syz-executor.5 Not tainted 5.5.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tabledist.part.0+0x13f/0x170 net/sched/sch_netem.c:333 Code: e8 48 83 c4 08 5b 41 5c 41 5d 41 5e 5d c3 e8 38 94 26 fb 48 81 eb 00 10 00 00 eb a5 e8 2a 94 26 fb 43 8d 0c 24 44 89 f0 31 d2 f1 4d 29 e5 49 01 d5 eb c5 48 89 df e8 4f 48 64 fb e9 0d ff ff RSP: 0018:ffffc90000006868 EFLAGS: 00010246 RAX: 0000000076dc5e0c RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff864e9d86 RDI: 0000000000000005 RBP: ffffc90000006890 R08: ffff88805e8a6200 R09: ffffed10136a7c2f R10: ffffed10136a7c2e R11: ffff88809b53e177 R12: ffffffff80000000 R13: 0000000000000000 R14: 0000000076dc5e0c R15: ffff88809b53e000 FS: 00007ff55d310700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000075c000 CR3: 0000000063997000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tabledist net/sched/sch_netem.c:536 [inline] netem_enqueue+0x416/0x2e10 net/sched/sch_netem.c:536 __dev_xmit_skb net/core/dev.c:3671 [inline] __dev_queue_xmit+0x152e/0x35c0 net/core/dev.c:3982 dev_queue_xmit+0x18/0x20 net/core/dev.c:4046 br_dev_queue_push_xmit+0x3f3/0x5e0 net/bridge/br_forward.c:52 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] br_forward_finish+0xfa/0x3f0 net/bridge/br_forward.c:65 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] __br_forward+0x63c/0xaf0 net/bridge/br_forward.c:109 br_flood+0x372/0x3d0 net/bridge/br_forward.c:234 br_dev_xmit+0xd29/0x1590 net/bridge/br_device.c:82 __netdev_start_xmit include/linux/netdevice.h:4459 [inline] netdev_start_xmit include/linux/netdevice.h:4473 [inline] xmit_one net/core/dev.c:3420 [inline] dev_hard_start_xmit+0x1a3/0x9b0 net/core/dev.c:3436 __dev_queue_xmit+0x2b05/0x35c0 net/core/dev.c:4013 dev_queue_xmit+0x18/0x20 net/core/dev.c:4046 arp_xmit_finish net/ipv4/arp.c:630 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] arp_xmit+0xdf/0x3f0 net/ipv4/arp.c:639 arp_send_dst.part.0+0x202/0x290 net/ipv4/arp.c:317 arp_send_dst net/ipv4/arp.c:390 [inline] arp_solicit+0x748/0x1370 net/ipv4/arp.c:389 neigh_probe+0xd0/0x120 net/core/neighbour.c:1009 __neigh_event_send+0x3e3/0x17c0 net/core/neighbour.c:1169 neigh_event_send include/net/neighbour.h:444 [inline] neigh_resolve_output+0x5ee/0x990 net/core/neighbour.c:1471 neigh_output include/net/neighbour.h:510 [inline] ip_finish_output2+0x909/0x2610 net/ipv4/ip_output.c:228 __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x604/0xbd0 net/ipv4/ip_output.c:290 ip_finish_output+0x38/0x1f0 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x22b/0x680 net/ipv4/ip_output.c:432 dst_output include/net/dst.h:436 [inline] ip_local_out+0xbb/0x1b0 net/ipv4/ip_output.c:125 ip_send_skb+0x42/0xf0 net/ipv4/ip_output.c:1562 ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1582 icmp_push_reply+0x350/0x4a0 net/ipv4/icmp.c:390 __icmp_send+0xc44/0x14a0 net/ipv4/icmp.c:740 ipv4_send_dest_unreach net/ipv4/route.c:1222 [inline] ipv4_link_failure+0x549/0x920 net/ipv4/route.c:1229 dst_link_failure include/net/dst.h:419 [inline] arp_error_report+0xce/0x1c0 net/ipv4/arp.c:293 neigh_invalidate+0x245/0x570 net/core/neighbour.c:993 neigh_timer_handler+0xd44/0x10e0 net/core/neighbour.c:1079 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x6c3/0x1790 kernel/time/timer.c:1786 __do_softirq+0x262/0x98c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x19b/0x1e0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:__kasan_check_read+0x12/0x20 mm/kasan/common.c:96 Code: 48 c7 c7 f0 ba 42 89 f7 da e8 fe c3 ab ff e9 3e ef ff ff cc cc cc cc cc 55 89 f6 31 d2 48 89 e5 48 8b 4d 08 e8 1f 2a 00 00 5d 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 55 89 f6 ba 01 00 00 00 RSP: 0018:ffffc90001667668 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX: ffff8880ae838100 RCX: ffffffff8162b2b4 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880ae8381e0 RBP: ffffc90001667688 R08: 1ffff11015d0703c R09: ffffed1015d0703d R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: ffff8880ae8381e0 R13: 0000000000000000 R14: ffffea0001973188 R15: dead000000000100 rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:922 rcu_read_lock include/linux/rcupdate.h:618 [inline] lock_page_memcg+0x13d/0x240 mm/memcontrol.c:1972 page_remove_file_rmap mm/rmap.c:1237 [inline] page_remove_rmap+0x5ce/0x11d0 mm/rmap.c:1330 zap_pte_range mm/memory.c:1080 [inline] zap_pmd_range mm/memory.c:1184 [inline] zap_pud_range mm/memory.c:1213 [inline] zap_p4d_range mm/memory.c:1234 [inline] unmap_page_range+0xde0/0x28a0 mm/memory.c:1255 unmap_single_vma+0x19d/0x300 mm/memory.c:1300 unmap_vmas+0x184/0x2f0 mm/memory.c:1332 exit_mmap+0x2ba/0x530 mm/mmap.c:3140 __mmput kernel/fork.c:1082 [inline] mmput+0x179/0x4d0 kernel/fork.c:1103 exit_mm kernel/exit.c:485 [inline] do_exit+0x806/0x2ef0 kernel/exit.c:784 do_group_exit+0x135/0x360 kernel/exit.c:895 get_signal+0x47c/0x24f0 kernel/signal.c:2734 do_signal+0x87/0x1700 arch/x86/kernel/signal.c:815 exit_to_usermode_loop+0x286/0x380 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x676/0x790 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45af49 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff55d30fcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 000000000075bfd0 RCX: 000000000045af49 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 000000000075bfd4 RBP: 000000000075bfc8 R08: 0000000000000009 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000075bfd4 R13: 00007ffd2c56d45f R14: 00007ff55d3109c0 R15: 000000000075bfd4 Modules linked in: ---[ end trace c6625acb37065d0a ]--- RIP: 0010:tabledist.part.0+0x13f/0x170 net/sched/sch_netem.c:333 Code: e8 48 83 c4 08 5b 41 5c 41 5d 41 5e 5d c3 e8 38 94 26 fb 48 81 eb 00 10 00 00 eb a5 e8 2a 94 26 fb 43 8d 0c 24 44 89 f0 31 d2 f1 4d 29 e5 49 01 d5 eb c5 48 89 df e8 4f 48 64 fb e9 0d ff ff RSP: 0018:ffffc90000006868 EFLAGS: 00010246 RAX: 0000000076dc5e0c RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff864e9d86 RDI: 0000000000000005 RBP: ffffc90000006890 R08: ffff88805e8a6200 R09: ffffed10136a7c2f R10: ffffed10136a7c2e R11: ffff88809b53e177 R12: ffffffff80000000 R13: 0000000000000000 R14: 0000000076dc5e0c R15: ffff88809b53e000 FS: 00007ff55d310700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000075c000 CR3: 0000000063997000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400