bisecting fixing commit since 36a21d51725af2ce0700c6ebcb6b9594aac658a6 building syzkaller on 6972b10616d785401dea17cec890cca8916424a7 testing commit 36a21d51725af2ce0700c6ebcb6b9594aac658a6 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 861a1edb0c9dac3975e852a96122f60160a4fa575a54ec1bfb5b214c95b81335 all runs: crashed: divide error in ath9k_htc_swba testing current HEAD 0280e3c58f92b2fe0e8fbbdf8d386449168de4a8 testing commit 0280e3c58f92b2fe0e8fbbdf8d386449168de4a8 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fff0aea86a4429f96c35d0e9a0ffbb74ef3e1a9d52ff8664c5d43658a67cb43e run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: EOF run #1: crashed: divide error in ath9k_htc_swba run #2: crashed: divide error in ath9k_htc_swba run #3: crashed: divide error in ath9k_htc_swba run #4: crashed: divide error in ath9k_htc_swba run #5: crashed: divide error in ath9k_htc_swba run #6: crashed: divide error in ath9k_htc_swba run #7: crashed: divide error in ath9k_htc_swba run #8: crashed: divide error in ath9k_htc_swba run #9: crashed: divide error in ath9k_htc_swba revisions tested: 2, total time: 20m53.971875312s (build: 13m41.180811752s, test: 6m20.07257191s) the crash still happens on HEAD commit msg: Merge tag 'nfs-for-5.17-1' of git://git.linux-nfs.org/projects/anna/linux-nfs crash: divide error in ath9k_htc_swba divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1197 Comm: kworker/u4:5 Not tainted 5.17.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker RIP: 0010:ath9k_htc_choose_bslot drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:277 [inline] RIP: 0010:ath9k_htc_swba+0x18b/0xb10 drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:310 Code: c0 40 84 c6 0f 85 b1 08 00 00 48 8b 55 00 0f b7 c9 bd 01 00 00 00 48 0f ca 48 89 d0 c1 ea 0a 48 c1 e8 20 c1 e0 16 09 d0 31 d2 f1 8d 04 12 31 d2 f7 f1 29 c5 48 8d 83 b0 03 00 00 48 89 c7 48 RSP: 0018:ffffc90000007de8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880639eb3a0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000001 R09: ffffffff8f0c8957 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000001002 R14: ffff8880639eb3a0 R15: ffff8880727fadc0 FS: 0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb6d626c950 CR3: 00000000175a2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ath9k_wmi_event_tasklet+0x2bf/0x430 drivers/net/wireless/ath/ath9k/wmi.c:165 tasklet_action_common.constprop.0+0x201/0x2e0 kernel/softirq.c:784 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 do_softirq.part.0+0xde/0x130 kernel/softirq.c:459 do_softirq kernel/softirq.c:451 [inline] __local_bh_enable_ip+0x102/0x120 kernel/softirq.c:383 spin_unlock_bh include/linux/spinlock.h:394 [inline] batadv_nc_purge_paths+0x1e9/0x2d0 net/batman-adv/network-coding.c:471 batadv_nc_worker+0x6e0/0xd70 net/batman-adv/network-coding.c:720 process_one_work+0x879/0x1410 kernel/workqueue.c:2307 worker_thread+0x5a0/0xf60 kernel/workqueue.c:2454 kthread+0x299/0x340 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:ath9k_htc_choose_bslot drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:277 [inline] RIP: 0010:ath9k_htc_swba+0x18b/0xb10 drivers/net/wireless/ath/ath9k/htc_drv_beacon.c:310 Code: c0 40 84 c6 0f 85 b1 08 00 00 48 8b 55 00 0f b7 c9 bd 01 00 00 00 48 0f ca 48 89 d0 c1 ea 0a 48 c1 e8 20 c1 e0 16 09 d0 31 d2 f1 8d 04 12 31 d2 f7 f1 29 c5 48 8d 83 b0 03 00 00 48 89 c7 48 RSP: 0018:ffffc90000007de8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880639eb3a0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000001 R09: ffffffff8f0c8957 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000001002 R14: ffff8880639eb3a0 R15: ffff8880727fadc0 FS: 0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb6d626c950 CR3: 00000000175a2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: c0 40 84 c6 rolb $0xc6,-0x7c(%rax) 4: 0f 85 b1 08 00 00 jne 0x8bb a: 48 8b 55 00 mov 0x0(%rbp),%rdx e: 0f b7 c9 movzwl %cx,%ecx 11: bd 01 00 00 00 mov $0x1,%ebp 16: 48 0f ca bswap %rdx 19: 48 89 d0 mov %rdx,%rax 1c: c1 ea 0a shr $0xa,%edx 1f: 48 c1 e8 20 shr $0x20,%rax 23: c1 e0 16 shl $0x16,%eax 26: 09 d0 or %edx,%eax 28: 31 d2 xor %edx,%edx * 2a: f7 f1 div %ecx <-- trapping instruction 2c: 8d 04 12 lea (%rdx,%rdx,1),%eax 2f: 31 d2 xor %edx,%edx 31: f7 f1 div %ecx 33: 29 c5 sub %eax,%ebp 35: 48 8d 83 b0 03 00 00 lea 0x3b0(%rbx),%rax 3c: 48 89 c7 mov %rax,%rdi 3f: 48 rex.W