bisecting fixing commit since e1f7d50ae3a3ec342e87a9b1ce6787bfb8b3c08b building syzkaller on be5c2c81971442d623dd1b265dabf4644ceeb35b testing commit e1f7d50ae3a3ec342e87a9b1ce6787bfb8b3c08b with gcc (GCC) 8.1.0 kernel signature: 8626cefa241e9ec2ff0a61350633cca7ffa2a29f881f53ec21b5a2cda9d79c10 all runs: crashed: divide error in netem_enqueue testing current HEAD 98db2bf27b9ed2d5ed0b6c9c8a4bfcb127a19796 testing commit 98db2bf27b9ed2d5ed0b6c9c8a4bfcb127a19796 with gcc (GCC) 8.1.0 kernel signature: 1b590860119ea85ea72948428f37c9330e60c0d978901f9866fefb308d42f033 all runs: crashed: divide error in netem_enqueue revisions tested: 2, total time: 27m42.808312032s (build: 18m40.65936978s, test: 8m26.526422982s) the crash still happens on HEAD commit msg: Linux 4.14.171 crash: divide error in netem_enqueue IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready divide error: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 2723 Comm: kworker/1:2 Not tainted 4.14.171-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work task: ffff88809f7d6200 task.stack: ffff88809f6f8000 RIP: 0010:packet_len_2_sched_time net/sched/sch_netem.c:352 [inline] RIP: 0010:netem_enqueue+0x6f9/0x2a50 net/sched/sch_netem.c:562 RSP: 0018:ffff8880aed06ce0 EFLAGS: 00010246 RAX: 1aedcbe189692000 RBX: ffff88808c4ef47c RCX: 000000000000001e RDX: 0000000000000000 RSI: 0000000031ce8b90 RDI: ffff88808c4ef4a8 RBP: ffff8880aed06d70 R08: ffff88808c4ef400 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000073a8a150 R13: 0000000073000000 R14: 000000000000206e R15: ffff88808c4ef240 FS: 0000000000000000(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe95f8fd110 CR3: 000000008d56a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __dev_xmit_skb net/core/dev.c:3229 [inline] __dev_queue_xmit+0x1156/0x2740 net/core/dev.c:3493 dev_queue_xmit+0xb/0x10 net/core/dev.c:3558 br_dev_queue_push_xmit+0x14b/0x570 net/bridge/br_forward.c:55 br_nf_dev_queue_xmit+0x2a9/0x1740 net/bridge/br_netfilter_hooks.c:779 NF_HOOK include/linux/netfilter.h:250 [inline] br_nf_post_routing+0x5e8/0xdc0 net/bridge/br_netfilter_hooks.c:825 nf_hook_entry_hookfn include/linux/netfilter.h:108 [inline] nf_hook_slow+0xa1/0x180 net/netfilter/core.c:467 nf_hook include/linux/netfilter.h:205 [inline] NF_HOOK include/linux/netfilter.h:248 [inline] br_forward_finish+0x18a/0x2b0 net/bridge/br_forward.c:67 br_nf_hook_thresh+0x23b/0x380 net/bridge/br_netfilter_hooks.c:1008 br_nf_forward_finish+0x22a/0x630 net/bridge/br_netfilter_hooks.c:550 NF_HOOK include/linux/netfilter.h:250 [inline] br_nf_forward_ip+0x555/0x1440 net/bridge/br_netfilter_hooks.c:617 nf_hook_entry_hookfn include/linux/netfilter.h:108 [inline] nf_hook_slow+0xa1/0x180 net/netfilter/core.c:467 nf_hook include/linux/netfilter.h:205 [inline] NF_HOOK include/linux/netfilter.h:248 [inline] __br_forward+0x2be/0x8d0 net/bridge/br_forward.c:111 deliver_clone+0x54/0xa0 net/bridge/br_forward.c:127 br_flood+0x36d/0x4f0 net/bridge/br_forward.c:222 br_handle_frame_finish+0xa69/0x1db0 net/bridge/br_input.c:210 br_nf_hook_thresh+0x23b/0x380 net/bridge/br_netfilter_hooks.c:1008 br_nf_pre_routing_finish_ipv6+0x5cb/0xb10 net/bridge/br_netfilter_ipv6.c:210 NF_HOOK include/linux/netfilter.h:250 [inline] br_nf_pre_routing_ipv6+0x3de/0x700 net/bridge/br_netfilter_ipv6.c:240 br_nf_pre_routing+0x848/0x11b0 net/bridge/br_netfilter_hooks.c:491 nf_hook_entry_hookfn include/linux/netfilter.h:108 [inline] nf_hook_slow+0xa1/0x180 net/netfilter/core.c:467 nf_hook include/linux/netfilter.h:205 [inline] NF_HOOK include/linux/netfilter.h:248 [inline] br_handle_frame+0x762/0x1180 net/bridge/br_input.c:348 __netif_receive_skb_core+0x6d1/0x3260 net/core/dev.c:4431 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:4515 process_backlog+0x1fc/0x710 net/core/dev.c:5197 napi_poll net/core/dev.c:5598 [inline] net_rx_action+0x458/0xed0 net/core/dev.c:5664 __do_softirq+0x246/0x9b0 kernel/softirq.c:288 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1015 do_softirq.part.16+0x11a/0x150 kernel/softirq.c:332 do_softirq kernel/softirq.c:324 [inline] __local_bh_enable_ip+0x15c/0x180 kernel/softirq.c:185 local_bh_enable include/linux/bottom_half.h:32 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:725 [inline] ip6_finish_output2+0x94d/0x22e0 net/ipv6/ip6_output.c:121 ip6_finish_output+0x363/0xa50 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:239 [inline] ip6_output+0x1b7/0x600 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:462 [inline] NF_HOOK include/linux/netfilter.h:250 [inline] mld_sendpack+0x82f/0xc60 net/ipv6/mcast.c:1660 mld_send_initial_cr.part.27+0xd7/0x110 net/ipv6/mcast.c:2077 mld_send_initial_cr net/ipv6/mcast.c:2090 [inline] ipv6_mc_dad_complete+0x14d/0x1a0 net/ipv6/mcast.c:2084 addrconf_dad_completed+0x85e/0xb90 net/ipv6/addrconf.c:4052 addrconf_dad_work+0x61f/0xfa0 net/ipv6/addrconf.c:3983 process_one_work+0x79e/0x16c0 kernel/workqueue.c:2114 worker_thread+0xcc/0xee0 kernel/workqueue.c:2248 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 6c 20 00 00 41 8b 87 68 02 00 00 44 01 e8 44 0f af e0 49 69 c4 00 ca 9a 3b 45 89 d2 31 d2 <49> f7 f2 48 c1 e8 06 49 01 c3 48 8b 45 d0 49 01 f3 48 8d 78 30 RIP: packet_len_2_sched_time net/sched/sch_netem.c:352 [inline] RSP: ffff8880aed06ce0 RIP: netem_enqueue+0x6f9/0x2a50 net/sched/sch_netem.c:562 RSP: ffff8880aed06ce0 ---[ end trace 6937fdd20542e809 ]---