[syzbot] [dm?] divide error in cache_ctr

[syzbot] [dm?] divide error in cache_ctr

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    ddfe51b0a0f5 Add linux-next specific files for 20261105
git tree:       linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15c38e55580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=3dffa811bfeed6b4
dashboard link: https://syzkaller.appspot.com/bug?extid=3e16980543e238b95bd1
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=172a6bdd580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10aa6bdd580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/181043a4bd52/disk-ddfe51b0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a69d8b670c38/vmlinux-ddfe51b0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/906d515c0893/bzImage-ddfe51b0.xz

AI-generated root cause summary:
In drivers/md/dm-cache-target.c, calculate_discard_block_size() repeatedly
doubles discard_block_size in a loop until the origin device has no more than
MAX_DISCARD_BLOCKS (16384) discard blocks. When creating a cache target with a
sufficiently large origin length (ti->len >= 2^45 sectors), discard_block_size
doubles until it reaches 2^32 (1ULL << 32). Because too_many_discard_blocks()
uses sector_div(), which expects a 32-bit divisor (uint32_t), passing 2^32
causes the divisor to truncate to zero. This triggers an unhandled kernel divide
error (#DE), crashing the system with an Oops: divide error.

full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=3e16980543e238b95bd1

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3e16980543e238b95bd1@syzkaller.appspotmail.com

Oops: divide error: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5654 Comm: syz-executor515 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline]
RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline]
RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline]
RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649
Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d
RSP: 0018:ffffc900038bf860 EFLAGS: 00010246
RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff88807f1c3e80
RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000
RBP: ffffc900038bfa38 R08: ffffc90000bbe007 R09: 0000000000000000
R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000
R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff1100fec2462
FS:  000055557cd07400(0000) GS:ffff888123259000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004697f0 CR3: 0000000078996000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 dm_table_add_target+0x58d/0xc70 drivers/md/dm-table.c:749
 populate_table drivers/md/dm-ioctl.c:1602 [inline]
 table_load+0x325/0x8a0 drivers/md/dm-ioctl.c:1645
 ctl_ioctl drivers/md/dm-ioctl.c:2221 [inline]
 dm_ctl_ioctl+0x9ec/0xe10 drivers/md/dm-ioctl.c:2243
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x00007fdd52f9b8c9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdc56ed528 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 6d61722f7665642f RCX: 00007fdd52f9b8c9
RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000000013 R09: 0000000000000006
R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffdc56ed698
R13: 431bde82d7b634db R14: 00007fdd5302ec40 R15: 0000000000000002
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline]
RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline]
RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline]
RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649
Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d
RSP: 0018:ffffc900038bf860 EFLAGS: 00010246
RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff88807f1c3e80
RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000
RBP: ffffc900038bfa38 R08: ffffc90000bbe007 R09: 0000000000000000
R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000
R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff1100fec2462
FS:  000055557cd07400(0000) GS:ffff888123259000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004697f0 CR3: 0000000078996000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	4c 8b 30             	mov    (%rax),%r14
   3:	31 ff                	xor    %edi,%edi
   5:	4c 89 f6             	mov    %r14,%rsi
   8:	e8 87 30 f5 f8       	call   0xf8f53094
   d:	4d 85 f6             	test   %r14,%r14
  10:	0f 84 81 00 00 00    	je     0x97
  16:	4c 89 f3             	mov    %r14,%rbx
  19:	48 c1 eb 20          	shr    $0x20,%rbx
  1d:	45 89 ec             	mov    %r13d,%r12d
  20:	48 85 db             	test   %rbx,%rbx
  23:	74 0a                	je     0x2f
  25:	4c 89 f0             	mov    %r14,%rax
  28:	31 d2                	xor    %edx,%edx
* 2a:	49 f7 f4             	div    %r12 <-- trapping instruction
  2d:	eb 08                	jmp    0x37
  2f:	44 89 f0             	mov    %r14d,%eax
  32:	31 d2                	xor    %edx,%edx
  34:	41 f7 f4             	div    %r12d
  37:	48 3d 00 40 00 00    	cmp    $0x4000,%rax
  3d:	76 14                	jbe    0x53
  3f:	4d                   	rex.WRB


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: [PATCH] dm cache: fix divide error in too_many_discard_blocks

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] dm cache: fix divide error in too_many_discard_blocks
Author: drifabdelmalekmohamedsaid@gmail.com

#syz test

Signed-off-by: Drif Abdelmalek Mohamed Said <drifabdelmalekmohamedsaid@gmail.com>
---
 drivers/md/dm-cache-target.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1a5072425c4a..408bc743a141 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2383,6 +2383,8 @@ static int create_cache_policy(struct cache *cache, struct cache_args *ca,
 static bool too_many_discard_blocks(sector_t discard_block_size,
 				    sector_t origin_size)
 {
+	if (discard_block_size > U32 / 2)
+		return false;
 	(void) sector_div(origin_size, discard_block_size);
 
 	return origin_size > MAX_DISCARD_BLOCKS;
-- 
2.47.3

Forwarded: [PATCH] dm cache: fix divide error in too_many_discard_blocks

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] dm cache: fix divide error in too_many_discard_blocks
Author: drifabdelmalekmohamedsaid@gmail.com

#syz test

Signed-off-by: Drif Abdelmalek Mohamed Said <drifabdelmalekmohamedsaid@gmail.com>
---
 drivers/md/dm-cache-target.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1a5072425c4a..408bc743a141 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2383,6 +2383,8 @@ static int create_cache_policy(struct cache *cache, struct cache_args *ca,
 static bool too_many_discard_blocks(sector_t discard_block_size,
 				    sector_t origin_size)
 {
+	if (discard_block_size > U32_MAX / 2)
+		return false;
 	(void) sector_div(origin_size, discard_block_size);
 
 	return origin_size > MAX_DISCARD_BLOCKS;
-- 
2.47.3