syzbot


divide error in comedi_inc_scan_progress (2)

Status: upstream: reported on 2025/11/05 08:13
Reported-by: syzbot+bb6180f965618f0f7b31@syzkaller.appspotmail.com
First crash: 159d, last: 15d
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 divide error in comedi_inc_scan_progress (2) 2 1 44d 44d 0/3 upstream: reported on 2026/02/27 16:53
linux-6.6 divide error in comedi_inc_scan_progress 2 2 262d 265d 0/2 auto-obsoleted due to no activity on 2025/11/01 16:46
upstream divide error in comedi_inc_scan_progress comedi 2 74 127d 278d 0/29 auto-obsoleted due to no activity on 2026/02/15 00:02
linux-5.15 divide error in comedi_inc_scan_progress 2 2 145d 145d 0/3 auto-obsoleted due to no activity on 2026/02/27 00:49
linux-6.1 divide error in comedi_inc_scan_progress 2 4 9d11h 124d 0/3 upstream: reported on 2025/12/10 08:43

Sample crash report:
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:comedi_inc_scan_progress+0x1a2/0x430 drivers/comedi/drivers.c:562
Code: b6 0c 19 84 c9 0f 85 b8 01 00 00 03 45 34 4c 8d a5 88 00 00 00 4c 89 e1 48 c1 e9 03 0f b6 0c 19 84 c9 0f 85 c7 01 00 00 31 d2 <41> f7 34 24 41 89 17 45 89 ec eb 0f e8 7d 41 76 f9 48 bb 00 00 00
RSP: 0018:ffffc90000007c80 EFLAGS: 00010046
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888079b0c600 R08: ffff888079b0c600 R09: 00000000000000ff
R10: dffffc0000000000 R11: fffff52001f40a01 R12: ffff888079b0c688
R13: 0000000000000002 R14: 0000000000000000 R15: ffff888079b0c634
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d917ff8 CR3: 000000007ac1b000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 comedi_buf_write_samples+0x372/0x5d0 drivers/comedi/comedi_buf.c:646
 das16m1_handler+0x213/0x4b0 drivers/comedi/drivers/das16m1.c:413
 das16m1_interrupt+0xab/0x180 drivers/comedi/drivers/das16m1.c:470
 __handle_irq_event_percpu+0x271/0x940 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x247/0xb30 kernel/irq/chip.c:831
 generic_handle_irq_desc include/linux/irqdesc.h:161 [inline]
 handle_irq arch/x86/kernel/irq.c:240 [inline]
 __common_interrupt+0x13b/0x230 arch/x86/kernel/irq.c:259
 common_interrupt+0xb4/0xd0 arch/x86/kernel/irq.c:249
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:678
RIP: 0010:pv_native_safe_halt+0xf/0x10 arch/x86/kernel/paravirt.c:148
Code: 6f 21 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 23 39 42 00 fb f4 <c3> 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2e 41 89 de 80
RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c6
RAX: c963888a30600200 RBX: ffffffff8162a9dd RCX: c963888a30600200
RDX: 0000000000000001 RSI: ffffffff8acac9e0 RDI: ffffffff8b1c89a0
RBP: ffffffff8ce07eb8 R08: ffff8880b8e36b2b R09: 1ffff110171c6d65
R10: dffffc0000000000 R11: ffffed10171c6d66 R12: 1ffffffff19c0fbc
R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:753
 default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
 cpuidle_idle_call kernel/sched/idle.c:178 [inline]
 do_idle+0x33d/0x590 kernel/sched/idle.c:302
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:401
 rest_init+0x2e2/0x300 init/main.c:744
 arch_call_rest_init+0xe/0x10 init/main.c:841
 start_kernel+0x459/0x4e0 init/main.c:1086
 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:555
 x86_64_start_kernel+0x60/0x60 arch/x86/kernel/head64.c:536
 secondary_startup_64_no_verify+0x179/0x17b
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:comedi_inc_scan_progress+0x1a2/0x430 drivers/comedi/drivers.c:562
Code: b6 0c 19 84 c9 0f 85 b8 01 00 00 03 45 34 4c 8d a5 88 00 00 00 4c 89 e1 48 c1 e9 03 0f b6 0c 19 84 c9 0f 85 c7 01 00 00 31 d2 <41> f7 34 24 41 89 17 45 89 ec eb 0f e8 7d 41 76 f9 48 bb 00 00 00
RSP: 0018:ffffc90000007c80 EFLAGS: 00010046
RAX: 0000000000000001 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888079b0c600 R08: ffff888079b0c600 R09: 00000000000000ff
R10: dffffc0000000000 R11: fffff52001f40a01 R12: ffff888079b0c688
R13: 0000000000000002 R14: 0000000000000000 R15: ffff888079b0c634
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d917ff8 CR3: 000000007ac1b000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
   0:	b6 0c                	mov    $0xc,%dh
   2:	19 84 c9 0f 85 b8 01 	sbb    %eax,0x1b8850f(%rcx,%rcx,8)
   9:	00 00                	add    %al,(%rax)
   b:	03 45 34             	add    0x34(%rbp),%eax
   e:	4c 8d a5 88 00 00 00 	lea    0x88(%rbp),%r12
  15:	4c 89 e1             	mov    %r12,%rcx
  18:	48 c1 e9 03          	shr    $0x3,%rcx
  1c:	0f b6 0c 19          	movzbl (%rcx,%rbx,1),%ecx
  20:	84 c9                	test   %cl,%cl
  22:	0f 85 c7 01 00 00    	jne    0x1ef
  28:	31 d2                	xor    %edx,%edx
* 2a:	41 f7 34 24          	divl   (%r12) <-- trapping instruction
  2e:	41 89 17             	mov    %edx,(%r15)
  31:	45 89 ec             	mov    %r13d,%r12d
  34:	eb 0f                	jmp    0x45
  36:	e8 7d 41 76 f9       	call   0xf97641b8
  3b:	48                   	rex.W
  3c:	bb                   	.byte 0xbb
  3d:	00 00                	add    %al,(%rax)

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/28 18:52 linux-6.6.y c09fbcd31ae6 b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
2026/03/05 16:39 linux-6.6.y 4fc00fe35d46 d20b04c8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
2026/02/20 07:34 linux-6.6.y 7a137e9bfa0e 17d780d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
2026/02/20 07:34 linux-6.6.y 7a137e9bfa0e 17d780d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
2026/01/19 21:23 linux-6.6.y cbb31f77b879 a9fc5226 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
2026/01/09 14:08 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
2025/11/20 03:06 linux-6.6.y 0a805b6ea8cd 26ee5237 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
2025/11/05 08:13 linux-6.6.y 0a805b6ea8cd a6c9c731 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan divide error in comedi_inc_scan_progress
* Struck through repros no longer work on HEAD.