divide error in cache

Based on kernel commit ddfe51b0a0f5:

Root Cause Analysis

Involved Components

File: drivers/md/dm-cache-target.c
Functions: too_many_discard_blocks(), calculate_discard_block_size(), cache_create(), cache_ctr()
Structs & Fields:
- struct cache: origin_sectors (sector_t), discard_block_size (uint32_t)
- struct dm_target: len (sector_t)
- Macro: sector_div(a, b) -> do_div(a, b) (include/linux/math.h, arch/x86/include/asm/div64.h)

Detailed Technical Mechanism

Target Construction and Parameter Propagation: When loading a Device Mapper table via ioctl (DM_TABLE_LOAD), dm_table_add_target() creates a dm_target whose length in sectors (ti->len) is supplied by userspace. For the cache target, cache_ctr() invokes cache_create(), which sets the origin device size:
```
origin_blocks = cache->origin_sectors = ti->len;
```
At this stage of table creation, ti->len has not yet been validated against the underlying physical block device boundaries.

Discard Block Size Calculation: cache_create() subsequently computes the discard block size for the cache target:

cache->discard_block_size =
    calculate_discard_block_size(cache->sectors_per_block,
                                 cache->origin_sectors);

In calculate_discard_block_size(), the driver attempts to keep the total number of discard blocks across the origin device at or below MAX_DISCARD_BLOCKS (1 << 14, or 16384):

static sector_t calculate_discard_block_size(sector_t cache_block_size,
                                             sector_t origin_size)
{
    sector_t discard_block_size = cache_block_size;

    if (origin_size)
        while (too_many_discard_blocks(discard_block_size, origin_size))
            discard_block_size *= 2;

    return discard_block_size;
}

32-Bit Truncation in sector_div(): The helper too_many_discard_blocks() checks whether the number of discard blocks exceeds MAX_DISCARD_BLOCKS:
```
static bool too_many_discard_blocks(sector_t discard_block_size,
                                    sector_t origin_size)
{
    (void) sector_div(origin_size, discard_block_size);

    return origin_size > MAX_DISCARD_BLOCKS;
}
```
sector_div(n, base) is defined as do_div(n, base). In the Linux kernel (including on 64-bit architectures like x86_64), do_div() divides a 64-bit dividend n by a 32-bit divisor base (uint32_t __base = (base);).
Triggering Division by Zero: When cache->origin_sectors (ti->len) is very large (e.g. 0x003fffffffffffff in the crash report, where origin_size >= MAX_DISCARD_BLOCKS * 2^31 sectors = 2^45 sectors), origin_size / discard_block_size > MAX_DISCARD_BLOCKS continues to evaluate to true when discard_block_size reaches 2^31.

The while loop then multiplies discard_block_size by 2, causing it to become 2^32 (1ULL << 32 / 0x0000000100000000, visible in register %r13 in the crash report).

In the next loop iteration, too_many_discard_blocks() passes discard_block_size = 2^32 to sector_div(). Inside do_div(), casting 2^32 to a 32-bit unsigned integer truncates the divisor to 0:
```
mov    %r13d, %r12d   ; r13d is lower 32-bits of 1ULL << 32 == 0
...
div    %r12          ; div by zero (#DE)
```
Executing the div instruction with a zero divisor generates an x86 hardware divide error exception (#DE), causing an immediate kernel panic with Oops: divide error: 0000 [#1] SMP.

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
81b8d6ca	assessment-security	DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	divide error in cache_ctr	2026/11/06 14:58	2026/11/06 14:58	2026/11/06 15:32	5cecaf1f

assessment-security

DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

divide error in cache_ctr

2026/11/06 14:58

2026/11/06 15:32

5cecaf1f

Title	Replies (including bot)	Last reply
[syzbot] [dm?] divide error in cache_ctr	0 (1)	2026/11/06 15:33

Title

Replies (including bot)

Last reply

[syzbot] [dm?] divide error in cache_ctr

0 (1)

2026/11/06 15:33

Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5651 Comm: syz-executor201 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline] RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline] RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline] RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649 Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d RSP: 0018:ffffc90003a9f860 EFLAGS: 00010246 RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff8880337addc0 RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000 RBP: ffffc90003a9fa38 R08: ffffc90000bbe007 R09: 0000000000000000 R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000 R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff11004e11c62 FS: 000055556d48e400(0000) GS:ffff888123159000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004697f0 CR3: 00000000745fa000 CR4: 00000000003526f0 Call Trace: <TASK> dm_table_add_target+0x58d/0xc70 drivers/md/dm-table.c:749 populate_table drivers/md/dm-ioctl.c:1602 [inline] table_load+0x325/0x8a0 drivers/md/dm-ioctl.c:1645 ctl_ioctl drivers/md/dm-ioctl.c:2221 [inline] dm_ctl_ioctl+0x9ec/0xe10 drivers/md/dm-ioctl.c:2243 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x00007f0d2b0498c9 Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe1d3e7778 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 6d61722f7665642f RCX: 00007f0d2b0498c9 RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000013 R09: 0000000000000006 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffe1d3e78e8 R13: 431bde82d7b634db R14: 00007f0d2b0dcc40 R15: 0000000000000002 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:too_many_discard_blocks drivers/md/dm-cache-target.c:2386 [inline] RIP: 0010:calculate_discard_block_size drivers/md/dm-cache-target.c:2397 [inline] RIP: 0010:cache_create drivers/md/dm-cache-target.c:2525 [inline] RIP: 0010:cache_ctr+0x1a86/0x2bf0 drivers/md/dm-cache-target.c:2649 Code: 4c 8b 30 31 ff 4c 89 f6 e8 87 30 f5 f8 4d 85 f6 0f 84 81 00 00 00 4c 89 f3 48 c1 eb 20 45 89 ec 48 85 db 74 0a 4c 89 f0 31 d2 <49> f7 f4 eb 08 44 89 f0 31 d2 41 f7 f4 48 3d 00 40 00 00 76 14 4d RSP: 0018:ffffc90003a9f860 EFLAGS: 00010246 RAX: 003fffffffffffff RBX: 00000000003fffff RCX: ffff8880337addc0 RDX: 0000000000000000 RSI: 003fffffffffffff RDI: 0000000000000000 RBP: ffffc90003a9fa38 R08: ffffc90000bbe007 R09: 0000000000000000 R10: ffffc90000bbe000 R11: fffff52000177c01 R12: 0000000000000000 R13: 0000000100000000 R14: 003fffffffffffff R15: 1ffff11004e11c62 FS: 000055556d48e400(0000) GS:ffff888123159000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004697f0 CR3: 00000000745fa000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 4c 8b 30 mov (%rax),%r14 3: 31 ff xor %edi,%edi 5: 4c 89 f6 mov %r14,%rsi 8: e8 87 30 f5 f8 call 0xf8f53094 d: 4d 85 f6 test %r14,%r14 10: 0f 84 81 00 00 00 je 0x97 16: 4c 89 f3 mov %r14,%rbx 19: 48 c1 eb 20 shr $0x20,%rbx 1d: 45 89 ec mov %r13d,%r12d 20: 48 85 db test %rbx,%rbx 23: 74 0a je 0x2f 25: 4c 89 f0 mov %r14,%rax 28: 31 d2 xor %edx,%edx * 2a: 49 f7 f4 div %r12 <-- trapping instruction 2d: eb 08 jmp 0x37 2f: 44 89 f0 mov %r14d,%eax 32: 31 d2 xor %edx,%edx 34: 41 f7 f4 div %r12d 37: 48 3d 00 40 00 00 cmp $0x4000,%rax 3d: 76 14 jbe 0x53 3f: 4d rex.WRB

Crashes (4):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/11/06 16:36	linux-next	ddfe51b0a0f5	5cecaf1f	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-rust-kasan-gce	divide error in cache_ctr
2026/11/06 16:04	linux-next	ddfe51b0a0f5	5cecaf1f	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-rust-kasan-gce	divide error in cache_ctr
2026/11/06 15:31	linux-next	ddfe51b0a0f5	5cecaf1f	.config	strace log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-rust-kasan-gce	divide error in cache_ctr
2026/11/06 14:58	linux-next	ddfe51b0a0f5	5cecaf1f	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-rust-kasan-gce	divide error in cache_ctr

Crashes (4):

Assets (help?)