Re: [syzbot] [usb-storage?] divide error in alauda_transport
From: syzbot
Date: Wed Aug 26 2026 - 06:27:12 EST
syzbot has found a reproducer for the following issue on:
HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=157ff979580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=dc208a8cf8d37cf3e5ac
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=113d1625580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dc208a8cf8d37cf3e5ac@xxxxxxxxxxxxxxxxxxxxxxxxx
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 6620 Comm: usb-storage Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:953 [inline]
RIP: 0010:alauda_transport+0xe5a/0x35c0 drivers/usb/storage/alauda.c:1187
Code: 01 45 85 ed 0f 84 6d 1c 00 00 c7 04 24 00 00 00 00 8b 5c 24 20 e8 46 38 53 fa 31 d2 48 8b 7c 24 08 89 d8 89 5c 24 20 41 89 df <f7> 74 24 70 89 c3 89 54 24 10 89 de e8 05 c1 ff ff 44 0f b7 74 24
RSP: 0018:ffffc900044ff9d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87b7c98a RDI: ffff8880578f8e90
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f741d1ca6e4 CR3: 0000000054fb4000 CR4: 0000000000352ef0
Call Trace:
<TASK>
usb_stor_invoke_transport+0xe7/0x15c0 drivers/usb/storage/transport.c:611
usb_stor_control_thread+0x5e4/0xae0 drivers/usb/storage/usb.c:462
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:953 [inline]
RIP: 0010:alauda_transport+0xe5a/0x35c0 drivers/usb/storage/alauda.c:1187
Code: 01 45 85 ed 0f 84 6d 1c 00 00 c7 04 24 00 00 00 00 8b 5c 24 20 e8 46 38 53 fa 31 d2 48 8b 7c 24 08 89 d8 89 5c 24 20 41 89 df <f7> 74 24 70 89 c3 89 54 24 10 89 de e8 05 c1 ff ff 44 0f b7 74 24
RSP: 0018:ffffc900044ff9d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87b7c98a RDI: ffff8880578f8e90
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f741d1ca6e4 CR3: 0000000054fb4000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 01 45 85 add %eax,-0x7b(%rbp)
3: ed in (%dx),%eax
4: 0f 84 6d 1c 00 00 je 0x1c77
a: c7 04 24 00 00 00 00 movl $0x0,(%rsp)
11: 8b 5c 24 20 mov 0x20(%rsp),%ebx
15: e8 46 38 53 fa call 0xfa533860
1a: 31 d2 xor %edx,%edx
1c: 48 8b 7c 24 08 mov 0x8(%rsp),%rdi
21: 89 d8 mov %ebx,%eax
23: 89 5c 24 20 mov %ebx,0x20(%rsp)
27: 41 89 df mov %ebx,%r15d
* 2a: f7 74 24 70 divl 0x70(%rsp) <-- trapping instruction
2e: 89 c3 mov %eax,%ebx
30: 89 54 24 10 mov %edx,0x10(%rsp)
34: 89 de mov %ebx,%esi
36: e8 05 c1 ff ff call 0xffffc140
3b: 44 rex.R
3c: 0f .byte 0xf
3d: b7 74 mov $0x74,%bh
3f: 24 .byte 0x24
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.