Re: [PATCH] rcutorture: Fix divide-by-zero with fwd_progress_div=1

[Paul E. McKenney]

On Thu, Aug 20, 2026 at 05:42:28PM +0800, Kunwu Chan wrote:
> From: Kunwu Chan <kunwu.chan@xxxxxxxxx>
> 
> When fwd_progress_div=1, the forward-progress test computes:
>   sd4 = (sd + div - 1) / div = sd
>   dur = sd4 + torture_random(&trs) % (sd - sd4) = sd4 + % 0
> 
> The modulo operation with a zero divisor triggers an integer
> division by zero (undefined behavior at the C level, #DE trap on x86),
> causing a kernel Oops and panic. On x86_64, this manifests as:
> 
>   rcu_torture_fwd_prog_nr: Starting forward-progress test 0
>   Oops: divide error: 0000 [#1] SMP PTI
>   RIP: 0010:rcu_torture_fwd_prog+0x90b/0x1160
>   R12: 0000000000000000
> 
> The existing guard only handles non-positive values. However,
> fwd_progress_div=1 also makes the random range empty because
> sd4 == sd.
> 
> Change the guard to reject values below 2. The forward-progress test
> only reaches this calculation when stall_dur() is positive, so
> sd = stall_dur() + 1 >= 2. For fwd_progress_div >= 2, sd4 < sd,
> ensuring that sd - sd4 is at least 1.
> 
> Keep the existing fallback to the default value of 4 for invalid
> values.
> 
> Verified with QEMU/KVM: a 138-second run with fwd_progress_div=1
> completed 81 forward-progress test cycles without a crash.
> 
> Fixes: 1b27291b1ea4f ("rcutorture: Add forward-progress tests for RCU grace periods")
> Signed-off-by: Kunwu Chan <kunwu.chan@xxxxxxxxx>

Good eyes!  Queued for further review and testing, thank you!

							Thanx, Paul

> ---
>  kernel/rcu/rcutorture.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
> index 54bec8e21e71..ed2407e888b4 100644
> --- a/kernel/rcu/rcutorture.c
> +++ b/kernel/rcu/rcutorture.c
> @@ -3990,7 +3990,7 @@ static int __init rcu_torture_fwd_prog_init(void)
>  	}
>  	if (fwd_progress_holdoff <= 0)
>  		fwd_progress_holdoff = 1;
> -	if (fwd_progress_div <= 0)
> +	if (fwd_progress_div < 2)
>  		fwd_progress_div = 4;
>  	rfp = kzalloc_objs(*rfp, fwd_progress);
>  	fwd_prog_tasks = kzalloc_objs(*fwd_prog_tasks, fwd_progress);
> 
> base-commit: c68271c3f83a46de3fca48d3aa9e27c4dec8e58a
> -- 
> 2.43.0
>