[BUG] drivers/media: divide-by-zero in em28xx_audio_init()

From: co

Date: Sat Sep 12 2026 - 09:07:13 EST


This is a bug report, not a patch submission.

We found a bug reachable in:

path drivers/media/usb/em28xx
crash divide-by-zero in em28xx_audio_init()
commit 2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
If you fix this bug, this tag credits the report and lets us
close it on our side:

Reported-by: co+9782320f78c23f40@xxxxxxx

Everything in this mail is validated by the reproducer below.

We also hold an unreviewed LLM-generated analysis and candidate
patch. The same reproducer panics the unpatched kernel and runs
clean with that patch applied. Use it as a starting point, or ignore
it and write your own:

patch.diff https://bugs.sh/b/9782320f78c23f40/patch.diff
report.md https://bugs.sh/b/9782320f78c23f40/report.md

Happy to test patches. Complaints and suggestions about our work
are welcome at:

cedalion@xxxxxxx

== Environment =========================================================
Reproduced on 2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
VM setup https://bugs.sh/b/9782320f78c23f40/run.sh
config https://bugs.sh/b/9782320f78c23f40/config.gz
poc https://bugs.sh/b/9782320f78c23f40/repro.c

== Sanitizer Report ====================================================
Oops: divide error: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 795 Comm: kworker/0:2 Not tainted 7.3.0-rc1 #1 PREEMPT(full)
Workqueue: events request_module_async
RIP: 0010:em28xx_audio_init (drivers/media/usb/em28xx/em28xx-audio.c:718 drivers/media/usb/em28xx/em28xx-audio.c:870)
Call Trace:
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Kernel panic - not syncing: Fatal exception


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@xxxxxxx

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup