divide error in tabledist

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: c3038e71 Linux 4.19.80
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=168b0024e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=44c623b7e5432cee
dashboard link: https://syzkaller.appspot.com/bug?extid=27502b739115cfecfe57
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=147b74a8e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1615d170e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+27502b...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.19.80 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:tabledist.part.0+0x13f/0x170 net/sched/sch_netem.c:333
Code: e8 48 83 c4 08 5b 41 5c 41 5d 41 5e 5d c3 e8 58 69 e3 fb 48 81 eb 00
10 00 00 eb a5 e8 4a 69 e3 fb 43 8d 0c 24 44 89 f0 31 d2 <f7> f1 4d 29 e5
49 01 d5 eb c5 48 89 df e8 1f ff 19 fc e9 0d ff ff
RSP: 0018:ffff8880ae9075a8 EFLAGS: 00010246
RAX: 000000007c15f78b RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff85875df6 RDI: 0000000000000005
RBP: ffff8880ae9075d0 R08: ffff8880aa2703c0 R09: ffffed1015d20ea6
R10: ffffed1015d20ea5 R11: 0000000000000003 R12: ffffffff80000000
R13: 0000000000000000 R14: 000000007c15f78b R15: ffff8880924a3240
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560368d211a0 CR3: 00000000a0a9d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
tabledist net/sched/sch_netem.c:533 [inline]
netem_enqueue+0x418/0x28f0 net/sched/sch_netem.c:533
__dev_xmit_skb net/core/dev.c:3495 [inline]
__dev_queue_xmit+0x153d/0x2fe0 net/core/dev.c:3811
dev_queue_xmit+0x18/0x20 net/core/dev.c:3876
neigh_resolve_output net/core/neighbour.c:1369 [inline]
neigh_resolve_output+0x5b7/0x980 net/core/neighbour.c:1349
neigh_output include/net/neighbour.h:501 [inline]
ip6_finish_output2+0xb7f/0x2550 net/ipv6/ip6_output.c:120
ip6_finish_output+0x574/0xbe0 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x235/0x7c0 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:447 [inline]
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
mld_sendpack+0x9d3/0xeb0 net/ipv6/mcast.c:1684
mld_send_cr net/ipv6/mcast.c:1980 [inline]
mld_ifc_timer_expire+0x449/0x8a0 net/ipv6/mcast.c:2479
call_timer_fn+0x18d/0x720 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers kernel/time/timer.c:1684 [inline]
__run_timers kernel/time/timer.c:1652 [inline]
run_timer_softirq+0x64f/0x16a0 kernel/time/timer.c:1697
__do_softirq+0x25c/0x921 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:893
</IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: ff ff 48 89 df e8 72 e5 af fa eb 82 e9 07 00 00 00 0f 00 2d b4 63 56
00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d a4 63 56 00 fb f4 <c3> 90 55 48 89
e5 41 57 41 56 41 55 41 54 53 e8 6e c4 67 fa e8 29
RSP: 0018:ffff8880aa27fd08 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e48cc RBX: ffff8880aa2703c0 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880aa270c3c
RBP: ffff8880aa27fd38 R08: ffff8880aa2703c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffffffff88724650 R14: 0000000000000000 R15: ffff8880aa2703c0
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:556
default_idle_call+0x36/0x90 kernel/sched/idle.c:93
cpuidle_idle_call kernel/sched/idle.c:153 [inline]
do_idle+0x30c/0x4d0 kernel/sched/idle.c:263
cpu_startup_entry+0xc8/0xe0 kernel/sched/idle.c:369
start_secondary+0x3e8/0x5b0 arch/x86/kernel/smpboot.c:271
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
Modules linked in:
---[ end trace 42959894b6fbd544 ]---
RIP: 0010:tabledist.part.0+0x13f/0x170 net/sched/sch_netem.c:333
Code: e8 48 83 c4 08 5b 41 5c 41 5d 41 5e 5d c3 e8 58 69 e3 fb 48 81 eb 00
10 00 00 eb a5 e8 4a 69 e3 fb 43 8d 0c 24 44 89 f0 31 d2 <f7> f1 4d 29 e5
49 01 d5 eb c5 48 89 df e8 1f ff 19 fc e9 0d ff ff
RSP: 0018:ffff8880ae9075a8 EFLAGS: 00010246
RAX: 000000007c15f78b RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff85875df6 RDI: 0000000000000005
RBP: ffff8880ae9075d0 R08: ffff8880aa2703c0 R09: ffffed1015d20ea6
R10: ffffed1015d20ea5 R11: 0000000000000003 R12: ffffffff80000000
R13: 0000000000000000 R14: 000000007c15f78b R15: ffff8880924a3240
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560368d211a0 CR3: 00000000a0a9d000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 95ba2236b8e69de3cb9b12e1cd6c4252a1574a19
Author: Aleksandr Nogikh <nog...@google.com>
Date: Wed Oct 28 17:07:31 2020 +0000

netem: fix zero division in tabledist

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17fb9e5e500000
start commit: c14d30dc Linux 4.19.139
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=93b261233af4719e
dashboard link: https://syzkaller.appspot.com/bug?extid=27502b739115cfecfe57
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11eaa191900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=179175a6900000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: netem: fix zero division in tabledist

For information about bisection process see: https://goo.gl/tpsmEJ#bisection