snapshot_io_hints() copies the snapshot store's chunk_size, which is in 512-byte sectors, into queue_limits.discard_granularity, which, like all other members of struct queue_limits, is in bytes. For snapshots with a chunk size smaller than 512 sectors, e.g. the 16 KiB (32-sector) chunks created by the syzkaller reproducer, the resulting granularity is smaller than a single sector. When dm_calculate_queue_limits() then stacks the target limits into the table limits: blk_stack_limits(limits, &ti_limits, 0) queue_limit_discard_alignment() truncates that granularity to zero sectors and sector_div() divides by zero: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:queue_limit_discard_alignment block/blk-settings.c:645 [inline] RIP: 0010:blk_stack_limits+0x1105/0x2d00 block/blk-settings.c:916 Call Trace: dm_calculate_queue_limits+0x70c/0x1510 drivers/md/dm-table.c:1823 dm_setup_md_queue+0x199/0x4f0 drivers/md/dm.c:2618 table_load+0x4fd/0x8a0 drivers/md/dm-ioctl.c:1661 The divide fault itself only became reachable when commit e924da7d6622 ("block: Drop granularity check in queue_limit_discard_alignment()") removed the check for a sub-sector granularity in v6.13. Kernels before that returned a zero discard alignment instead of faulting, but they still advertised a granularity 512 times too small. Use the same chunk_size << SECTOR_SHIFT conversion that io_overlaps_chunk() already applies to turn chunk_size into bytes. Fixes: 2e6023850e17 ("dm snapshot: add optional discard support features") Reported-by: syzbot+1288484b13bf6af3620d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1288484b13bf6af3620d Cc: stable@vger.kernel.org Signed-off-by: wuyuehong --- drivers/md/dm-snap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c index 797c432594d8..31676ee05514 100644 --- a/drivers/md/dm-snap.c +++ b/drivers/md/dm-snap.c @@ -2414,7 +2414,7 @@ static void snapshot_io_hints(struct dm_target *ti, struct queue_limits *limits) snap = snap_src; /* All discards are split on chunk_size boundary */ - limits->discard_granularity = snap->store->chunk_size; + limits->discard_granularity = snap->store->chunk_size << SECTOR_SHIFT; limits->max_hw_discard_sectors = snap->store->chunk_size; up_read(&_origins_lock); -- 2.43.0