On Thu, Aug 20, 2026 at 05:42:28PM +0800, Kunwu Chan wrote:
> From: Kunwu Chan <[email protected]>
>
> When fwd_progress_div=1, the forward-progress test computes:
> sd4 = (sd + div - 1) / div = sd
> dur = sd4 + torture_random(&trs) % (sd - sd4) = sd4 + % 0
>
> The modulo operation with a zero divisor triggers an integer
> division by zero (undefined behavior at the C level, #DE trap on x86),
> causing a kernel Oops and panic. On x86_64, this manifests as:
>
> rcu_torture_fwd_prog_nr: Starting forward-progress test 0
> Oops: divide error: 0000 [#1] SMP PTI
> RIP: 0010:rcu_torture_fwd_prog+0x90b/0x1160
> R12: 0000000000000000
>
> The existing guard only handles non-positive values. However,
> fwd_progress_div=1 also makes the random range empty because
> sd4 == sd.
>
> Change the guard to reject values below 2. The forward-progress test
> only reaches this calculation when stall_dur() is positive, so
> sd = stall_dur() + 1 >= 2. For fwd_progress_div >= 2, sd4 < sd,
> ensuring that sd - sd4 is at least 1.
>
> Keep the existing fallback to the default value of 4 for invalid
> values.
>
> Verified with QEMU/KVM: a 138-second run with fwd_progress_div=1
> completed 81 forward-progress test cycles without a crash.
>
> Fixes: 1b27291b1ea4f ("rcutorture: Add forward-progress tests for RCU grace
> periods")
> Signed-off-by: Kunwu Chan <[email protected]>
Good eyes! Queued for further review and testing, thank you!
Thanx, Paul
> ---
> kernel/rcu/rcutorture.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
> index 54bec8e21e71..ed2407e888b4 100644
> --- a/kernel/rcu/rcutorture.c
> +++ b/kernel/rcu/rcutorture.c
> @@ -3990,7 +3990,7 @@ static int __init rcu_torture_fwd_prog_init(void)
> }
> if (fwd_progress_holdoff <= 0)
> fwd_progress_holdoff = 1;
> - if (fwd_progress_div <= 0)
> + if (fwd_progress_div < 2)
> fwd_progress_div = 4;
> rfp = kzalloc_objs(*rfp, fwd_progress);
> fwd_prog_tasks = kzalloc_objs(*fwd_prog_tasks, fwd_progress);
>
> base-commit: c68271c3f83a46de3fca48d3aa9e27c4dec8e58a
> --
> 2.43.0
>
