================================================================================
UBSAN: shift-out-of-bounds in net/core/gen_estimator.c:83:38
shift exponent -154 is negative
CPU: 0 PID: 4894 Comm: systemd-udevd Not tainted 5.10.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 est_timer.cold+0xbb/0x12d net/core/gen_estimator.c:83
 call_timer_fn+0x1a5/0x710 kernel/time/timer.c:1417
 expire_timers kernel/time/timer.c:1462 [inline]
 __run_timers+0x6f6/0xb10 kernel/time/timer.c:1731
 run_timer_softirq+0x7d/0x140 kernel/time/timer.c:1744
 __do_softirq+0x2cb/0xad5 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x18a/0x1b0 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
RIP: 0010:__read_once_word_nocheck+0x0/0x10 include/asm-generic/rwonce.h:67
Code: 30 fe ff ff e8 61 c9 87 00 e9 e5 fd ff ff e8 57 c9 87 00 e9 b2 fd ff ff e8 4d c9 87 00 e9 6a fd ff ff cc cc cc cc cc cc cc cc <48> 8b 07 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 41 57 89 d0 41 56
RSP: 0018:ffffc9000161f850 EFLAGS: 00000283
RAX: ffffc90001620000 RBX: ffffc9000161fa08 RCX: ffffc9000161fa08
RDX: dffffc0000000000 RSI: ffffc9000161f9b8 RDI: ffffc9000161f9b8
RBP: ffffc9000161f9b8 R08: ffffffff8e88614a R09: ffffffff8e88614e
R10: fffff520002c3f43 R11: 0000000000000001 R12: ffffc9000161f9c0
R13: ffffc90001618000 R14: ffffc9000161fa10 R15: ffffc9000161f9c0
 deref_stack_reg+0xee/0x150 arch/x86/kernel/unwind_orc.c:355
 unwind_next_frame+0xcbc/0x2610 arch/x86/kernel/unwind_orc.c:531
 __unwind_start+0x544/0x810 arch/x86/kernel/unwind_orc.c:696
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 arch_stack_walk+0x5c/0xe0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:682 [inline]
 kernfs_iop_get_link fs/kernfs/symlink.c:135 [inline]
 kernfs_iop_get_link+0x61/0x700 fs/kernfs/symlink.c:126
 vfs_readlink+0x1d7/0x390 fs/namei.c:4552
 do_readlinkat+0x27e/0x2f0 fs/stat.c:419
 __do_sys_readlinkat fs/stat.c:434 [inline]
 __se_sys_readlinkat fs/stat.c:431 [inline]
 __x64_sys_readlinkat+0x93/0xf0 fs/stat.c:431
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fb34dcfc0ba
Code: 48 8b 0d e1 bd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 0b 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ae bd 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007fff801c3028 EFLAGS: 00000202 ORIG_RAX: 000000000000010b
RAX: ffffffffffffffda RBX: 00005615dd4e7580 RCX: 00007fb34dcfc0ba
RDX: 00005615dd4e7580 RSI: 00007fff801c30b0 RDI: 00000000ffffff9c
RBP: 0000000000000064 R08: 00007fb34dfb8bd8 R09: 0000000000000070
R10: 0000000000000063 R11: 0000000000000202 R12: 00007fff801c30b0
R13: 00000000ffffff9c R14: 00007fff801c3080 R15: 0000000000000063
================================================================================