================================================================================ UBSAN: shift-out-of-bounds in net/sched/sch_api.c:572:7 shift exponent 50 is too large for 32-bit type 'int' CPU: 1 PID: 17492 Comm: syz-executor.5 Not tainted 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:330 __qdisc_calculate_pkt_len.cold+0x62/0xcf net/sched/sch_api.c:572 qdisc_calculate_pkt_len include/net/sch_generic.h:841 [inline] __dev_xmit_skb net/core/dev.c:3788 [inline] __dev_queue_xmit+0x115c/0x36e0 net/core/dev.c:4172 neigh_resolve_output net/core/neighbour.c:1492 [inline] neigh_resolve_output+0x50e/0x820 net/core/neighbour.c:1472 neigh_output include/net/neighbour.h:510 [inline] ip_finish_output2+0x813/0x2140 net/ipv4/ip_output.c:221 __ip_finish_output net/ipv4/ip_output.c:299 [inline] __ip_finish_output+0x396/0x640 net/ipv4/ip_output.c:281 ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:309 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x196/0x310 net/ipv4/ip_output.c:423 dst_output include/net/dst.h:450 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126 igmpv3_send_cr net/ipv4/igmp.c:719 [inline] igmp_ifc_timer_expire+0x75b/0xf80 net/ipv4/igmp.c:808 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:check_kcov_mode kernel/kcov.c:163 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x7/0x60 kernel/kcov.c:197 Code: fd ff ff b9 ff ff ff ff ba 08 00 00 00 4d 8b 03 48 0f bd ca 49 8b 45 00 48 63 c9 e9 64 ff ff ff 0f 1f 00 65 8b 05 69 e4 8b 7e <89> c1 48 8b 34 24 81 e1 00 01 00 00 65 48 8b 14 25 40 f0 01 00 a9 RSP: 0018:ffffc90004f1e960 EFLAGS: 00000282 RAX: 0000000080000001 RBX: 0000000000000063 RCX: 00000000000000fb RDX: 0000000000000000 RSI: ffff888075bed580 RDI: 0000000000000003 RBP: ffffc90004f1ea80 R08: 0000000000000009 R09: 00000000fffffffb R10: ffffffff83f5f271 R11: 0000000000000012 R12: ffffffff898cb781 R13: ffffffff898cb780 R14: 1ffff920009e3d30 R15: 0000000000000063 format_decode+0x323/0xad0 lib/vsprintf.c:2591 vsnprintf+0x157/0x14f0 lib/vsprintf.c:2749 snprintf+0xbb/0xf0 lib/vsprintf.c:2930 print_caller kernel/printk/printk.c:1270 [inline] info_print_prefix+0x11c/0x340 kernel/printk/printk.c:1289 record_print_text+0x14d/0x3e0 kernel/printk/printk.c:1336 console_unlock+0x2d8/0xb70 kernel/printk/printk.c:2691 vprintk_emit+0x198/0x4f0 kernel/printk/printk.c:2244 vprintk+0x80/0x90 kernel/printk/printk_safe.c:50 _printk+0xba/0xed kernel/printk/printk.c:2265 __nla_validate_parse.cold+0x6d/0xaa lib/nlattr.c:600 __nla_parse+0x3d/0x50 lib/nlattr.c:685 nla_parse_nested_deprecated include/net/netlink.h:1231 [inline] __rtnl_newlink+0x39f/0x1750 net/core/rtnetlink.c:3307 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3506 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7ff37d8bb709 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff37adf0188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff37d9c00e0 RCX: 00007ff37d8bb709 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000004 RBP: 00007ff37d915cb4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc672c3c3f R14: 00007ff37adf0300 R15: 0000000000022000 ================================================================================ ---------------- Code disassembly (best guess), 3 bytes skipped: 0: b9 ff ff ff ff mov $0xffffffff,%ecx 5: ba 08 00 00 00 mov $0x8,%edx a: 4d 8b 03 mov (%r11),%r8 d: 48 0f bd ca bsr %rdx,%rcx 11: 49 8b 45 00 mov 0x0(%r13),%rax 15: 48 63 c9 movslq %ecx,%rcx 18: e9 64 ff ff ff jmpq 0xffffff81 1d: 0f 1f 00 nopl (%rax) 20: 65 8b 05 69 e4 8b 7e mov %gs:0x7e8be469(%rip),%eax # 0x7e8be490 * 27: 89 c1 mov %eax,%ecx <-- trapping instruction 29: 48 8b 34 24 mov (%rsp),%rsi 2d: 81 e1 00 01 00 00 and $0x100,%ecx 33: 65 48 8b 14 25 40 f0 mov %gs:0x1f040,%rdx 3a: 01 00 3c: a9 .byte 0xa9