UBSAN: undefined-behaviour in cbq_dequeue

Status: upstream: reported C repro on 2020/09/20 14:43
Reported-by: syzbot+f2984924f8a9e06166a2@syzkaller.appspotmail.com
First crash: 2162d, last: 2131d
Fix bisection: failed (error log, bisect log)
  

Sample crash report:
batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
netlink: 96 bytes leftover after parsing attributes in process `syz-executor666'.
================================================================================
UBSAN: Undefined behaviour in ./include/net/sch_generic.h:1051:7
shift exponent 129 is too large for 32-bit type 'int'
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 qdisc_l2t include/net/sch_generic.h:1051 [inline]
 cbq_update net/sched/sch_cbq.c:567 [inline]
 cbq_dequeue.cold+0x189/0x18e net/sched/sch_cbq.c:814
 dequeue_skb net/sched/sch_generic.c:282 [inline]
 qdisc_restart net/sched/sch_generic.c:385 [inline]
 __qdisc_run+0x1b9/0x1680 net/sched/sch_generic.c:403
 qdisc_run include/net/pkt_sched.h:120 [inline]
 net_tx_action+0x520/0xce0 net/core/dev.c:4592
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 run_ksoftirqd+0x57/0x130 kernel/softirq.c:653
 smpboot_thread_fn+0x66e/0xa30 kernel/smpboot.c:164
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
=====================

Crashes (117):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/02 09:19 linux-4.19.y b09c34517e1a 9602ddf4 .config console log report syz C ci2-linux-4-19
2020/09/20 16:12 linux-4.19.y 015e94d0e37b 9564d2e9 .config console log report syz C ci2-linux-4-19
2020/10/21 22:23 linux-4.19.y ad326970d25c 99c64d5c .config console log report info ci2-linux-4-19
2020/10/21 21:00 linux-4.19.y ad326970d25c 99c64d5c .config console log report info ci2-linux-4-19
2020/10/21 16:37 linux-4.19.y ad326970d25c 99c64d5c .config console log report info ci2-linux-4-19
2020/10/21 15:00 linux-4.19.y ad326970d25c 99c64d5c .config console log report info ci2-linux-4-19
2020/10/21 13:48 linux-4.19.y ad326970d25c 99c64d5c .config console log report info ci2-linux-4-19
2020/10/20 23:12 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/20 16:33 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/20 12:54 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/20 08:24 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/20 02:15 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/20 00:54 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/19 23:32 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/19 16:09 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/19 12:21 linux-4.19.y ad326970d25c ff4a3345 .config console log report info ci2-linux-4-19
2020/10/17 15:04 linux-4.19.y ad326970d25c fea47c01 .config console log report info ci2-linux-4-19
2020/10/17 14:00 linux-4.19.y ad326970d25c fea47c01 .config console log report info ci2-linux-4-19
2020/10/17 00:58 linux-4.19.y a1b977b49b66 6e262c73 .config console log report info ci2-linux-4-19
2020/10/16 23:25 linux-4.19.y a1b977b49b66 6e262c73 .config console log report info ci2-linux-4-19
2020/10/16 21:17 linux-4.19.y a1b977b49b66 6e262c73 .config console log report info ci2-linux-4-19
2020/10/16 08:20 linux-4.19.y a1b977b49b66 6e262c73 .config console log report info ci2-linux-4-19
2020/10/16 06:36 linux-4.19.y a1b977b49b66 6e262c73 .config console log report info ci2-linux-4-19
2020/10/16 05:23 linux-4.19.y a1b977b49b66 6e262c73 .config console log report info ci2-linux-4-19
2020/10/16 02:26 linux-4.19.y a1b977b49b66 6e262c73 .config console log report info ci2-linux-4-19
2020/10/08 08:03 linux-4.19.y a1b977b49b66 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/08 01:49 linux-4.19.y a1b977b49b66 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/07 07:27 linux-4.19.y a1b977b49b66 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/06 20:50 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/06 17:50 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/06 16:04 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/06 14:52 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/06 10:02 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/06 06:44 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/05 17:09 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report info ci2-linux-4-19
2020/10/05 00:58 linux-4.19.y b09c34517e1a 5ef9c291 .config console log report info ci2-linux-4-19
2020/10/04 14:38 linux-4.19.y b09c34517e1a 5ef9c291 .config console log report info ci2-linux-4-19
2020/10/04 07:58 linux-4.19.y b09c34517e1a 1a3f9408 .config console log report info ci2-linux-4-19
2020/10/04 05:18 linux-4.19.y b09c34517e1a 1a3f9408 .config console log report info ci2-linux-4-19
2020/10/03 22:28 linux-4.19.y b09c34517e1a 1a3f9408 .config console log report info ci2-linux-4-19
2020/10/03 06:58 linux-4.19.y b09c34517e1a 2653fa43 .config console log report info ci2-linux-4-19
2020/10/02 14:01 linux-4.19.y b09c34517e1a 062c9832 .config console log report info ci2-linux-4-19
2020/10/02 11:58 linux-4.19.y b09c34517e1a 9602ddf4 .config console log report info ci2-linux-4-19
2020/10/02 10:52 linux-4.19.y b09c34517e1a 9602ddf4 .config console log report info ci2-linux-4-19
2020/10/02 00:56 linux-4.19.y b09c34517e1a 9602ddf4 .config console log report info ci2-linux-4-19
2020/10/01 23:26 linux-4.19.y b09c34517e1a 9602ddf4 .config console log report info ci2-linux-4-19
2020/10/01 01:28 linux-4.19.y 10ad6cfd5736 a9767fb2 .config console log report info ci2-linux-4-19
2020/09/30 09:35 linux-4.19.y 10ad6cfd5736 8516f6d3 .config console log report info ci2-linux-4-19
2020/09/30 09:34 linux-4.19.y 10ad6cfd5736 8516f6d3 .config console log report info ci2-linux-4-19
2020/09/30 08:45 linux-4.19.y 10ad6cfd5736 8516f6d3 .config console log report info ci2-linux-4-19
2020/09/30 03:33 linux-4.19.y 10ad6cfd5736 5abc3f1a .config console log report info ci2-linux-4-19
2020/09/20 14:43 linux-4.19.y 015e94d0e37b 9564d2e9 .config console log report info ci2-linux-4-19
* Struck through repros no longer work on HEAD.