================================================================================
UBSAN: shift-out-of-bounds in ./include/net/xfrm.h:863:23
shift exponent -128 is negative
CPU: 0 PID: 10993 Comm: syz.6.1097 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
 __ubsan_handle_shift_out_of_bounds+0x368/0x3f0 lib/ubsan.c:387
 addr4_match include/net/xfrm.h:863 [inline]
 __xfrm4_selector_match net/xfrm/xfrm_policy.c:203 [inline]
 xfrm_selector_match+0xd57/0x1140 net/xfrm/xfrm_policy.c:228
 __xfrm_policy_check+0x7f7/0x3170 net/xfrm/xfrm_policy.c:3660
 __xfrm_policy_check2 include/net/xfrm.h:1195 [inline]
 xfrm_policy_check+0x479/0x880 include/net/xfrm.h:1200
 xfrm4_policy_check include/net/xfrm.h:1205 [inline]
 vti_input+0x163/0x280 net/ipv4/ip_vti.c:58
 xfrm4_esp_rcv+0xa1/0x210 net/ipv4/xfrm4_protocol.c:104
 ip_protocol_deliver_rcu+0x20a/0x3f0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x2c3/0x510 net/ipv4/ip_input.c:233
 NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304
 NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304
 __netif_receive_skb_one_core net/core/dev.c:5646 [inline]
 __netif_receive_skb+0xcc/0x290 net/core/dev.c:5760
 process_backlog+0x380/0x710 net/core/dev.c:6088
 __napi_poll+0xbb/0x460 net/core/dev.c:6650
 napi_poll net/core/dev.c:6717 [inline]
 net_rx_action+0x65f/0xcc0 net/core/dev.c:6853
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 do_softirq+0xfa/0x1a0 kernel/softirq.c:479
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x184/0x1c0 kernel/softirq.c:406
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 netif_rx net/core/dev.c:5232 [inline]
 dev_loopback_xmit+0x2e6/0x430 net/core/dev.c:3996
 NF_HOOK include/linux/netfilter.h:304 [inline]
 ip_mc_output+0x254/0x570 net/ipv4/ip_output.c:399
 dst_output include/net/dst.h:467 [inline]
 xfrm_output_resume+0x5847/0x5b90 net/xfrm/xfrm_output.c:596
 NF_HOOK_COND include/linux/netfilter.h:293 [inline]
 xfrm4_output+0x1cb/0x520 net/ipv4/xfrm4_output.c:33
 dst_output include/net/dst.h:467 [inline]
 ip_local_out net/ipv4/ip_output.c:129 [inline]
 ip_send_skb+0x12f/0x1d0 net/ipv4/ip_output.c:1500
 udp_send_skb+0xa7d/0x1440 net/ipv4/udp.c:984
 udp_sendmsg+0x1b23/0x23d0 net/ipv4/udp.c:1270
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 sock_write_iter+0x2dc/0x420 net/socket.c:1161
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x474/0x9a0 fs/read_write.c:584
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f93a0f9de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f93a1edb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f93a1225fa0 RCX: 00007f93a0f9de99
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f93a1033eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f93a1226038 R14: 00007f93a1225fa0 R15: 00007ffe12060cd8
 </TASK>
================================================================================