program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000000c0)={'das16m1\x00', [0x4f27, 0x800007, 0x4, 0x4, 0x5, 0x6, 0x6, 0x7, 0xa, 0x100, 0x2, 0x80000, 0x1, 0x8, 0x1e, 0x1, 0x0, 0x1a449, 0x1ff, 0x6, 0x2000081, 0xcaa7, 0x4, 0x1e58, 0xb, 0x3, 0x3c, 0x932, 0x80000000, 0x0, 0x5]}) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x0, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x1, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}]}], {0x14}}, 0xa8}}, 0x4004) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003240)=@newtfilter={0x30, 0x28, 0xd27, 0x1000000, 0x0, {0x0, 0x0, 0x0, r4, {0x4, 0x9}, {0x6}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r6, &(0x7f0000000140), 0x4924b68, 0x0) [ 88.633933][ T4689] Bluetooth: hci0: command tx timeout [ 88.662554][ T54] cfg80211: failed to load regulatory.db [ 88.775002][ T5346] ------------[ cut here ]------------ [ 88.777297][ T5346] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/das16m1.c:525:9 [ 88.801845][ T5346] shift exponent 8388615 is too large for 32-bit type 'int' [ 88.805073][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 88.805091][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 88.805098][ T5346] Call Trace: [ 88.805104][ T5346] [ 88.805110][ T5346] dump_stack_lvl+0x189/0x250 [ 88.805195][ T5346] ? __pfx_dump_stack_lvl+0x10/0x10 [ 88.805234][ T5346] ? __pfx__printk+0x10/0x10 [ 88.805261][ T5346] ubsan_epilogue+0xa/0x40 [ 88.805278][ T5346] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 88.805331][ T5346] ? __comedi_request_region+0x74/0x140 [ 88.805374][ T5346] das16m1_attach+0x8ee/0xb20 [ 88.805396][ T5346] comedi_device_attach+0x520/0x670 [ 88.805413][ T5346] comedi_unlocked_ioctl+0x686/0xf40 [ 88.805435][ T5346] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 88.805459][ T5346] ? __lock_acquire+0xab9/0xd20 [ 88.805475][ T5346] ? __fget_files+0x2a/0x420 [ 88.805486][ T5346] ? __fget_files+0x2a/0x420 [ 88.805494][ T5346] ? __fget_files+0x3a0/0x420 [ 88.805503][ T5346] ? __fget_files+0x2a/0x420 [ 88.805513][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 88.805520][ T5346] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 88.805530][ T5346] __se_sys_ioctl+0xfc/0x170 [ 88.805539][ T5346] do_syscall_64+0xfa/0x3b0 [ 88.805571][ T5346] ? lockdep_hardirqs_on+0x9c/0x150 [ 88.805589][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.805597][ T5346] ? clear_bhb_loop+0x60/0xb0 [ 88.805607][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.805614][ T5346] RIP: 0033:0x7f31f5d8e929 [ 88.805623][ T5346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 88.805630][ T5346] RSP: 002b:00007f31f6b60038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 88.805640][ T5346] RAX: ffffffffffffffda RBX: 00007f31f5fb5fa0 RCX: 00007f31f5d8e929 [ 88.805649][ T5346] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000006 [ 88.805657][ T5346] RBP: 00007f31f5e10b39 R08: 0000000000000000 R09: 0000000000000000 [ 88.805663][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.805669][ T5346] R13: 0000000000000000 R14: 00007f31f5fb5fa0 R15: 00007ffe6ec141d8 [ 88.805687][ T5346] [ 88.805691][ T5346] ---[ end trace ]--- [ 88.932572][ T5347] Zero length message leads to an empty skb [ 88.935664][ T5346] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 88.939395][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 88.944655][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 88.950107][ T5346] Call Trace: [ 88.951639][ T5346] [ 88.952901][ T5346] dump_stack_lvl+0x99/0x250 [ 88.954940][ T5346] ? __asan_memcpy+0x40/0x70 [ 88.956941][ T5346] ? __pfx_dump_stack_lvl+0x10/0x10 [ 88.959218][ T5346] ? __pfx__printk+0x10/0x10 [ 88.961173][ T5346] panic+0x2db/0x790 [ 88.962896][ T5346] ? __pfx_panic+0x10/0x10 [ 88.964840][ T5346] ? _printk+0xcf/0x120 [ 88.966624][ T5346] ? __pfx__printk+0x10/0x10 [ 88.968526][ T5346] check_panic_on_warn+0x89/0xb0 [ 88.970628][ T5346] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 88.973429][ T5346] ? __comedi_request_region+0x74/0x140 [ 88.975777][ T5346] das16m1_attach+0x8ee/0xb20 [ 88.977768][ T5346] comedi_device_attach+0x520/0x670 [ 88.979955][ T5346] comedi_unlocked_ioctl+0x686/0xf40 [ 88.982141][ T5346] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 88.984641][ T5346] ? __lock_acquire+0xab9/0xd20 [ 88.986662][ T5346] ? __fget_files+0x2a/0x420 [ 88.988610][ T5346] ? __fget_files+0x2a/0x420 [ 88.990738][ T5346] ? __fget_files+0x3a0/0x420 [ 88.992618][ T5346] ? __fget_files+0x2a/0x420 [ 88.994501][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 88.996571][ T5346] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 88.999899][ T5346] __se_sys_ioctl+0xfc/0x170 [ 89.001668][ T5346] do_syscall_64+0xfa/0x3b0 [ 89.003593][ T5346] ? lockdep_hardirqs_on+0x9c/0x150 [ 89.005754][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.008207][ T5346] ? clear_bhb_loop+0x60/0xb0 [ 89.009966][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.012415][ T5346] RIP: 0033:0x7f31f5d8e929 [ 89.014557][ T5346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 89.023121][ T5346] RSP: 002b:00007f31f6b60038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 89.026886][ T5346] RAX: ffffffffffffffda RBX: 00007f31f5fb5fa0 RCX: 00007f31f5d8e929 [ 89.030537][ T5346] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000006 [ 89.034027][ T5346] RBP: 00007f31f5e10b39 R08: 0000000000000000 R09: 0000000000000000 [ 89.037312][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.040460][ T5346] R13: 0000000000000000 R14: 00007f31f5fb5fa0 R15: 00007ffe6ec141d8 [ 89.043566][ T5346] [ 89.045229][ T5346] Kernel Offset: disabled [ 89.047252][ T5346] Rebooting in 86400 seconds..