program:
r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'pcl726\x00', [0x9e1, 0x2166, 0x2000000, 0x100000, 0x88d7, 0x400008f, 0x6, 0x10, 0xd, 0xffffffff, 0x1ff, 0x4008, 0x344, 0x1, 0x7, 0x1, 0x8, 0x3, 0x9, 0xe, 0x100, 0x3, 0x7, 0xa, 0x5, 0x1, 0xb0c4, 0x7df, 0x8, 0x400007, 0x1]})
ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f00000002c0)={0x0, 0x30000, 0x40, 0x1, 0x4, 0x2, 0xffffffff, 0x7, 0x20, 0x401, 0x10, 0xb, 0x0, 0x0, 0x0})
[ 67.383673][ T5334] Bluetooth: hci0: command tx timeout
[ 67.418700][ T5355] ------------[ cut here ]------------
[ 67.422451][ T5355] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/pcl726.c:331:46
[ 67.446842][ T5355] shift exponent 8550 is too large for 32-bit type 'int'
[ 67.451038][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 67.451059][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 67.451067][ T5355] Call Trace:
[ 67.451074][ T5355]
[ 67.451081][ T5355] dump_stack_lvl+0x189/0x250
[ 67.451175][ T5355] ? __pfx_dump_stack_lvl+0x10/0x10
[ 67.451185][ T5355] ? __pfx__printk+0x10/0x10
[ 67.451196][ T5355] ubsan_epilogue+0xa/0x40
[ 67.451205][ T5355] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 67.451250][ T5355] ? __kmalloc_noprof+0x29b/0x4f0
[ 67.451269][ T5355] pcl726_attach+0xac4/0xd50
[ 67.451310][ T5355] ? rcu_is_watching+0x15/0xb0
[ 67.451323][ T5355] comedi_device_attach+0x51f/0x720
[ 67.451334][ T5355] comedi_unlocked_ioctl+0x5ff/0x1020
[ 67.451347][ T5355] ? rcu_is_watching+0x15/0xb0
[ 67.451354][ T5355] ? lock_release+0x4b/0x3e0
[ 67.451370][ T5355] ? tomoyo_path_number_perm+0x47a/0x5a0
[ 67.451380][ T5355] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 67.451399][ T5355] ? __might_fault+0xb0/0x130
[ 67.451416][ T5355] ? lock_release+0x4b/0x3e0
[ 67.451429][ T5355] ? __fget_files+0x2a/0x420
[ 67.451441][ T5355] ? __fget_files+0x3a0/0x420
[ 67.451454][ T5355] ? __fget_files+0x2a/0x420
[ 67.451467][ T5355] ? bpf_lsm_file_ioctl+0x9/0x20
[ 67.451477][ T5355] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 67.451490][ T5355] __se_sys_ioctl+0xfc/0x170
[ 67.451500][ T5355] do_syscall_64+0xfa/0x3b0
[ 67.451548][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 67.451559][ T5355] ? clear_bhb_loop+0x60/0xb0
[ 67.451569][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 67.451579][ T5355] RIP: 0033:0x7fb8c6b8ebe9
[ 67.451591][ T5355] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 67.451600][ T5355] RSP: 002b:00007fb8c7a4c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 67.451615][ T5355] RAX: ffffffffffffffda RBX: 00007fb8c6db5fa0 RCX: 00007fb8c6b8ebe9
[ 67.451622][ T5355] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003
[ 67.451628][ T5355] RBP: 00007fb8c6c11e19 R08: 0000000000000000 R09: 0000000000000000
[ 67.451634][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 67.451640][ T5355] R13: 00007fb8c6db6038 R14: 00007fb8c6db5fa0 R15: 00007fff60cc70a8
[ 67.451651][ T5355]
[ 67.451655][ T5355] ---[ end trace ]---
[ 67.576809][ T5355] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 67.581692][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 67.586019][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 67.590827][ T5355] Call Trace:
[ 67.592558][ T5355]
[ 67.593873][ T5355] dump_stack_lvl+0x99/0x250
[ 67.596001][ T5355] ? __asan_memcpy+0x40/0x70
[ 67.598543][ T5355] ? __pfx_dump_stack_lvl+0x10/0x10
[ 67.601776][ T5355] ? __pfx__printk+0x10/0x10
[ 67.604224][ T5355] vpanic+0x281/0x750
[ 67.605911][ T5355] ? __pfx_vpanic+0x10/0x10
[ 67.608138][ T5355] panic+0xb9/0xc0
[ 67.609788][ T5355] ? __pfx_panic+0x10/0x10
[ 67.611798][ T5355] ? __pfx__printk+0x10/0x10
[ 67.614018][ T5355] check_panic_on_warn+0x89/0xb0
[ 67.616585][ T5355] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 67.620010][ T5355] ? __kmalloc_noprof+0x29b/0x4f0
[ 67.622610][ T5355] pcl726_attach+0xac4/0xd50
[ 67.624921][ T5355] ? rcu_is_watching+0x15/0xb0
[ 67.627125][ T5355] comedi_device_attach+0x51f/0x720
[ 67.629585][ T5355] comedi_unlocked_ioctl+0x5ff/0x1020
[ 67.632082][ T5355] ? rcu_is_watching+0x15/0xb0
[ 67.634919][ T5355] ? lock_release+0x4b/0x3e0
[ 67.637386][ T5355] ? tomoyo_path_number_perm+0x47a/0x5a0
[ 67.640370][ T5355] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 67.643707][ T5355] ? __might_fault+0xb0/0x130
[ 67.646028][ T5355] ? lock_release+0x4b/0x3e0
[ 67.647989][ T5355] ? __fget_files+0x2a/0x420
[ 67.650106][ T5355] ? __fget_files+0x3a0/0x420
[ 67.652537][ T5355] ? __fget_files+0x2a/0x420
[ 67.655411][ T5355] ? bpf_lsm_file_ioctl+0x9/0x20
[ 67.658238][ T5355] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 67.661359][ T5355] __se_sys_ioctl+0xfc/0x170
[ 67.663470][ T5355] do_syscall_64+0xfa/0x3b0
[ 67.665483][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 67.668203][ T5355] ? clear_bhb_loop+0x60/0xb0
[ 67.670850][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 67.673477][ T5355] RIP: 0033:0x7fb8c6b8ebe9
[ 67.675434][ T5355] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 67.684981][ T5355] RSP: 002b:00007fb8c7a4c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 67.688433][ T5355] RAX: ffffffffffffffda RBX: 00007fb8c6db5fa0 RCX: 00007fb8c6b8ebe9
[ 67.691979][ T5355] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003
[ 67.695515][ T5355] RBP: 00007fb8c6c11e19 R08: 0000000000000000 R09: 0000000000000000
[ 67.700676][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 67.705114][ T5355] R13: 00007fb8c6db6038 R14: 00007fb8c6db5fa0 R15: 00007fff60cc70a8
[ 67.708712][ T5355]
[ 67.710661][ T5355] Kernel Offset: disabled
[ 67.712681][ T5355] Rebooting in 86400 seconds..