program: socket(0x10, 0x3, 0x0) (async) r0 = io_uring_setup(0x75d8, &(0x7f0000000080)={0x0, 0xcac8, 0x40, 0x1, 0xff}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100), 0x80000, 0x0) io_uring_enter(r1, 0x7804, 0x8b91, 0x3, &(0x7f0000000140)={[0x83]}, 0x8) io_uring_enter(r0, 0x3b64, 0xc15a, 0x2, &(0x7f0000000000)={[0x81]}, 0x8) (async) r2 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x2180, 0x0) (async) getsockopt$IP_VS_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x481, &(0x7f0000000180), &(0x7f00000001c0)=0xc) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000280)={'pcl726\x00', [0x2f00, 0x5a, 0x3, 0x2, 0x0, 0x1, 0x1, 0x9, 0xffe, 0x1, 0xc, 0x1, 0x4, 0x4, 0xffff, 0x6, 0xffffffa7, 0x40000009, 0x832, 0x1, 0x3ff, 0xd, 0x800, 0xe2df, 0x2, 0x1, 0x7f, 0x3, 0x4, 0x9, 0x70f]}) [ 57.729878][ T5352] ------------[ cut here ]------------ [ 57.735328][ T5352] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/pcl726.c:331:46 [ 57.745743][ T5352] shift exponent 90 is too large for 32-bit type 'int' [ 57.749361][ T5352] CPU: 0 UID: 0 PID: 5352 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) [ 57.749373][ T5352] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 57.749380][ T5352] Call Trace: [ 57.749387][ T5352] [ 57.749393][ T5352] dump_stack_lvl+0x189/0x250 [ 57.749496][ T5352] ? __pfx_dump_stack_lvl+0x10/0x10 [ 57.749509][ T5352] ? __pfx__printk+0x10/0x10 [ 57.749522][ T5352] ubsan_epilogue+0xa/0x40 [ 57.749532][ T5352] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 57.749582][ T5352] ? __kmalloc_noprof+0x29b/0x4f0 [ 57.749596][ T5352] pcl726_attach+0xac4/0xd50 [ 57.749637][ T5352] ? rcu_is_watching+0x15/0xb0 [ 57.749649][ T5352] comedi_device_attach+0x51f/0x720 [ 57.749663][ T5352] comedi_unlocked_ioctl+0x5ff/0x1020 [ 57.749681][ T5352] ? rcu_is_watching+0x15/0xb0 [ 57.749690][ T5352] ? lock_release+0x4b/0x3e0 [ 57.749703][ T5352] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 57.749716][ T5352] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 57.749733][ T5352] ? __might_fault+0xb0/0x130 [ 57.749752][ T5352] ? lock_release+0x4b/0x3e0 [ 57.749767][ T5352] ? __fget_files+0x2a/0x420 [ 57.749780][ T5352] ? __fget_files+0x3a0/0x420 [ 57.749792][ T5352] ? __fget_files+0x2a/0x420 [ 57.749805][ T5352] ? bpf_lsm_file_ioctl+0x9/0x20 [ 57.749816][ T5352] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 57.749830][ T5352] __se_sys_ioctl+0xf9/0x170 [ 57.749842][ T5352] do_syscall_64+0xfa/0x3b0 [ 57.749889][ T5352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.749896][ T5352] ? clear_bhb_loop+0x60/0xb0 [ 57.749904][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.749911][ T5352] RIP: 0033:0x7f07beb8ebe9 [ 57.749921][ T5352] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 57.749927][ T5352] RSP: 002b:00007f07bfa52038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 57.749936][ T5352] RAX: ffffffffffffffda RBX: 00007f07bedb5fa0 RCX: 00007f07beb8ebe9 [ 57.749969][ T5352] RDX: 0000200000000280 RSI: 0000000040946400 RDI: 0000000000000006 [ 57.749975][ T5352] RBP: 00007f07bec11e19 R08: 0000000000000000 R09: 0000000000000000 [ 57.749981][ T5352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.749987][ T5352] R13: 00007f07bedb6038 R14: 00007f07bedb5fa0 R15: 00007ffc7343d298 [ 57.749998][ T5352] [ 57.750002][ T5352] ---[ end trace ]--- [ 57.874264][ T5352] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 57.877161][ T5352] CPU: 0 UID: 0 PID: 5352 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) [ 57.882397][ T5352] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 57.887345][ T5352] Call Trace: [ 57.888823][ T5352] [ 57.890183][ T5352] dump_stack_lvl+0x99/0x250 [ 57.892263][ T5352] ? __asan_memcpy+0x40/0x70 [ 57.894218][ T5352] ? __pfx_dump_stack_lvl+0x10/0x10 [ 57.896506][ T5352] ? __pfx__printk+0x10/0x10 [ 57.898819][ T5352] vpanic+0x281/0x750 [ 57.900587][ T5352] ? __pfx_vpanic+0x10/0x10 [ 57.902862][ T5352] panic+0xb9/0xc0 [ 57.905213][ T5352] ? __pfx_panic+0x10/0x10 [ 57.907930][ T5352] ? __pfx__printk+0x10/0x10 [ 57.910473][ T5352] check_panic_on_warn+0x89/0xb0 [ 57.912834][ T5352] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 57.915747][ T5352] ? __kmalloc_noprof+0x29b/0x4f0 [ 57.918085][ T5352] pcl726_attach+0xac4/0xd50 [ 57.920152][ T5352] ? rcu_is_watching+0x15/0xb0 [ 57.922329][ T5352] comedi_device_attach+0x51f/0x720 [ 57.924726][ T5352] comedi_unlocked_ioctl+0x5ff/0x1020 [ 57.927122][ T5352] ? rcu_is_watching+0x15/0xb0 [ 57.929561][ T5352] ? lock_release+0x4b/0x3e0 [ 57.931867][ T5352] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 57.934604][ T5352] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 57.937486][ T5352] ? __might_fault+0xb0/0x130 [ 57.939545][ T5352] ? lock_release+0x4b/0x3e0 [ 57.941656][ T5352] ? __fget_files+0x2a/0x420 [ 57.943719][ T5352] ? __fget_files+0x3a0/0x420 [ 57.945745][ T5352] ? __fget_files+0x2a/0x420 [ 57.947699][ T5352] ? bpf_lsm_file_ioctl+0x9/0x20 [ 57.949827][ T5352] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 57.952375][ T5352] __se_sys_ioctl+0xf9/0x170 [ 57.954294][ T5352] do_syscall_64+0xfa/0x3b0 [ 57.956295][ T5352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.958806][ T5352] ? clear_bhb_loop+0x60/0xb0 [ 57.960764][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.963454][ T5352] RIP: 0033:0x7f07beb8ebe9 [ 57.965491][ T5352] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 57.973749][ T5352] RSP: 002b:00007f07bfa52038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 57.977276][ T5352] RAX: ffffffffffffffda RBX: 00007f07bedb5fa0 RCX: 00007f07beb8ebe9 [ 57.980783][ T5352] RDX: 0000200000000280 RSI: 0000000040946400 RDI: 0000000000000006 [ 57.984318][ T5352] RBP: 00007f07bec11e19 R08: 0000000000000000 R09: 0000000000000000 [ 57.987652][ T5352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.990904][ T5352] R13: 00007f07bedb6038 R14: 00007f07bedb5fa0 R15: 00007ffc7343d298 [ 57.994266][ T5352] [ 57.995916][ T5352] Kernel Offset: disabled [ 57.997822][ T5352] Rebooting in 86400 seconds..