program: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x2c}}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x4f2b, 0x1000009, 0x2, 0x4, 0x5, 0x6, 0xa, 0x7, 0xa, 0x100, 0x2, 0x80000, 0x1, 0x8, 0x1e, 0x1, 0x0, 0x1a449, 0x3, 0x6, 0x81, 0xcaa7, 0x4, 0x1e58, 0x6, 0x3, 0x3c, 0x8, 0x80000000, 0x0, 0xa38e]}) sendmsg$nl_route(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c000000210001003b0113000000080081"], 0x2c}, 0x1, 0x0, 0x0, 0x4004080}, 0x40008d0) ioctl$SIOCSIFMTU(r1, 0x8923, &(0x7f0000000140)={'macvtap0\x00', 0x1}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000400)={{0x1, 0x0, 0x7ffffe, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_START(r5, 0x54a0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000400)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f00000002c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, 0x0, 0x0) r9 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r9, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r10 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r10, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000003c80)=ANY=[], 0x12f4}}, 0x0) recvmsg$unix(r10, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/13, 0xd}, {&(0x7f0000000480)=""/233, 0xe9}], 0x2}, 0x10002) statx(0xffffffffffffff9c, &(0x7f00000000c0)='\x00', 0x7000, 0x240, &(0x7f0000000200)) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) [ 84.764211][ T5318] Bluetooth: hci0: command tx timeout [ 84.828926][ T5340] ------------[ cut here ]------------ [ 84.831455][ T5340] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/aio_iiro_16.c:180:9 [ 84.835667][ T5340] shift exponent 16777225 is too large for 32-bit type 'int' [ 84.892310][ T5341] netlink: 16 bytes leftover after parsing attributes in process `syz.0.0'. [ 84.920236][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 84.920257][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 84.920265][ T5340] Call Trace: [ 84.920270][ T5340] [ 84.920276][ T5340] dump_stack_lvl+0x189/0x250 [ 84.920380][ T5340] ? __pfx_dump_stack_lvl+0x10/0x10 [ 84.920394][ T5340] ? __pfx__printk+0x10/0x10 [ 84.920415][ T5340] ? __pfx___request_region_locked+0x10/0x10 [ 84.920435][ T5340] ubsan_epilogue+0xa/0x40 [ 84.920451][ T5340] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 84.920505][ T5340] ? __request_region+0xc2/0xe0 [ 84.920524][ T5340] ? comedi_request_region+0x7b/0x180 [ 84.920571][ T5340] aio_iiro_16_attach+0x5e8/0x790 [ 84.920590][ T5340] comedi_device_attach+0x520/0x670 [ 84.920608][ T5340] comedi_unlocked_ioctl+0x686/0xf40 [ 84.920632][ T5340] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 84.920665][ T5340] ? __lock_acquire+0xab9/0xd20 [ 84.920690][ T5340] ? __fget_files+0x2a/0x420 [ 84.920708][ T5340] ? __fget_files+0x2a/0x420 [ 84.920730][ T5340] ? __fget_files+0x3a0/0x420 [ 84.920777][ T5340] ? __fget_files+0x2a/0x420 [ 84.920796][ T5340] ? bpf_lsm_file_ioctl+0x9/0x20 [ 84.920810][ T5340] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 84.920826][ T5340] __se_sys_ioctl+0xfc/0x170 [ 84.920841][ T5340] do_syscall_64+0xfa/0x3b0 [ 84.920888][ T5340] ? lockdep_hardirqs_on+0x9c/0x150 [ 84.920907][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.920919][ T5340] ? clear_bhb_loop+0x60/0xb0 [ 84.920935][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.920947][ T5340] RIP: 0033:0x7f66ca78e929 [ 84.920959][ T5340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 84.920968][ T5340] RSP: 002b:00007f66cb6ce038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 84.920982][ T5340] RAX: ffffffffffffffda RBX: 00007f66ca9b5fa0 RCX: 00007f66ca78e929 [ 84.920990][ T5340] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000006 [ 84.920998][ T5340] RBP: 00007f66ca810b39 R08: 0000000000000000 R09: 0000000000000000 [ 84.921006][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.921013][ T5340] R13: 0000000000000000 R14: 00007f66ca9b5fa0 R15: 00007fff5403a518 [ 84.921032][ T5340] [ 84.921036][ T5340] ---[ end trace ]--- [ 85.044709][ T5346] : renamed from macvtap0 (while UP) [ 85.059332][ T5340] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 85.062640][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 85.067710][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.071778][ T5340] Call Trace: [ 85.073119][ T5340] [ 85.074365][ T5340] dump_stack_lvl+0x99/0x250 [ 85.076207][ T5340] ? __asan_memcpy+0x40/0x70 [ 85.077904][ T5340] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.080235][ T5340] ? __pfx__printk+0x10/0x10 [ 85.082265][ T5340] panic+0x2db/0x790 [ 85.083838][ T5340] ? __pfx_panic+0x10/0x10 [ 85.085529][ T5340] ? _printk+0xcf/0x120 [ 85.087107][ T5340] ? __pfx__printk+0x10/0x10 [ 85.089041][ T5340] check_panic_on_warn+0x89/0xb0 [ 85.091365][ T5340] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 85.094240][ T5340] ? __request_region+0xc2/0xe0 [ 85.096612][ T5340] ? comedi_request_region+0x7b/0x180 [ 85.099171][ T5340] aio_iiro_16_attach+0x5e8/0x790 [ 85.101505][ T5340] comedi_device_attach+0x520/0x670 [ 85.103705][ T5340] comedi_unlocked_ioctl+0x686/0xf40 [ 85.106094][ T5340] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 85.108721][ T5340] ? __lock_acquire+0xab9/0xd20 [ 85.110863][ T5340] ? __fget_files+0x2a/0x420 [ 85.113000][ T5340] ? __fget_files+0x2a/0x420 [ 85.115043][ T5340] ? __fget_files+0x3a0/0x420 [ 85.117164][ T5340] ? __fget_files+0x2a/0x420 [ 85.119184][ T5340] ? bpf_lsm_file_ioctl+0x9/0x20 [ 85.121465][ T5340] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 85.124030][ T5340] __se_sys_ioctl+0xfc/0x170 [ 85.126086][ T5340] do_syscall_64+0xfa/0x3b0 [ 85.128216][ T5340] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.130593][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.133113][ T5340] ? clear_bhb_loop+0x60/0xb0 [ 85.135267][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.137629][ T5340] RIP: 0033:0x7f66ca78e929 [ 85.139582][ T5340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.147531][ T5340] RSP: 002b:00007f66cb6ce038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.150928][ T5340] RAX: ffffffffffffffda RBX: 00007f66ca9b5fa0 RCX: 00007f66ca78e929 [ 85.154340][ T5340] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000006 [ 85.157636][ T5340] RBP: 00007f66ca810b39 R08: 0000000000000000 R09: 0000000000000000 [ 85.160974][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.164490][ T5340] R13: 0000000000000000 R14: 00007f66ca9b5fa0 R15: 00007fff5403a518 [ 85.167924][ T5340] [ 85.169687][ T5340] Kernel Offset: disabled [ 85.171446][ T5340] Rebooting in 86400 seconds..