program:
mbind(&(0x7f0000ff8000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000000)=0x5, 0x3, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003140)=ANY=[@ANYBLOB="c01800002000010a00000000000000000a0000002c01018028014880ed00a90013466820cd76bb221fbb4acd690c6a8b9c760a61eeec7793b579aefdb936d00f403d3f04637cdb9ac70e28c5dd66ddedde2d0930650e6821f9a26a4a193c1d06a3e75523f901e44fe087ae32c836c6d6ddba3af8e9a2beae8936168f9fa38c395f5cf7408df69c60bf584bee86a6312e9ce866e456c3eda6f2924082d78a2f385bdbd0c9afb54758c102bf13094645fb6aa34d424ec776691fee3d25307f61fed2752babf7c686e8a3d9b59a8343bcf4121bf5cf400a0c1070855fac565cad8968a97ce0a12a1161054d82d0a240b7dedf9ba3cc63e9d1c3b9a8402f7d5b4cafcd48928a3d4a76498900000014007c00ff01000000000000000000000000000108003d00", @ANYRES32=0x0, @ANYBLOB="08001a"], 0x18c0}}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
r0 = socket(0x10, 0x3, 0x0)
sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000740)='numa_maps\x00')
r2 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0)
ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000140)={'pcl726\x00', [0x8269, 0x2163, 0x5, 0x100000, 0x88d6, 0x8f, 0x1df, 0x1, 0x2, 0xffffffff, 0x2000202, 0xfff, 0x1344, 0xbf96, 0x5e, 0x10001, 0x9, 0x3, 0x3, 0xfffffffb, 0x1004, 0x20000000, 0x51, 0x7ff, 0x0, 0x1, 0xb0c8, 0xa, 0x1, 0xf3, 0x1000001]})
setresuid(0x0, 0xee00, 0x0)
r3 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$nl_crypto(r3, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000bc0)=@delrng={0x10, 0x14, 0x301, 0x70bd2b, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x4000010}, 0x10)
pread64(r1, &(0x7f00000001c0)=""/73, 0x49, 0x400000000000000)
[ 75.939281][ T5321] Bluetooth: hci0: command tx timeout
[ 75.976269][ T5342] netlink: 6032 bytes leftover after parsing attributes in process `syz.0.0'.
[ 76.009401][ T5342] Zero length message leads to an empty skb
[ 76.015598][ T5342] ------------[ cut here ]------------
[ 76.027928][ T5342] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/pcl726.c:331:46
[ 76.032116][ T5342] shift exponent 8547 is too large for 32-bit type 'int'
[ 76.035121][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full)
[ 76.035137][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 76.035146][ T5342] Call Trace:
[ 76.035154][ T5342]
[ 76.035161][ T5342] dump_stack_lvl+0x189/0x250
[ 76.035249][ T5342] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.035265][ T5342] ? __pfx__printk+0x10/0x10
[ 76.035290][ T5342] ubsan_epilogue+0xa/0x40
[ 76.035307][ T5342] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 76.035359][ T5342] ? __kmalloc_noprof+0x29b/0x4f0
[ 76.035381][ T5342] pcl726_attach+0xac4/0xd50
[ 76.035435][ T5342] comedi_device_attach+0x520/0x670
[ 76.035454][ T5342] comedi_unlocked_ioctl+0x686/0xf40
[ 76.035476][ T5342] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 76.035512][ T5342] ? __lock_acquire+0xab9/0xd20
[ 76.035537][ T5342] ? __fget_files+0x2a/0x420
[ 76.035553][ T5342] ? __fget_files+0x2a/0x420
[ 76.035567][ T5342] ? __fget_files+0x3a0/0x420
[ 76.035580][ T5342] ? __fget_files+0x2a/0x420
[ 76.035597][ T5342] ? bpf_lsm_file_ioctl+0x9/0x20
[ 76.035609][ T5342] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 76.035632][ T5342] __se_sys_ioctl+0xfc/0x170
[ 76.035647][ T5342] do_syscall_64+0xfa/0x3b0
[ 76.035688][ T5342] ? lockdep_hardirqs_on+0x9c/0x150
[ 76.035707][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.035720][ T5342] ? clear_bhb_loop+0x60/0xb0
[ 76.035735][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.035747][ T5342] RIP: 0033:0x7f0eff78e929
[ 76.035761][ T5342] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 76.035770][ T5342] RSP: 002b:00007f0f0063d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 76.035783][ T5342] RAX: ffffffffffffffda RBX: 00007f0eff9b5fa0 RCX: 00007f0eff78e929
[ 76.035792][ T5342] RDX: 0000200000000140 RSI: 0000000040946400 RDI: 0000000000000005
[ 76.035800][ T5342] RBP: 00007f0eff810ca1 R08: 0000000000000000 R09: 0000000000000000
[ 76.035807][ T5342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 76.035814][ T5342] R13: 0000000000000000 R14: 00007f0eff9b5fa0 R15: 00007fff630ef148
[ 76.035834][ T5342]
[ 76.035838][ T5342] ---[ end trace ]---
[ 76.166986][ T5342] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 76.170956][ T5342] CPU: 0 UID: 0 PID: 5342 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full)
[ 76.176198][ T5342] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 76.180523][ T5342] Call Trace:
[ 76.181968][ T5342]
[ 76.183348][ T5342] dump_stack_lvl+0x99/0x250
[ 76.185381][ T5342] ? __asan_memcpy+0x40/0x70
[ 76.187432][ T5342] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.189767][ T5342] ? __pfx__printk+0x10/0x10
[ 76.191699][ T5342] panic+0x2db/0x790
[ 76.193434][ T5342] ? __pfx_panic+0x10/0x10
[ 76.195395][ T5342] ? _printk+0xcf/0x120
[ 76.197175][ T5342] ? __pfx__printk+0x10/0x10
[ 76.199262][ T5342] check_panic_on_warn+0x89/0xb0
[ 76.201402][ T5342] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 76.203868][ T5342] ? __kmalloc_noprof+0x29b/0x4f0
[ 76.206039][ T5342] pcl726_attach+0xac4/0xd50
[ 76.208081][ T5342] comedi_device_attach+0x520/0x670
[ 76.210416][ T5342] comedi_unlocked_ioctl+0x686/0xf40
[ 76.212653][ T5342] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 76.215261][ T5342] ? __lock_acquire+0xab9/0xd20
[ 76.217342][ T5342] ? __fget_files+0x2a/0x420
[ 76.219626][ T5342] ? __fget_files+0x2a/0x420
[ 76.221668][ T5342] ? __fget_files+0x3a0/0x420
[ 76.223784][ T5342] ? __fget_files+0x2a/0x420
[ 76.225937][ T5342] ? bpf_lsm_file_ioctl+0x9/0x20
[ 76.228226][ T5342] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 76.230905][ T5342] __se_sys_ioctl+0xfc/0x170
[ 76.233025][ T5342] do_syscall_64+0xfa/0x3b0
[ 76.235096][ T5342] ? lockdep_hardirqs_on+0x9c/0x150
[ 76.237338][ T5342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.240155][ T5342] ? clear_bhb_loop+0x60/0xb0
[ 76.242048][ T5342] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.244523][ T5342] RIP: 0033:0x7f0eff78e929
[ 76.246308][ T5342] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 76.254363][ T5342] RSP: 002b:00007f0f0063d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 76.257985][ T5342] RAX: ffffffffffffffda RBX: 00007f0eff9b5fa0 RCX: 00007f0eff78e929
[ 76.261202][ T5342] RDX: 0000200000000140 RSI: 0000000040946400 RDI: 0000000000000005
[ 76.264437][ T5342] RBP: 00007f0eff810ca1 R08: 0000000000000000 R09: 0000000000000000
[ 76.268034][ T5342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 76.271246][ T5342] R13: 0000000000000000 R14: 00007f0eff9b5fa0 R15: 00007fff630ef148
[ 76.274554][ T5342]
[ 76.276195][ T5342] Kernel Offset: disabled
[ 76.278010][ T5342] Rebooting in 86400 seconds..