program:
r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'das16m1\x00', [0x9df, 0x20, 0x0, 0xffffffff, 0x88d6, 0x8f, 0x1, 0x10, 0x26, 0xffffffff, 0x200, 0x1, 0x0, 0x1, 0x7, 0x1, 0x4, 0x3, 0x409, 0xfffffc00, 0x4, 0x40080, 0x10001, 0x4, 0x0, 0x3, 0x401, 0x7df, 0x807f, 0x7ff, 0xc0000]})
[ 77.624024][ T5341] syz.0.0 (5341) used greatest stack de[ 74.431090][ T5322] Bluetooth: hci0: command tx timeout
[ 74.480468][ T5341] ------------[ cut here ]------------
[ 74.482974][ T5341] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/das16m1.c:525:9
[ 74.505593][ T5341] shift exponent 32 is too large for 32-bit type 'int'
[ 74.508736][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full)
[ 74.508754][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 74.508762][ T5341] Call Trace:
[ 74.508770][ T5341]
[ 74.508778][ T5341] dump_stack_lvl+0x189/0x250
[ 74.508866][ T5341] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.508881][ T5341] ? __pfx__printk+0x10/0x10
[ 74.508909][ T5341] ubsan_epilogue+0xa/0x40
[ 74.508925][ T5341] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 74.508979][ T5341] ? __comedi_request_region+0x74/0x140
[ 74.509028][ T5341] das16m1_attach+0x8ee/0xb20
[ 74.509050][ T5341] comedi_device_attach+0x520/0x670
[ 74.509069][ T5341] comedi_unlocked_ioctl+0x686/0xf40
[ 74.509093][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.509131][ T5341] ? __lock_acquire+0xab9/0xd20
[ 74.509159][ T5341] ? __fget_files+0x2a/0x420
[ 74.509179][ T5341] ? __fget_files+0x2a/0x420
[ 74.509193][ T5341] ? __fget_files+0x3a0/0x420
[ 74.509208][ T5341] ? __fget_files+0x2a/0x420
[ 74.509235][ T5341] ? bpf_lsm_file_ioctl+0x9/0x20
[ 74.509250][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.509268][ T5341] __se_sys_ioctl+0xfc/0x170
[ 74.509300][ T5341] do_syscall_64+0xfa/0x3b0
[ 74.509344][ T5341] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.509365][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.509378][ T5341] ? clear_bhb_loop+0x60/0xb0
[ 74.509393][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.509405][ T5341] RIP: 0033:0x7f2ebc58e929
[ 74.509418][ T5341] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 74.509428][ T5341] RSP: 002b:00007f2ebd43f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 74.509443][ T5341] RAX: ffffffffffffffda RBX: 00007f2ebc7b5fa0 RCX: 00007f2ebc58e929
[ 74.509452][ T5341] RDX: 0000200000000140 RSI: 0000000040946400 RDI: 0000000000000003
[ 74.509460][ T5341] RBP: 00007f2ebc610b39 R08: 0000000000000000 R09: 0000000000000000
[ 74.509467][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 74.509474][ T5341] R13: 0000000000000000 R14: 00007f2ebc7b5fa0 R15: 00007ffdd32a26d8
[ 74.509491][ T5341]
[ 74.654864][ T5341] ---[ end trace ]---
[ 74.656869][ T5341] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 74.660118][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full)
[ 74.665670][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 74.670456][ T5341] Call Trace:
[ 74.671880][ T5341]
[ 74.673215][ T5341] dump_stack_lvl+0x99/0x250
[ 74.675353][ T5341] ? __asan_memcpy+0x40/0x70
[ 74.677627][ T5341] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.680079][ T5341] ? __pfx__printk+0x10/0x10
[ 74.682258][ T5341] panic+0x2db/0x790
[ 74.684005][ T5341] ? __pfx_panic+0x10/0x10
[ 74.686107][ T5341] ? _printk+0xcf/0x120
[ 74.687991][ T5341] ? __pfx__printk+0x10/0x10
[ 74.690136][ T5341] check_panic_on_warn+0x89/0xb0
[ 74.692442][ T5341] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 74.695221][ T5341] ? __comedi_request_region+0x74/0x140
[ 74.697409][ T5341] das16m1_attach+0x8ee/0xb20
[ 74.699037][ T5341] comedi_device_attach+0x520/0x670
[ 74.701047][ T5341] comedi_unlocked_ioctl+0x686/0xf40
[ 74.703113][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.705400][ T5341] ? __lock_acquire+0xab9/0xd20
[ 74.707322][ T5341] ? __fget_files+0x2a/0x420
[ 74.709260][ T5341] ? __fget_files+0x2a/0x420
[ 74.711161][ T5341] ? __fget_files+0x3a0/0x420
[ 74.713176][ T5341] ? __fget_files+0x2a/0x420
[ 74.715330][ T5341] ? bpf_lsm_file_ioctl+0x9/0x20
[ 74.717565][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.720057][ T5341] __se_sys_ioctl+0xfc/0x170
[ 74.722131][ T5341] do_syscall_64+0xfa/0x3b0
[ 74.724248][ T5341] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.726737][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.729469][ T5341] ? clear_bhb_loop+0x60/0xb0
[ 74.731724][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.734545][ T5341] RIP: 0033:0x7f2ebc58e929
[ 74.736632][ T5341] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 74.745189][ T5341] RSP: 002b:00007f2ebd43f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 74.748821][ T5341] RAX: ffffffffffffffda RBX: 00007f2ebc7b5fa0 RCX: 00007f2ebc58e929
[ 74.752440][ T5341] RDX: 0000200000000140 RSI: 0000000040946400 RDI: 0000000000000003
[ 74.756170][ T5341] RBP: 00007f2ebc610b39 R08: 0000000000000000 R09: 0000000000000000
[ 74.759627][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 74.763336][ T5341] R13: 0000000000000000 R14: 00007f2ebc7b5fa0 R15: 00007ffdd32a26d8
[ 74.767124][ T5341]
[ 74.769058][ T5341] Kernel Offset: disabled
[ 74.770974][ T5341] Rebooting in 86400 seconds..