================================================================================ UBSAN: Undefined behaviour in net/sched/sch_api.c:561:7 shift exponent 129 is too large for 32-bit type 'int' CPU: 0 PID: 23 Comm: kworker/u4:1 Not tainted 4.19.150-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker Call Trace: netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 __qdisc_calculate_pkt_len+0x3bb/0x570 net/sched/sch_api.c:561 qdisc_calculate_pkt_len include/net/sch_generic.h:697 [inline] __dev_xmit_skb net/core/dev.c:3443 [inline] __dev_queue_xmit+0x1372/0x2ec0 net/core/dev.c:3807 neigh_hh_output include/net/neighbour.h:491 [inline] neigh_output include/net/neighbour.h:499 [inline] ip_finish_output2+0xc04/0x1640 net/ipv4/ip_output.c:230 ip_finish_output+0x88e/0xd80 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_output+0x203/0x650 net/ipv4/ip_output.c:406 dst_output include/net/dst.h:455 [inline] ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125 iptunnel_xmit+0x63e/0xa30 net/ipv4/ip_tunnel_core.c:91 geneve_xmit_skb drivers/net/geneve.c:865 [inline] geneve_xmit+0xf46/0x2ac0 drivers/net/geneve.c:938 __netdev_start_xmit include/linux/netdevice.h:4333 [inline] netdev_start_xmit include/linux/netdevice.h:4347 [inline] xmit_one net/core/dev.c:3256 [inline] dev_hard_start_xmit+0x1a8/0x960 net/core/dev.c:3272 __dev_queue_xmit+0x276a/0x2ec0 net/core/dev.c:3838 neigh_hh_output include/net/neighbour.h:491 [inline] neigh_output include/net/neighbour.h:499 [inline] ip6_finish_output2+0xe78/0x2370 net/ipv6/ip6_output.c:120 ip6_finish_output+0x610/0xcc0 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x205/0x7c0 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:455 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] ndisc_send_skb+0xa6b/0x1860 net/ipv6/ndisc.c:491 ndisc_send_rs+0x131/0x6a0 net/ipv6/ndisc.c:685 addrconf_rs_timer+0x2d9/0x640 net/ipv6/addrconf.c:3834 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:check_preemption_disabled+0x0/0x2b0 lib/smp_processor_id.c:12 Code: 08 fe e9 5a f6 ff ff 48 89 de 48 c7 c7 a0 16 18 8a e8 74 7e 13 00 e9 23 f9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 57 41 56 41 55 49 89 f5 41 54 55 48 89 fd 53 e8 eb 2e cf fd 65 RSP: 0018:ffff8880a9bdfc98 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 RAX: ffff8880a9bce600 RBX: 0000000000000000 RCX: ffffffff87942ae7 RDX: 0000000000000000 RSI: ffffffff8851f300 RDI: ffffffff8851f340 RBP: ffff8880502ce660 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000000 R13: dffffc0000000000 R14: 00000000000002a4 R15: 0000000000000000 rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline] rcu_is_watching+0xe/0x100 kernel/rcu/tree.c:1025 rcu_read_unlock include/linux/rcupdate.h:677 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:423 [inline] batadv_nc_worker+0x96f/0xd90 net/batman-adv/network-coding.c:730 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ================================================================================ netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. EXT4-fs (sda1): re-mounted. Opts: (null) EXT4-fs (sda1): re-mounted. Opts: (null) Dev loop5: unable to read RDB block 2 loop5: unable to read partition table loop5: partition table beyond EOD, truncated loop_reread_partitions: partition scan of loop5 () failed (rc=-5) ptrace attach of "/root/syz-executor.2"[8922] was attempted by "/root/syz-executor.2"[8923] xt_CT: You must specify a L4 protocol and not use inversions on it xt_CT: You must specify a L4 protocol and not use inversions on it xt_CT: You must specify a L4 protocol and not use inversions on it ptrace attach of "/root/syz-executor.2"[8936] was attempted by "/root/syz-executor.2"[8937] xt_CT: You must specify a L4 protocol and not use inversions on it ptrace attach of "/root/syz-executor.2"[8941] was attempted by "/root/syz-executor.2"[8942] xt_CT: You must specify a L4 protocol and not use inversions on it ptrace attach of "/root/syz-executor.2"[8948] was attempted by "/root/syz-executor.2"[8949] bridge0: port 2(bridge_slave_1) entered disabled state bridge0: port 1(bridge_slave_0) entered disabled state device bridge0 entered promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode Bluetooth: hci1: command 0x0409 tx timeout