================================================================================
UBSAN: shift-out-of-bounds in ./include/net/red.h:310:18
shift exponent 181 is too large for 64-bit type 'long unsigned int'
CPU: 1 PID: 4875 Comm: systemd-udevd Not tainted 5.10.0-rc6-next-20201207-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 red_calc_qavg_from_idle_time include/net/red.h:310 [inline]
 red_calc_qavg include/net/red.h:351 [inline]
 choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221
 __dev_xmit_skb net/core/dev.c:3789 [inline]
 __dev_queue_xmit+0x199e/0x2ec0 net/core/dev.c:4101
 neigh_resolve_output net/core/neighbour.c:1491 [inline]
 neigh_resolve_output+0x4d8/0x7e0 net/core/neighbour.c:1471
 neigh_output include/net/neighbour.h:510 [inline]
 ip6_finish_output2+0x68c/0x1710 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:143 [inline]
 __ip6_finish_output+0x4be/0xb80 net/ipv6/ip6_output.c:128
 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x1db/0x520 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:441 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ndisc_send_skb+0xacc/0x1850 net/ipv6/ndisc.c:508
 ndisc_send_rs+0x12e/0x710 net/ipv6/ndisc.c:702
 addrconf_rs_timer+0x3f2/0x820 net/ipv6/addrconf.c:3874
 call_timer_fn+0x1a5/0x710 kernel/time/timer.c:1417
 expire_timers kernel/time/timer.c:1462 [inline]
 __run_timers.part.0+0x692/0xa80 kernel/time/timer.c:1731
 __run_timers kernel/time/timer.c:1712 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1744
 __do_softirq+0x2b7/0xa76 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu kernel/softirq.c:424 [inline]
 irq_exit_rcu+0x194/0x210 kernel/softirq.c:436
 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
RIP: 0010:tomoyo_check_acl+0xb0/0x450 security/tomoyo/domain.c:173
Code: 03 00 00 49 8b 5d 00 49 39 dd 0f 84 fa 01 00 00 e8 e5 20 eb fd 48 8d 7b 18 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 0f b6 04 28 <38> d0 7f 08 84 c0 0f 85 f7 02 00 00 44 0f b6 73 18 31 ff 44 89 f6
RSP: 0018:ffffc9000110fa20 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888011aa0b00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8387254b RDI: ffff888011aa0b18
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff838725f8 R11: 0000000000000000 R12: ffffc9000110fb50
R13: ffff8881413edb90 R14: 0000000000000000 R15: 0000000000000000
 tomoyo_path_permission security/tomoyo/file.c:586 [inline]
 tomoyo_path_permission+0x1ff/0x3a0 security/tomoyo/file.c:573
 tomoyo_path_perm+0x2ec/0x3f0 security/tomoyo/file.c:838
 security_inode_getattr+0xcf/0x140 security/security.c:1280
 vfs_getattr fs/stat.c:121 [inline]
 vfs_statx+0x164/0x390 fs/stat.c:189
 vfs_fstatat fs/stat.c:207 [inline]
 vfs_lstat include/linux/fs.h:3123 [inline]
 __do_sys_newlstat+0x91/0x110 fs/stat.c:362
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fca9a7ac335
Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89
RSP: 002b:00007ffd8ea30228 EFLAGS: 00000246 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000560b29779640 RCX: 00007fca9a7ac335
RDX: 00007ffd8ea30260 RSI: 00007ffd8ea30260 RDI: 0000560b29778640
RBP: 00007ffd8ea30320 R08: 0000560b297b6010 R09: 0000000000001010
R10: 0000000000000020 R11: 0000000000000246 R12: 0000560b29778640
R13: 0000560b2977865a R14: 0000560b29756ff5 R15: 0000560b29756ffa
================================================================================