================================================================================ UBSAN: shift-out-of-bounds in net/sched/sch_api.c:572:7 shift exponent 80 is too large for 32-bit type 'int' CPU: 0 PID: 11711 Comm: syz-executor.1 Not tainted 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:330 __qdisc_calculate_pkt_len.cold+0x62/0xcf net/sched/sch_api.c:572 qdisc_calculate_pkt_len include/net/sch_generic.h:841 [inline] __dev_xmit_skb net/core/dev.c:3788 [inline] __dev_queue_xmit+0x115c/0x36e0 net/core/dev.c:4172 neigh_resolve_output net/core/neighbour.c:1492 [inline] neigh_resolve_output+0x50e/0x820 net/core/neighbour.c:1472 neigh_output include/net/neighbour.h:510 [inline] ip_finish_output2+0x813/0x2140 net/ipv4/ip_output.c:221 __ip_finish_output net/ipv4/ip_output.c:299 [inline] __ip_finish_output+0x396/0x640 net/ipv4/ip_output.c:281 ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:309 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_output+0x196/0x310 net/ipv4/ip_output.c:423 dst_output include/net/dst.h:450 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126 igmpv3_send_cr net/ipv4/igmp.c:719 [inline] igmp_ifc_timer_expire+0x75b/0xf80 net/ipv4/igmp.c:808 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:rcu_lockdep_current_cpu_online+0x14/0x150 kernel/rcu/tree.c:1166 Code: 48 8b 44 24 18 e9 41 fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 65 8b 15 59 1e a0 7e 81 e2 00 00 f0 00 b8 01 00 00 00 75 0a <8b> 15 d2 80 0c 0c 85 d2 75 01 c3 55 53 65 ff 05 38 1e a0 7e e8 c3 RSP: 0018:ffffc90004ebf6d0 EFLAGS: 00000246 RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff8161c3d4 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880b9c32a08 RBP: 1ffff920009d7edf R08: 0000000000000000 R09: ffff8880b9c32a0b R10: ffffed1017386541 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000000 R14: dffffc0000000000 R15: 00007f45e0ebb000 rcu_read_lock_held_common kernel/rcu/update.c:112 [inline] rcu_read_lock_held_common kernel/rcu/update.c:102 [inline] rcu_read_lock_sched_held+0x25/0x70 kernel/rcu/update.c:123 trace_lock_release include/trace/events/lock.h:58 [inline] lock_release+0x522/0x720 kernel/locking/lockdep.c:5636 zap_pte_range mm/memory.c:1362 [inline] zap_pmd_range mm/memory.c:1481 [inline] zap_pud_range mm/memory.c:1510 [inline] zap_p4d_range mm/memory.c:1531 [inline] unmap_page_range+0xed5/0x2a10 mm/memory.c:1552 unmap_single_vma+0x198/0x310 mm/memory.c:1597 unmap_vmas+0x16d/0x2f0 mm/memory.c:1629 exit_mmap+0x1d0/0x630 mm/mmap.c:3171 __mmput+0x122/0x4b0 kernel/fork.c:1115 mmput+0x58/0x60 kernel/fork.c:1136 exit_mm kernel/exit.c:501 [inline] do_exit+0xabc/0x2a30 kernel/exit.c:812 do_group_exit+0x125/0x310 kernel/exit.c:922 get_signal+0x47f/0x2160 kernel/signal.c:2868 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f45e20ff51b Code: Unable to access opcode bytes at RIP 0x7f45e20ff4f1. RSP: 002b:00007ffe7c7aab20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00007f45e20ff51b RDX: 0000001b2e1261fc RSI: ffffffff89365938 RDI: 0000000000000007 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2e1261e0 R10: 00000000000001a6 R11: 0000000000000293 R12: 00007f45e2251b60 R13: 00007f45e2251b60 R14: 00007f45e2250f60 R15: 0000000000043cbb ================================================================================ ---------------- Code disassembly (best guess): 0: 48 8b 44 24 18 mov 0x18(%rsp),%rax 5: e9 41 fe ff ff jmpq 0xfffffe4b a: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 11: 00 00 00 00 15: 90 nop 16: 65 8b 15 59 1e a0 7e mov %gs:0x7ea01e59(%rip),%edx # 0x7ea01e76 1d: 81 e2 00 00 f0 00 and $0xf00000,%edx 23: b8 01 00 00 00 mov $0x1,%eax 28: 75 0a jne 0x34 * 2a: 8b 15 d2 80 0c 0c mov 0xc0c80d2(%rip),%edx # 0xc0c8102 <-- trapping instruction 30: 85 d2 test %edx,%edx 32: 75 01 jne 0x35 34: c3 retq 35: 55 push %rbp 36: 53 push %rbx 37: 65 ff 05 38 1e a0 7e incl %gs:0x7ea01e38(%rip) # 0x7ea01e76 3e: e8 .byte 0xe8 3f: c3 retq