================================================================================
UBSAN: shift-out-of-bounds in net/core/gen_estimator.c:83:38
shift exponent -131 is negative
CPU: 1 PID: 8520 Comm: syz-executor.2 Not tainted 5.11.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 est_timer.cold+0xbb/0x12d net/core/gen_estimator.c:83
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1417
 expire_timers kernel/time/timer.c:1462 [inline]
 __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1731
 __run_timers kernel/time/timer.c:1712 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1744
 __do_softirq+0x2bc/0xa29 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu kernel/softirq.c:420 [inline]
 irq_exit_rcu+0x134/0x200 kernel/softirq.c:432
 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
RIP: 0010:clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:49
Code: 48 89 47 18 48 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d9 90 c3 0f 1f 80 00 00 00 00 b9 00 10 00 00 31 c0 <f3> aa c3 cc cc cc cc cc cc 41 57 41 56 41 55 41 54 55 53 48 89 fb
RSP: 0018:ffffc900016ef468 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffea000168d340 RCX: 0000000000000b40
RDX: 1ffff11003e22cd8 RSI: 0000000000000001 RDI: ffff88805a34d4c0
RBP: ffff88801f115340 R08: 0000000000000001 R09: ffffed100b469a00
R10: fffff940002d1a6e R11: 0000000000000100 R12: ffffed1003e22d2c
R13: dffffc0000000000 R14: ffffea000168d380 R15: ffff88801f116960
 clear_page arch/x86/include/asm/page_64.h:49 [inline]
 clear_highpage include/linux/highmem.h:203 [inline]
 kernel_init_free_pages+0x99/0x120 mm/page_alloc.c:1211
 prep_new_page mm/page_alloc.c:2304 [inline]
 get_page_from_freelist+0x1cb4/0x4160 mm/page_alloc.c:3942
 __alloc_pages_nodemask+0x2d6/0x730 mm/page_alloc.c:4992
 alloc_pages_current+0x18c/0x2a0 mm/mempolicy.c:2267
 alloc_pages include/linux/gfp.h:547 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x16/0x1e0 arch/x86/mm/pgtable.c:33
 __pte_alloc+0x1f/0x290 mm/memory.c:428
 copy_pte_range mm/memory.c:941 [inline]
 copy_pmd_range mm/memory.c:1058 [inline]
 copy_pud_range mm/memory.c:1095 [inline]
 copy_p4d_range mm/memory.c:1119 [inline]
 copy_page_range+0x17ad/0x3fa0 mm/memory.c:1192
 dup_mmap kernel/fork.c:594 [inline]
 dup_mm+0x9ed/0x1380 kernel/fork.c:1361
 copy_mm kernel/fork.c:1417 [inline]
 copy_process+0x2a46/0x6fd0 kernel/fork.c:2099
 kernel_clone+0xe7/0xab0 kernel/fork.c:2464
 __do_sys_clone+0xc8/0x110 kernel/fork.c:2581
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45c7ea
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 0c 25 10 00 00 00 31 d2 4d 8d 91 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00
RSP: 002b:00007ffc48d96640 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc48d96640 RCX: 000000000045c7ea
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc48d96680 R08: 0000000000000001 R09: 00000000019e6940
R10: 00000000019e6c10 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
================================================================================