================================================================================ UBSAN: Undefined behaviour in ./include/net/red.h:272:18 shift exponent 193 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 8476 Comm: syz-executor.2 Not tainted 4.19.152-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 IPVS: ftp: loaded support on port[0] = 21 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 red_calc_qavg_from_idle_time include/net/red.h:272 [inline] red_calc_qavg include/net/red.h:313 [inline] red_enqueue+0x2064/0x2200 net/sched/sch_red.c:68 __dev_xmit_skb net/core/dev.c:3494 [inline] __dev_queue_xmit+0x14e1/0x2ec0 net/core/dev.c:3807 neigh_resolve_output+0x55a/0x950 net/core/neighbour.c:1374 neigh_output include/net/neighbour.h:501 [inline] ip6_finish_output2+0x1184/0x2370 net/ipv6/ip6_output.c:120 ip6_finish_output+0x610/0xcc0 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x205/0x7c0 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:455 [inline] ip6_local_out+0xaf/0x170 net/ipv6/output_core.c:178 ip6_send_skb+0xb3/0x300 net/ipv6/ip6_output.c:1699 ip6_push_pending_frames+0xdd/0x100 net/ipv6/ip6_output.c:1719 icmpv6_push_pending_frames+0x294/0x470 net/ipv6/icmp.c:288 icmp6_send+0x1c51/0x2310 net/ipv6/icmp.c:584 icmpv6_send+0x11e/0x26d net/ipv6/ip6_icmp.c:43 ip6_link_failure+0x26/0x560 net/ipv6/route.c:2297 dst_link_failure include/net/dst.h:438 [inline] ip6_tnl_xmit+0x482/0x3600 net/ipv6/ip6_tunnel.c:1235 ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1389 [inline] ip6_tnl_start_xmit+0x931/0x1e80 net/ipv6/ip6_tunnel.c:1415 __netdev_start_xmit include/linux/netdevice.h:4333 [inline] netdev_start_xmit include/linux/netdevice.h:4347 [inline] xmit_one net/core/dev.c:3256 [inline] dev_hard_start_xmit+0x1a8/0x960 net/core/dev.c:3272 __dev_queue_xmit+0x276a/0x2ec0 net/core/dev.c:3838 neigh_output include/net/neighbour.h:501 [inline] ip6_finish_output2+0x1184/0x2370 net/ipv6/ip6_output.c:120 ip6_finish_output+0x610/0xcc0 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x205/0x7c0 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:455 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] ip6_xmit+0xe46/0x2110 net/ipv6/ip6_output.c:275 inet6_csk_xmit+0x350/0x661 net/ipv6/inet6_connection_sock.c:139 __tcp_transmit_skb+0x1c72/0x36c0 net/ipv4/tcp_output.c:1148 tcp_transmit_skb net/ipv4/tcp_output.c:1164 [inline] tcp_send_syn_data net/ipv4/tcp_output.c:3486 [inline] tcp_connect+0x121e/0x2610 net/ipv4/tcp_output.c:3525 tcp_v6_connect+0x1c36/0x2290 net/ipv6/tcp_ipv6.c:321 __inet_stream_connect+0x836/0xe50 net/ipv4/af_inet.c:655 inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:719 __sys_connect+0x265/0x2c0 net/socket.c:1663 __do_sys_connect net/socket.c:1674 [inline] __se_sys_connect net/socket.c:1671 [inline] __x64_sys_connect+0x6f/0xb0 net/socket.c:1671 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45de59 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f4122234c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000002380 RCX: 000000000045de59 RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffe1914d0df R14: 00007f41222359c0 R15: 000000000118bf2c ================================================================================ IPVS: ftp: loaded support on port[0] = 21 syz-executor.2 (8476) used greatest stack depth: 22784 bytes left nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop2): Unrecognized mount option "pcr=00000000000000000036" or missing value EXT4-fs (loop2): Unrecognized mount option "pcr=00000000000000000036" or missing value EXT4-fs (loop3): VFS: Can't find ext4 filesystem EXT4-fs (loop3): VFS: Can't find ext4 filesystem qnx4: no qnx4 filesystem (no root dir). qnx4: no qnx4 filesystem (no root dir). netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. audit: type=1804 audit(1603096185.234:19): pid=8669 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir745766397/syzkaller.1YBcbz/12/file0" dev="sda1" ino=15839 res=1 encrypted_key: keyword 'new' not allowed when called from .update method netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. kvm: pic: single mode not supported kvm: pic: level sensitive irq not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: single mode not supported kvm: pic: level sensitive irq not supported raw_sendmsg: syz-executor.0 forgot to set AF_INET. Fix it! kvm: pic: level sensitive irq not supported netlink: 28 bytes leftover after parsing attributes in process `syz-executor.0'.