================================================================================ UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 shift exponent 195 is too large for 64-bit type 'long unsigned int' CPU: 0 PID: 11262 Comm: syz-executor.5 Not tainted 5.11.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395 red_calc_qavg_from_idle_time include/net/red.h:312 [inline] red_calc_qavg include/net/red.h:353 [inline] red_enqueue.cold+0x64/0x452 net/sched/sch_red.c:77 __dev_xmit_skb net/core/dev.c:3837 [inline] __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] ip6_local_out+0xaf/0x1a0 net/ipv6/output_core.c:179 ip6_send_skb+0xb7/0x340 net/ipv6/ip6_output.c:1904 ip6_push_pending_frames+0xdd/0x100 net/ipv6/ip6_output.c:1924 icmpv6_push_pending_frames+0x294/0x470 net/ipv6/icmp.c:310 icmp6_send+0x1a27/0x2280 net/ipv6/icmp.c:626 icmpv6_send include/linux/icmpv6.h:24 [inline] ip6_link_failure+0x29/0x510 net/ipv6/route.c:2673 dst_link_failure include/net/dst.h:427 [inline] ndisc_error_report+0xc7/0x1c0 net/ipv6/ndisc.c:712 neigh_invalidate+0x20d/0x560 net/core/neighbour.c:994 neigh_timer_handler+0xd43/0x10e0 net/core/neighbour.c:1081 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1431 expire_timers kernel/time/timer.c:1476 [inline] __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1745 __run_timers kernel/time/timer.c:1726 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1758 __do_softirq+0x29b/0x9f6 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu kernel/softirq.c:420 [inline] irq_exit_rcu+0x134/0x200 kernel/softirq.c:432 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:163 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:197 Code: f0 4d 89 03 e9 f2 fc ff ff b9 ff ff ff ff ba 08 00 00 00 4d 8b 03 48 0f bd ca 49 8b 45 00 48 63 c9 e9 64 ff ff ff 0f 1f 40 00 <65> 8b 05 c9 e6 8e 7e 89 c1 48 8b 34 24 81 e1 00 01 00 00 65 48 8b RSP: 0018:ffffc900030cf740 EFLAGS: 00000212 RAX: 0000000000002795 RBX: 0000000000000000 RCX: ffffc900137eb000 RDX: 0000000000040000 RSI: ffffffff815b279f RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8fa7e7e7 R10: ffffffff815b2795 R11: 0000000000000000 R12: ffffffff84aa5310 R13: 0000000000000200 R14: dffffc0000000000 R15: ffffc900030cf7a0 console_unlock+0x805/0xc80 kernel/printk/printk.c:2580 vprintk_emit+0x1ca/0x560 kernel/printk/printk.c:2092 vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393 printk+0xba/0xed kernel/printk/printk.c:2140 xt_check_table_hooks.cold+0x17/0x22 net/netfilter/x_tables.c:606 translate_table+0xaaa/0x1750 net/ipv6/netfilter/ip6_tables.c:721 do_replace net/ipv6/netfilter/ip6_tables.c:1152 [inline] do_ip6t_set_ctl+0x553/0xb70 net/ipv6/netfilter/ip6_tables.c:1636 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1008 udpv6_setsockopt+0x76/0xc0 net/ipv6/udp.c:1629 __sys_setsockopt+0x2db/0x610 net/socket.c:2115 __do_sys_setsockopt net/socket.c:2126 [inline] __se_sys_setsockopt net/socket.c:2123 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2123 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x465f69 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f347a38b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000004 RBP: 00000000004bfa67 R08: 00000000000003d8 R09: 0000000000000000 R10: 0000000020000500 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffc58a8f19f R14: 00007f347a38b300 R15: 0000000000022000 ================================================================================