================================================================================ UBSAN: Undefined behaviour in net/sched/sch_api.c:569:10 shift exponent 92 is too large for 32-bit type 'int' CPU: 0 PID: 13863 Comm: syz-executor.5 Not tainted 4.19.149-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 encrypted_key: master key parameter is missing ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 __qdisc_calculate_pkt_len+0x370/0x570 net/sched/sch_api.c:569 qdisc_calculate_pkt_len include/net/sch_generic.h:697 [inline] __dev_xmit_skb net/core/dev.c:3443 [inline] __dev_queue_xmit+0x1372/0x2ec0 net/core/dev.c:3807 br_dev_queue_push_xmit+0x25a/0x6c0 net/bridge/br_forward.c:56 NF_HOOK include/linux/netfilter.h:289 [inline] br_forward_finish+0xb5/0x430 net/bridge/br_forward.c:69 NF_HOOK include/linux/netfilter.h:289 [inline] __br_forward+0x693/0xbb0 net/bridge/br_forward.c:113 deliver_clone net/bridge/br_forward.c:129 [inline] maybe_deliver+0x2d2/0x3c0 net/bridge/br_forward.c:184 br_flood+0x180/0x4f0 net/bridge/br_forward.c:226 br_dev_xmit+0xdd0/0x1510 net/bridge/br_device.c:103 encrypted_key: master key parameter is missing __netdev_start_xmit include/linux/netdevice.h:4333 [inline] netdev_start_xmit include/linux/netdevice.h:4347 [inline] xmit_one net/core/dev.c:3256 [inline] dev_hard_start_xmit+0x1a8/0x960 net/core/dev.c:3272 __dev_queue_xmit+0x276a/0x2ec0 net/core/dev.c:3838 neigh_resolve_output+0x55a/0x950 net/core/neighbour.c:1374 neigh_output include/net/neighbour.h:501 [inline] ip6_finish_output2+0x1184/0x2370 net/ipv6/ip6_output.c:120 ip6_finish_output+0x610/0xcc0 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x205/0x7c0 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:455 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] ndisc_send_skb+0xa6b/0x1860 net/ipv6/ndisc.c:491 encrypted_key: master key parameter is missing ndisc_send_rs+0x131/0x6a0 net/ipv6/ndisc.c:685 addrconf_rs_timer+0x2d9/0x640 net/ipv6/addrconf.c:3834 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__block_write_begin+0x0/0x40 fs/buffer.c:2027 Code: 96 59 e6 ff 48 8b 44 24 30 e9 f0 f4 ff ff e8 b7 56 e6 ff e9 bd f4 ff ff 48 8b bc 24 90 00 00 00 e8 55 54 e6 ff e9 42 f4 ff ff <41> 56 49 89 ce 41 55 41 89 d5 41 54 49 89 f4 55 48 89 fd e8 88 07 RSP: 0018:ffff888049d1f978 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000040000 RBX: ffff88804eeff930 RCX: ffffffff81f53a10 RDX: 0000000000001000 RSI: 0000000000198000 RDI: ffffea0000de2c80 RBP: ffffea0000de2c80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: ffffea0000de2c00 R13: 0000000000000001 R14: dffffc0000000000 R15: 0000000000198000 ext4_da_write_begin+0x4e1/0x1120 fs/ext4/inode.c:3101 generic_perform_write+0x1f8/0x4d0 mm/filemap.c:3170 __generic_file_write_iter+0x24b/0x610 mm/filemap.c:3295 ext4_file_write_iter+0x2fe/0xfb0 fs/ext4/file.c:272 call_write_iter include/linux/fs.h:1821 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x51b/0x770 fs/read_write.c:487 vfs_write+0x1f3/0x540 fs/read_write.c:549 ksys_write+0x12b/0x2a0 fs/read_write.c:599 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45de89 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f0265d17c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000003a900 RCX: 000000000045de89 encrypted_key: master key parameter is missing RDX: 000000006db6e559 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffeb856ea9f R14: 00007f0265d189c0 R15: 000000000118bf2c ================================================================================ new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. ================================================================================ UBSAN: Undefined behaviour in ./include/net/red.h:272:18 shift exponent 75 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 14021 Comm: syz-executor.4 Not tainted 4.19.149-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 red_calc_qavg_from_idle_time include/net/red.h:272 [inline] red_calc_qavg include/net/red.h:313 [inline] choke_enqueue+0x2a7e/0x2cc0 net/sched/sch_choke.c:231 __dev_xmit_skb net/core/dev.c:3494 [inline] __dev_queue_xmit+0x14e1/0x2ec0 net/core/dev.c:3807 neigh_hh_output include/net/neighbour.h:491 [inline] neigh_output include/net/neighbour.h:499 [inline] ip_finish_output2+0xc04/0x1640 net/ipv4/ip_output.c:230 ip_finish_output+0x88e/0xd80 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_output+0x203/0x650 net/ipv4/ip_output.c:406 dst_output include/net/dst.h:455 [inline] ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125 __ip_queue_xmit+0x8a0/0x1bd0 net/ipv4/ip_output.c:506 __tcp_transmit_skb+0x1c72/0x36c0 net/ipv4/tcp_output.c:1148 tcp_transmit_skb net/ipv4/tcp_output.c:1164 [inline] tcp_send_syn_data net/ipv4/tcp_output.c:3486 [inline] tcp_connect+0x121e/0x2610 net/ipv4/tcp_output.c:3525 tcp_v4_connect+0x141c/0x1aa0 net/ipv4/tcp_ipv4.c:315 __inet_stream_connect+0x836/0xe50 net/ipv4/af_inet.c:655 tcp_sendmsg_fastopen net/ipv4/tcp.c:1185 [inline] tcp_sendmsg_locked+0x22cb/0x2fe0 net/ipv4/tcp.c:1232 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1460 inet_sendmsg+0x174/0x640 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xc7/0x130 net/socket.c:632 __sys_sendto+0x21a/0x320 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1795 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45de89 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f4230aecc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000000000002e880 RCX: 000000000045de89 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000118bf78 R08: 0000000020e68000 R09: 0000000000000010 R10: 00000000200007fd R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffce24f54af R14: 00007f4230aed9c0 R15: 000000000118bf2c ================================================================================ netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.