================================================================================
UBSAN: shift-out-of-bounds in net/sched/sch_api.c:572:7
shift exponent 255 is too large for 32-bit type 'int'
CPU: 0 PID: 2969 Comm: systemd-udevd Not tainted 5.15.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:330
 __qdisc_calculate_pkt_len.cold+0x62/0xcf net/sched/sch_api.c:572
 qdisc_calculate_pkt_len include/net/sch_generic.h:841 [inline]
 __dev_xmit_skb net/core/dev.c:3788 [inline]
 __dev_queue_xmit+0x115c/0x36e0 net/core/dev.c:4172
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip_finish_output2+0xf01/0x2140 net/ipv4/ip_output.c:221
 __ip_finish_output net/ipv4/ip_output.c:299 [inline]
 __ip_finish_output+0x396/0x640 net/ipv4/ip_output.c:281
 ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:309
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0x196/0x310 net/ipv4/ip_output.c:423
 dst_output include/net/dst.h:450 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 ip_send_skb net/ipv4/ip_output.c:1555 [inline]
 ip_push_pending_frames+0x125/0x2b0 net/ipv4/ip_output.c:1575
 icmp_push_reply+0x351/0x4a0 net/ipv4/icmp.c:393
 __icmp_send+0xb99/0x13c0 net/ipv4/icmp.c:769
 ipv4_send_dest_unreach net/ipv4/route.c:1225 [inline]
 ipv4_link_failure+0x5d5/0x9f0 net/ipv4/route.c:1232
 dst_link_failure include/net/dst.h:429 [inline]
 arp_error_report+0xc7/0x1c0 net/ipv4/arp.c:295
 neigh_invalidate+0x20d/0x560 net/core/neighbour.c:995
 neigh_timer_handler+0xd47/0x10e0 net/core/neighbour.c:1082
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:write_comp_data kernel/kcov.c:218 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x1d/0x80 kernel/kcov.c:270
Code: 54 c8 20 48 89 10 c3 66 0f 1f 44 00 00 53 41 89 fb 41 89 f1 bf 03 00 00 00 65 48 8b 0c 25 40 f0 01 00 48 89 ce 4c 8b 54 24 08 <e8> 4e f1 ff ff 84 c0 74 51 48 8b 81 20 15 00 00 44 8b 81 1c 15 00
RSP: 0018:ffffc900022ef598 EFLAGS: 00000206
RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffff88807aefd580
RDX: ffff88807aefd580 RSI: ffff88807aefd580 RDI: 0000000000000003
RBP: ffff88801dc02b80 R08: 0000000000000000 R09: 0000000000000005
R10: ffffffff83a2312a R11: 0000000000000010 R12: 0000000000000026
R13: 00000000000003d0 R14: dffffc0000000000 R15: 0000000000000000
 tomoyo_domain_quota_is_ok+0x32a/0x550 security/tomoyo/util.c:1092
 tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission security/tomoyo/file.c:587 [inline]
 tomoyo_path_permission+0x270/0x3a0 security/tomoyo/file.c:573
 tomoyo_check_open_permission+0x33e/0x380 security/tomoyo/file.c:777
 tomoyo_file_open security/tomoyo/tomoyo.c:311 [inline]
 tomoyo_file_open+0xa3/0xd0 security/tomoyo/tomoyo.c:306
 security_file_open+0x45/0xb0 security/security.c:1634
 do_dentry_open+0x353/0x11d0 fs/open.c:809
 do_open fs/namei.c:3428 [inline]
 path_openat+0x1c9a/0x2740 fs/namei.c:3561
 do_filp_open+0x1aa/0x400 fs/namei.c:3588
 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200
 do_sys_open fs/open.c:1216 [inline]
 __do_sys_open fs/open.c:1224 [inline]
 __se_sys_open fs/open.c:1220 [inline]
 __x64_sys_open+0x119/0x1c0 fs/open.c:1220
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fafbc45f9b1
Code: f7 d8 bf ff ff ff ff 64 89 02 eb cb 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 80 3f 00 74 1b be 00 08 09 00 b8 02 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 1f 89 c7 e9 00 ff ff ff 48 8b 05 b1 54 2e 00
RSP: 002b:00007fff8638e9d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fff8638eba0 RCX: 00007fafbc45f9b1
RDX: 0000000000000100 RSI: 0000000000090800 RDI: 0000559c37948b40
RBP: 0000000000000000 R08: 00007fafbc7461a8 R09: 0000000000000110
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff8638ebd0
R13: 0000559c37948b40 R14: 0000000000000100 R15: 00007fff8638eaa0
================================================================================
----------------
Code disassembly (best guess):
   0:	54                   	push   %rsp
   1:	c8 20 48 89          	enterq $0x4820,$0x89
   5:	10 c3                	adc    %al,%bl
   7:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
   d:	53                   	push   %rbx
   e:	41 89 fb             	mov    %edi,%r11d
  11:	41 89 f1             	mov    %esi,%r9d
  14:	bf 03 00 00 00       	mov    $0x3,%edi
  19:	65 48 8b 0c 25 40 f0 	mov    %gs:0x1f040,%rcx
  20:	01 00
  22:	48 89 ce             	mov    %rcx,%rsi
  25:	4c 8b 54 24 08       	mov    0x8(%rsp),%r10
* 2a:	e8 4e f1 ff ff       	callq  0xfffff17d <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	74 51                	je     0x84
  33:	48 8b 81 20 15 00 00 	mov    0x1520(%rcx),%rax
  3a:	44                   	rex.R
  3b:	8b                   	.byte 0x8b
  3c:	81                   	.byte 0x81
  3d:	1c 15                	sbb    $0x15,%al