================================================================================
UBSAN: Undefined behaviour in net/sched/sch_api.c:561:7
shift exponent 129 is too large for 32-bit type 'int'
CPU: 1 PID: 15647 Comm: syz-executor.5 Not tainted 4.19.152-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 __qdisc_calculate_pkt_len+0x3bb/0x570 net/sched/sch_api.c:561
 qdisc_calculate_pkt_len include/net/sch_generic.h:697 [inline]
 __dev_xmit_skb net/core/dev.c:3443 [inline]
 __dev_queue_xmit+0x1370/0x2ec0 net/core/dev.c:3807
 neigh_hh_output include/net/neighbour.h:491 [inline]
 neigh_output include/net/neighbour.h:499 [inline]
 ip_finish_output2+0xc04/0x16b0 net/ipv4/ip_output.c:230
 ip_finish_output+0x88e/0xd80 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip_output+0x203/0x650 net/ipv4/ip_output.c:406
 dst_output include/net/dst.h:455 [inline]
 ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125
 iptunnel_xmit+0x63e/0xa30 net/ipv4/ip_tunnel_core.c:91
 geneve_xmit_skb drivers/net/geneve.c:865 [inline]
 geneve_xmit+0xf46/0x2af0 drivers/net/geneve.c:938
 __netdev_start_xmit include/linux/netdevice.h:4333 [inline]
 netdev_start_xmit include/linux/netdevice.h:4347 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x960 net/core/dev.c:3272
 __dev_queue_xmit+0x2768/0x2ec0 net/core/dev.c:3838
 neigh_resolve_output+0x55a/0x950 net/core/neighbour.c:1374
 neigh_output include/net/neighbour.h:501 [inline]
 ip6_finish_output2+0x1184/0x2370 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x610/0xcc0 net/ipv6/ip6_output.c:154
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x205/0x7c0 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:455 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ndisc_send_skb+0xa6b/0x1860 net/ipv6/ndisc.c:491
 ndisc_send_rs+0x131/0x6a0 net/ipv6/ndisc.c:685
 addrconf_rs_timer+0x384/0x6a0 net/ipv6/addrconf.c:3834
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x257/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15d/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:write_comp_data+0x6c/0x70 kernel/kcov.c:146
Code: 00 00 4e 8d 04 dd 28 00 00 00 4c 39 c6 72 1b 48 83 c7 01 4e 89 54 00 e0 4e 89 4c 00 e8 4a 89 54 00 f0 4a 89 4c d8 20 48 89 38 <c3> 0f 1f 00 48 8b 0c 24 40 0f b6 d6 40 0f b6 f7 31 ff eb 80 48 8b
RSP: 0018:ffff888052c36e00 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000002 RBX: 0000000000000005 RCX: ffffffff88682c1d
RDX: 0000000000000004 RSI: ffff888091c240c0 RDI: 0000000000000001
RBP: ffffffff89d73ca0 R08: 0000000000000004 R09: 0000000000000004
R10: 0000000000000001 R11: 00000000fac72f60 R12: 0000000000000001
R13: 0000000000000008 R14: 0000000000000004 R15: ffff888052c36f48
 __sanitizer_cov_trace_switch+0x4b/0x80 kernel/kcov.c:224
 vsnprintf+0x17d/0x14f0 lib/vsprintf.c:2249
 add_uevent_var+0x15d/0x380 lib/kobject_uevent.c:662
 dev_uevent+0x12b/0x7a0 drivers/base/core.c:1151
 kobject_uevent_env+0x662/0x1610 lib/kobject_uevent.c:554
 device_add+0xa9b/0x1610 drivers/base/core.c:2153
 netdev_register_kobject+0x181/0x428 net/core/net-sysfs.c:1765
 register_netdevice+0xbbf/0x1270 net/core/dev.c:8717
 ieee80211_if_add+0xf93/0x1780 net/mac80211/iface.c:1888
 ieee80211_register_hw+0x2ca7/0x3580 net/mac80211/main.c:1160
 mac80211_hwsim_new_radio+0x1f6b/0x4170 drivers/net/wireless/mac80211_hwsim.c:2896
 hwsim_new_radio_nl+0x5ef/0x8b0 drivers/net/wireless/mac80211_hwsim.c:3374
 genl_family_rcv_msg+0x6bf/0xd50 net/netlink/genetlink.c:602
 genl_rcv_msg+0xdf/0x1b0 net/netlink/genetlink.c:627
 netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2455
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:638
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x717/0xcc0 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xc7/0x130 net/socket.c:632
 ___sys_sendmsg+0x7bb/0x8f0 net/socket.c:2115
 __sys_sendmsg net/socket.c:2153 [inline]
 __do_sys_sendmsg net/socket.c:2162 [inline]
 __se_sys_sendmsg net/socket.c:2160 [inline]
 __x64_sys_sendmsg+0x132/0x220 net/socket.c:2160
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45de59
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f51bb28bc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000002e400 RCX: 000000000045de59
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c
R13: 00007ffec19167ef R14: 00007f51bb28c9c0 R15: 000000000118bf2c
================================================================================
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xcbf/0xf30 net/netfilter/ipvs/ip_vs_ctl.c:2451
IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xcbf/0xf30 net/netfilter/ipvs/ip_vs_ctl.c:2451
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xcbf/0xf30 net/netfilter/ipvs/ip_vs_ctl.c:2451
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xcbf/0xf30 net/netfilter/ipvs/ip_vs_ctl.c:2451
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xcbf/0xf30 net/netfilter/ipvs/ip_vs_ctl.c:2451
audit: type=1804 audit(1603274015.613:51): pid=15827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir084186137/syzkaller.nwXZef/233/bus" dev="sda1" ino=15943 res=1
audit: type=1800 audit(1603274015.713:52): pid=15827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15943 res=0
audit: type=1804 audit(1603274015.723:53): pid=15829 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir084186137/syzkaller.nwXZef/233/bus" dev="sda1" ino=15943 res=1
audit: type=1804 audit(1603274015.743:54): pid=15827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir084186137/syzkaller.nwXZef/233/bus" dev="sda1" ino=15943 res=1
audit: type=1804 audit(1603274015.753:55): pid=15829 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir084186137/syzkaller.nwXZef/233/bus" dev="sda1" ino=15943 res=1
audit: type=1804 audit(1603274015.753:56): pid=15827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir084186137/syzkaller.nwXZef/233/bus" dev="sda1" ino=15943 res=1
audit: type=1800 audit(1603274015.753:57): pid=15827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15943 res=0
audit: type=1804 audit(1603274016.133:58): pid=15859 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir084186137/syzkaller.nwXZef/234/bus" dev="sda1" ino=15878 res=1
audit: type=1800 audit(1603274016.133:59): pid=15859 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15878 res=0
audit: type=1804 audit(1603274016.153:60): pid=15859 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir084186137/syzkaller.nwXZef/234/bus" dev="sda1" ino=15878 res=1
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.