program:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000007040)={0x0, 0x0, &(0x7f0000007000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000070000000900010073790000ac0ac716c9ca97c0ef97527a86e4510000000000000a00000008000240000000010900010073797a300000000028000000000a030000000000000000000a00400008000240000000000900010073797a3000000400140000001100010000000000000000000000000a855d8be2360375a2e4227aec2cbfc32291c96acf7a64923f4c5e04f54e3ab22e0386a63236"], 0x98}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x3c, 0x3b, 0x1, 0x0, 0x0, {0xa}, [@typed={0x25, 0x1, 0x0, 0x0, @str='SMC1 \x00'}]}, 0x3c}}, 0x0)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20}, 0x10)
listen(r2, 0xa)
r3 = socket$inet_smc(0x2b, 0x1, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x2, 0x0, {0xa, 0x20, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1001a}, [@FRA_DST={0x14, 0x1, @private1}, @FIB_RULE_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}, @FRA_SRC={0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x29}}]}, 0x4c}}, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x8, 0x0, 0x2}}}}}}, 0x0)
r5 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r5, &(0x7f0000000540)=[{{&(0x7f0000001200)={0xa, 0x0, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)='|', 0x1}], 0x1}}], 0x1, 0x0)
connect$inet(r3, &(0x7f0000000100)={0x2, 0x4e20}, 0x10)
accept4$inet(r2, 0x0, 0x0, 0x800)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105511, &(0x7f00000000c0)={{0xc, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x0, 0x100, 0xfffffffffffffffd, 0x0, 0x9, 0x100000000, 0x0, 0x4, 0x8, 0x0, 0xc3, 0x7f, 0x1, 0x0, 0x8000000, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x100000000, 0xffffffffffffffff, 0x0, 0x5, 0x4, 0x4, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0xfffffffe, 0x0, 0x6, 0xfffffdfffffffffe, 0x4, 0x804000, 0x0, 0xffffffff, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x401, 0x22, 0xffffffff, 0x2000000, 0xfffffffc, 0x1, 0x0, 0x0, 0xd87, 0x0, 0x40, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xdf9cd8e, 0x8000200, 0x6, 0x5, 0x0, 0x0, 0x0, 0xbb, 0x200000, 0x0, 0x0, 0xfffffffe, 0x7, 0x7ffffffd, 0x3, 0x0, 0xffffffffffff2328, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8, 0x4, 0x0, 0x0, 0xb, 0x1, 0x7, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7ff]})
r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x0, 0x0)
ioctl(r6, 0x40946400, &(0x7f0000000100)="6474323831312d706768000000000000000000000003")
syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x2, 0x0, 0x1, 0x0, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@bridge_newvlan={0x18, 0x76, 0x1, 0x0, 0x0, {0x7, 0x2}}, 0x18}, 0x1, 0x5502000000000000}, 0x0)
ioctl$sock_ifreq(r7, 0x8948, &(0x7f0000000080)={'ipvlan0\x00', @ifru_data=&(0x7f0000000000)="6eab63a066cb6b99ec5d55baf473ac43727b1aef93f98188fe5166b157224cb9"})
setxattr$security_ima(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), &(0x7f0000000340)=@v2={0x3, 0x2, 0x8a, 0x1, 0x4, "05dc85a8"}, 0xd, 0x0)
[ 94.174274][ T5279] Bluetooth: hci0: command tx timeout
[ 94.397590][ T5320] ------------[ cut here ]------------
[ 94.397602][ T5320] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31
[ 94.397613][ T5320] shift exponent -3 is negative
[ 94.397621][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.397633][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.397640][ T5320] Call Trace:
[ 94.397644][ T5320]
[ 94.397650][ T5320] dump_stack_lvl+0xe8/0x150
[ 94.397932][ T5320] ubsan_epilogue+0xa/0x30
[ 94.397948][ T5320] __ubsan_handle_shift_out_of_bounds+0x36d/0x400
[ 94.398247][ T5320] dt2811_attach+0x8e0/0xba0
[ 94.398319][ T5320] comedi_device_attach+0x52d/0x720
[ 94.398339][ T5320] comedi_unlocked_ioctl+0x8ef/0x1af0
[ 94.398372][ T5320] ? kasan_quarantine_put+0xbb/0x1f0
[ 94.398391][ T5320] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 94.398420][ T5320] ? do_vfs_ioctl+0x116f/0x1530
[ 94.398438][ T5320] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 94.398464][ T5320] ? hook_file_ioctl+0x1f2/0x600
[ 94.398505][ T5320] ? __fget_files+0x2a/0x420
[ 94.398522][ T5320] ? __fget_files+0x2a/0x420
[ 94.398536][ T5320] ? __fget_files+0x3a2/0x420
[ 94.398551][ T5320] ? __fget_files+0x2a/0x420
[ 94.398567][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20
[ 94.398581][ T5320] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 94.398598][ T5320] __se_sys_ioctl+0xfc/0x170
[ 94.398618][ T5320] do_syscall_64+0x166/0x520
[ 94.398634][ T5320] ? trace_irq_disable+0x3b/0x140
[ 94.398647][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.398661][ T5320] ? clear_bhb_loop+0x70/0xc0
[ 94.398675][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.398687][ T5320] RIP: 0033:0x7f2dc199e159
[ 94.398701][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.398710][ T5320] RSP: 002b:00007f2dbddd3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 94.398726][ T5320] RAX: ffffffffffffffda RBX: 00007f2dc1c26090 RCX: 00007f2dc199e159
[ 94.398734][ T5320] RDX: 0000200000000100 RSI: 0000000040946400 RDI: 000000000000000a
[ 94.398741][ T5320] RBP: 00007f2dc1a3506b R08: 0000000000000000 R09: 0000000000000000
[ 94.398748][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.398754][ T5320] R13: 00007f2dc1c26128 R14: 00007f2dc1c26090 R15: 00007ffcaa798e68
[ 94.398774][ T5320]
[ 94.398884][ T5320] ---[ end trace ]---
[ 94.398893][ T5320] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 94.504879][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.508548][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.512664][ T5320] Call Trace:
[ 94.514096][ T5320]
[ 94.515337][ T5320] vpanic+0x56d/0xa60
[ 94.517059][ T5320] ? __pfx_vpanic+0x10/0x10
[ 94.518971][ T5320] panic+0xc5/0xd0
[ 94.520498][ T5320] ? __pfx_panic+0x10/0x10
[ 94.522325][ T5320] ? __pfx__printk+0x10/0x10
[ 94.524186][ T5320] check_panic_on_warn+0x89/0xb0
[ 94.526188][ T5320] __ubsan_handle_shift_out_of_bounds+0x36d/0x400
[ 94.528788][ T5320] dt2811_attach+0x8e0/0xba0
[ 94.530691][ T5320] comedi_device_attach+0x52d/0x720
[ 94.532850][ T5320] comedi_unlocked_ioctl+0x8ef/0x1af0
[ 94.535032][ T5320] ? kasan_quarantine_put+0xbb/0x1f0
[ 94.537256][ T5320] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 94.539710][ T5320] ? do_vfs_ioctl+0x116f/0x1530
[ 94.541754][ T5320] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 94.543912][ T5320] ? hook_file_ioctl+0x1f2/0x600
[ 94.546008][ T5320] ? __fget_files+0x2a/0x420
[ 94.547948][ T5320] ? __fget_files+0x2a/0x420
[ 94.549880][ T5320] ? __fget_files+0x3a2/0x420
[ 94.551853][ T5320] ? __fget_files+0x2a/0x420
[ 94.553804][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20
[ 94.555871][ T5320] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 94.558277][ T5320] __se_sys_ioctl+0xfc/0x170
[ 94.560195][ T5320] do_syscall_64+0x166/0x520
[ 94.562099][ T5320] ? trace_irq_disable+0x3b/0x140
[ 94.564203][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.566764][ T5320] ? clear_bhb_loop+0x70/0xc0
[ 94.568746][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.571323][ T5320] RIP: 0033:0x7f2dc199e159
[ 94.573207][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.581073][ T5320] RSP: 002b:00007f2dbddd3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 94.584703][ T5320] RAX: ffffffffffffffda RBX: 00007f2dc1c26090 RCX: 00007f2dc199e159
[ 94.587978][ T5320] RDX: 0000200000000100 RSI: 0000000040946400 RDI: 000000000000000a
[ 94.591189][ T5320] RBP: 00007f2dc1a3506b R08: 0000000000000000 R09: 0000000000000000
[ 94.594456][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.597706][ T5320] R13: 00007f2dc1c26128 R14: 00007f2dc1c26090 R15: 00007ffcaa798e68
[ 94.600980][ T5320]
[ 94.602776][ T5320] Kernel Offset: disabled
[ 94.604601][ T5320] Rebooting in 86400 seconds..