program:
r0 = memfd_create(&(0x7f0000000000)='syzkaller\x00', 0x0)
ftruncate(r0, 0x10000)
pwrite64(r0, &(0x7f0000001000)='\b\x00\x00\x00\n\x00\x00\x00\v\x00\x00\x00\f\x00\x00\x00\x00\x00', 0x12, 0x2008)
pwrite64(r0, &(0x7f0000001020)="8000000080000000010000000010000000040000", 0x14, 0x2024)
pwrite64(r0, &(0x7f0000001060)="000800000000000000000000000400002000000002", 0x15, 0x2068)
pwrite64(r0, &(0x7f000000107c)="389d267c", 0x4, 0x2084)
pwrite64(r0, &(0x7f0000001090)="0d00000000040000000400000100000001000000010000000100000001000000800000", 0x23, 0x2098)
pwrite64(r0, &(0x7f00000010d0)="0101010101010101010101010101", 0xe, 0x20cc)
pwrite64(r0, &(0x7f00000010e0)="5419010054190100541901005419010054", 0x11, 0x2554)
pwrite64(r0, &(0x7f00000010f0)='U', 0x1, 0x2804)
pwrite64(r0, 0x0, 0x0, 0x2818)
pwrite64(r0, 0x0, 0x0, 0x2828)
pwrite64(r0, &(0x7f0000001130)="80000000a0000000c0000000e000000000", 0x11, 0x2854)
pwrite64(r0, &(0x7f0000001160)="ed410200", 0x4, 0x2d00)
pwrite64(r0, &(0x7f0000001170)="0002000000000000", 0x8, 0x2d08)
pwrite64(r0, &(0x7f0000001180)='\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00\x00\f\x00\x00', 0x2f, 0x2d28)
pwrite64(r0, &(0x7f0000001190)="020000000c0001002e00000002000000f40102002e2e00", 0x17, 0x3000)
r1 = syz_open_dev$loop(&(0x7f0000002000), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000003000)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000003000)='./mnt\x00', &(0x7f0000004000)='ufs\x00', 0x0, &(0x7f0000005000)='ufstype=sun\x00')
openat(0xffffffffffffff9c, &(0x7f0000006000)='./mnt/file\x00', 0x42, 0x1ff)
[ 94.100479][ T5329] loop0: detected capacity change from 0 to 128
[ 94.113605][ T4651] Bluetooth: hci0: command tx timeout
[ 94.172119][ T5329] ufs: ufs_fill_super(): fs needs fsck
[ 94.175102][ T5329] ------------[ cut here ]------------
[ 94.178328][ T5329] UBSAN: shift-out-of-bounds in fs/ufs/super.c:1177:18
[ 94.182801][ T5329] shift exponent 4294967294 is too large for 32-bit type 'int'
[ 94.186192][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.186205][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.186213][ T5329] Call Trace:
[ 94.186218][ T5329]
[ 94.186223][ T5329] dump_stack_lvl+0xe8/0x150
[ 94.186320][ T5329] ubsan_epilogue+0xa/0x30
[ 94.186335][ T5329] __ubsan_handle_shift_out_of_bounds+0x36d/0x400
[ 94.186388][ T5329] ufs_fill_super+0x5f8d/0x67e0
[ 94.186422][ T5329] ? setup_bdev_super+0x4c1/0x5b0
[ 94.186442][ T5329] get_tree_bdev_flags+0x430/0x4f0
[ 94.186459][ T5329] ? __pfx_ufs_fill_super+0x10/0x10
[ 94.186472][ T5329] ? __pfx_get_tree_bdev_flags+0x10/0x10
[ 94.186514][ T5329] vfs_get_tree+0x92/0x2a0
[ 94.186528][ T5329] do_new_mount+0x319/0xdc0
[ 94.186539][ T5329] ? __pfx_do_new_mount+0x10/0x10
[ 94.186548][ T5329] ? ns_capable+0x89/0xe0
[ 94.186559][ T5329] ? path_mount+0x647/0x1040
[ 94.186570][ T5329] ? user_path_at+0xd4/0x160
[ 94.186586][ T5329] __se_sys_mount+0x31d/0x420
[ 94.186604][ T5329] ? __pfx___se_sys_mount+0x10/0x10
[ 94.186622][ T5329] ? __x64_sys_mount+0x20/0xc0
[ 94.186634][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.186646][ T5329] do_syscall_64+0x174/0x580
[ 94.186694][ T5329] ? trace_irq_disable+0x3b/0x140
[ 94.186709][ T5329] ? clear_bhb_loop+0x40/0x90
[ 94.186718][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.186726][ T5329] RIP: 0033:0x7f74f7b9e019
[ 94.186735][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.186741][ T5329] RSP: 002b:00007f74f8a15fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.186749][ T5329] RAX: ffffffffffffffda RBX: 00007f74f7e25fa0 RCX: 00007f74f7b9e019
[ 94.186755][ T5329] RDX: 0000200000004000 RSI: 0000200000003000 RDI: 0000200000000040
[ 94.186762][ T5329] RBP: 00007f74f7c3500c R08: 0000200000005000 R09: 0000000000000000
[ 94.186769][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.186776][ T5329] R13: 00007f74f7e26038 R14: 00007f74f7e25fa0 R15: 00007ffdd30e8eb8
[ 94.186793][ T5329]
[ 94.187125][ T5329] ---[ end trace ]---
[ 94.277715][ T5329] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 94.280503][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.284174][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.288289][ T5329] Call Trace:
[ 94.289733][ T5329]
[ 94.290947][ T5329] vpanic+0x56c/0xa60
[ 94.292690][ T5329] ? __pfx_vpanic+0x10/0x10
[ 94.294567][ T5329] ? irqentry_exit+0x218/0x8f0
[ 94.296597][ T5329] panic+0xc5/0xd0
[ 94.298098][ T5329] ? __pfx_panic+0x10/0x10
[ 94.300024][ T5329] ? __pfx__printk+0x10/0x10
[ 94.302023][ T5329] check_panic_on_warn+0x89/0xb0
[ 94.304140][ T5329] __ubsan_handle_shift_out_of_bounds+0x36d/0x400
[ 94.306791][ T5329] ufs_fill_super+0x5f8d/0x67e0
[ 94.309029][ T5329] ? setup_bdev_super+0x4c1/0x5b0
[ 94.311132][ T5329] get_tree_bdev_flags+0x430/0x4f0
[ 94.313166][ T5329] ? __pfx_ufs_fill_super+0x10/0x10
[ 94.315348][ T5329] ? __pfx_get_tree_bdev_flags+0x10/0x10
[ 94.317494][ T5329] vfs_get_tree+0x92/0x2a0
[ 94.319364][ T5329] do_new_mount+0x319/0xdc0
[ 94.321035][ T5329] ? __pfx_do_new_mount+0x10/0x10
[ 94.322921][ T5329] ? ns_capable+0x89/0xe0
[ 94.324807][ T5329] ? path_mount+0x647/0x1040
[ 94.326901][ T5329] ? user_path_at+0xd4/0x160
[ 94.329006][ T5329] __se_sys_mount+0x31d/0x420
[ 94.331138][ T5329] ? __pfx___se_sys_mount+0x10/0x10
[ 94.333452][ T5329] ? __x64_sys_mount+0x20/0xc0
[ 94.335452][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.338048][ T5329] do_syscall_64+0x174/0x580
[ 94.340081][ T5329] ? trace_irq_disable+0x3b/0x140
[ 94.342398][ T5329] ? clear_bhb_loop+0x40/0x90
[ 94.344511][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.347220][ T5329] RIP: 0033:0x7f74f7b9e019
[ 94.349231][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.358496][ T5329] RSP: 002b:00007f74f8a15fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.363161][ T5329] RAX: ffffffffffffffda RBX: 00007f74f7e25fa0 RCX: 00007f74f7b9e019
[ 94.366601][ T5329] RDX: 0000200000004000 RSI: 0000200000003000 RDI: 0000200000000040
[ 94.369706][ T5329] RBP: 00007f74f7c3500c R08: 0000200000005000 R09: 0000000000000000
[ 94.372722][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.375653][ T5329] R13: 00007f74f7e26038 R14: 00007f74f7e25fa0 R15: 00007ffdd30e8eb8
[ 94.378506][ T5329]
[ 94.380034][ T5329] Kernel Offset: disabled
[ 94.381741][ T5329] Rebooting in 86400 seconds..