program:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1a, 0x7, 0xb, 0x22}, 0x50) (async)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6)
write$binfmt_misc(r2, &(0x7f0000000000), 0xd) (async, rerun: 32)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x4f27, 0x2009, 0x4, 0x4, 0x5, 0x6, 0x6, 0x7, 0xa, 0x100, 0x2, 0x80000, 0x1, 0x8, 0x2001e, 0x800001, 0x0, 0x1a449, 0x3, 0x6, 0x81, 0xcaa7, 0x4, 0x1e58, 0xb, 0x3, 0x3c, 0x8, 0x80000000, 0x0, 0xa38e]}) (async, rerun: 32)
r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000004c0), 0x60000)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000000)={{0x2, 0x0, 0x81, 0x3, 0x908e}})
[ 74.350740][ T5320] Bluetooth: hci0: command tx timeout
[ 74.453555][ T5341] ------------[ cut here ]------------
[ 74.455939][ T5341] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/aio_iiro_16.c:180:9
[ 74.459712][ T5341] shift exponent 8201 is too large for 32-bit type 'int'
[ 74.473388][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full)
[ 74.473403][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 74.473408][ T5341] Call Trace:
[ 74.473412][ T5341]
[ 74.473416][ T5341] dump_stack_lvl+0x189/0x250
[ 74.473512][ T5341] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.473526][ T5341] ? __pfx__printk+0x10/0x10
[ 74.473548][ T5341] ? __pfx___request_region_locked+0x10/0x10
[ 74.473570][ T5341] ubsan_epilogue+0xa/0x40
[ 74.473587][ T5341] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 74.473643][ T5341] ? __request_region+0xc2/0xe0
[ 74.473662][ T5341] ? comedi_request_region+0x7b/0x180
[ 74.473710][ T5341] aio_iiro_16_attach+0x5e8/0x790
[ 74.473730][ T5341] comedi_device_attach+0x51d/0x670
[ 74.473747][ T5341] comedi_unlocked_ioctl+0x686/0xf40
[ 74.473772][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.473806][ T5341] ? __lock_acquire+0xab9/0xd20
[ 74.473832][ T5341] ? __fget_files+0x2a/0x420
[ 74.473850][ T5341] ? __fget_files+0x2a/0x420
[ 74.473864][ T5341] ? __fget_files+0x3a0/0x420
[ 74.473878][ T5341] ? __fget_files+0x2a/0x420
[ 74.473896][ T5341] ? bpf_lsm_file_ioctl+0x9/0x20
[ 74.473909][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.473921][ T5341] __se_sys_ioctl+0xfc/0x170
[ 74.473930][ T5341] do_syscall_64+0xfa/0x3b0
[ 74.473986][ T5341] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.474000][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.474008][ T5341] ? clear_bhb_loop+0x60/0xb0
[ 74.474018][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.474026][ T5341] RIP: 0033:0x7ff49c38e929
[ 74.474034][ T5341] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 74.474042][ T5341] RSP: 002b:00007ff49d252038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 74.474057][ T5341] RAX: ffffffffffffffda RBX: 00007ff49c5b6080 RCX: 00007ff49c38e929
[ 74.474065][ T5341] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000003
[ 74.474072][ T5341] RBP: 00007ff49c410b39 R08: 0000000000000000 R09: 0000000000000000
[ 74.474078][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 74.474085][ T5341] R13: 0000000000000001 R14: 00007ff49c5b6080 R15: 00007ffc7f4b4098
[ 74.474105][ T5341]
[ 74.474197][ T5341] ---[ end trace ]---
[ 74.619867][ T5341] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 74.623097][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full)
[ 74.628594][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 74.633203][ T5341] Call Trace:
[ 74.634726][ T5341]
[ 74.636126][ T5341] dump_stack_lvl+0x99/0x250
[ 74.638351][ T5341] ? __asan_memcpy+0x40/0x70
[ 74.640572][ T5341] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.642945][ T5341] ? __pfx__printk+0x10/0x10
[ 74.645034][ T5341] panic+0x2db/0x790
[ 74.646736][ T5341] ? __pfx_panic+0x10/0x10
[ 74.648606][ T5341] ? _printk+0xcf/0x120
[ 74.650309][ T5341] ? __pfx__printk+0x10/0x10
[ 74.652323][ T5341] check_panic_on_warn+0x89/0xb0
[ 74.654468][ T5341] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 74.657337][ T5341] ? __request_region+0xc2/0xe0
[ 74.659472][ T5341] ? comedi_request_region+0x7b/0x180
[ 74.661759][ T5341] aio_iiro_16_attach+0x5e8/0x790
[ 74.663949][ T5341] comedi_device_attach+0x51d/0x670
[ 74.666269][ T5341] comedi_unlocked_ioctl+0x686/0xf40
[ 74.668624][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.672203][ T5341] ? __lock_acquire+0xab9/0xd20
[ 74.674847][ T5341] ? __fget_files+0x2a/0x420
[ 74.676917][ T5341] ? __fget_files+0x2a/0x420
[ 74.679249][ T5341] ? __fget_files+0x3a0/0x420
[ 74.681220][ T5341] ? __fget_files+0x2a/0x420
[ 74.683125][ T5341] ? bpf_lsm_file_ioctl+0x9/0x20
[ 74.685172][ T5341] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 74.687597][ T5341] __se_sys_ioctl+0xfc/0x170
[ 74.689506][ T5341] do_syscall_64+0xfa/0x3b0
[ 74.691483][ T5341] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.693843][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.696520][ T5341] ? clear_bhb_loop+0x60/0xb0
[ 74.698574][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.701179][ T5341] RIP: 0033:0x7ff49c38e929
[ 74.702963][ T5341] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 74.711010][ T5341] RSP: 002b:00007ff49d252038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 74.714836][ T5341] RAX: ffffffffffffffda RBX: 00007ff49c5b6080 RCX: 00007ff49c38e929
[ 74.718341][ T5341] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000003
[ 74.722035][ T5341] RBP: 00007ff49c410b39 R08: 0000000000000000 R09: 0000000000000000
[ 74.725492][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 74.728945][ T5341] R13: 0000000000000001 R14: 00007ff49c5b6080 R15: 00007ffc7f4b4098
[ 74.732529][ T5341]
[ 74.734157][ T5341] Kernel Offset: disabled
[ 74.735935][ T5341] Rebooting in 86400 seconds..