Re: [syzbot] [lvs?] UBSAN: shift-out-of-bounds in ip_vs_rht_desired_size

[Julian Anastasov <ja@ssi.bg>]

	Hello,

On Mon, 27 Apr 2026, syzbot wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e728258debd5 Merge tag 'net-7.1-rc1' of git://git.kernel.o..
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=169022ce580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ca77bfc4078c8193
> dashboard link: https://syzkaller.appspot.com/bug?extid=217f1db9c791e27fe54a
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/24195bde5d1d/disk-e728258d.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/78131d1b0e14/vmlinux-e728258d.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/836d0dd78c10/bzImage-e728258d.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+217f1db9c791e27fe54a@syzkaller.appspotmail.com
> 
> wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)
> ------------[ cut here ]------------
> UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13
> shift exponent 64 is too large for 64-bit type 'unsigned long'
> CPU: 1 UID: 0 PID: 77 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
> Workqueue: events_unbound conn_resize_work_handler
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>  ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
>  __ubsan_handle_shift_out_of_bounds+0x385/0x410 lib/ubsan.c:494
>  __roundup_pow_of_two include/linux/log2.h:57 [inline]

	Looks like roundup_pow_of_two() is called for 0.
Will provide fix for this...

>  ip_vs_rht_desired_size+0x2cf/0x410 net/netfilter/ipvs/ip_vs_core.c:240
>  ip_vs_conn_desired_size net/netfilter/ipvs/ip_vs_conn.c:765 [inline]
>  conn_resize_work_handler+0x1b6/0x14c0 net/netfilter/ipvs/ip_vs_conn.c:822
>  process_one_work kernel/workqueue.c:3302 [inline]
>  process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385
>  worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466
>  kthread+0x388/0x470 kernel/kthread.c:436
>  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
> ---[ end trace ]---
> Kernel panic - not syncing: UBSAN: panic_on_warn set ...
> CPU: 1 UID: 0 PID: 77 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
> Workqueue: events_unbound conn_resize_work_handler
> Call Trace:
>  <TASK>
>  vpanic+0x56c/0xa60 kernel/panic.c:650
>  panic+0xc5/0xd0 kernel/panic.c:787
>  check_panic_on_warn+0x89/0xb0 kernel/panic.c:524
>  __ubsan_handle_shift_out_of_bounds+0x385/0x410 lib/ubsan.c:494
>  __roundup_pow_of_two include/linux/log2.h:57 [inline]
>  ip_vs_rht_desired_size+0x2cf/0x410 net/netfilter/ipvs/ip_vs_core.c:240
>  ip_vs_conn_desired_size net/netfilter/ipvs/ip_vs_conn.c:765 [inline]
>  conn_resize_work_handler+0x1b6/0x14c0 net/netfilter/ipvs/ip_vs_conn.c:822
>  process_one_work kernel/workqueue.c:3302 [inline]
>  process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385
>  worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466
>  kthread+0x388/0x470 kernel/kthread.c:436
>  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
> Kernel Offset: disabled
> Rebooting in 86400 seconds..

Regards

--
Julian Anastasov <ja@ssi.bg>