[v6.6] UBSAN: shift-out-of-bounds in xfrm_selector_match

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: da47cbc25466 Linux 6.6.144
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17c0a899580000
kernel config: https://syzkaller.appspot.com/x/.config?x=938110aa66424b94
dashboard link: https://syzkaller.appspot.com/bug?extid=058d02c05e27def58c58
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a9e82134d7e6/disk-da47cbc2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/296a86743157/vmlinux-da47cbc2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c5adb532f254/bzImage-da47cbc2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+058d02...@syzkaller.appspotmail.com

================================================================================
UBSAN: shift-out-of-bounds in ./include/net/xfrm.h:863:23
shift exponent -128 is negative
CPU: 0 PID: 10993 Comm: syz.6.1097 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
ubsan_epilogue+0xa/0x30 lib/ubsan.c:217
__ubsan_handle_shift_out_of_bounds+0x368/0x3f0 lib/ubsan.c:387
addr4_match include/net/xfrm.h:863 [inline]
__xfrm4_selector_match net/xfrm/xfrm_policy.c:203 [inline]
xfrm_selector_match+0xd57/0x1140 net/xfrm/xfrm_policy.c:228
__xfrm_policy_check+0x7f7/0x3170 net/xfrm/xfrm_policy.c:3660
__xfrm_policy_check2 include/net/xfrm.h:1195 [inline]
xfrm_policy_check+0x479/0x880 include/net/xfrm.h:1200
xfrm4_policy_check include/net/xfrm.h:1205 [inline]
vti_input+0x163/0x280 net/ipv4/ip_vti.c:58
xfrm4_esp_rcv+0xa1/0x210 net/ipv4/xfrm4_protocol.c:104
ip_protocol_deliver_rcu+0x20a/0x3f0 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x2c3/0x510 net/ipv4/ip_input.c:233
NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304
NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304
__netif_receive_skb_one_core net/core/dev.c:5646 [inline]
__netif_receive_skb+0xcc/0x290 net/core/dev.c:5760
process_backlog+0x380/0x710 net/core/dev.c:6088
__napi_poll+0xbb/0x460 net/core/dev.c:6650
napi_poll net/core/dev.c:6717 [inline]
net_rx_action+0x65f/0xcc0 net/core/dev.c:6853
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
do_softirq+0xfa/0x1a0 kernel/softirq.c:479
</IRQ>
<TASK>
__local_bh_enable_ip+0x184/0x1c0 kernel/softirq.c:406
local_bh_enable include/linux/bottom_half.h:33 [inline]
netif_rx net/core/dev.c:5232 [inline]
dev_loopback_xmit+0x2e6/0x430 net/core/dev.c:3996
NF_HOOK include/linux/netfilter.h:304 [inline]
ip_mc_output+0x254/0x570 net/ipv4/ip_output.c:399
dst_output include/net/dst.h:467 [inline]
xfrm_output_resume+0x5847/0x5b90 net/xfrm/xfrm_output.c:596
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
xfrm4_output+0x1cb/0x520 net/ipv4/xfrm4_output.c:33
dst_output include/net/dst.h:467 [inline]
ip_local_out net/ipv4/ip_output.c:129 [inline]
ip_send_skb+0x12f/0x1d0 net/ipv4/ip_output.c:1500
udp_send_skb+0xa7d/0x1440 net/ipv4/udp.c:984
udp_sendmsg+0x1b23/0x23d0 net/ipv4/udp.c:1270
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
sock_write_iter+0x2dc/0x420 net/socket.c:1161
call_write_iter include/linux/fs.h:2018 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x474/0x9a0 fs/read_write.c:584
ksys_write+0x151/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f93a0f9de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f93a1edb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f93a1225fa0 RCX: 00007f93a0f9de99
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f93a1033eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f93a1226038 R14: 00007f93a1225fa0 R15: 00007ffe12060cd8
</TASK>
================================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup