Warning: Permanently added '10.128.0.234' (ECDSA) to the list of known hosts. syzkaller login: [ 43.126824] audit: type=1400 audit(1600647678.752:8): avc: denied { execmem } for pid=6477 comm="syz-executor836" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 43.153559] IPVS: ftp: loaded support on port[0] = 21 [ 43.253633] chnl_net:caif_netlink_parms(): no params data found [ 43.332371] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.340422] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.350062] device bridge_slave_0 entered promiscuous mode [ 43.358970] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.366713] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.374531] device bridge_slave_1 entered promiscuous mode [ 43.396345] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 43.409024] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 43.433068] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 43.441721] team0: Port device team_slave_0 added [ 43.449451] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 43.457520] team0: Port device team_slave_1 added [ 43.475990] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 43.482551] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 43.511031] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 43.524679] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 43.533380] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 43.564351] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 43.577256] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 43.586968] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 43.610631] device hsr_slave_0 entered promiscuous mode [ 43.617287] device hsr_slave_1 entered promiscuous mode [ 43.624577] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 43.633331] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 43.711598] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.718721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.726914] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.734464] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.772879] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 43.782024] 8021q: adding VLAN 0 to HW filter on device bond0 [ 43.793013] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 43.803412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.814151] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.822316] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.830507] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 43.846781] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 43.854320] 8021q: adding VLAN 0 to HW filter on device team0 [ 43.867842] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.876953] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.883747] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.896370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.905192] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.913001] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.930026] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 43.939735] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 43.952463] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 43.966163] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.979515] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.996612] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 44.004016] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 44.023359] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 44.033621] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 44.044350] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 44.057835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 44.074514] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 44.088023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.133987] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 44.142415] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 44.150978] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 44.161836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.170320] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.178149] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.188576] device veth0_vlan entered promiscuous mode [ 44.199055] device veth1_vlan entered promiscuous mode [ 44.205983] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 44.216800] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 44.229528] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 44.238111] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 44.246350] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 44.258259] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready [ 44.265811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.273600] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.285546] device veth0_macvtap entered promiscuous mode [ 44.292101] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 44.301610] device veth1_macvtap entered promiscuous mode [ 44.309862] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready [ 44.319232] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 44.329765] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 44.340518] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 44.348506] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 44.356447] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 44.364382] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 44.372263] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.381260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.396293] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 44.403698] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 44.412390] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.421234] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program [ 44.712214] ================================================================================ [ 44.721177] UBSAN: Undefined behaviour in net/sched/sch_api.c:561:7 [ 44.728050] shift exponent 129 is too large for 32-bit type 'int' [ 44.734545] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.146-syzkaller #0 [ 44.742056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.751799] Workqueue: ipv6_addrconf addrconf_dad_work [ 44.757277] Call Trace: [ 44.759986] dump_stack+0x22c/0x33e [ 44.763632] ubsan_epilogue+0xe/0x3a [ 44.767535] __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 [ 44.773851] ? check_preemption_disabled+0x41/0x2b0 [ 44.778885] __qdisc_calculate_pkt_len+0x3bb/0x570 [ 44.784059] __dev_queue_xmit+0x1372/0x2ec0 [ 44.788762] ? ctnetlink_conntrack_event+0xc82/0x1405 [ 44.794613] ? netdev_pick_tx+0x350/0x350 [ 44.799673] ? mark_held_locks+0xa6/0xf0 [ 44.804620] ? ip_finish_output2+0x1073/0x1640 [ 44.810433] ip_finish_output2+0xc04/0x1640 [ 44.815096] ? ip_reply_glue_bits+0xb0/0xb0 [ 44.819752] ? lock_downgrade+0x750/0x750 [ 44.824225] ip_finish_output+0x88e/0xd80 [ 44.828395] ip_output+0x203/0x650 [ 44.831948] ? ip_mc_output+0xff0/0xff0 [ 44.836169] ? ip_fragment.constprop.0+0x240/0x240 [ 44.841450] ? prandom_u32+0xa3/0x100 [ 44.845591] ip_local_out+0xaf/0x170 [ 44.849685] iptunnel_xmit+0x63e/0xa30 [ 44.853969] geneve_xmit+0xeb4/0x2a20 [ 44.858847] ? geneve_fill_metadata_dst+0xd00/0xd00 [ 44.864475] ? netif_skb_features+0x3f9/0xb20 [ 44.869154] dev_hard_start_xmit+0x1a8/0x960 [ 44.873763] __dev_queue_xmit+0x276a/0x2ec0 [ 44.878260] ? __neigh_create+0x1286/0x1d80 [ 44.882753] ? netdev_pick_tx+0x350/0x350 [ 44.887006] ? ip6_finish_output2+0x1184/0x2370 [ 44.891861] ? memcpy+0x35/0x50 [ 44.895632] neigh_resolve_output+0x55a/0x950 [ 44.900487] ip6_finish_output2+0x1184/0x2370 [ 44.905353] ? ip6_append_data+0x300/0x300 [ 44.909730] ? lock_downgrade+0x750/0x750 [ 44.914218] ? check_preemption_disabled+0x41/0x2b0 [ 44.919443] ip6_finish_output+0x610/0xcc0 [ 44.924301] ip6_output+0x205/0x7c0 [ 44.928090] ? ip6_finish_output+0xcc0/0xcc0 [ 44.932656] ? ip6_fragment+0x3390/0x3390 [ 44.936817] ? check_preemption_disabled+0x41/0x2b0 [ 44.943338] ndisc_send_skb+0xa6b/0x1860 [ 44.947616] ? pndisc_constructor+0x250/0x250 [ 44.952196] ? __kmalloc_node_track_caller+0x38/0x70 [ 44.957438] ? do_ipv6_setsockopt.constprop.0.cold+0x8c/0x8c [ 44.963242] ? __alloc_skb+0x36d/0x580 [ 44.967193] ? skb_set_owner_w+0x21f/0x370 [ 44.971430] ndisc_send_ns+0x51d/0x840 [ 44.975572] ? addrconf_dad_work+0xab2/0x1130 [ 44.980374] ? pndisc_redo+0x20/0x20 [ 44.984091] ? mark_held_locks+0xa6/0xf0 [ 44.988195] ? addrconf_dad_work+0x677/0x1130 [ 44.992849] ? __local_bh_enable_ip+0x159/0x2a0 [ 44.997684] addrconf_dad_work+0xb78/0x1130 [ 45.002121] ? addrconf_dad_completed+0xb60/0xb60 [ 45.006975] process_one_work+0x796/0x14e0 [ 45.011589] ? init_w