new mount options do not match the existing superblock, will be ignored
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38
shift exponent -246 is negative
CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline]
RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025
Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef
RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913
RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68
RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000
R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000
rcu_read_lock include/linux/rcupdate.h:628 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline]
batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730
process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:88:23
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
est_timer.cold+0xd6/0x126 net/core/gen_estimator.c:88
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline]
RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025
Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef
RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913
RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68
RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000
netlink: 48 bytes leftover after parsing attributes in process `syz-executor.3'.
R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000
rcu_read_lock include/linux/rcupdate.h:628 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline]
batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730
process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46
shift exponent -246 is negative
CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline]
RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025
Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef
RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913
RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68
RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000
R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000
rcu_read_lock include/linux/rcupdate.h:628 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline]
batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730
process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:91:22
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
est_timer.cold+0x5b/0x126 net/core/gen_estimator.c:91
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline]
RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025
Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef
RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913
RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68
RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000
R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000
rcu_read_lock include/linux/rcupdate.h:628 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline]
batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730
process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
new mount options do not match the existing superblock, will be ignored
EXT4-fs (loop3): Unrecognized mount option "˙˙˙˙˙˙˙˙" or missing value
tmpfs: Bad mount option
ėge
EXT4-fs (loop3): Unrecognized mount option "˙˙˙˙˙˙˙˙" or missing value
new mount options do not match the existing superblock, will be ignored
new mount options do not match the existing superblock, will be ignored
tmpfs: Bad mount option
ėge
new mount options do not match the existing superblock, will be ignored
new mount options do not match the existing superblock, will be ignored
audit: type=1400 audit(1601371529.310:31): avc: denied { name_bind } for pid=9633 comm="syz-executor.3" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1
netlink: 256 bytes leftover after parsing attributes in process `syz-executor.0'.
audit: type=1400 audit(1601371529.350:32): avc: denied { node_bind } for pid=9633 comm="syz-executor.3" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=dccp_socket permissive=1
netlink: 25 bytes leftover after parsing attributes in process `syz-executor.0'.
new mount options do not match the existing superblock, will be ignored
audit: type=1400 audit(1601371529.360:33): avc: denied { name_connect } for pid=9633 comm="syz-executor.3" dest=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1
IPv6: ADDRCONF(NETDEV_UP): veth3: link is not ready
team0: Port device veth3 added
syz-executor.0 (9646) used greatest stack depth: 22624 bytes left
new mount options do not match the existing superblock, will be ignored
new mount options do not match the existing superblock, will be ignored
overlayfs: upper fs does not support tmpfile.
overlayfs: failed to resolve './file0': -2
overlayfs: cleanup of 'file1/work' failed (-13)
netlink: 'syz-executor.2': attribute type 1 has an invalid length.
overlayfs: failed to create directory ./file1/work (errno: 17); mounting read-only
new mount options do not match the existing superblock, will be ignored
overlayfs: failed to resolve './file0': -2
IPv6: ADDRCONF(NETDEV_UP): bond2: link is not ready
8021q: adding VLAN 0 to HW filter on device bond2
new mount options do not match the existing superblock, will be ignored
bond2: Enslaving veth7 as an active interface with a down link
device bridge1 entered promiscuous mode
device bridge1 left promiscuous mode
sctp: [Deprecated]: syz-executor.2 (pid 9735) Use of int in max_burst socket option deprecated.
Use struct sctp_assoc_value instead
bond2: making interface vlan2 the new active one
device bridge1 entered promiscuous mode
device vlan2 entered promiscuous mode
bond2: Enslaving vlan2 as an active interface with an up link
IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready
netlink: 'syz-executor.2': attribute type 1 has an invalid length.
bond2: Enslaving veth9 as an active interface with a down link
sctp: [Deprecated]: syz-executor.2 (pid 9735) Use of int in max_burst socket option deprecated.
Use struct sctp_assoc_value instead
new mount options do not match the existing superblock, will be ignored
bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0)
FAT-fs (loop3): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
new mount options do not match the existing superblock, will be ignored
new mount options do not match the existing superblock, will be ignored
netlink: 'syz-executor.4': attribute type 5 has an invalid length.
new mount options do not match the existing superblock, will be ignored
sctp: [Deprecated]: syz-executor.1 (pid 9847) Use of int in max_burst socket option.
Use struct sctp_assoc_value instead
new mount options do not match the existing superblock, will be ignored
loop0: p1 p2 p3 p4
loop0: partition table partially beyond EOD, truncated
loop0: p1 size 11290111 extends beyond EOD, truncated
new mount options do not match the existing superblock, will be ignored
loop0: p2 size 100663296 extends beyond EOD, truncated
loop0: p3 start 4293001441 is beyond EOD, truncated
loop0: p4 size 3657465856 extends beyond EOD, truncated
new mount options do not match the existing superblock, will be ignored
loop0: p1 p2 p3 p4
loop0: partition table partially beyond EOD, truncated
loop0: p1 size 11290111 extends beyond EOD, truncated
loop0: p2 size 100663296 extends beyond EOD, truncated
loop0: p3 start 4293001441 is beyond EOD, truncated
loop0: p4 size 3657465856 extends beyond EOD, truncated
loop0: p1 p2 p3 p4
loop0: partition table partially beyond EOD, truncated
loop0: p1 size 11290111 extends beyond EOD, truncated
loop0: p2 size 100663296 extends beyond EOD, truncated
loop0: p3 start 4293001441 is beyond EOD, truncated
loop0: p4 size 3657465856 extends beyond EOD, truncated
audit: type=1804 audit(1601371532.290:34): pid=9959 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir008097733/syzkaller.4vsJCi/71/bus" dev="sda1" ino=15994 res=1
Dev loop5: unable to read RDB block 1
loop5: AHDI p2 p3
loop5: partition table partially beyond EOD, truncated
loop5: p2 start 3462489443 is beyond EOD, truncated
netlink: 168 bytes leftover after parsing attributes in process `syz-executor.0'.
netlink: 168 bytes leftover after parsing attributes in process `syz-executor.0'.
Dev loop5: unable to read RDB block 1
loop5: AHDI p2 p3
loop5: partition table partially beyond EOD, truncated
loop5: p2 start 3462489443 is beyond EOD, truncated
Dev loop5: unable to read RDB block 1
loop5: AHDI p2 p3
loop5: partition table partially beyond EOD, truncated
loop5: p2 start 3462489443 is beyond EOD, truncated
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
x_tables: eb_tables: ip.0 match: invalid size 32 (kernel) != (user) 28
kvm [10049]: vcpu0, guest rIP: 0x135 Hyper-V unhandled rdmsr: 0x40000024
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000001e
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000050
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000007c
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000001f
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000002a
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000000c
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000030
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000047
kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000066
IPVS: ftp: loaded support on port[0] = 21
device wlan1 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
device wlan1 left promiscuous mode
IPVS: ftp: loaded support on port[0] = 21
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=104 sclass=netlink_route_socket pid=10308 comm=syz-executor.1