new mount options do not match the existing superblock, will be ignored ================================================================================ UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38 shift exponent -246 is negative CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline] RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025 Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913 RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68 RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000 R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000 rcu_read_lock include/linux/rcupdate.h:628 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline] batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ================================================================================ ================================================================================ UBSAN: Undefined behaviour in net/core/gen_estimator.c:88:23 shift exponent 255 is too large for 64-bit type 'long long unsigned int' CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 est_timer.cold+0xd6/0x126 net/core/gen_estimator.c:88 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline] RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025 Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913 RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68 RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000 netlink: 48 bytes leftover after parsing attributes in process `syz-executor.3'. R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000 rcu_read_lock include/linux/rcupdate.h:628 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline] batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ================================================================================ ================================================================================ UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46 shift exponent -246 is negative CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline] RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025 Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913 RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68 RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000 R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000 rcu_read_lock include/linux/rcupdate.h:628 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline] batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ================================================================================ ================================================================================ UBSAN: Undefined behaviour in net/core/gen_estimator.c:91:22 shift exponent 255 is too large for 64-bit type 'long long unsigned int' CPU: 1 PID: 6443 Comm: kworker/u4:5 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 est_timer.cold+0x5b/0x126 net/core/gen_estimator.c:91 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:348 [inline] RIP: 0010:rcu_is_watching+0x61/0x100 kernel/rcu/tree.c:1025 Code: d0 48 3d 00 02 00 00 0f 87 8b 00 00 00 48 8d 3c ed 60 cf 2c 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 65 48 03 1c ed 60 cf 2c 89 be 04 00 00 00 48 8d 6b 10 48 89 ef RSP: 0018:ffff8880a7d37ca0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 00000000000239c0 RCX: ffffffff83a27913 RDX: 1ffffffff12599ed RSI: ffffffff892ccf68 RDI: ffffffff892ccf68 RBP: 0000000000000001 R08: 00000000456b6938 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000002 R12: 0000000000000000 R13: dffffc0000000000 R14: 00000000000002e7 R15: 0000000000000000 rcu_read_lock include/linux/rcupdate.h:628 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline] batadv_nc_worker+0x929/0xd90 net/batman-adv/network-coding.c:730 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ================================================================================ new mount options do not match the existing superblock, will be ignored EXT4-fs (loop3): Unrecognized mount option "˙˙˙˙˙˙˙˙" or missing value tmpfs: Bad mount option ėge EXT4-fs (loop3): Unrecognized mount option "˙˙˙˙˙˙˙˙" or missing value new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored tmpfs: Bad mount option ėge new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored audit: type=1400 audit(1601371529.310:31): avc: denied { name_bind } for pid=9633 comm="syz-executor.3" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 netlink: 256 bytes leftover after parsing attributes in process `syz-executor.0'. audit: type=1400 audit(1601371529.350:32): avc: denied { node_bind } for pid=9633 comm="syz-executor.3" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=dccp_socket permissive=1 netlink: 25 bytes leftover after parsing attributes in process `syz-executor.0'. new mount options do not match the existing superblock, will be ignored audit: type=1400 audit(1601371529.360:33): avc: denied { name_connect } for pid=9633 comm="syz-executor.3" dest=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 IPv6: ADDRCONF(NETDEV_UP): veth3: link is not ready team0: Port device veth3 added syz-executor.0 (9646) used greatest stack depth: 22624 bytes left new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored overlayfs: upper fs does not support tmpfile. overlayfs: failed to resolve './file0': -2 overlayfs: cleanup of 'file1/work' failed (-13) netlink: 'syz-executor.2': attribute type 1 has an invalid length. overlayfs: failed to create directory ./file1/work (errno: 17); mounting read-only new mount options do not match the existing superblock, will be ignored overlayfs: failed to resolve './file0': -2 IPv6: ADDRCONF(NETDEV_UP): bond2: link is not ready 8021q: adding VLAN 0 to HW filter on device bond2 new mount options do not match the existing superblock, will be ignored bond2: Enslaving veth7 as an active interface with a down link device bridge1 entered promiscuous mode device bridge1 left promiscuous mode sctp: [Deprecated]: syz-executor.2 (pid 9735) Use of int in max_burst socket option deprecated. Use struct sctp_assoc_value instead bond2: making interface vlan2 the new active one device bridge1 entered promiscuous mode device vlan2 entered promiscuous mode bond2: Enslaving vlan2 as an active interface with an up link IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready netlink: 'syz-executor.2': attribute type 1 has an invalid length. bond2: Enslaving veth9 as an active interface with a down link sctp: [Deprecated]: syz-executor.2 (pid 9735) Use of int in max_burst socket option deprecated. Use struct sctp_assoc_value instead new mount options do not match the existing superblock, will be ignored bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) FAT-fs (loop3): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored netlink: 'syz-executor.4': attribute type 5 has an invalid length. new mount options do not match the existing superblock, will be ignored sctp: [Deprecated]: syz-executor.1 (pid 9847) Use of int in max_burst socket option. Use struct sctp_assoc_value instead new mount options do not match the existing superblock, will be ignored loop0: p1 p2 p3 p4 loop0: partition table partially beyond EOD, truncated loop0: p1 size 11290111 extends beyond EOD, truncated new mount options do not match the existing superblock, will be ignored loop0: p2 size 100663296 extends beyond EOD, truncated loop0: p3 start 4293001441 is beyond EOD, truncated loop0: p4 size 3657465856 extends beyond EOD, truncated new mount options do not match the existing superblock, will be ignored loop0: p1 p2 p3 p4 loop0: partition table partially beyond EOD, truncated loop0: p1 size 11290111 extends beyond EOD, truncated loop0: p2 size 100663296 extends beyond EOD, truncated loop0: p3 start 4293001441 is beyond EOD, truncated loop0: p4 size 3657465856 extends beyond EOD, truncated loop0: p1 p2 p3 p4 loop0: partition table partially beyond EOD, truncated loop0: p1 size 11290111 extends beyond EOD, truncated loop0: p2 size 100663296 extends beyond EOD, truncated loop0: p3 start 4293001441 is beyond EOD, truncated loop0: p4 size 3657465856 extends beyond EOD, truncated audit: type=1804 audit(1601371532.290:34): pid=9959 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir008097733/syzkaller.4vsJCi/71/bus" dev="sda1" ino=15994 res=1 Dev loop5: unable to read RDB block 1 loop5: AHDI p2 p3 loop5: partition table partially beyond EOD, truncated loop5: p2 start 3462489443 is beyond EOD, truncated netlink: 168 bytes leftover after parsing attributes in process `syz-executor.0'. netlink: 168 bytes leftover after parsing attributes in process `syz-executor.0'. Dev loop5: unable to read RDB block 1 loop5: AHDI p2 p3 loop5: partition table partially beyond EOD, truncated loop5: p2 start 3462489443 is beyond EOD, truncated Dev loop5: unable to read RDB block 1 loop5: AHDI p2 p3 loop5: partition table partially beyond EOD, truncated loop5: p2 start 3462489443 is beyond EOD, truncated A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. x_tables: eb_tables: ip.0 match: invalid size 32 (kernel) != (user) 28 kvm [10049]: vcpu0, guest rIP: 0x135 Hyper-V unhandled rdmsr: 0x40000024 kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000001e A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000050 kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000007c kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000001f kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000002a kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x4000000c kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000030 kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000047 kvm [10049]: vcpu0, guest rIP: 0x145 Hyper-V unhandled rdmsr: 0x40000066 IPVS: ftp: loaded support on port[0] = 21 device wlan1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready device wlan1 left promiscuous mode IPVS: ftp: loaded support on port[0] = 21 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=104 sclass=netlink_route_socket pid=10308 comm=syz-executor.1