audit: type=1804 audit(1601408282.273:135): pid=25874 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir938967919/syzkaller.TiNqmh/13/memory.events" dev="sda1" ino=16227 res=1
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38
shift exponent -246 is negative
CPU: 1 PID: 6506 Comm: syz-executor.3 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d 6b a4 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff88808261fc20 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c7135 RBX: ffff888082610600 RCX: 1ffff110104c21e0
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000286
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000004 R12: 1ffff110104c3f87
R13: f1c187b4bef5fcf5 R14: ffff888082610600 R15: 0000000000000004
 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:176
 spin_unlock include/linux/spinlock.h:369 [inline]
 d_walk+0x551/0xa40 fs/dcache.c:1329
 shrink_dcache_parent+0x92/0x120 fs/dcache.c:1483
 vfs_rmdir.part.0+0x1c9/0x430 fs/namei.c:3886
 vfs_rmdir fs/namei.c:3865 [inline]
 do_rmdir+0x3af/0x420 fs/namei.c:3943
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45db07
Code: 00 66 90 b8 57 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc9d46ad88 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045db07
RDX: 0000000000000000 RSI: 000000000074c678 RDI: 00007ffc9d46bec0
RBP: 00000000000006e8 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000207 R12: 00007ffc9d46bec0
R13: 00000000021a5a60 R14: 0000000000000000 R15: 00007ffc9d46bec0
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:88:23
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 6506 Comm: syz-executor.3 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0xd6/0x126 net/core/gen_estimator.c:88
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d 6b a4 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff88808261fc20 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c7135 RBX: ffff888082610600 RCX: 1ffff110104c21e0
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000286
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000004 R12: 1ffff110104c3f87
R13: f1c187b4bef5fcf5 R14: ffff888082610600 R15: 0000000000000004
 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:176
 spin_unlock include/linux/spinlock.h:369 [inline]
 d_walk+0x551/0xa40 fs/dcache.c:1329
 shrink_dcache_parent+0x92/0x120 fs/dcache.c:1483
 vfs_rmdir.part.0+0x1c9/0x430 fs/namei.c:3886
 vfs_rmdir fs/namei.c:3865 [inline]
 do_rmdir+0x3af/0x420 fs/namei.c:3943
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45db07
Code: 00 66 90 b8 57 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc9d46ad88 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045db07
RDX: 0000000000000000 RSI: 000000000074c678 RDI: 00007ffc9d46bec0
RBP: 00000000000006e8 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000207 R12: 00007ffc9d46bec0
R13: 00000000021a5a60 R14: 0000000000000000 R15: 00007ffc9d46bec0
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46
shift exponent -246 is negative
CPU: 1 PID: 6506 Comm: syz-executor.3 Not tainted 4.19.148-syzkaller #0
audit: type=1804 audit(1601408282.353:136): pid=25877 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir938967919/syzkaller.TiNqmh/13/memory.events" dev="sda1" ino=16227 res=1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d 6b a4 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff88808261fc20 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c7135 RBX: ffff888082610600 RCX: 1ffff110104c21e0
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000286
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000004 R12: 1ffff110104c3f87
R13: f1c187b4bef5fcf5 R14: ffff888082610600 R15: 0000000000000004
 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:176
 spin_unlock include/linux/spinlock.h:369 [inline]
 d_walk+0x551/0xa40 fs/dcache.c:1329
 shrink_dcache_parent+0x92/0x120 fs/dcache.c:1483
 vfs_rmdir.part.0+0x1c9/0x430 fs/namei.c:3886
 vfs_rmdir fs/namei.c:3865 [inline]
 do_rmdir+0x3af/0x420 fs/namei.c:3943
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.4'.
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45db07
Code: 00 66 90 b8 57 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc9d46ad88 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045db07
RDX: 0000000000000000 RSI: 000000000074c678 RDI: 00007ffc9d46bec0
RBP: 00000000000006e8 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000207 R12: 00007ffc9d46bec0
R13: 00000000021a5a60 R14: 0000000000000000 R15: 00007ffc9d46bec0
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:91:22
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 6506 Comm: syz-executor.3 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x5b/0x126 net/core/gen_estimator.c:91
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d 6b a4 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff88808261fc20 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c7135 RBX: ffff888082610600 RCX: 1ffff110104c21e0
RDX: dffffc0000000000 RSI: 0000000000000004 RDI: 0000000000000286
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000004 R12: 1ffff110104c3f87
R13: f1c187b4bef5fcf5 R14: ffff888082610600 R15: 0000000000000004
 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline]
 _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:176
 spin_unlock include/linux/spinlock.h:369 [inline]
 d_walk+0x551/0xa40 fs/dcache.c:1329
 shrink_dcache_parent+0x92/0x120 fs/dcache.c:1483
 vfs_rmdir.part.0+0x1c9/0x430 fs/namei.c:3886
 vfs_rmdir fs/namei.c:3865 [inline]
 do_rmdir+0x3af/0x420 fs/namei.c:3943
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45db07
Code: 00 66 90 b8 57 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 8d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 6d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc9d46ad88 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 000000000045db07
RDX: 0000000000000000 RSI: 000000000074c678 RDI: 00007ffc9d46bec0
audit: type=1804 audit(1601408282.393:137): pid=25877 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir938967919/syzkaller.TiNqmh/13/memory.events" dev="sda1" ino=16227 res=1
RBP: 00000000000006e8 R08: 0000000000000000 R09: 0000000000000001
R10: 000000000000000a R11: 0000000000000207 R12: 00007ffc9d46bec0
R13: 00000000021a5a60 R14: 0000000000000000 R15: 00007ffc9d46bec0
================================================================================
binder: 25868:25876 ioctl 5429 0 returned -22
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.4'.
audit: type=1804 audit(1601408282.443:138): pid=25880 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir938967919/syzkaller.TiNqmh/13/memory.events" dev="sda1" ino=16227 res=1
audit: type=1804 audit(1601408284.623:139): pid=25929 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir798623656/syzkaller.J6XkxF/489/bus/file0" dev="sda1" ino=15732 res=1
overlayfs: failed to resolve './bus': -2
overlayfs: './file0' not a directory
audit: type=1804 audit(1601408284.753:140): pid=25929 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir798623656/syzkaller.J6XkxF/489/bus/bus/file0" dev="sda1" ino=16804 res=1
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 25964:25967 ioctl c0306201 20000200 returned -22
audit: type=1800 audit(1601408285.193:141): pid=25969 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16898 res=0
audit: type=1804 audit(1601408285.203:142): pid=25969 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir938967919/syzkaller.TiNqmh/17/file0" dev="sda1" ino=16898 res=1
audit: type=1800 audit(1601408285.203:143): pid=25969 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16898 res=0
audit: type=1804 audit(1601408285.203:144): pid=25969 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir938967919/syzkaller.TiNqmh/17/file0" dev="sda1" ino=16898 res=1
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 25978:25980 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 25989:25994 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26011:26015 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26025:26028 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26045:26050 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26057:26067 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26076:26084 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26096:26102 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26115:26118 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26135:26140 ioctl c0306201 20000200 returned -22
IPv6: NLM_F_CREATE should be specified when creating new route
netlink: 164 bytes leftover after parsing attributes in process `syz-executor.3'.
binder: BC_ATTEMPT_ACQUIRE not supported

binder: 26151:26156 ioctl c0306201 20000200 returned -22
**********************************************************
**   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
**                                                      **
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26173:26175 ioctl c0306201 20000200 returned -22
** trace_printk() being used. Allocating extra memory.  **
**                                                      **
** This means that this is a DEBUG kernel and it is     **
** unsafe for production use.                           **
**                                                      **
** If you see this message and you are not debugging    **
** the kernel, report this immediately to your vendor!  **
**                                                      **
**   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
**********************************************************
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26227:26236 ioctl c0306201 20000200 returned -22
9pnet: p9_fd_create_tcp (26243): problem connecting socket to 127.0.0.1
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26253:26261 ioctl c0306201 20000200 returned -22
binder: BC_ATTEMPT_ACQUIRE not supported
binder: 26281:26287 ioctl c0306201 20000200 returned -22
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
binder: BC_ATTEMPT_ACQUIRE not supported