audit: type=1804 audit(1601436774.982:22): pid=8827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/27/bus" dev="sda1" ino=15844 res=1
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38
shift exponent -23 is negative
CPU: 1 PID: 240 Comm: kworker/u4:3 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:lock_acquire+0x1f5/0x3f0 kernel/locking/lockdep.c:3911
Code: e8 03 80 3c 10 00 0f 85 dd 01 00 00 48 83 3d c9 9d 0b 08 00 0f 84 4e 01 00 00 48 8b 7c 24 08 57 9d 0f 1f 44 00 00 48 83 c4 18 <5b> 5d 41 5c 41 5d 41 5e 41 5f c3 65 8b 05 29 95 a9 7e 83 f8 3f 0f
RSP: 0018:ffff8880a8ef7c78 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c7135 RBX: ffff8880a8ee2240 RCX: 00000000360de534
RDX: dffffc0000000000 RSI: ffff8880a8ee2ac8 RDI: 0000000000000286
RBP: ffffffff897351e0 R08: 0000000091b18ccd R09: 0000000000000000
R10: 0000000000000050 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:242 [inline]
rcu_read_lock include/linux/rcupdate.h:627 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline]
batadv_nc_worker+0x12d/0xd90 net/batman-adv/network-coding.c:730
process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46
shift exponent -23 is negative
CPU: 1 PID: 240 Comm: kworker/u4:3 Not tainted 4.19.148-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:lock_acquire+0x1f5/0x3f0 kernel/locking/lockdep.c:3911
Code: e8 03 80 3c 10 00 0f 85 dd 01 00 00 48 83 3d c9 9d 0b 08 00 0f 84 4e 01 00 00 48 8b 7c 24 08 57 9d 0f 1f 44 00 00 48 83 c4 18 <5b> 5d 41 5c 41 5d 41 5e 41 5f c3 65 8b 05 29 95 a9 7e 83 f8 3f 0f
RSP: 0018:ffff8880a8ef7c78 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c7135 RBX: ffff8880a8ee2240 RCX: 00000000360de534
RDX: dffffc0000000000 RSI: ffff8880a8ee2ac8 RDI: 0000000000000286
RBP: ffffffff897351e0 R08: 0000000091b18ccd R09: 0000000000000000
R10: 0000000000000050 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:242 [inline]
rcu_read_lock include/linux/rcupdate.h:627 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:419 [inline]
batadv_nc_worker+0x12d/0xd90 net/batman-adv/network-coding.c:730
process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
XFS (loop1): Invalid superblock magic number
audit: type=1804 audit(1601436774.982:23): pid=8827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/27/bus" dev="sda1" ino=15844 res=1
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
IPVS: ftp: loaded support on port[0] = 21
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
IPVS: ftp: loaded support on port[0] = 21
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
netlink: 'syz-executor.1': attribute type 1 has an invalid length.
IPv6: ADDRCONF(NETDEV_UP): bond1: link is not ready
8021q: adding VLAN 0 to HW filter on device bond1
netlink: 'syz-executor.1': attribute type 1 has an invalid length.
8021q: adding VLAN 0 to HW filter on device macvlan2
**********************************************************
bond2: Enslaving macvlan2 as an active interface with a down link
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **
bond1: making interface bridge1 the new active one
device bridge1 entered promiscuous mode
** **
bond1: Enslaving bridge1 as an active interface with an up link
IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready
netlink: 'syz-executor.1': attribute type 1 has an invalid length.
** trace_printk() being used. Allocating extra memory. **
netlink: 'syz-executor.1': attribute type 1 has an invalid length.
** **
** This means that this is a DEBUG kernel and it is **
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
** unsafe for production use. **
** **
** If you see this message and you are not debugging **
kvm: pic: non byte read
** the kernel, report this immediately to your vendor! **
kvm: pic: non byte read
kvm: pic: non byte read
** **
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
kvm: pic: non byte read
** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **
kvm: pic: non byte read
kvm: pic: non byte read
**********************************************************
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
kvm: pic: non byte read
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
netlink: 'syz-executor.0': attribute type 5 has an invalid length.
IPVS: ftp: loaded support on port[0] = 21
audit: type=1804 audit(1601436781.992:24): pid=9301 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/39/bus" dev="sda1" ino=15892 res=1
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters.
audit: type=1804 audit(1601436782.192:25): pid=9326 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/39/bus" dev="sda1" ino=15892 res=1
IPVS: ftp: loaded support on port[0] = 21
audit: type=1804 audit(1601436782.272:26): pid=9290 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/39/bus" dev="sda1" ino=15892 res=1
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters.
audit: type=1804 audit(1601436782.282:27): pid=9290 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/39/bus" dev="sda1" ino=15892 res=1
audit: type=1804 audit(1601436782.592:28): pid=9354 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/40/bus" dev="sda1" ino=15892 res=1
audit: type=1804 audit(1601436782.682:29): pid=9366 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir641766040/syzkaller.WGGVWU/40/bus" dev="sda1" ino=15892 res=1
validate_nla: 7 callbacks suppressed
netlink: 'syz-executor.0': attribute type 5 has an invalid length.