================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38
shift exponent -246 is negative
CPU: 0 PID: 30418 Comm: syz-executor.0 Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:ns_capable+0x2/0x20 kernel/capability.c:397
Code: 89 e8 5b 5d 41 5c 41 5d c3 e8 ba fa 65 00 eb dd e8 43 fb 65 00 e9 63 ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 41 54 <41> 89 f4 55 48 89 fd e8 22 ac 2c 00 44 89 e6 48 89 ef 5d 41 5c 31
RSP: 0018:ffff888091197bb8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 0000000000000041 RCX: ffff888091197d80
RDX: 1ffff1101023c8b7 RSI: 000000000000000c RDI: ffffffff896ab700
RBP: 00007ffc7d555770 R08: 0000000000000001 R09: fffffffffffff000
R10: 0000000000000007 R11: 0000000000000000 R12: ffff88804af86180
R13: ffff888091197d80 R14: ffff88804af861b0 R15: ffff8880811e4540
 do_ip6t_get_ctl+0xdb/0x910 net/ipv6/netfilter/ip6_tables.c:1703
 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
 nf_getsockopt+0x72/0xd0 net/netfilter/nf_sockopt.c:122
 ipv6_getsockopt+0x1b6/0x260 net/ipv6/ipv6_sockglue.c:1388
 tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:3616
 __sys_getsockopt+0x135/0x210 net/socket.c:1938
 __do_sys_getsockopt net/socket.c:1949 [inline]
 __se_sys_getsockopt net/socket.c:1946 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:1946
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x46099a
Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca 88 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc7d5556e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffc7d555710 RCX: 000000000046099a
RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 000000000074bca0 R08: 00007ffc7d55570c R09: 0000000000004000
R10: 00007ffc7d555770 R11: 0000000000000212 R12: 00007ffc7d555770
R13: 0000000000000003 R14: 000000000074af20 R15: 0000000000000029
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:88:23
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 0 PID: 30418 Comm: syz-executor.0 Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0xd6/0x126 net/core/gen_estimator.c:88
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:ns_capable+0x2/0x20 kernel/capability.c:397
Code: 89 e8 5b 5d 41 5c 41 5d c3 e8 ba fa 65 00 eb dd e8 43 fb 65 00 e9 63 ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 41 54 <41> 89 f4 55 48 89 fd e8 22 ac 2c 00 44 89 e6 48 89 ef 5d 41 5c 31
RSP: 0018:ffff888091197bb8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 0000000000000041 RCX: ffff888091197d80
RDX: 1ffff1101023c8b7 RSI: 000000000000000c RDI: ffffffff896ab700
RBP: 00007ffc7d555770 R08: 0000000000000001 R09: fffffffffffff000
R10: 0000000000000007 R11: 0000000000000000 R12: ffff88804af86180
R13: ffff888091197d80 R14: ffff88804af861b0 R15: ffff8880811e4540
 do_ip6t_get_ctl+0xdb/0x910 net/ipv6/netfilter/ip6_tables.c:1703
 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
 nf_getsockopt+0x72/0xd0 net/netfilter/nf_sockopt.c:122
 ipv6_getsockopt+0x1b6/0x260 net/ipv6/ipv6_sockglue.c:1388
 tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:3616
 __sys_getsockopt+0x135/0x210 net/socket.c:1938
 __do_sys_getsockopt net/socket.c:1949 [inline]
 __se_sys_getsockopt net/socket.c:1946 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:1946
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x46099a
Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca 88 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc7d5556e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffc7d555710 RCX: 000000000046099a
RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 000000000074bca0 R08: 00007ffc7d55570c R09: 0000000000004000
R10: 00007ffc7d555770 R11: 0000000000000212 R12: 00007ffc7d555770
R13: 0000000000000003 R14: 000000000074af20 R15: 0000000000000029
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46
shift exponent -246 is negative
CPU: 0 PID: 30418 Comm: syz-executor.0 Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:ns_capable+0x2/0x20 kernel/capability.c:397
Code: 89 e8 5b 5d 41 5c 41 5d c3 e8 ba fa 65 00 eb dd e8 43 fb 65 00 e9 63 ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 41 54 <41> 89 f4 55 48 89 fd e8 22 ac 2c 00 44 89 e6 48 89 ef 5d 41 5c 31
RSP: 0018:ffff888091197bb8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 0000000000000041 RCX: ffff888091197d80
RDX: 1ffff1101023c8b7 RSI: 000000000000000c RDI: ffffffff896ab700
RBP: 00007ffc7d555770 R08: 0000000000000001 R09: fffffffffffff000
R10: 0000000000000007 R11: 0000000000000000 R12: ffff88804af86180
R13: ffff888091197d80 R14: ffff88804af861b0 R15: ffff8880811e4540
 do_ip6t_get_ctl+0xdb/0x910 net/ipv6/netfilter/ip6_tables.c:1703
 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
 nf_getsockopt+0x72/0xd0 net/netfilter/nf_sockopt.c:122
 ipv6_getsockopt+0x1b6/0x260 net/ipv6/ipv6_sockglue.c:1388
 tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:3616
 __sys_getsockopt+0x135/0x210 net/socket.c:1938
 __do_sys_getsockopt net/socket.c:1949 [inline]
 __se_sys_getsockopt net/socket.c:1946 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:1946
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x46099a
Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca 88 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc7d5556e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffc7d555710 RCX: 000000000046099a
RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 000000000074bca0 R08: 00007ffc7d55570c R09: 0000000000004000
R10: 00007ffc7d555770 R11: 0000000000000212 R12: 00007ffc7d555770
R13: 0000000000000003 R14: 000000000074af20 R15: 0000000000000029
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:91:22
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 0 PID: 30418 Comm: syz-executor.0 Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x5b/0x126 net/core/gen_estimator.c:91
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:ns_capable+0x2/0x20 kernel/capability.c:397
Code: 89 e8 5b 5d 41 5c 41 5d c3 e8 ba fa 65 00 eb dd e8 43 fb 65 00 e9 63 ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 41 54 <41> 89 f4 55 48 89 fd e8 22 ac 2c 00 44 89 e6 48 89 ef 5d 41 5c 31
RSP: 0018:ffff888091197bb8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 0000000000000041 RCX: ffff888091197d80
RDX: 1ffff1101023c8b7 RSI: 000000000000000c RDI: ffffffff896ab700
RBP: 00007ffc7d555770 R08: 0000000000000001 R09: fffffffffffff000
R10: 0000000000000007 R11: 0000000000000000 R12: ffff88804af86180
R13: ffff888091197d80 R14: ffff88804af861b0 R15: ffff8880811e4540
 do_ip6t_get_ctl+0xdb/0x910 net/ipv6/netfilter/ip6_tables.c:1703
 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
 nf_getsockopt+0x72/0xd0 net/netfilter/nf_sockopt.c:122
 ipv6_getsockopt+0x1b6/0x260 net/ipv6/ipv6_sockglue.c:1388
 tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:3616
 __sys_getsockopt+0x135/0x210 net/socket.c:1938
 __do_sys_getsockopt net/socket.c:1949 [inline]
 __se_sys_getsockopt net/socket.c:1946 [inline]
 __x64_sys_getsockopt+0xba/0x150 net/socket.c:1946
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x46099a
Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ca 88 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffc7d5556e8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffc7d555710 RCX: 000000000046099a
RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 000000000074bca0 R08: 00007ffc7d55570c R09: 0000000000004000
R10: 00007ffc7d555770 R11: 0000000000000212 R12: 00007ffc7d555770
R13: 0000000000000003 R14: 000000000074af20 R15: 0000000000000029
================================================================================
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
device lo entered promiscuous mode
device tunl0 entered promiscuous mode
device gre0 entered promiscuous mode
device gretap0 entered promiscuous mode
device erspan0 entered promiscuous mode
device ip_vti0 entered promiscuous mode
device ip6_vti0 entered promiscuous mode
device sit0 entered promiscuous mode
device ip6tnl0 entered promiscuous mode
device ip6gre0 entered promiscuous mode
device syz_tun entered promiscuous mode
device ip6gretap0 entered promiscuous mode
device bridge0 entered promiscuous mode
device vcan0 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
device bond0 entered promiscuous mode
device bond_slave_0 entered promiscuous mode
device bond_slave_1 entered promiscuous mode
device team0 entered promiscuous mode
device team_slave_0 entered promiscuous mode
device team_slave_1 entered promiscuous mode
device dummy0 entered promiscuous mode
device nlmon0 entered promiscuous mode
device caif0 entered promiscuous mode
A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
gfs2: can't find protocol 
gfs2: can't find protocol 
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
audit: type=1804 audit(1601800238.114:4582): pid=17645 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir283445557/syzkaller.oBHVkB/542/bus" dev="sda1" ino=17105 res=1
audit: type=1804 audit(1601800238.834:4583): pid=17645 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir283445557/syzkaller.oBHVkB/542/bus" dev="sda1" ino=17105 res=1
audit: type=1804 audit(1601800238.954:4584): pid=17679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
audit: type=1804 audit(1601800238.964:4585): pid=17679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
audit: type=1804 audit(1601800238.974:4586): pid=17679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
audit: type=1804 audit(1601800238.974:4587): pid=17679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
audit: type=1804 audit(1601800238.984:4588): pid=17686 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
audit: type=1804 audit(1601800238.984:4589): pid=17686 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
audit: type=1804 audit(1601800238.984:4590): pid=17686 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
audit: type=1804 audit(1601800238.994:4591): pid=17679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir241879470/syzkaller.ZMTRah/691/file0" dev="sda1" ino=17073 res=1
IPv6: ADDRCONF(NETDEV_UP): bond1: link is not ready
8021q: adding VLAN 0 to HW filter on device bond1
bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0)
bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0)
nla_parse: 14 callbacks suppressed
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'.