================================================================================ UBSAN: Undefined behaviour in net/netfilter/ipset/ip_set_hash_gen.h:125:6 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 1 PID: 8809 Comm: syz-executor.2 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 htable_bits net/netfilter/ipset/ip_set_hash_gen.h:125 [inline] hash_ipportip_create.cold+0x1a/0x21 net/netfilter/ipset/ip_set_hash_gen.h:1290 ip_set_create+0x70e/0x1380 net/netfilter/ipset/ip_set_core.c:940 nfnetlink_rcv_msg+0xeff/0x1210 net/netfilter/nfnetlink.c:233 netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2455 nfnetlink_rcv+0x1b2/0x41b net/netfilter/nfnetlink.c:565 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x717/0xcc0 net/netlink/af_netlink.c:1909 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xc7/0x130 net/socket.c:632 ___sys_sendmsg+0x7bb/0x8f0 net/socket.c:2115 __sys_sendmsg net/socket.c:2153 [inline] __do_sys_sendmsg net/socket.c:2162 [inline] __se_sys_sendmsg net/socket.c:2160 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2160 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45e179 Code: 3d b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff722a7fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000029b40 RCX: 000000000045e179 RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 000000000118cf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c R13: 00007ffe87f8a0df R14: 00007ff722a809c0 R15: 000000000118cf4c ================================================================================ netlink: 'syz-executor.2': attribute type 1 has an invalid length. netlink: 144 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 'syz-executor.2': attribute type 1 has an invalid length. netlink: 144 bytes leftover after parsing attributes in process `syz-executor.2'. netlink: 'syz-executor.2': attribute type 1 has an invalid length. netlink: 144 bytes leftover after parsing attributes in process `syz-executor.2'. ================================================================================ UBSAN: Undefined behaviour in drivers/vhost/vhost.c:116:62 load of value 39 is not a valid value for type '_Bool' CPU: 0 PID: 8877 Comm: syz-executor.0 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_load_invalid_value.cold+0x63/0x6f lib/ubsan.c:454 vhost_init_is_le drivers/vhost/vhost.c:116 [inline] vhost_reset_is_le drivers/vhost/vhost.c:143 [inline] vhost_vq_reset.constprop.0.cold+0x15/0x1a drivers/vhost/vhost.c:325 vhost_dev_init+0x442/0x780 drivers/vhost/vhost.c:463 vhost_vsock_dev_open+0x1c9/0x310 drivers/vhost/vsock.c:583 misc_open+0x372/0x4a0 drivers/char/misc.c:141 chrdev_open+0x266/0x770 fs/char_dev.c:423 do_dentry_open+0x4aa/0x1160 fs/open.c:796 do_last fs/namei.c:3421 [inline] path_openat+0x7d5/0x2e90 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45e179 Code: 3d b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f49b292fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000024840 RCX: 000000000045e179 RDX: 0000000000000002 RSI: 0000000020000000 RDI: 00000000ffffff9c RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c R13: 00007ffe9a110eef R14: 00007f49b29309c0 R15: 000000000118cf4c ================================================================================ syz-executor.0 (8877) used greatest stack depth: 23072 bytes left audit: type=1400 audit(1601317648.067:19): avc: denied { create } for pid=8936 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601317648.067:20): avc: denied { name_bind } for pid=8936 comm="syz-executor.3" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601317648.067:21): avc: denied { node_bind } for pid=8936 comm="syz-executor.3" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601317648.077:22): avc: denied { name_connect } for pid=8936 comm="syz-executor.3" dest=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 device team1 entered promiscuous mode device lo entered promiscuous mode device tunl0 entered promiscuous mode device gre0 entered promiscuous mode device gretap0 entered promiscuous mode device erspan0 entered promiscuous mode device ip_vti0 entered promiscuous mode device ip6_vti0 entered promiscuous mode