================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38
shift exponent -74 is negative
CPU: 0 PID: 2377 Comm: kworker/u4:4 Not tainted 4.19.150-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound call_usermodehelper_exec_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_is_held_type+0x269/0x340 kernel/locking/lockdep.c:3947
Code: df c7 83 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 af 00 00 00 48 83 3d 68 28 0c 08 00 74 4a 48 8b 7c 24 10 57 9d <0f> 1f 44 00 00 48 83 c4 18 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffff8880a0cef818 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff8880a0c72000 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff897351e0 RDI: 0000000000000286
RBP: ffff8880a0c72000 R08: 000000003453d216 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000002 R12: 0000000000000000
R13: ffff8880a0c72888 R14: ffff8880a0c728b0 R15: 0000000000000002
 lock_is_held include/linux/lockdep.h:344 [inline]
 ___might_sleep+0x3da/0x530 kernel/sched/core.c:6161
 cache_alloc_debugcheck_before mm/slab.c:3071 [inline]
 slab_alloc mm/slab.c:3387 [inline]
 kmem_cache_alloc+0x2e1/0x4a0 mm/slab.c:3557
 alloc_pid+0x53/0x910 kernel/pid.c:168
 copy_process.part.0+0x3f86/0x7fb0 kernel/fork.c:1911
 copy_process kernel/fork.c:1694 [inline]
 _do_fork+0x22f/0x1020 kernel/fork.c:2207
 kernel_thread+0x2f/0x40 kernel/fork.c:2266
 call_usermodehelper_exec_work+0x16d/0x260 kernel/umh.c:190
 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:88:23
shift exponent 81 is too large for 64-bit type 'long long unsigned int'
CPU: 0 PID: 2377 Comm: kworker/u4:4 Not tainted 4.19.150-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound call_usermodehelper_exec_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0xd6/0x126 net/core/gen_estimator.c:88
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_is_held_type+0x269/0x340 kernel/locking/lockdep.c:3947
Code: df c7 83 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 af 00 00 00 48 83 3d 68 28 0c 08 00 74 4a 48 8b 7c 24 10 57 9d <0f> 1f 44 00 00 48 83 c4 18 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffff8880a0cef818 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff8880a0c72000 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff897351e0 RDI: 0000000000000286
RBP: ffff8880a0c72000 R08: 000000003453d216 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000002 R12: 0000000000000000
R13: ffff8880a0c72888 R14: ffff8880a0c728b0 R15: 0000000000000002
 lock_is_held include/linux/lockdep.h:344 [inline]
 ___might_sleep+0x3da/0x530 kernel/sched/core.c:6161
 cache_alloc_debugcheck_before mm/slab.c:3071 [inline]
 slab_alloc mm/slab.c:3387 [inline]
 kmem_cache_alloc+0x2e1/0x4a0 mm/slab.c:3557
 alloc_pid+0x53/0x910 kernel/pid.c:168
 copy_process.part.0+0x3f86/0x7fb0 kernel/fork.c:1911
 copy_process kernel/fork.c:1694 [inline]
 _do_fork+0x22f/0x1020 kernel/fork.c:2207
 kernel_thread+0x2f/0x40 kernel/fork.c:2266
 call_usermodehelper_exec_work+0x16d/0x260 kernel/umh.c:190
 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46
shift exponent -74 is negative
CPU: 0 PID: 2377 Comm: kworker/u4:4 Not tainted 4.19.150-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound call_usermodehelper_exec_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_is_held_type+0x269/0x340 kernel/locking/lockdep.c:3947
Code: df c7 83 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 af 00 00 00 48 83 3d 68 28 0c 08 00 74 4a 48 8b 7c 24 10 57 9d <0f> 1f 44 00 00 48 83 c4 18 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffff8880a0cef818 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff8880a0c72000 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff897351e0 RDI: 0000000000000286
RBP: ffff8880a0c72000 R08: 000000003453d216 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000002 R12: 0000000000000000
R13: ffff8880a0c72888 R14: ffff8880a0c728b0 R15: 0000000000000002
 lock_is_held include/linux/lockdep.h:344 [inline]
 ___might_sleep+0x3da/0x530 kernel/sched/core.c:6161
 cache_alloc_debugcheck_before mm/slab.c:3071 [inline]
 slab_alloc mm/slab.c:3387 [inline]
 kmem_cache_alloc+0x2e1/0x4a0 mm/slab.c:3557
 alloc_pid+0x53/0x910 kernel/pid.c:168
 copy_process.part.0+0x3f86/0x7fb0 kernel/fork.c:1911
 copy_process kernel/fork.c:1694 [inline]
 _do_fork+0x22f/0x1020 kernel/fork.c:2207
 kernel_thread+0x2f/0x40 kernel/fork.c:2266
 call_usermodehelper_exec_work+0x16d/0x260 kernel/umh.c:190
 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:91:22
shift exponent 81 is too large for 64-bit type 'long long unsigned int'
CPU: 0 PID: 2377 Comm: kworker/u4:4 Not tainted 4.19.150-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound call_usermodehelper_exec_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x5b/0x126 net/core/gen_estimator.c:91
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_is_held_type+0x269/0x340 kernel/locking/lockdep.c:3947
Code: df c7 83 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 af 00 00 00 48 83 3d 68 28 0c 08 00 74 4a 48 8b 7c 24 10 57 9d <0f> 1f 44 00 00 48 83 c4 18 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffff8880a0cef818 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff8880a0c72000 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff897351e0 RDI: 0000000000000286
RBP: ffff8880a0c72000 R08: 000000003453d216 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000002 R12: 0000000000000000
R13: ffff8880a0c72888 R14: ffff8880a0c728b0 R15: 0000000000000002
 lock_is_held include/linux/lockdep.h:344 [inline]
 ___might_sleep+0x3da/0x530 kernel/sched/core.c:6161
 cache_alloc_debugcheck_before mm/slab.c:3071 [inline]
 slab_alloc mm/slab.c:3387 [inline]
 kmem_cache_alloc+0x2e1/0x4a0 mm/slab.c:3557
 alloc_pid+0x53/0x910 kernel/pid.c:168
 copy_process.part.0+0x3f86/0x7fb0 kernel/fork.c:1911
 copy_process kernel/fork.c:1694 [inline]
 _do_fork+0x22f/0x1020 kernel/fork.c:2207
 kernel_thread+0x2f/0x40 kernel/fork.c:2266
 call_usermodehelper_exec_work+0x16d/0x260 kernel/umh.c:190
 process_one_work+0x796/0x14e0 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
================================================================================