8021q: adding VLAN 0 to HW filter on device batadv0 ================================================================================ UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38 shift exponent -23 is negative CPU: 1 PID: 8085 Comm: syz-executor.3 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0033:0x412d10 Code: 00 0f 86 bf 00 00 00 49 8d ae 88 00 00 00 4c 89 ef 48 89 ee e8 21 f7 ff ff 48 39 eb 74 3c 0f 1f 40 00 48 8b 75 00 48 8b 55 f8 <48> 8d 45 f8 48 39 f2 77 0a e9 9b 00 00 00 66 90 48 89 c8 48 89 50 RSP: 002b:00007fffea906060 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: 00007fe8e8f61bf0 RBX: 00007fe8e8fed8a8 RCX: 00007fe8e8f5f1d8 RDX: ffffffff81d4b8d0 RSI: ffffffff81d4b8d0 RDI: 00007fe8e8ee4010 RBP: 00007fe8e8f61bf8 R08: ffffffff8100a4bd R09: 00000000ba1ad6e1 R10: 00007fffea906200 R11: 0000000000000246 R12: 000000000118cfc8 R13: 00007fe8e8ee4008 R14: 00007fe8e8ee4000 R15: 0000000000021314 ================================================================================ ================================================================================ UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46 shift exponent -23 is negative CPU: 1 PID: 8085 Comm: syz-executor.3 Not tainted 4.19.148-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x22c/0x33e lib/dump_stack.c:118 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422 est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338 expire_timers+0x243/0x500 kernel/time/timer.c:1375 __run_timers kernel/time/timer.c:1703 [inline] run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716 __do_softirq+0x27d/0xad2 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x22d/0x270 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0033:0x412d10 Code: 00 0f 86 bf 00 00 00 49 8d ae 88 00 00 00 4c 89 ef 48 89 ee e8 21 f7 ff ff 48 39 eb 74 3c 0f 1f 40 00 48 8b 75 00 48 8b 55 f8 <48> 8d 45 f8 48 39 f2 77 0a e9 9b 00 00 00 66 90 48 89 c8 48 89 50 RSP: 002b:00007fffea906060 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: 00007fe8e8f61bf0 RBX: 00007fe8e8fed8a8 RCX: 00007fe8e8f5f1d8 RDX: ffffffff81d4b8d0 RSI: ffffffff81d4b8d0 RDI: 00007fe8e8ee4010 RBP: 00007fe8e8f61bf8 R08: ffffffff8100a4bd R09: 00000000ba1ad6e1 R10: 00007fffea906200 R11: 0000000000000246 R12: 000000000118cfc8 R13: 00007fe8e8ee4008 R14: 00007fe8e8ee4000 R15: 0000000000021314 ================================================================================ 8021q: adding VLAN 0 to HW filter on device batadv0 device batadv0 entered promiscuous mode 8021q: adding VLAN 0 to HW filter on device batadv0 audit: type=1804 audit(1601173194.795:9): pid=8196 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir675607200/syzkaller.1DTrgV/4/memory.events" dev="sda1" ino=15784 res=1 audit: type=1804 audit(1601173194.985:10): pid=8200 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir675607200/syzkaller.1DTrgV/4/memory.events" dev="sda1" ino=15784 res=1 audit: type=1804 audit(1601173195.255:11): pid=8212 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir675607200/syzkaller.1DTrgV/5/memory.events" dev="sda1" ino=15784 res=1 audit: type=1804 audit(1601173195.635:12): pid=8225 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir238767594/syzkaller.NNsrRy/7/memory.events" dev="sda1" ino=15788 res=1 8021q: adding VLAN 0 to HW filter on device batadv0 audit: type=1400 audit(1601173196.855:13): avc: denied { create } for pid=8254 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601173196.855:14): avc: denied { name_bind } for pid=8254 comm="syz-executor.1" src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601173196.855:15): avc: denied { node_bind } for pid=8254 comm="syz-executor.1" saddr=::1 src=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=dccp_socket permissive=1 audit: type=1400 audit(1601173196.855:16): avc: denied { name_connect } for pid=8254 comm="syz-executor.1" dest=20000 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 audit: type=1804 audit(1601173196.995:17): pid=8255 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir238767594/syzkaller.NNsrRy/8/memory.events" dev="sda1" ino=15770 res=1 8021q: adding VLAN 0 to HW filter on device batadv0 netlink: 'syz-executor.5': attribute type 4 has an invalid length. syz-executor.0 (8258) used greatest stack depth: 22680 bytes left IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready bond0: xfrm1 ether type (65534) is different from other slaves (1), can not enslave it netlink: 'syz-executor.5': attribute type 4 has an invalid length. IPv6: NLM_F_CREATE should be specified when creating new route netlink: 16 bytes leftover after parsing attributes in process `syz-executor.1'. bond0: xfrm1 ether type (65534) is different from other slaves (1), can not enslave it netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor.1'. bond0: xfrm1 ether type (65534) is different from other slaves (1), can not enslave it bond0: xfrm1 ether type (65534) is different from other slaves (1), can not enslave it batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode