netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:87:38
shift exponent -246 is negative
CPU: 1 PID: 13950 Comm: systemd-udevd Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x96/0x126 net/core/gen_estimator.c:87
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d ab 94 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff888049657d18 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff888089c2a000 RCX: 1ffff11011385511
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286
RBP: 0000000000000000 R08: 0000000000d8db90 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff110092cafa6
R13: 0000000000000000 R14: ffff888089c2a000 R15: 0000000000000001
 slab_pre_alloc_hook mm/slab.h:420 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x2c/0x4a0 mm/slab.c:3557
 getname_flags+0xce/0x590 fs/namei.c:140
 do_sys_open+0x26c/0x520 fs/open.c:1079
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2db2d68840
Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24
RSP: 002b:00007ffffb580068 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00005558a5c129c0 RCX: 00007f2db2d68840
RDX: 00005558a3f35fe3 RSI: 0000000000080000 RDI: 00005558a5c15940
RBP: 0000000000000001 R08: 00005558a3f35670 R09: 0000000000000110
R10: 00000000000002fe R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00005558a5c1e6f0 R15: 00000000ffffffff
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:88:23
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 13950 Comm: systemd-udevd Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0xd6/0x126 net/core/gen_estimator.c:88
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d ab 94 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff888049657d18 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff888089c2a000 RCX: 1ffff11011385511
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286
RBP: 0000000000000000 R08: 0000000000d8db90 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff110092cafa6
R13: 0000000000000000 R14: ffff888089c2a000 R15: 0000000000000001
 slab_pre_alloc_hook mm/slab.h:420 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x2c/0x4a0 mm/slab.c:3557
 getname_flags+0xce/0x590 fs/namei.c:140
 do_sys_open+0x26c/0x520 fs/open.c:1079
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2db2d68840
Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24
RSP: 002b:00007ffffb580068 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00005558a5c129c0 RCX: 00007f2db2d68840
RDX: 00005558a3f35fe3 RSI: 0000000000080000 RDI: 00005558a5c15940
RBP: 0000000000000001 R08: 00005558a3f35670 R09: 0000000000000110
R10: 00000000000002fe R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00005558a5c1e6f0 R15: 00000000ffffffff
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:90:46
shift exponent -246 is negative
CPU: 1 PID: 13950 Comm: systemd-udevd Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x17/0x126 net/core/gen_estimator.c:90
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d ab 94 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff888049657d18 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff888089c2a000 RCX: 1ffff11011385511
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286
RBP: 0000000000000000 R08: 0000000000d8db90 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff110092cafa6
R13: 0000000000000000 R14: ffff888089c2a000 R15: 0000000000000001
 slab_pre_alloc_hook mm/slab.h:420 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x2c/0x4a0 mm/slab.c:3557
 getname_flags+0xce/0x590 fs/namei.c:140
 do_sys_open+0x26c/0x520 fs/open.c:1079
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2db2d68840
Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24
RSP: 002b:00007ffffb580068 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00005558a5c129c0 RCX: 00007f2db2d68840
RDX: 00005558a3f35fe3 RSI: 0000000000080000 RDI: 00005558a5c15940
RBP: 0000000000000001 R08: 00005558a3f35670 R09: 0000000000000110
R10: 00000000000002fe R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00005558a5c1e6f0 R15: 00000000ffffffff
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/core/gen_estimator.c:91:22
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 13950 Comm: systemd-udevd Not tainted 4.19.149-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x22c/0x33e lib/dump_stack.c:118
 ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
 __ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
 est_timer.cold+0x5b/0x126 net/core/gen_estimator.c:91
 call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
 expire_timers+0x243/0x500 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
 __do_softirq+0x27d/0xad2 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x22d/0x270 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:lock_release+0x429/0x8e0 kernel/locking/lockdep.c:3929
Code: 84 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 c5 03 00 00 48 83 3d ab 94 0b 08 00 0f 84 f0 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 00 00
RSP: 0018:ffff888049657d18 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713d RBX: ffff888089c2a000 RCX: 1ffff11011385511
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286
RBP: 0000000000000000 R08: 0000000000d8db90 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff110092cafa6
R13: 0000000000000000 R14: ffff888089c2a000 R15: 0000000000000001
 slab_pre_alloc_hook mm/slab.h:420 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc+0x2c/0x4a0 mm/slab.c:3557
 getname_flags+0xce/0x590 fs/namei.c:140
 do_sys_open+0x26c/0x520 fs/open.c:1079
 do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2db2d68840
Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24
RSP: 002b:00007ffffb580068 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00005558a5c129c0 RCX: 00007f2db2d68840
RDX: 00005558a3f35fe3 RSI: 0000000000080000 RDI: 00005558a5c15940
RBP: 0000000000000001 R08: 00005558a3f35670 R09: 0000000000000110
R10: 00000000000002fe R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00005558a5c1e6f0 R15: 00000000ffffffff
================================================================================
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'.
x_tables: duplicate underflow at hook 1
audit: type=1326 audit(1601940171.002:44): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=13986 comm="syz-executor.2" exe="/root/syz-executor.2" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
x_tables: duplicate underflow at hook 1
syz-executor.1 (13987) used greatest stack depth: 22560 bytes left
audit: type=1326 audit(1601940171.162:45): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=13988 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
ptrace attach of "/root/syz-executor.3"[14012] was attempted by "/root/syz-executor.3"[14011]
syz-executor.1 (14017): /proc/14016/oom_adj is deprecated, please use /proc/14016/oom_score_adj instead.
audit: type=1326 audit(1601940171.772:46): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=13986 comm="syz-executor.2" exe="/root/syz-executor.2" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
audit: type=1326 audit(1601940172.042:47): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=14047 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
audit: type=1326 audit(1601940172.942:48): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=14105 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
capability: warning: `syz-executor.3' uses 32-bit capabilities (legacy support in use)
nla_parse: 10 callbacks suppressed
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
audit: type=1326 audit(1601940173.822:49): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=14156 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 25 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 25 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 64 bytes leftover after parsing attributes in process `syz-executor.5'.
audit: type=1326 audit(1601940174.712:50): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=14216 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'.
PF_BRIDGE: br_mdb_parse() with invalid entry
audit: type=1804 audit(1601940175.062:51): pid=14258 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir632402417/syzkaller.DA7YU3/196/bus" dev="sda1" ino=16412 res=1
audit: type=1804 audit(1601940175.222:52): pid=14263 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir632402417/syzkaller.DA7YU3/196/bus" dev="sda1" ino=16412 res=1
audit: type=1326 audit(1601940175.622:53): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=14270 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0
bridge1: port 1(macvlan1) entered blocking state
bridge1: port 1(macvlan1) entered disabled state
device macvlan1 entered promiscuous mode
device macvlan1 left promiscuous mode
bridge1: port 1(macvlan1) entered disabled state
audit: type=1326 audit(1601940176.452:54): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=14347 comm="syz-executor.4" exe="/root/syz-executor.4" sig=9 arch=c000003e syscall=228 compat=0 ip=0x460c8a code=0x0