================================================================================
UBSAN: Undefined behaviour in net/sched/sch_api.c:561:7
shift exponent 116 is too large for 32-bit type 'int'
CPU: 1 PID: 12094 Comm: syz-executor.4 Not tainted 4.19.152-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
__qdisc_calculate_pkt_len+0x3bb/0x570 net/sched/sch_api.c:561
qdisc_calculate_pkt_len include/net/sch_generic.h:697 [inline]
__dev_xmit_skb net/core/dev.c:3443 [inline]
__dev_queue_xmit+0x1372/0x2ec0 net/core/dev.c:3807
neigh_hh_output include/net/neighbour.h:491 [inline]
neigh_output include/net/neighbour.h:499 [inline]
ip_finish_output2+0xc04/0x1640 net/ipv4/ip_output.c:230
ip_finish_output+0x88e/0xd80 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip_output+0x203/0x650 net/ipv4/ip_output.c:406
dst_output include/net/dst.h:455 [inline]
ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125
iptunnel_xmit+0x63e/0xa30 net/ipv4/ip_tunnel_core.c:91
geneve_xmit_skb drivers/net/geneve.c:865 [inline]
geneve_xmit+0xf46/0x2ac0 drivers/net/geneve.c:938
__netdev_start_xmit include/linux/netdevice.h:4333 [inline]
netdev_start_xmit include/linux/netdevice.h:4347 [inline]
xmit_one net/core/dev.c:3256 [inline]
dev_hard_start_xmit+0x1a8/0x960 net/core/dev.c:3272
__dev_queue_xmit+0x276a/0x2ec0 net/core/dev.c:3838
neigh_hh_output include/net/neighbour.h:491 [inline]
neigh_output include/net/neighbour.h:499 [inline]
ip6_finish_output2+0xe78/0x2370 net/ipv6/ip6_output.c:120
ip6_finish_output+0x610/0xcc0 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x205/0x7c0 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:455 [inline]
NF_HOOK include/linux/netfilter.h:289 [inline]
ndisc_send_skb+0xa6b/0x1860 net/ipv6/ndisc.c:491
ndisc_send_rs+0x131/0x6a0 net/ipv6/ndisc.c:685
addrconf_rs_timer+0x2d9/0x640 net/ipv6/addrconf.c:3834
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x50/0x90 kernel/locking/spinlock.c:192
Code: c0 f8 89 63 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 3d 48 83 3d 41 5d b2 01 00 74 25 fb 66 0f 1f 44 00 00 01 00 00 00 e8 96 d8 9b f9 65 8b 05 ff c0 50 78 85 c0 74 02 5d
RSP: 0018:ffff88808ef07810 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713f RBX: 0000000076d330a8 RCX: 1ffff11009d425b2
RDX: dffffc0000000000 RSI: ffff88804ea12d70 RDI: ffff88804ea12d44
RBP: ffff8880ae32c2c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ae32c2c0
R13: ffff8880821b65c0 R14: 0000000000000000 R15: 0000000000000001
finish_lock_switch kernel/sched/core.c:2578 [inline]
finish_task_switch+0x174/0x8b0 kernel/sched/core.c:2678
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8ed/0x22e0 kernel/sched/core.c:3517
preempt_schedule_irq+0xb4/0x180 kernel/sched/core.c:3744
retint_kernel+0x1b/0x2d
RIP: 0010:__find_get_block+0x2a3/0x1080 fs/buffer.c:1293
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 76 0d 00 00 48 83 3d b7 85 9f 07 00 0f 84 28 05 00 00 e8 84 ce ad ff fb 66 0f 1f 44 00 00 <4d> 85 e4 0f 84 6f 02 00 00 e8 6f ce ad ff 0f 1f 44 00 00 e8 65 ce
RSP: 0018:ffff88808ef07a38 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff88804ea124c0 RBX: 0000000000000010 RCX: 1ffff11009d425b2
RDX: 0000000000000000 RSI: ffffffff81c4044c RDI: ffff88804ea12d44
RBP: 000000000000000f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000013 R14: 000000000000040a R15: ffff88804b56cbd0
__getblk_gfp+0x28/0x70 fs/buffer.c:1317
sb_getblk include/linux/buffer_head.h:333 [inline]
ext4_read_inode_bitmap+0x298/0x1b50 fs/ext4/ialloc.c:139
__ext4_new_inode+0x16a0/0x5e40 fs/ext4/ialloc.c:908
ext4_symlink+0x3f5/0xc00 fs/ext4/namei.c:3146
vfs_symlink+0x3ac/0x630 fs/namei.c:4129
do_symlinkat+0x258/0x2c0 fs/namei.c:4156
do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45db87
Code: 0f 1f 00 b8 5c 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffedfcc7d78 EFLAGS: 00000206 ORIG_RAX: 0000000000000058
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87
RDX: 00007ffedfcc7e13 RSI: 00000000004c3889 RDI: 00007ffedfcc7e00
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013
R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001
R13: 00007ffedfcc7db0 R14: 0000000000000000 R15: 00007ffedfcc7dc0
================================================================================
================================================================================
UBSAN: Undefined behaviour in net/sched/sch_api.c:569:10
shift exponent 181 is too large for 32-bit type 'int'
CPU: 1 PID: 12094 Comm: syz-executor.4 Not tainted 4.19.152-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_shift_out_of_bounds.cold+0x1c4/0x250 lib/ubsan.c:422
__qdisc_calculate_pkt_len+0x370/0x570 net/sched/sch_api.c:569
qdisc_calculate_pkt_len include/net/sch_generic.h:697 [inline]
__dev_xmit_skb net/core/dev.c:3443 [inline]
__dev_queue_xmit+0x1372/0x2ec0 net/core/dev.c:3807
neigh_hh_output include/net/neighbour.h:491 [inline]
neigh_output include/net/neighbour.h:499 [inline]
ip_finish_output2+0xc04/0x1640 net/ipv4/ip_output.c:230
ip_finish_output+0x88e/0xd80 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip_output+0x203/0x650 net/ipv4/ip_output.c:406
dst_output include/net/dst.h:455 [inline]
ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125
iptunnel_xmit+0x63e/0xa30 net/ipv4/ip_tunnel_core.c:91
geneve_xmit_skb drivers/net/geneve.c:865 [inline]
geneve_xmit+0xf46/0x2ac0 drivers/net/geneve.c:938
__netdev_start_xmit include/linux/netdevice.h:4333 [inline]
netdev_start_xmit include/linux/netdevice.h:4347 [inline]
xmit_one net/core/dev.c:3256 [inline]
dev_hard_start_xmit+0x1a8/0x960 net/core/dev.c:3272
__dev_queue_xmit+0x276a/0x2ec0 net/core/dev.c:3838
neigh_hh_output include/net/neighbour.h:491 [inline]
neigh_output include/net/neighbour.h:499 [inline]
ip6_finish_output2+0xe78/0x2370 net/ipv6/ip6_output.c:120
ip6_finish_output+0x610/0xcc0 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x205/0x7c0 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:455 [inline]
NF_HOOK include/linux/netfilter.h:289 [inline]
ndisc_send_skb+0xa6b/0x1860 net/ipv6/ndisc.c:491
ndisc_send_rs+0x131/0x6a0 net/ipv6/ndisc.c:685
addrconf_rs_timer+0x2d9/0x640 net/ipv6/addrconf.c:3834
call_timer_fn+0x177/0x760 kernel/time/timer.c:1338
expire_timers+0x243/0x500 kernel/time/timer.c:1375
__run_timers kernel/time/timer.c:1703 [inline]
run_timer_softirq+0x259/0x730 kernel/time/timer.c:1716
__do_softirq+0x27d/0xad2 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x22d/0x270 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:544 [inline]
smp_apic_timer_interrupt+0x15f/0x5d0 arch/x86/kernel/apic/apic.c:1094
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x50/0x90 kernel/locking/spinlock.c:192
Code: c0 f8 89 63 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 3d 48 83 3d 41 5d b2 01 00 74 25 fb 66 0f 1f 44 00 00 01 00 00 00 e8 96 d8 9b f9 65 8b 05 ff c0 50 78 85 c0 74 02 5d
RSP: 0018:ffff88808ef07810 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff12c713f RBX: 0000000076d330a8 RCX: 1ffff11009d425b2
RDX: dffffc0000000000 RSI: ffff88804ea12d70 RDI: ffff88804ea12d44
RBP: ffff8880ae32c2c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ae32c2c0
R13: ffff8880821b65c0 R14: 0000000000000000 R15: 0000000000000001
finish_lock_switch kernel/sched/core.c:2578 [inline]
finish_task_switch+0x174/0x8b0 kernel/sched/core.c:2678
context_switch kernel/sched/core.c:2831 [inline]
__schedule+0x8ed/0x22e0 kernel/sched/core.c:3517
preempt_schedule_irq+0xb4/0x180 kernel/sched/core.c:3744
retint_kernel+0x1b/0x2d
RIP: 0010:__find_get_block+0x2a3/0x1080 fs/buffer.c:1293
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 76 0d 00 00 48 83 3d b7 85 9f 07 00 0f 84 28 05 00 00 e8 84 ce ad ff fb 66 0f 1f 44 00 00 <4d> 85 e4 0f 84 6f 02 00 00 e8 6f ce ad ff 0f 1f 44 00 00 e8 65 ce
RSP: 0018:ffff88808ef07a38 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff88804ea124c0 RBX: 0000000000000010 RCX: 1ffff11009d425b2
RDX: 0000000000000000 RSI: ffffffff81c4044c RDI: ffff88804ea12d44
RBP: 000000000000000f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000013 R14: 000000000000040a R15: ffff88804b56cbd0
__getblk_gfp+0x28/0x70 fs/buffer.c:1317
sb_getblk include/linux/buffer_head.h:333 [inline]
ext4_read_inode_bitmap+0x298/0x1b50 fs/ext4/ialloc.c:139
__ext4_new_inode+0x16a0/0x5e40 fs/ext4/ialloc.c:908
ext4_symlink+0x3f5/0xc00 fs/ext4/namei.c:3146
vfs_symlink+0x3ac/0x630 fs/namei.c:4129
do_symlinkat+0x258/0x2c0 fs/namei.c:4156
do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45db87
Code: 0f 1f 00 b8 5c 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffedfcc7d78 EFLAGS: 00000206 ORIG_RAX: 0000000000000058
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045db87
RDX: 00007ffedfcc7e13 RSI: 00000000004c3889 RDI: 00007ffedfcc7e00
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013
R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001
R13: 00007ffedfcc7db0 R14: 0000000000000000 R15: 00007ffedfcc7dc0
================================================================================
IPv6: NLM_F_CREATE should be specified when creating new route
netlink: 160 bytes leftover after parsing attributes in process `syz-executor.4'.
device wlan1 entered promiscuous mode
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
IPv6: NLM_F_CREATE should be set when creating new route
IPv6: NLM_F_CREATE should be set when creating new route
IPv6: NLM_F_CREATE should be set when creating new route
device wlan1 left promiscuous mode
device wlan1 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
netlink: 206846 bytes leftover after parsing attributes in process `syz-executor.5'.
device batadv0 entered promiscuous mode
netlink: 206846 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 206846 bytes leftover after parsing attributes in process `syz-executor.5'.
8021q: adding VLAN 0 to HW filter on device batadv0
8021q: adding VLAN 0 to HW filter on device batadv0
audit: type=1400 audit(1603109683.653:9): avc: denied { create } for pid=12411 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1