UBSAN: array-index-out-of-bounds in print_bpf_insn (2)

Status: upstream: reported C repro on 2026/08/20 01:33
Subsystems: bpf
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+3544d9b2a9206be8ba37@syzkaller.appspotmail.com
Fix commit: bpf: Reject invalid LDSX instruction in disassembly
Patched on: [ci-upstream-bpf-kasan-gce ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 17d, last: now
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
bde42590 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ UBSAN: array-index-out-of-bounds in print_bpf_insn (2) 2026/08/17 03:28 2026/08/17 03:28 2026/08/17 03:58 746171ee
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
Re: [PATCH] bpf: fix array-index-out-of-bounds in print_bpf_insn 1 (1) 2026/08/24 21:23
[PATCH bpf-next v1 1/2] bpf: Reject invalid LDSX instruction in disassembly 2 (2) 2026/08/20 05:23
[syzbot] [bpf?] UBSAN: array-index-out-of-bounds in print_bpf_insn (2) 0 (1) 2026/08/20 01:33
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in print_bpf_insn bpf 15 syz, C done 9 1127d 1129d 23/29 fixed on 2023/10/12 12:47
▶ ▼ Cause bisection attempts (1)
Created Duration User Patch Repo Result
2026/08/16 22:55 0m bisect bpf-next error

Sample crash report:
------------[ cut here ]--
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:21
index 3 is out of range for type 'char *[3]'
CPU: 3 UID: 0 PID: 5927 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
 print_bpf_insn+0x2969/0x2a10 kernel/bpf/disasm.c:306
 format_disasm_line kernel/bpf/diagnostics.c:633 [inline]
 diag_print_insn_context+0x3ab/0x9b0 kernel/bpf/diagnostics.c:783
 bpf_diag_source+0x698/0x1540 kernel/bpf/diagnostics.c:896
 bpf_diag_program_structure+0x200/0x290 kernel/bpf/diagnostics.c:1215
 check_subprogs kernel/bpf/verifier.c:3057 [inline]
 bpf_check+0x5914/0xa7c0 kernel/bpf/verifier.c:21097
 bpf_prog_load+0x1ac3/0x2a80 kernel/bpf/syscall.c:3133
 __sys_bpf+0x1f46/0x4a30 kernel/bpf/syscall.c:6367
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0xce/0x140 kernel/bpf/syscall.c:6483
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f456219e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe31e31d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f4562425fa0 RCX: 00007f456219e159
RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005
RBP: 00007f4562235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4562425fac R14: 00007f4562425fa0 R15: 00007f4562425fa0
 </TASK>
---[ end trace ]---

Crashes (3818):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/02 09:38 upstream 89a312991dc6 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 16:23 upstream 786262be6048 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 15:39 upstream 786262be6048 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 04:46 bpf-next d761934c9483 587f6b29 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 03:55 net-next c8ea08ba34f2 587f6b29 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 08:05 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 07:30 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 06:09 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 04:56 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 03:39 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 07:40 upstream 89a312991dc6 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 06:11 upstream 89a312991dc6 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/30 16:59 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/29 19:20 upstream cf72cbb39da8 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/29 13:48 upstream cf72cbb39da8 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 00:25 upstream bf1079577a11 00e9c810 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 02:28 upstream a23cbb05744b 2f52988a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/21 18:02 upstream 818bebeb63dd 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 09:01 net 1d2929d0850f 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 05:49 net 1d2929d0850f 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 00:48 net 1d2929d0850f 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 22:57 net 1d2929d0850f 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 21:19 net 1d2929d0850f 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 17:24 net 545b63503c69 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 12:27 net 545b63503c69 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 08:44 net 545b63503c69 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 06:49 net 1376afc7660b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 05:37 net 1376afc7660b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 04:27 net 1376afc7660b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 22:37 net 1376afc7660b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 21:29 net 1376afc7660b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 19:29 net 1376afc7660b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 07:19 net-next c8ea08ba34f2 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 03:04 bpf-next d761934c9483 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 02:09 net-next c8ea08ba34f2 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 01:09 net-next c8ea08ba34f2 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 23:41 bpf-next d761934c9483 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 21:54 net-next c8ea08ba34f2 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 19:43 net-next c8ea08ba34f2 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 18:09 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 16:13 net-next 25c1f6111034 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 14:36 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 13:58 net-next 25c1f6111034 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 12:54 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 11:23 net-next 25c1f6111034 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 10:32 net-next 25c1f6111034 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 09:52 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 08:12 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 06:57 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 05:48 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 03:24 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 02:33 net-next 1bb784eb6e38 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 01:30 net-next 1bb784eb6e38 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 23:48 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 22:31 bpf-next d761934c9483 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 20:23 net-next 1bb784eb6e38 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 18:29 net-next 1bb784eb6e38 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 16:41 bpf-next d761934c9483 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 16:09 bpf-next d761934c9483 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/31 15:05 net-next 1bb784eb6e38 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/21 14:44 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/25 16:12 net-next 91ec20351349 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: global-out-of-bounds Read in print_bpf_insn
* Struck through repros no longer work on HEAD.