UBSAN: array-index-out-of-bounds in print_bpf_insn (2)

Status: upstream: reported C repro on 2026/08/20 01:33
Subsystems: bpf
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+3544d9b2a9206be8ba37@syzkaller.appspotmail.com
Fix commit: 37e5c4f4d285 bpf: Reject invalid LDSX instruction in disassembly
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-gce-arm64 ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root]
First crash: 27d, last: 3h03m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
bde42590 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ UBSAN: array-index-out-of-bounds in print_bpf_insn (2) 2026/08/17 03:28 2026/08/17 03:28 2026/08/17 03:58 746171ee
Discussions (3)
Title Replies (including bot) Last reply
Re: [PATCH] bpf: fix array-index-out-of-bounds in print_bpf_insn 1 (1) 2026/08/24 21:23
[PATCH bpf-next v1 1/2] bpf: Reject invalid LDSX instruction in disassembly 2 (2) 2026/08/20 05:23
[syzbot] [bpf?] UBSAN: array-index-out-of-bounds in print_bpf_insn (2) 0 (1) 2026/08/20 01:33
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in print_bpf_insn bpf 15 syz, C done 9 1137d 1138d 23/29 fixed on 2023/10/12 12:47
Cause bisection attempts (1)
Created Duration User Patch Repo Result
2026/08/16 22:55 0m bisect bpf-next error

Sample crash report:
------------[ cut here ]--
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:21
index 3 is out of range for type 'char *[3]'
CPU: 3 UID: 0 PID: 5927 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
 print_bpf_insn+0x2969/0x2a10 kernel/bpf/disasm.c:306
 format_disasm_line kernel/bpf/diagnostics.c:633 [inline]
 diag_print_insn_context+0x3ab/0x9b0 kernel/bpf/diagnostics.c:783
 bpf_diag_source+0x698/0x1540 kernel/bpf/diagnostics.c:896
 bpf_diag_program_structure+0x200/0x290 kernel/bpf/diagnostics.c:1215
 check_subprogs kernel/bpf/verifier.c:3057 [inline]
 bpf_check+0x5914/0xa7c0 kernel/bpf/verifier.c:21097
 bpf_prog_load+0x1ac3/0x2a80 kernel/bpf/syscall.c:3133
 __sys_bpf+0x1f46/0x4a30 kernel/bpf/syscall.c:6367
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0xce/0x140 kernel/bpf/syscall.c:6483
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f456219e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe31e31d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f4562425fa0 RCX: 00007f456219e159
RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005
RBP: 00007f4562235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4562425fac R14: 00007f4562425fa0 R15: 00007f4562425fa0
 </TASK>
---[ end trace ]---

Crashes (5682):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/02 09:38 upstream 89a312991dc6 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 16:23 upstream 786262be6048 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 15:39 upstream 786262be6048 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/07 02:57 net 38b6be101006 4f7b22a0 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 04:46 bpf-next d761934c9483 587f6b29 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 03:55 net-next c8ea08ba34f2 587f6b29 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 08:05 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 07:30 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 06:09 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 04:56 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 03:39 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/08 18:40 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 243b72f1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/08 17:12 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 243b72f1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/08 16:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 243b72f1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/06 18:45 upstream 1fc5a74b108f 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/05 18:13 upstream 654ae5d73c05 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/30 16:59 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/29 13:48 upstream cf72cbb39da8 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/07 00:05 upstream 1fc5a74b108f 4f7b22a0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/06 08:46 upstream 9f0346dcbea3 4f7b22a0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/05 16:42 upstream 4d7d9486c04d 4f7b22a0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 02:17 net 5096947508b7 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 02:12 net 5096947508b7 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 01:03 net 5096947508b7 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 23:54 net 5096947508b7 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 22:30 net 5096947508b7 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 22:22 net 5096947508b7 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 17:31 net 7f26a5e8040b 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 16:18 net 7f26a5e8040b 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 15:07 net 7f26a5e8040b 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 12:28 net 7f26a5e8040b 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 12:23 net 7f26a5e8040b 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 03:01 net a401a9d547c5 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 01:21 net a401a9d547c5 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 00:00 net a401a9d547c5 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/09 22:49 net a401a9d547c5 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/09 21:47 net a401a9d547c5 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 07:21 net-next 211f2a875f6f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 07:13 net-next 211f2a875f6f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 06:09 net-next 211f2a875f6f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 05:04 net-next 211f2a875f6f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 03:36 net-next 211f2a875f6f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 21:12 net-next 211f2a875f6f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 19:14 net-next 211f2a875f6f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 16:28 net-next 211f2a875f6f 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 11:09 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 09:58 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 08:57 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 08:04 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 07:00 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 05:57 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 05:29 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 04:03 net-next 8342c68435dd 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/09 22:54 net-next 548b86839f7f 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/07 07:56 bpf-next b0ca562e0d05 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/21 14:44 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/12 04:00 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/12 02:51 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 22:29 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 21:01 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 19:21 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 18:00 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 15:51 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 10:12 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 08:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/11 04:47 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 13:52 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/10 01:52 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/06 06:22 net 2b4707a149a5 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: global-out-of-bounds Read in print_bpf_insn
* Struck through repros no longer work on HEAD.