program: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="17000000000000000084000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x18, 0xf, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000600000000000700edff181100cd5ee0513ea331ad2a05816d6db44430c33137f4ae0d122c889959b853993f1e111672a800007ec3fd85761c015551e2259e0cefcf86545b2741abe54b0eb0967f1fcde7185812d84766ce06f9e0299ee8b3d8483cd0e5b6324a08a34c59ba6bb37706bb33f4967a8dd1611a43ea72938d5d455293fe86f65627a6b8525c7795a603127ceeab410ab0eecee4d15695a29a72c6606864e4d7b8e2d3af1bbd211367e9c96f50d0fa77166741b1e38eed8f", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000340)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@ipv6_newrule={0x1c, 0x20, 0x1}, 0x1c}}, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r3, 0x4, 0x4, 0x0, 0xe2, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @dev, 0x80, 0x0, 0xffffffff, 0x1}}) [ 94.733372][ T4646] Bluetooth: hci0: command tx timeout [ 94.767065][ T5318] ------------[ cut here ]------------ [ 94.767113][ T5318] UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:6 [ 94.767153][ T5318] index 3 is out of range for type 'const char *const[3]' [ 94.767184][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.767232][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.767258][ T5318] Call Trace: [ 94.767263][ T5318] [ 94.767269][ T5318] dump_stack_lvl+0xe8/0x150 [ 94.767329][ T5318] ubsan_epilogue+0xa/0x30 [ 94.767343][ T5318] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 94.767393][ T5318] print_bpf_insn+0x21f1/0x2910 [ 94.767411][ T5318] ? __pfx_disasm_print+0x10/0x10 [ 94.767428][ T5318] ? __pfx_print_bpf_insn+0x10/0x10 [ 94.767447][ T5318] ? vscnprintf+0x5c/0x90 [ 94.767493][ T5318] ? bpf_verifier_vlog+0x3d1/0x900 [ 94.767526][ T5318] diag_print_insn_context+0x433/0xd00 [ 94.767550][ T5318] ? __pfx_diag_print_insn_context+0x10/0x10 [ 94.767568][ T5318] ? __pfx_diag_write+0x10/0x10 [ 94.767583][ T5318] ? __pfx_disasm_print+0x10/0x10 [ 94.767598][ T5318] ? __pfx_disasm_kfunc_name+0x10/0x10 [ 94.767616][ T5318] ? diag_print_wrapped_prefixed+0x207/0x240 [ 94.767631][ T5318] bpf_diag_source+0x639/0x18d0 [ 94.767640][ T5318] ? vsnprintf+0xe42/0xef0 [ 94.767653][ T5318] ? vscnprintf+0x5c/0x90 [ 94.767661][ T5318] ? bpf_verifier_vlog+0x3d1/0x900 [ 94.767672][ T5318] ? __pfx_bpf_diag_source+0x10/0x10 [ 94.767690][ T5318] ? __pfx_diag_write+0x10/0x10 [ 94.767706][ T5318] ? kfree+0x1c5/0x650 [ 94.767718][ T5318] ? bpf_diag_program_structure+0x28a/0x430 [ 94.767736][ T5318] bpf_diag_program_structure+0x31c/0x430 [ 94.767752][ T5318] ? verbose+0x11d/0x1a0 [ 94.767770][ T5318] ? __pfx_bpf_diag_program_structure+0x10/0x10 [ 94.767786][ T5318] ? bpf_prepare_btf_info+0x639/0x1200 [ 94.767801][ T5318] ? rcu_is_watching+0x16/0xb0 [ 94.767819][ T5318] check_subprogs+0x6d3/0x740 [ 94.767834][ T5318] bpf_check+0x17ba/0x2e10 [ 94.767847][ T5318] ? ktime_get_with_offset+0x93/0x2d0 [ 94.767861][ T5318] ? __pfx_bpf_check+0x10/0x10 [ 94.767873][ T5318] ? bpf_obj_name_cpy+0x194/0x1e0 [ 94.767892][ T5318] bpf_prog_load+0x14d6/0x1c20 [ 94.767913][ T5318] ? __pfx_bpf_prog_load+0x10/0x10 [ 94.767937][ T5318] ? do_raw_spin_lock+0x100/0x2f0 [ 94.767952][ T5318] __sys_bpf+0xd11/0xda0 [ 94.767967][ T5318] ? do_raw_spin_lock+0x100/0x2f0 [ 94.767983][ T5318] ? __pfx___sys_bpf+0x10/0x10 [ 94.767998][ T5318] ? do_futex+0x3e7/0x4e0 [ 94.768013][ T5318] ? do_raw_spin_lock+0x100/0x2f0 [ 94.768040][ T5318] ? rcu_is_watching+0x16/0xb0 [ 94.768057][ T5318] __x64_sys_bpf+0xba/0xd0 [ 94.768069][ T5318] do_syscall_64+0x166/0x520 [ 94.768086][ T5318] ? trace_irq_disable+0x3b/0x140 [ 94.768097][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.768111][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 94.768127][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.768139][ T5318] RIP: 0033:0x7f59b3d9e159 [ 94.768152][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.768163][ T5318] RSP: 002b:00007f59b4c60fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 94.768173][ T5318] RAX: ffffffffffffffda RBX: 00007f59b4025fa0 RCX: 00007f59b3d9e159 [ 94.768182][ T5318] RDX: 0000000000000094 RSI: 00002000000009c0 RDI: 0000000000000005 [ 94.768189][ T5318] RBP: 00007f59b3e35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.768196][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.768203][ T5318] R13: 00007f59b4026038 R14: 00007f59b4025fa0 R15: 00007ffde3a8f9c8 [ 94.768220][ T5318] [ 94.769201][ T5318] ---[ end trace ]--- [ 94.769233][ T5318] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 94.935517][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.939281][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.943576][ T5318] Call Trace: [ 94.945069][ T5318] [ 94.946389][ T5318] vpanic+0x56d/0xa60 [ 94.948090][ T5318] ? __pfx_vpanic+0x10/0x10 [ 94.950048][ T5318] ? irqentry_exit+0x218/0x910 [ 94.952033][ T5318] panic+0xc5/0xd0 [ 94.953746][ T5318] ? __pfx_panic+0x10/0x10 [ 94.955669][ T5318] ? __pfx__printk+0x10/0x10 [ 94.957715][ T5318] check_panic_on_warn+0x89/0xb0 [ 94.959868][ T5318] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 94.962357][ T5318] print_bpf_insn+0x21f1/0x2910 [ 94.964467][ T5318] ? __pfx_disasm_print+0x10/0x10 [ 94.966654][ T5318] ? __pfx_print_bpf_insn+0x10/0x10 [ 94.968816][ T5318] ? vscnprintf+0x5c/0x90 [ 94.970689][ T5318] ? bpf_verifier_vlog+0x3d1/0x900 [ 94.972891][ T5318] diag_print_insn_context+0x433/0xd00 [ 94.975283][ T5318] ? __pfx_diag_print_insn_context+0x10/0x10 [ 94.977804][ T5318] ? __pfx_diag_write+0x10/0x10 [ 94.979914][ T5318] ? __pfx_disasm_print+0x10/0x10 [ 94.982111][ T5318] ? __pfx_disasm_kfunc_name+0x10/0x10 [ 94.984367][ T5318] ? diag_print_wrapped_prefixed+0x207/0x240 [ 94.986822][ T5318] bpf_diag_source+0x639/0x18d0 [ 94.988807][ T5318] ? vsnprintf+0xe42/0xef0 [ 94.990654][ T5318] ? vscnprintf+0x5c/0x90 [ 94.992410][ T5318] ? bpf_verifier_vlog+0x3d1/0x900 [ 94.994514][ T5318] ? __pfx_bpf_diag_source+0x10/0x10 [ 94.996673][ T5318] ? __pfx_diag_write+0x10/0x10 [ 94.998755][ T5318] ? kfree+0x1c5/0x650 [ 95.000472][ T5318] ? bpf_diag_program_structure+0x28a/0x430 [ 95.002834][ T5318] bpf_diag_program_structure+0x31c/0x430 [ 95.005173][ T5318] ? verbose+0x11d/0x1a0 [ 95.006853][ T5318] ? __pfx_bpf_diag_program_structure+0x10/0x10 [ 95.009480][ T5318] ? bpf_prepare_btf_info+0x639/0x1200 [ 95.011816][ T5318] ? rcu_is_watching+0x16/0xb0 [ 95.013940][ T5318] check_subprogs+0x6d3/0x740 [ 95.015993][ T5318] bpf_check+0x17ba/0x2e10 [ 95.017941][ T5318] ? ktime_get_with_offset+0x93/0x2d0 [ 95.020054][ T5318] ? __pfx_bpf_check+0x10/0x10 [ 95.022076][ T5318] ? bpf_obj_name_cpy+0x194/0x1e0 [ 95.024247][ T5318] bpf_prog_load+0x14d6/0x1c20 [ 95.026399][ T5318] ? __pfx_bpf_prog_load+0x10/0x10 [ 95.028611][ T5318] ? do_raw_spin_lock+0x100/0x2f0 [ 95.030685][ T5318] __sys_bpf+0xd11/0xda0 [ 95.032427][ T5318] ? do_raw_spin_lock+0x100/0x2f0 [ 95.034615][ T5318] ? __pfx___sys_bpf+0x10/0x10 [ 95.036760][ T5318] ? do_futex+0x3e7/0x4e0 [ 95.038632][ T5318] ? do_raw_spin_lock+0x100/0x2f0 [ 95.040770][ T5318] ? rcu_is_watching+0x16/0xb0 [ 95.042829][ T5318] __x64_sys_bpf+0xba/0xd0 [ 95.044769][ T5318] do_syscall_64+0x166/0x520 [ 95.046803][ T5318] ? trace_irq_disable+0x3b/0x140 [ 95.048924][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.051480][ T5318] ? clear_bhb_loop+0x70/0xc0 [ 95.053424][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.055913][ T5318] RIP: 0033:0x7f59b3d9e159 [ 95.057887][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.066325][ T5318] RSP: 002b:00007f59b4c60fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 95.069962][ T5318] RAX: ffffffffffffffda RBX: 00007f59b4025fa0 RCX: 00007f59b3d9e159 [ 95.073219][ T5318] RDX: 0000000000000094 RSI: 00002000000009c0 RDI: 0000000000000005 [ 95.076584][ T5318] RBP: 00007f59b3e35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.079669][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.082844][ T5318] R13: 00007f59b4026038 R14: 00007f59b4025fa0 R15: 00007ffde3a8f9c8 [ 95.086115][ T5318] [ 95.087803][ T5318] Kernel Offset: disabled [ 95.089592][ T5318] Rebooting in 86400 seconds..