Extracting prog: 1m41.801639285s Minimizing prog: 4m26.185687606s Simplifying prog options: 0s Extracting C: 1m22.128919518s Simplifying C: 5m4.975393776s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b4001793a377ea247f0101000038605a992be7bf5df00000000a00006111900000000000c60000a68b87c6bd5ab07a6a89374d3dcb0adfe4481d3cac97817e749bc4e7d2b24918e7c8a1db9f3dd1c62b5d15648dca7079b3ffc242f534d74a274889702ef79c7235b141731bd8fd1a595be998c8fa7980f0ce3ce3a726b85624d25111bc247bfc07c581ca55351d919aea88b2ba79a492547a5124dd943e391bbd51278d2df2d0a8da177a4f4352ba3508848ca642d3f1527c03ca04b330c142c2755dc5def99170d1e977decc67c5efba384b94"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x54) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn single: successfully extracted reproducer found reproducer with 1 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b4001793a377ea247f0101000038605a992be7bf5df00000000a00006111900000000000c60000a68b87c6bd5ab07a6a89374d3dcb0adfe4481d3cac97817e749bc4e7d2b24918e7c8a1db9f3dd1c62b5d15648dca7079b3ffc242f534d74a274889702ef79c7235b141731bd8fd1a595be998c8fa7980f0ce3ce3a726b85624d25111bc247bfc07c581ca55351d919aea88b2ba79a492547a5124dd943e391bbd51278d2df2d0a8da177a4f4352ba3508848ca642d3f1527c03ca04b330c142c2755dc5def99170d1e977decc67c5efba384b94"], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b4001793a377ea247f0101000038605a992be7bf5df00000000a00006111900000000000c60000a68b87c6bd5ab07a6a89374d3dcb0adfe4481d3cac97817e749bc4e7d2b24918e7c8a1db9f3dd1c62b5d15648dca7079b3ffc242f534d74a274889702ef79c7235b141731bd8fd1a595be998c8fa7980f0ce3ce3a726b85624d25111bc247bfc07c581ca55351d919aea88b2ba79a492547a5124dd943e391bbd51278d2df2d0a8da177a4f4352ba3508848ca642d3f1527c03ca04b330c142c2755dc5def99170d1e977decc67c5efba384b94"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x94) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in corrupted a never seen crash title: UBSAN: array-index-out-of-bounds in corrupted, ignore testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in corrupted a never seen crash title: UBSAN: array-index-out-of-bounds in corrupted, ignore testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in corrupted a never seen crash title: UBSAN: array-index-out-of-bounds in corrupted, ignore testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b4001793a377ea247f0101000038605a992be7bf5df00000000a00006111900000000000c60000a68b87c6bd5ab07a6a89374d3dcb0adfe4481d3cac97817e749bc4e7d2b24918e7c8a1db9f3dd1c62b5d15648dca7079b3ffc242f534d74a274889702ef79c7235b141731bd8fd1a595be998c8fa7980f0ce3ce3a726b85624d25111bc247bfc07c581ca55351d919aea88b2ba79a492547a5124dd943e391bbd51278d2df2d0a8da177a4f4352ba3508848ca642d3f1527c03ca04b330c142c2755dc5def99170d1e977decc67c5efba384b94"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x54) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b4001793a377ea247f0101000038605a992be7bf5df00000000a00006111900000000000c60000a68b87c6bd5ab07a6a89374d3dcb0adfe4481d3cac97817e749bc4e7d2b24918e7c8a1db9f3dd1c62b5d15648dca7079b3ffc242f534d74a274889702ef79c7235b141731bd8fd1a595be998c8fa7980f0ce3ce3a726b85624d25111bc247bfc07c581ca55351d919aea88b2ba79a492547a5124dd943e391bbd51278d2df2d0a8da177a4f4352ba3508848ca642d3f1527c03ca04b330c142c2755dc5def99170d1e977decc67c5efba384b94"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x54) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b4001793a377ea247f0101000038605a992be7bf5df00000000a00006111900000000000c60000a68b87c6bd5ab07a6a89374d3dcb0adfe4481d3cac97817e749bc4e7d2b24918e7c8a1db9f3dd1c62b5d15648dca7079b3ffc242f534d74a274889702ef79c7235b141731bd8fd1a595be998c8fa7980f0ce3ce3a726b85624d25111bc247bfc07c581ca55351d919aea88b2ba79a492547a5124dd943e391bbd51278d2df2d0a8da177a4f4352ba3508848ca642d3f1527c03ca04b330c142c2755dc5def99170d1e977decc67c5efba384b94"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x1e00, 0x0, '\x00', 0x0, @sock_ops}, 0x54) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn validation run: crashed=true reproducing took 15m53.124322119s repro crashed as (corrupted=false): ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:6 index 3 is out of range for type 'const char *const[3]' CPU: 0 UID: 0 PID: 4913 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:455 print_bpf_insn+0x19c4/0x1ee0 kernel/bpf/disasm.c:306 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 ---[ end trace ]--- ================================================================== BUG: KASAN: global-out-of-bounds in print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 Read of size 8 at addr ffff800086ad37d8 by task syz.0.17/4913 CPU: 0 UID: 0 PID: 4913 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 The buggy address belongs to the variable: bpf_ldsx_string+0x18/0x60 The buggy address belongs to a 0-page vmalloc region starting at 0xffff8000869d0000 allocated at declare_kernel_vmas+0x54/0xb4 arch/arm64/mm/mmu.c:1434 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2190d3 flags: 0x5ffc00000002000(reserved|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000002000 fffffdffc76434c8 fffffdffc76434c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800086ad3680: 00 03 f9 f9 f9 f9 f9 f9 00 01 f9 f9 00 00 00 05 ffff800086ad3700: f9 f9 f9 f9 00 06 f9 f9 00 04 f9 f9 00 05 f9 f9 >ffff800086ad3780: 00 00 00 06 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 ^ ffff800086ad3800: 00 00 00 00 00 00 00 03 f9 f9 f9 f9 00 00 00 00 ffff800086ad3880: 01 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 00 04 f9 f9 ================================================================== final repro crashed as (corrupted=false): ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:6 index 3 is out of range for type 'const char *const[3]' CPU: 0 UID: 0 PID: 4913 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:455 print_bpf_insn+0x19c4/0x1ee0 kernel/bpf/disasm.c:306 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 ---[ end trace ]--- ================================================================== BUG: KASAN: global-out-of-bounds in print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 Read of size 8 at addr ffff800086ad37d8 by task syz.0.17/4913 CPU: 0 UID: 0 PID: 4913 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 The buggy address belongs to the variable: bpf_ldsx_string+0x18/0x60 The buggy address belongs to a 0-page vmalloc region starting at 0xffff8000869d0000 allocated at declare_kernel_vmas+0x54/0xb4 arch/arm64/mm/mmu.c:1434 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2190d3 flags: 0x5ffc00000002000(reserved|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000002000 fffffdffc76434c8 fffffdffc76434c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800086ad3680: 00 03 f9 f9 f9 f9 f9 f9 00 01 f9 f9 00 00 00 05 ffff800086ad3700: f9 f9 f9 f9 00 06 f9 f9 00 04 f9 f9 00 05 f9 f9 >ffff800086ad3780: 00 00 00 06 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 ^ ffff800086ad3800: 00 00 00 00 00 00 00 03 f9 f9 f9 f9 00 00 00 00 ffff800086ad3880: 01 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 00 04 f9 f9 ==================================================================