Extracting prog: 1m47.009067335s Minimizing prog: 3m47.600619009s Simplifying prog options: 0s Extracting C: 29.802085213s Simplifying C: 11m56.106932267s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn single: successfully extracted reproducer found reproducer with 1 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in corrupted a never seen crash title: UBSAN: array-index-out-of-bounds in corrupted, ignore testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in corrupted a never seen crash title: UBSAN: array-index-out-of-bounds in corrupted, ignore testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn validation run: crashed=true reproducing took 20m36.37702427s repro crashed as (corrupted=false): ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:6 index 3 is out of range for type 'const char *const[3]' CPU: 1 UID: 0 PID: 4914 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:455 print_bpf_insn+0x19c4/0x1ee0 kernel/bpf/disasm.c:306 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 ---[ end trace ]--- ================================================================== BUG: KASAN: global-out-of-bounds in print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 Read of size 8 at addr ffff800086ad37d8 by task syz.0.17/4914 CPU: 1 UID: 0 PID: 4914 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 The buggy address belongs to the variable: bpf_ldsx_string+0x18/0x60 The buggy address belongs to a 0-page vmalloc region starting at 0xffff8000869d0000 allocated at declare_kernel_vmas+0x54/0xb4 arch/arm64/mm/mmu.c:1434 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2190d3 flags: 0x5ffc00000002000(reserved|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000002000 fffffdffc76434c8 fffffdffc76434c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800086ad3680: 00 03 f9 f9 f9 f9 f9 f9 00 01 f9 f9 00 00 00 05 ffff800086ad3700: f9 f9 f9 f9 00 06 f9 f9 00 04 f9 f9 00 05 f9 f9 >ffff800086ad3780: 00 00 00 06 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 ^ ffff800086ad3800: 00 00 00 00 00 00 00 03 f9 f9 f9 f9 00 00 00 00 ffff800086ad3880: 01 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 00 04 f9 f9 ================================================================== final repro crashed as (corrupted=false): ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:6 index 3 is out of range for type 'const char *const[3]' CPU: 1 UID: 0 PID: 4914 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:455 print_bpf_insn+0x19c4/0x1ee0 kernel/bpf/disasm.c:306 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 ---[ end trace ]--- ================================================================== BUG: KASAN: global-out-of-bounds in print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 Read of size 8 at addr ffff800086ad37d8 by task syz.0.17/4914 CPU: 1 UID: 0 PID: 4914 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 print_bpf_insn+0x80c/0x1ee0 kernel/bpf/disasm.c:-1 format_disasm_line kernel/bpf/diagnostics.c:633 [inline] diag_print_insn_context+0x360/0x808 kernel/bpf/diagnostics.c:783 bpf_diag_source+0x518/0xfd0 kernel/bpf/diagnostics.c:-1 bpf_diag_program_structure+0x1b0/0x250 kernel/bpf/diagnostics.c:1215 check_subprogs+0x510/0x5c0 kernel/bpf/verifier.c:3057 bpf_check+0x19a4/0x243c kernel/bpf/verifier.c:21097 bpf_prog_load+0xf4c/0x1554 kernel/bpf/syscall.c:3133 __sys_bpf+0x7d4/0x82c kernel/bpf/syscall.c:6367 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline] __se_sys_bpf kernel/bpf/syscall.c:6483 [inline] __arm64_sys_bpf+0xd0/0xec kernel/bpf/syscall.c:6483 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 The buggy address belongs to the variable: bpf_ldsx_string+0x18/0x60 The buggy address belongs to a 0-page vmalloc region starting at 0xffff8000869d0000 allocated at declare_kernel_vmas+0x54/0xb4 arch/arm64/mm/mmu.c:1434 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2190d3 flags: 0x5ffc00000002000(reserved|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000002000 fffffdffc76434c8 fffffdffc76434c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800086ad3680: 00 03 f9 f9 f9 f9 f9 f9 00 01 f9 f9 00 00 00 05 ffff800086ad3700: f9 f9 f9 f9 00 06 f9 f9 00 04 f9 f9 00 05 f9 f9 >ffff800086ad3780: 00 00 00 06 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 ^ ffff800086ad3800: 00 00 00 00 00 00 00 03 f9 f9 f9 f9 00 00 00 00 ffff800086ad3880: 01 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 00 04 f9 f9 ==================================================================