syzbot


WARNING in convert_ctx_accesses (2)

Status: upstream: reported C repro on 2025/09/13 08:23
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
Fix commit: 6fabca2fc94d bpf: Explicitly check accesses to bpf_sock_addr
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-upstream-gce-arm64]
First crash: 27d, last: 12d
Discussions (3)
Title Replies (including bot) Last reply
[PATCH bpf-next v2 1/3] bpf: Explicitly check accesses to bpf_sock_addr 1 (1) 2025/09/17 08:08
[PATCH bpf 1/3] bpf: Explicitly check accesses to bpf_sock_addr 5 (5) 2025/09/17 08:02
[syzbot] [bpf?] WARNING in convert_ctx_accesses (2) 0 (1) 2025/09/13 08:23
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in convert_ctx_accesses bpf -1 C done 80 49d 71d 29/29 fixed on 2025/09/04 16:57

Sample crash report:
------------[ cut here ]------------
verifier bug: error during ctx access conversion (0)(1)
WARNING: CPU: 0 PID: 3582 at kernel/bpf/verifier.c:21452 convert_ctx_accesses+0x9b0/0xb04 kernel/bpf/verifier.c:21452
Modules linked in:
CPU: 0 UID: 0 PID: 3582 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
pstate: 60402009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : convert_ctx_accesses+0x9b0/0xb04 kernel/bpf/verifier.c:21452
lr : convert_ctx_accesses+0x9b0/0xb04 kernel/bpf/verifier.c:21452
sp : ffff8000893939e0
x29: ffff8000893939e0 x28: faf0000008948000 x27: 0000000000000002
x26: f8ff8000832d5058 x25: 0000000000000000 x24: 0000000000000000
x23: ffff8000816c4744 x22: 0000000000000004 x21: 0000000000000002
x20: 0000000000000004 x19: ffff80008242a948 x18: 0000000000000001
x17: fff07ffffcfe1000 x16: ffff800080000000 x15: fff000007f8d4980
x14: 00000000000002de x13: 0000000000000000 x12: 0000000000000000
x11: 00000000000000c0 x10: b2ff97ff6a7f8b51 x9 : a6a5f6a0197b216f
x8 : f9f0000008b04978 x7 : 0000000000000190 x6 : 000000259596bf72
x5 : 0000000000000001 x4 : fbffff3fffffffff x3 : 000000000000ffff
x2 : 0000000000000000 x1 : 0000000000000000 x0 : f9f0000008b03780
Call trace:
 convert_ctx_accesses+0x9b0/0xb04 kernel/bpf/verifier.c:21452 (P)
 bpf_check+0x12f8/0x2aac kernel/bpf/verifier.c:24743
 bpf_prog_load+0x634/0xb74 kernel/bpf/syscall.c:2979
 __sys_bpf+0x2e0/0x1a3c kernel/bpf/syscall.c:6029
 __do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
 __arm64_sys_bpf+0x24/0x34 kernel/bpf/syscall.c:6137
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0x10c arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596
---[ end trace 0000000000000000 ]---

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/13 10:55 upstream 22f20375f5b7 e2beed91 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/13 10:01 upstream 22f20375f5b7 e2beed91 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/13 09:07 upstream 22f20375f5b7 e2beed91 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/13 08:13 upstream 22f20375f5b7 e2beed91 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/28 13:43 upstream 51a24b7deaae 001c9061 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 WARNING in convert_ctx_accesses
2025/09/28 13:42 upstream 51a24b7deaae 001c9061 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 WARNING in convert_ctx_accesses
2025/09/28 11:19 upstream 51a24b7deaae 001c9061 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/28 11:18 upstream 51a24b7deaae 001c9061 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/16 21:36 upstream 46a51f4f5eda e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-compat WARNING in convert_ctx_accesses
2025/09/16 21:35 upstream 46a51f4f5eda e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-compat WARNING in convert_ctx_accesses
2025/09/16 17:17 upstream 46a51f4f5eda e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 WARNING in convert_ctx_accesses
2025/09/16 17:16 upstream 46a51f4f5eda e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 WARNING in convert_ctx_accesses
2025/09/14 21:34 upstream f83a4f2a4d8c e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/14 21:33 upstream f83a4f2a4d8c e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/13 07:09 upstream 22f20375f5b7 e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
2025/09/13 07:08 upstream 22f20375f5b7 e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in convert_ctx_accesses
* Struck through repros no longer work on HEAD.