UBSAN: array-index-out-of-bounds in print_bpf_insn (2)

Status: upstream: reported C repro on 2026/08/20 01:33
Subsystems: bpf
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+3544d9b2a9206be8ba37@syzkaller.appspotmail.com
Fix commit: bpf: Reject invalid LDSX instruction in disassembly
Patched on: [ci-upstream-bpf-kasan-gce ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 20d, last: 53m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
bde42590 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ UBSAN: array-index-out-of-bounds in print_bpf_insn (2) 2026/08/17 03:28 2026/08/17 03:28 2026/08/17 03:58 746171ee
Discussions (3)
Title Replies (including bot) Last reply
Re: [PATCH] bpf: fix array-index-out-of-bounds in print_bpf_insn 1 (1) 2026/08/24 21:23
[PATCH bpf-next v1 1/2] bpf: Reject invalid LDSX instruction in disassembly 2 (2) 2026/08/20 05:23
[syzbot] [bpf?] UBSAN: array-index-out-of-bounds in print_bpf_insn (2) 0 (1) 2026/08/20 01:33
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in print_bpf_insn bpf 15 syz, C done 9 1130d 1131d 23/29 fixed on 2023/10/12 12:47
Cause bisection attempts (1)
Created Duration User Patch Repo Result
2026/08/16 22:55 0m bisect bpf-next error

Sample crash report:
------------[ cut here ]--
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:21
index 3 is out of range for type 'char *[3]'
CPU: 3 UID: 0 PID: 5927 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
 print_bpf_insn+0x2969/0x2a10 kernel/bpf/disasm.c:306
 format_disasm_line kernel/bpf/diagnostics.c:633 [inline]
 diag_print_insn_context+0x3ab/0x9b0 kernel/bpf/diagnostics.c:783
 bpf_diag_source+0x698/0x1540 kernel/bpf/diagnostics.c:896
 bpf_diag_program_structure+0x200/0x290 kernel/bpf/diagnostics.c:1215
 check_subprogs kernel/bpf/verifier.c:3057 [inline]
 bpf_check+0x5914/0xa7c0 kernel/bpf/verifier.c:21097
 bpf_prog_load+0x1ac3/0x2a80 kernel/bpf/syscall.c:3133
 __sys_bpf+0x1f46/0x4a30 kernel/bpf/syscall.c:6367
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0xce/0x140 kernel/bpf/syscall.c:6483
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f456219e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe31e31d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f4562425fa0 RCX: 00007f456219e159
RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005
RBP: 00007f4562235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4562425fac R14: 00007f4562425fa0 R15: 00007f4562425fa0
 </TASK>
---[ end trace ]---

Crashes (4402):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/02 09:38 upstream 89a312991dc6 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 16:23 upstream 786262be6048 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/01 15:39 upstream 786262be6048 587f6b29 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 04:46 bpf-next d761934c9483 587f6b29 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 03:55 net-next c8ea08ba34f2 587f6b29 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 08:05 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 07:30 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 06:09 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 04:56 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/16 03:39 bpf-next c93cbdb13f99 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 13:14 upstream 841e384b841a 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 19:06 upstream 940de590b839 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/30 16:59 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/29 19:20 upstream cf72cbb39da8 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/29 13:48 upstream cf72cbb39da8 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 15:08 upstream bc35965f6940 44dda43b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 13:12 upstream 940de590b839 a8a356ea .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/02 13:07 upstream 89a312991dc6 74e93e68 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 17:01 upstream 940de590b839 d2e5fb95 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 21:40 net 641d03105cc0 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 18:38 net 641d03105cc0 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 11:43 net adf50c47a47f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 10:20 net adf50c47a47f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 06:12 net adf50c47a47f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 03:42 net adf50c47a47f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 02:42 net adf50c47a47f 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 23:59 net adf50c47a47f 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 20:08 net 544d85de4dc2 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 14:27 net 544d85de4dc2 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 07:41 net 544d85de4dc2 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/05 01:55 net-next 6ebcf5074cff 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/05 01:46 bpf-next 3ccdb0781382 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/05 00:40 net-next 6ebcf5074cff 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 23:37 net-next 6ebcf5074cff 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 21:14 net-next 6ebcf5074cff 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 20:03 net-next 6ebcf5074cff 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 18:50 net-next 6ebcf5074cff 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 17:34 bpf-next 7bf591f26545 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 13:28 bpf-next 7bf591f26545 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 12:12 bpf-next 7bf591f26545 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 09:19 net-next 7042c8c193e5 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 09:03 bpf-next 7bf591f26545 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 08:02 bpf-next 7bf591f26545 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 07:13 net-next 7042c8c193e5 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 05:20 net-next 7042c8c193e5 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 04:17 net-next 7042c8c193e5 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 01:40 net-next 7042c8c193e5 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 23:10 bpf-next 418814c9fb26 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 21:56 net-next d0ec95a8a4e7 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 20:52 bpf-next 418814c9fb26 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 18:03 net-next d0ec95a8a4e7 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 16:31 net-next d0ec95a8a4e7 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 15:29 net-next d0ec95a8a4e7 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 13:26 net-next d0ec95a8a4e7 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 12:11 net-next d0ec95a8a4e7 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 10:54 bpf-next 418814c9fb26 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 10:49 bpf-next 418814c9fb26 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 09:45 bpf-next 418814c9fb26 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 08:43 bpf-next 418814c9fb26 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/21 14:44 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 22:43 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 5445d6419962 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/04 10:41 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci cee9395acd80 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/09/03 21:59 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci cee9395acd80 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 UBSAN: array-index-out-of-bounds in print_bpf_insn
2026/08/25 16:12 net-next 91ec20351349 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: global-out-of-bounds Read in print_bpf_insn
* Struck through repros no longer work on HEAD.