------------[ cut here ]------------ verifier bug: REG INVARIANTS VIOLATION (true_reg1): range bounds violation u64=[0x1f, 0x1f] s64=[0x1f, 0x1f] u32=[0x1f, 0x17] s32=[0x1f, 0x1f] var_off=(0x1f, 0x0)(1) WARNING: CPU: 0 PID: 6891 at kernel/bpf/verifier.c:2728 reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 Modules linked in: CPU: 0 UID: 0 PID: 6891 Comm: syz.1.55 Not tainted 6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 lr : reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 sp : ffff8000a1126c80 x29: ffff8000a1126d60 x28: 000000000000001f x27: 000000000000001f x26: 0000000000000017 x25: ffff0000d6deb188 x24: 000000000000001f x23: ffff0000d6deb168 x22: ffff0000d6deb1a0 x21: 000000000000001f x20: ffff0000d6deb1a8 x19: 1fffe0001adbd635 x18: 000000001d430000 x17: ffff0001fea8c8b0 x16: ffff80008b007340 x15: 0000000000000001 x14: 1ffff00014224d00 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000080000 x10: 0000000000061f95 x9 : 41319388571dc500 x8 : 41319388571dc500 x7 : ffff800080563af4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000807de560 x2 : 0000000000000002 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 (P) reg_set_min_max+0x14c/0x25c kernel/bpf/verifier.c:16334 check_cond_jmp_op+0x102c/0x2008 kernel/bpf/verifier.c:-1 do_check_insn kernel/bpf/verifier.c:19956 [inline] do_check+0x55c0/0xb650 kernel/bpf/verifier.c:20093 do_check_common+0x12c0/0x1cb8 kernel/bpf/verifier.c:23260 do_check_main kernel/bpf/verifier.c:23343 [inline] bpf_check+0x10600/0x15d8c kernel/bpf/verifier.c:24703 bpf_prog_load+0xec8/0x13fc kernel/bpf/syscall.c:2979 __sys_bpf+0x450/0x628 kernel/bpf/syscall.c:6029 __do_sys_bpf kernel/bpf/syscall.c:6139 [inline] __se_sys_bpf kernel/bpf/syscall.c:6137 [inline] __arm64_sys_bpf+0x80/0x98 kernel/bpf/syscall.c:6137 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 irq event stamp: 1466998 hardirqs last enabled at (1466997): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:86 [inline] hardirqs last enabled at (1466997): [] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:96 hardirqs last disabled at (1466998): [] el1_brk64+0x1c/0x48 arch/arm64/kernel/entry-common.c:574 softirqs last enabled at (1464954): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (1464952): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]---