------------[ cut here ]------------ verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0x4000000, 0x0] s64=[0x4000000, 0x0] u32=[0x4000000, 0x0] s32=[0x4000000, 0x0] var_off=(0x0, 0x0) WARNING: kernel/bpf/verifier.c:2742 at reg_bounds_sanity_check+0x550/0x170c kernel/bpf/verifier.c:2742, CPU#0: syz.2.512/5088 Modules linked in: CPU: 0 UID: 0 PID: 5088 Comm: syz.2.512 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : reg_bounds_sanity_check+0x550/0x170c kernel/bpf/verifier.c:2742 lr : reg_bounds_sanity_check+0x550/0x170c kernel/bpf/verifier.c:2742 sp : ffff8000a0926f90 x29: ffff8000a0926fc0 x28: 1fffe000037d825d x27: 1fffe000037d825e x26: 1fffe000037d825e x25: 0000000000000000 x24: 0000000004000000 x23: ffff8000857a66e0 x22: 0000000000000004 x21: 0000000000000004 x20: ffff000026010000 x19: ffff00001bec12a0 x18: 0000000000000000 x17: 000000002007ff0f x16: 00000000f1f1f1f1 x15: 0000000000000006 x14: 0000000000000001 x13: 0000000000000001 x12: ffff700014124d89 x11: 1ffff00014124d88 x10: ffff700014124d88 x9 : dfff800000000000 x8 : ffff8000a0926c47 x7 : 0000000000000001 x6 : ffff700014124d88 x5 : 1ffff00010e85c1c x4 : 1fffe0000287e721 x3 : dfff800000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000143f3900 Call trace: reg_bounds_sanity_check+0x550/0x170c kernel/bpf/verifier.c:2742 (P) reg_set_min_max kernel/bpf/verifier.c:16577 [inline] reg_set_min_max+0x1bc/0x248 kernel/bpf/verifier.c:16542 check_cond_jmp_op+0xd20/0x576c kernel/bpf/verifier.c:17021 do_check_insn kernel/bpf/verifier.c:20446 [inline] do_check kernel/bpf/verifier.c:20586 [inline] do_check_common+0x8774/0x96e4 kernel/bpf/verifier.c:23870 do_check_main kernel/bpf/verifier.c:23953 [inline] bpf_check+0x6ae4/0x8d80 kernel/bpf/verifier.c:25260 bpf_prog_load+0x11c0/0x2000 kernel/bpf/syscall.c:3088 __sys_bpf+0xf7c/0x2964 kernel/bpf/syscall.c:6164 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __arm64_sys_bpf+0x70/0xa4 kernel/bpf/syscall.c:6272 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x70/0x260 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x29c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 irq event stamp: 572 hardirqs last enabled at (571): [] irqentry_exit+0x11c/0x494 kernel/entry/common.c:219 hardirqs last disabled at (572): [] el1_brk64+0x20/0x60 arch/arm64/kernel/entry-common.c:412 softirqs last enabled at (332): [] softirq_handle_end kernel/softirq.c:468 [inline] softirqs last enabled at (332): [] handle_softirqs+0x874/0xd88 kernel/softirq.c:650 softirqs last disabled at (317): [] __do_softirq+0x14/0x20 kernel/softirq.c:656 ---[ end trace 0000000000000000 ]---