------------[ cut here ]------------ verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0x4000000, 0x0] s64=[0x4000000, 0x0] u32=[0x4000000, 0x0] s32=[0x4000000, 0x0] var_off=(0x0, 0x0)(1) WARNING: CPU: 1 PID: 6988 at kernel/bpf/verifier.c:2728 reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 Modules linked in: CPU: 1 UID: 0 PID: 6988 Comm: syz.0.42 Not tainted 6.17.0-rc1-syzkaller-g8f5ae30d69d7 #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 lr : reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 sp : ffff8000a5676c80 x29: ffff8000a5676d60 x28: 0000000000000000 x27: 0000000004000000 x26: 0000000000000000 x25: ffff0000f6b822f0 x24: 0000000004000000 x23: ffff0000f6b822d0 x22: ffff0000f6b82308 x21: 0000000000000000 x20: ffff0000f6b82310 x19: 1fffe0001ed70462 x18: 0000000007040000 x17: 000000002007ff0f x16: ffff80008b007340 x15: 0000000000000001 x14: 1ffff00014aced00 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000080000 x10: 00000000000131de x9 : 46e037c624ea7b00 x8 : 46e037c624ea7b00 x7 : ffff800080563af4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000807de560 x2 : 0000000000000002 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: reg_bounds_sanity_check+0x7e8/0xa6c kernel/bpf/verifier.c:2722 (P) reg_set_min_max+0x1b4/0x25c kernel/bpf/verifier.c:16336 check_cond_jmp_op+0x102c/0x2008 kernel/bpf/verifier.c:-1 do_check_insn kernel/bpf/verifier.c:19956 [inline] do_check+0x55c0/0xb650 kernel/bpf/verifier.c:20093 do_check_common+0x12c0/0x1cb8 kernel/bpf/verifier.c:23260 do_check_main kernel/bpf/verifier.c:23343 [inline] bpf_check+0x10600/0x15d8c kernel/bpf/verifier.c:24703 bpf_prog_load+0xec8/0x13fc kernel/bpf/syscall.c:2979 __sys_bpf+0x450/0x628 kernel/bpf/syscall.c:6029 __do_sys_bpf kernel/bpf/syscall.c:6139 [inline] __se_sys_bpf kernel/bpf/syscall.c:6137 [inline] __arm64_sys_bpf+0x80/0x98 kernel/bpf/syscall.c:6137 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x180 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 irq event stamp: 480 hardirqs last enabled at (479): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:86 [inline] hardirqs last enabled at (479): [] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:96 hardirqs last disabled at (480): [] el1_brk64+0x1c/0x48 arch/arm64/kernel/entry-common.c:574 softirqs last enabled at (82): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (80): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]---