syzbot


WARNING in reg_bounds_sanity_check (2)

Status: upstream: reported C repro on 2025/09/05 11:36
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+c950cc277150935cc0b5@syzkaller.appspotmail.com
First crash: 47d, last: 15m
Cause bisection: introduced by (bisect log) :
commit 0df1a55afa832f463f9ad68ddc5de92230f1bc8a
Author: Paul Chaignon <paul.chaignon@gmail.com>
Date: Tue Jul 1 18:36:15 2025 +0000

  bpf: Warn on internal verifier errors

Crash: WARNING in reg_bounds_sanity_check (log)
Repro: C syz .config
  
Discussions (4)
Title Replies (including bot) Last reply
Re: BPF verifier missing range intersection validation in subregister bounds deduction 1 (1) 2025/10/17 14:58
[syzbot] Monthly bpf report (Oct 2025) 0 (1) 2025/10/06 17:29
[PATCH] bpf: verifier: fix WARNING in reg_bounds_sanity_check (2) 3 (3) 2025/09/16 07:39
[syzbot] [bpf?] WARNING in reg_bounds_sanity_check (2) 0 (5) 2025/09/13 21:56
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in reg_bounds_sanity_check bpf -1 C done 6525 48d 112d 29/29 fixed on 2025/09/04 16:57
Last patch testing requests (3)
Created Duration User Patch Repo Result
2025/09/13 21:56 22m kriish.sharma2006@gmail.com patch upstream OK log
2025/09/13 21:17 27m kriish.sharma2006@gmail.com patch upstream OK log
2025/09/13 20:47 0m kriish.sharma2006@gmail.com patch upstream error

Sample crash report:
verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0xfffffffefffff630, 0xffffffff00000000] s64=[0xfffffffefffff630, 0xffffffff00000000] u32=[0x30, 0x8000050] s32=[0x30, 0x0] var_off=(0xfffffffe00000030, 0x10fffffc0)(1)
WARNING: CPU: 1 PID: 6031 at kernel/bpf/verifier.c:2722 reg_bounds_sanity_check+0x62b/0x1200 kernel/bpf/verifier.c:2722
Modules linked in:
CPU: 1 UID: 0 PID: 6031 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:reg_bounds_sanity_check+0x62b/0x1200 kernel/bpf/verifier.c:2722
Code: 45 ac 50 8b 45 b0 50 8b 45 b4 50 ff 75 b8 4c 8b 4d c0 4c 8b 45 c8 48 8b 95 58 ff ff ff 48 8b b5 60 ff ff ff e8 96 76 aa ff 90 <0f> 0b 90 90 48 8b 95 40 ff ff ff 48 83 c4 38 48 b8 00 00 00 00 00
RSP: 0018:ffffc900043af2f8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: fffffffefffff630 RCX: ffffffff817a3388
RDX: ffff88802ab90000 RSI: ffffffff817a3395 RDI: 0000000000000001
RBP: ffffc900043af3f0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880756a0000
R13: ffff888023fb01bc R14: ffff888023fb01b4 R15: ffff888023fb0168
FS:  00005555645e7500(0000) GS:ffff8881247b6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8dcc7c7dac CR3: 00000000753db000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 reg_set_min_max kernel/bpf/verifier.c:16336 [inline]
 reg_set_min_max+0x1dc/0x2c0 kernel/bpf/verifier.c:16308
 check_cond_jmp_op+0x19b0/0x72d0 kernel/bpf/verifier.c:16768
 do_check_insn kernel/bpf/verifier.c:19956 [inline]
 do_check kernel/bpf/verifier.c:20093 [inline]
 do_check_common+0xa13e/0xb410 kernel/bpf/verifier.c:23260
 do_check_main kernel/bpf/verifier.c:23343 [inline]
 bpf_check+0x869f/0xc670 kernel/bpf/verifier.c:24703
 bpf_prog_load+0xe41/0x2490 kernel/bpf/syscall.c:2979
 __sys_bpf+0x4a3f/0x4de0 kernel/bpf/syscall.c:6029
 __do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:6137
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8dcc58ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc501e4a78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f8dcc7c5fa0 RCX: 00007f8dcc58ebe9
RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005
RBP: 00007f8dcc611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8dcc7c5fa0 R14: 00007f8dcc7c5fa0 R15: 0000000000000003
 </TASK>

Crashes (6070):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/05 12:12 upstream d69eb204c255 d291dd2d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/09/05 11:32 upstream d69eb204c255 d291dd2d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/10/21 02:53 upstream 6548d364a3e8 9832ed61 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/09/24 11:28 upstream cec1e6e5d1ab 0abd0691 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/09/05 12:06 upstream d69eb204c255 d291dd2d .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/09/05 11:27 upstream d69eb204c255 d291dd2d .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/09/05 11:27 upstream d69eb204c255 d291dd2d .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/09/05 11:08 upstream d69eb204c255 d291dd2d .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/09/13 16:11 bpf 22f20375f5b7 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/09/13 15:40 bpf 22f20375f5b7 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/09/13 15:11 bpf 22f20375f5b7 e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/09/22 22:16 bpf-next 5a427fddec5e 0ac7291c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce WARNING in reg_bounds_sanity_check
2025/09/22 21:45 bpf-next 5a427fddec5e 0ac7291c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce WARNING in reg_bounds_sanity_check
2025/09/22 21:13 bpf-next 5a427fddec5e 0ac7291c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/22 20:09 upstream 250a17e8f955 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/10/22 19:01 upstream 250a17e8f955 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/10/21 22:15 upstream 6548d364a3e8 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING in reg_bounds_sanity_check
2025/10/21 21:14 upstream 6548d364a3e8 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING in reg_bounds_sanity_check
2025/10/21 20:01 upstream 6548d364a3e8 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING in reg_bounds_sanity_check
2025/10/21 10:28 upstream 211ddde0823f 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING in reg_bounds_sanity_check
2025/10/21 10:03 upstream 211ddde0823f 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING in reg_bounds_sanity_check
2025/10/21 07:25 upstream 211ddde0823f 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/10/20 19:00 upstream 211ddde0823f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING in reg_bounds_sanity_check
2025/10/20 16:28 upstream 211ddde0823f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING in reg_bounds_sanity_check
2025/10/20 11:26 upstream 211ddde0823f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/10/20 06:19 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING in reg_bounds_sanity_check
2025/10/20 01:15 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING in reg_bounds_sanity_check
2025/10/20 01:15 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING in reg_bounds_sanity_check
2025/10/19 21:48 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/10/19 20:33 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING in reg_bounds_sanity_check
2025/10/19 20:31 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING in reg_bounds_sanity_check
2025/10/19 17:00 upstream 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING in reg_bounds_sanity_check
2025/10/19 12:17 upstream 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING in reg_bounds_sanity_check
2025/10/19 10:50 upstream 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in reg_bounds_sanity_check
2025/10/22 20:02 upstream dd72c8fcf6d3 c0460fcd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/10/22 18:11 upstream dd72c8fcf6d3 c0460fcd .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/10/22 16:46 upstream dd72c8fcf6d3 c0460fcd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/10/22 08:40 upstream 552c50713f27 252fbbad .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/10/21 18:55 upstream 6548d364a3e8 252fbbad .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/10/21 07:32 upstream 6548d364a3e8 9832ed61 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/10/21 07:24 upstream 6548d364a3e8 9832ed61 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/10/21 05:38 upstream 6548d364a3e8 9832ed61 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/10/21 03:55 upstream 6548d364a3e8 9832ed61 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/10/20 23:29 upstream 211ddde0823f d422939c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in reg_bounds_sanity_check
2025/10/19 18:40 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in reg_bounds_sanity_check
2025/10/22 13:48 upstream 211ddde0823f 252fbbad .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64 WARNING in reg_bounds_sanity_check
2025/10/22 06:05 upstream 211ddde0823f 252fbbad .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in reg_bounds_sanity_check
2025/10/21 14:12 upstream 211ddde0823f 9832ed61 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in reg_bounds_sanity_check
2025/10/20 05:12 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in reg_bounds_sanity_check
2025/10/20 03:10 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte WARNING in reg_bounds_sanity_check
2025/10/19 10:54 upstream 1c64efcb083c 1c8c8cd8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING in reg_bounds_sanity_check
2025/10/14 06:38 upstream 3a8660878839 b6605ba8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-compat WARNING in reg_bounds_sanity_check
2025/10/22 15:25 bpf 881a9c9cb785 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/22 11:35 bpf 881a9c9cb785 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/22 06:44 bpf 881a9c9cb785 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/21 05:45 net ffff5c8fc2af 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/21 02:04 bpf 1c64efcb083c 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/21 02:02 bpf 1c64efcb083c 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/20 15:40 bpf 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/20 14:10 bpf 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/20 08:59 bpf 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/22 15:03 bpf-next e7586577b75f 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/22 04:38 bpf-next e7586577b75f 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/21 18:40 bpf-next 04a899573fb8 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/20 14:09 bpf-next 7361c864852f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-next-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/04 23:43 net-next 07fdad3a9375 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in reg_bounds_sanity_check
2025/10/21 00:54 linux-next 606da5bb1655 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in reg_bounds_sanity_check
2025/10/20 08:36 linux-next 606da5bb1655 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in reg_bounds_sanity_check
2025/10/21 20:07 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 143937ca51cc 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in reg_bounds_sanity_check
2025/10/21 17:25 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 143937ca51cc 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in reg_bounds_sanity_check
2025/10/20 07:32 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in reg_bounds_sanity_check
* Struck through repros no longer work on HEAD.