------------[ cut here ]------------
verifier bug: scev clamp produced empty range for r8
WARNING: kernel/bpf/scev.c:2898 at bpf_clamp_scev_regs+0x1712/0x1870 kernel/bpf/scev.c:2898, CPU#0: syz-executor304/5633
Modules linked in:
CPU: 0 UID: 0 PID: 5633 Comm: syz-executor304 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:bpf_clamp_scev_regs+0x1719/0x1870 kernel/bpf/scev.c:2898
Code: 48 81 c4 f0 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cb f4 00 0a cc e8 25 0f d9 ff 48 8d 3d ae 3e 8f 0f 48 8b 5c 24 10 89 de <67> 48 0f b9 3a 48 8b 7c 24 58 48 c7 c6 a0 a5 16 8c 89 da e8 1f 82
RSP: 0018:ffffc90003a1f438 EFLAGS: 00010293
RAX: ffffffff81ef855b RBX: 0000000000000008 RCX: ffff888033c51f40
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff917ec410
RBP: ffffffffffffffff R08: ffffc90003a1f507 R09: 0000000000000000
R10: ffffc90003a1f4e8 R11: fffff52000743ea1 R12: ffff888036f64000
R13: ffff88807ecc0cc8 R14: ffff888076d672b8 R15: ffff888076d67280
FS:  000055558766c400(0000) GS:ffff888123aab000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 0000000033ee0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 maybe_clamp_scev_regs kernel/bpf/verifier.c:20442 [inline]
 handle_loop_entry_exit kernel/bpf/verifier.c:20472 [inline]
 do_check kernel/bpf/verifier.c:20568 [inline]
 do_check_common+0x4c3f/0x7560 kernel/bpf/verifier.c:21902
 do_check_main+0x95/0x1f0 kernel/bpf/verifier.c:22004
 bpf_check+0x3067/0x3530 kernel/bpf/verifier.c:24017
 bpf_prog_load+0x1594/0x1d60 kernel/bpf/syscall.c:3176
 __sys_bpf+0xdeb/0xe70 kernel/bpf/syscall.c:6484
 __do_sys_bpf kernel/bpf/syscall.c:6606 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6603 [inline]
 __x64_sys_bpf+0xba/0xd0 kernel/bpf/syscall.c:6603
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0f6f627609
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff1a1533c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0f6f627609
RDX: 0000000000000094 RSI: 0000200000001000 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 431bde82d7b634db R14: 00007f0f6f6bac40 R15: 0000000000000002
 </TASK>
----------------
Code disassembly (best guess):
   0:	48 81 c4 f0 00 00 00 	add    $0xf0,%rsp
   7:	5b                   	pop    %rbx
   8:	41 5c                	pop    %r12
   a:	41 5d                	pop    %r13
   c:	41 5e                	pop    %r14
   e:	41 5f                	pop    %r15
  10:	5d                   	pop    %rbp
  11:	e9 cb f4 00 0a       	jmp    0xa00f4e1
  16:	cc                   	int3
  17:	e8 25 0f d9 ff       	call   0xffd90f41
  1c:	48 8d 3d ae 3e 8f 0f 	lea    0xf8f3eae(%rip),%rdi        # 0xf8f3ed1
  23:	48 8b 5c 24 10       	mov    0x10(%rsp),%rbx
  28:	89 de                	mov    %ebx,%esi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	48 8b 7c 24 58       	mov    0x58(%rsp),%rdi
  34:	48 c7 c6 a0 a5 16 8c 	mov    $0xffffffff8c16a5a0,%rsi
  3b:	89 da                	mov    %ebx,%edx
  3d:	e8                   	.byte 0xe8
  3e:	1f                   	(bad)
  3f:	82                   	.byte 0x82