verifier bug: REG INVARIANTS VIOLATION (true_reg1): range bounds violation u64=[0xffffdfcd, 0xffffffffffffdfcc] s64=[0x80000000ffffdfcd, 0x7fffffffffffdfcc] u32=[0xffffdfcd, 0xffffdfcc] s32=[0xffffdfcd, 0xffffdfcc] var_off=(0xffffdfcc, 0xffffffff00000000)
WARNING: CPU: 0 PID: 3811 at kernel/bpf/verifier.c:2715 reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715
Modules linked in:
CPU: 0 UID: 0 PID: 3811 Comm: syz.1.151 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
pstate: 60402009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715
lr : reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715
sp : ffff80008a163760
x29: ffff80008a163790 x28: 0000000000000006 x27: 0000000000000010
x26: fdf0000008e14310 x25: 0000000000000001 x24: f5f000000b3a0000
x23: ffff800082458f80 x22: ffff800082458f08 x21: ffff80008245ad48
x20: f5f000000b3a0000 x19: f7f000000a670a30 x18: 00000000fffffffd
x17: fff07ffffcfa3000 x16: ffff800082d38000 x15: ffff80008a163370
x14: 00000000ffffffea x13: ffff80008a163438 x12: ffff800082a2f940
x11: 0000000000000001 x10: 0000000000000001 x9 : 000000000002ffe8
x8 : c0000000ffffdfff x7 : ffff80008297f8b8 x6 : 00000000000affa8
x5 : fff000007f8cc508 x4 : 0000000000000000 x3 : fff07ffffcfa3000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : f7f0000008e00000
Call trace:
 reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715 (P)
 reg_set_min_max kernel/bpf/verifier.c:16407 [inline]
 reg_set_min_max+0x114/0x1f4 kernel/bpf/verifier.c:16381
 check_cond_jmp_op+0x8c8/0x132c kernel/bpf/verifier.c:16841
 do_check_insn kernel/bpf/verifier.c:19929 [inline]
 do_check kernel/bpf/verifier.c:20069 [inline]
 do_check_common+0x2974/0x2a54 kernel/bpf/verifier.c:23259
 do_check_main kernel/bpf/verifier.c:23342 [inline]
 bpf_check+0x22e0/0x2a24 kernel/bpf/verifier.c:24647
 bpf_prog_load+0x63c/0xcd4 kernel/bpf/syscall.c:3077
 __sys_bpf+0x2e0/0x1a88 kernel/bpf/syscall.c:6149
 __do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
 __arm64_sys_bpf+0x24/0x34 kernel/bpf/syscall.c:6257
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0x10c arch/arm64/kernel/entry-common.c:746
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:765
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596
---[ end trace 0000000000000000 ]---