verifier bug: REG INVARIANTS VIOLATION (true_reg1): range bounds violation u64=[0xffffdfcd, 0xffffffffffffdfcc] s64=[0x80000000ffffdfcd, 0x7fffffffffffdfcc] u32=[0xffffdfcd, 0xffffdfcc] s32=[0xffffdfcd, 0xffffdfcc] var_off=(0xffffdfcc, 0xffffffff00000000) WARNING: CPU: 1 PID: 3856 at kernel/bpf/verifier.c:2715 reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715 Modules linked in: CPU: 1 UID: 0 PID: 3856 Comm: syz.0.130 Not tainted syzkaller #0 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715 lr : reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715 sp : ffff800089d83760 x29: ffff800089d83790 x28: 0000000000000006 x27: 0000000000000010 x26: f9f0000008e39b10 x25: 0000000000000001 x24: f7f000000b010000 x23: ffff800082458f80 x22: ffff800082458f08 x21: ffff80008245ad48 x20: f7f000000b010000 x19: f2f0000008e0ea30 x18: 00000000fffffffd x17: fff07ffffcfbc000 x16: ffff800082d40000 x15: ffff800089d83370 x14: 00000000ffffffea x13: 000000000000023e x12: ffff800082951250 x11: 00000000000000c0 x10: 3dfa4a33a6ed997e x9 : 54e4b6aa9ba7159b x8 : f7f000000a46b7b8 x7 : 0000000000000004 x6 : 00000000ffffffff x5 : 0000000000000002 x4 : 0000000000000001 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000000 x0 : f7f000000a46a580 Call trace: reg_bounds_sanity_check+0x164/0x20c kernel/bpf/verifier.c:2715 (P) reg_set_min_max kernel/bpf/verifier.c:16407 [inline] reg_set_min_max+0x114/0x1f4 kernel/bpf/verifier.c:16381 check_cond_jmp_op+0x8c8/0x132c kernel/bpf/verifier.c:16841 do_check_insn kernel/bpf/verifier.c:19929 [inline] do_check kernel/bpf/verifier.c:20069 [inline] do_check_common+0x2974/0x2a54 kernel/bpf/verifier.c:23259 do_check_main kernel/bpf/verifier.c:23342 [inline] bpf_check+0x22e0/0x2a24 kernel/bpf/verifier.c:24647 bpf_prog_load+0x63c/0xcd4 kernel/bpf/syscall.c:3077 __sys_bpf+0x2e0/0x1a88 kernel/bpf/syscall.c:6149 __do_sys_bpf kernel/bpf/syscall.c:6259 [inline] __se_sys_bpf kernel/bpf/syscall.c:6257 [inline] __arm64_sys_bpf+0x24/0x34 kernel/bpf/syscall.c:6257 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0x10c arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: invalid-access in __memcpy+0xc/0x54 arch/arm64/lib/memcpy.S:250 Write at addr f8ff800089e457e7 by task syz.0.130/3856 Pointer tag: [f8], memory tag: [fe] CPU: 1 UID: 0 PID: 3856 Comm: syz.0.130 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x78/0x90 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x108/0x61c mm/kasan/report.c:482 kasan_report+0x88/0xac mm/kasan/report.c:595 report_tag_fault arch/arm64/mm/fault.c:326 [inline] do_tag_recovery arch/arm64/mm/fault.c:338 [inline] __do_kernel_fault+0x170/0x1c8 arch/arm64/mm/fault.c:380 do_bad_area+0x68/0x78 arch/arm64/mm/fault.c:480 do_tag_check_fault+0x34/0x44 arch/arm64/mm/fault.c:853 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:929 el1_abort+0x44/0x68 arch/arm64/kernel/entry-common.c:325 el1h_64_sync_handler+0x50/0xac arch/arm64/kernel/entry-common.c:459 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591 __memcpy+0xc/0x54 arch/arm64/lib/memcpy.S:250 (P) convert_ctx_accesses+0x694/0xb28 kernel/bpf/verifier.c:21478 bpf_check+0x1338/0x2a24 kernel/bpf/verifier.c:24683 bpf_prog_load+0x63c/0xcd4 kernel/bpf/syscall.c:3077 __sys_bpf+0x2e0/0x1a88 kernel/bpf/syscall.c:6149 __do_sys_bpf kernel/bpf/syscall.c:6259 [inline] __se_sys_bpf kernel/bpf/syscall.c:6257 [inline] __arm64_sys_bpf+0x24/0x34 kernel/bpf/syscall.c:6257 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0x10c arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:596 The buggy address belongs to a 1-page vmalloc region starting at 0xf8ff800089e45000 allocated at bpf_check+0x8c/0x2a24 kernel/bpf/verifier.c:24529 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x48d5c flags: 0x1ffdc0000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x7) raw: 01ffdc0000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800089e45500: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffff800089e45600: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffff800089e45700: f8 f8 f8 f8 f8 f8 f8 f8 f8 fe fe fe fe fe fe fe ^ ffff800089e45800: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ffff800089e45900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ==================================================================