Extracting prog: 1m32.52360844s
Minimizing prog: 17m45.538130907s
Simplifying prog options: 0s
Extracting C: 54.975755117s
Simplifying C: 9m11.478224776s


extracting reproducer from 37 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-openat$tun-bpf$PROG_LOAD-ioctl$TUNSETIFF-socket$kcm-setsockopt$sock_attach_bpf-ioctl$TUNSETLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0xa4, 0x1, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0xc}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x16}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1000})
r2 = socket$kcm(0xa, 0x1, 0x106)
setsockopt$sock_attach_bpf(r2, 0x1, 0x21, 0x0, 0x0)
ioctl$TUNSETLINK(r1, 0x400454cd, 0x310)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-openat$tun-bpf$PROG_LOAD-ioctl$TUNSETIFF-socket$kcm-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0xa4, 0x1, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0xc}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x16}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1000})
r2 = socket$kcm(0xa, 0x1, 0x106)
setsockopt$sock_attach_bpf(r2, 0x1, 0x21, 0x0, 0x0)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-openat$tun-bpf$PROG_LOAD-ioctl$TUNSETIFF-socket$kcm
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0xa4, 0x1, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0xc}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x16}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1000})
socket$kcm(0xa, 0x1, 0x106)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-openat$tun-bpf$PROG_LOAD-ioctl$TUNSETIFF
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0xa4, 0x1, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0xc}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x16}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1000})

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-openat$tun-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0xa4, 0x1, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0xc}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x16}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-openat$tun
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0xa4, 0x1, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0xc}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x16}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)

program did not crash
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_CT_GET-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0xa4, 0x1, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0xc}, [@CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_MARK_MASK={0x8}, @CTA_TUPLE_REPLY={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x16}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8000}, 0x20000010)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-bpf$PROG_LOAD
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)

program did not crash
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program did not crash
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program did not crash
testing program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program did not crash
extracting C reproducer
testing compiled C program (duration=45.564531985s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
simplifying C reproducer
testing compiled C program (duration=45.564531985s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing compiled C program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing compiled C program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing compiled C program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing compiled C program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing compiled C program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing compiled C program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
testing program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
validation run: crashed=true
testing program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
validation run: crashed=true
testing program (duration=45.564531985s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000810000000000000009000000850000008d000000998b6f1790a4ef1893c63cc095000000000000005b2ed9be9c412c109d47c62ac8824198d2a9875191246b2b1693f0a517452dc9400dd57e21495452648bbeead8cbb28c2133895100f2fbf2abb99513bb54204993d4c6bf0c6d020e8be9a764a7fedfb80def0442a355942b8e9813788f99ea02fc3a584d1ae1cd48f0ffe50f16d014925256c8b7048d2d0dbf5b8fc4132c7c36b7c7f5f2d5df22e37bdef594ceef3f564e1734e1012b7cbee72d87b97abfca1b9cfdea30263f77a334ed9d2d8ffcc0bcd7ba91cb4ffbb8ca0fb5ff4287b0c867fcf66f0303764793b6e2baa5a0415f74e02e73ed7f1283e2f75207f4c5a0699fb82d4efefb729395fefc9b7b2fdb033c5cabd9ee2d03bcc4c56e3c9446483939732c53c15da355247c1dfc024cc379ab4e41ae13748dcce4f6c4bb2fcbe9500f807021"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94)

program crashed: UBSAN: array-index-out-of-bounds in print_bpf_insn
validation run: crashed=true
reproducing took 34m10.221829162s
repro crashed as (corrupted=false):
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:6
index 3 is out of range for type 'const char *const[3]'
CPU: 0 UID: 0 PID: 5893 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:455
 print_bpf_insn+0x21f1/0x2910 kernel/bpf/disasm.c:306
 format_disasm_line kernel/bpf/diagnostics.c:633 [inline]
 diag_print_insn_context+0x433/0xd00 kernel/bpf/diagnostics.c:783
 bpf_diag_source+0x66a/0x1950 kernel/bpf/diagnostics.c:-1
 bpf_diag_program_structure+0x31c/0x430 kernel/bpf/diagnostics.c:1211
 check_subprogs+0x66b/0x740 kernel/bpf/verifier.c:3049
 bpf_check+0x17ba/0x2e10 kernel/bpf/verifier.c:21099
 bpf_prog_load+0x14d6/0x1c20 kernel/bpf/syscall.c:3133
 __sys_bpf+0xd0d/0xd90 kernel/bpf/syscall.c:6367
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0xba/0xd0 kernel/bpf/syscall.c:6483
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6341f9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd98b83628 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f6342225fa0 RCX: 00007f6341f9e0d9
RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005
RBP: 00007f6342035024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6342225fac R14: 00007f6342225fa0 R15: 00007f6342225fa0
 </TASK>
---[ end trace ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:6
index 3 is out of range for type 'const char *const[3]'
CPU: 0 UID: 0 PID: 5893 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xe8/0xf0 lib/ubsan.c:455
 print_bpf_insn+0x21f1/0x2910 kernel/bpf/disasm.c:306
 format_disasm_line kernel/bpf/diagnostics.c:633 [inline]
 diag_print_insn_context+0x433/0xd00 kernel/bpf/diagnostics.c:783
 bpf_diag_source+0x66a/0x1950 kernel/bpf/diagnostics.c:-1
 bpf_diag_program_structure+0x31c/0x430 kernel/bpf/diagnostics.c:1211
 check_subprogs+0x66b/0x740 kernel/bpf/verifier.c:3049
 bpf_check+0x17ba/0x2e10 kernel/bpf/verifier.c:21099
 bpf_prog_load+0x14d6/0x1c20 kernel/bpf/syscall.c:3133
 __sys_bpf+0xd0d/0xd90 kernel/bpf/syscall.c:6367
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0xba/0xd0 kernel/bpf/syscall.c:6483
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6341f9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd98b83628 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f6342225fa0 RCX: 00007f6341f9e0d9
RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005
RBP: 00007f6342035024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6342225fac R14: 00007f6342225fa0 R15: 00007f6342225fa0
 </TASK>
---[ end trace ]---