Re: [PATCH] bpf: fix array-index-out-of-bounds in print_bpf_insn

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Mon Aug 24, 2026 at 10:41 PM CEST, Rik van Riel wrote:
> syzkaller triggers UBSAN array-index-out-of-bounds and panic_on_warn
> panic in print_bpf_insn() when loading a BPF program containing
> BPF_LDX | BPF_MEMSX | BPF_DW.
>
> bpf_ldsx_string[] holds three entries for B/H/W (s8/s16/s32).
> BPF_DW gives index 3 and reads past the array. check_subprogs()
> prints the program via bpf_diag_program_structure() before
> do_check() validates the instruction, so the illegal insn reaches
> the disassembler.
>
>     UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:21
>     index 3 is out of range for type 'char *[3]'
>     print_bpf_insn+0x2328/0x2940 kernel/bpf/disasm.c:306
>     format_disasm_line kernel/bpf/diagnostics.c:633
>     diag_print_insn_context+0x3a5/0x930 kernel/bpf/diagnostics.c:783
>     bpf_diag_source+0x615/0x14a0 kernel/bpf/diagnostics.c:896
>     bpf_diag_program_structure+0x1f9/0x280 kernel/bpf/diagnostics.c:1215
>     check_subprogs+0x5c3/0x650 kernel/bpf/verifier.c:3057
>     bpf_check+0x1935/0x89f0 kernel/bpf/verifier.c:21097
>     bpf_prog_load+0x17dd/0x2990 kernel/bpf/syscall.c:3133
>
> Guard any size index beyond the corresponding string table and emit
> BUG_ldx instead of accessing memory beyond the end of the the array.
>
> Fixes: f835bb622299 ("bpf: Add kernel/bpftool asm support for new instructions")
> Assisted-by: claw:muse-spark-1.2 syzkaller
> Signed-off-by: Rik van Riel <riel@surriel.coM>
> ---

Already fixed by https://lore.kernel.org/bpf/20260820022020.3450479-2-memxor@gmail.com.

pw-bot: cr

> [...]