From: sanan.hasanou@gmail.com
To: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com,
andrii@kernel.org, martin.lau@linux.dev, eddyz87@gmail.com,
song@kernel.org, yonghong.song@linux.dev, kpsingh@kernel.org,
sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: WARNING in bpf_check
Date: Fri, 26 Jun 2026 14:28:58 -0700 (PDT) [thread overview]
Message-ID: <6a3eef1a.516c2524.21c3a2.afcd@mx.google.com> (raw)
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1k9D2rcoA6Ta2EKqEXXLkEqia9y0Pezfk>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!
Best regards,
Sanan Hasanov
------------[ cut here ]------------
verifier bug: error during ctx access conversion (1)
WARNING: kernel/bpf/verifier.c:22670 at convert_ctx_accesses kernel/bpf/verifier.c:22670 [inline], CPU#0: syz.5.97/11999
WARNING: kernel/bpf/verifier.c:22670 at bpf_check+0x11a77/0x1c9a0 kernel/bpf/verifier.c:26032, CPU#0: syz.5.97/11999
Modules linked in:
CPU: 0 UID: 0 PID: 11999 Comm: syz.5.97 Not tainted 7.0.0-rc1 #1 PREEMPT_{RT,(full)}
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:convert_ctx_accesses kernel/bpf/verifier.c:22670 [inline]
RIP: 0010:bpf_check+0x11a79/0x1c9a0 kernel/bpf/verifier.c:26032
Code: 84 a7 00 00 41 88 1e 83 7c 24 08 00 0f 84 8e 00 00 00 e8 0a 1e de ff e9 fc 40 00 00 e8 00 1e de ff 48 8d 3d f9 87 ef 0f 89 de <67> 48 0f b9 3a 48 8b bc 24 78 01 00 00 48 c7 c6 c0 7f 78 8c 89 da
RSP: 0018:ffffc9000c19f640 EFLAGS: 00010283
RAX: ffffffff81bb16f0 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000f4d1000 RSI: 0000000000000001 RDI: ffffffff91aa9ef0
RBP: ffffc9000c19fb30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000040 R12: 0000000000000004
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000002
FS: 00007f01a33266c0(0000) GS:ffff88809826b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f01a5347dac CR3: 000000004a65a000 CR4: 00000000000006f0
Call Trace:
<TASK>
bpf_prog_load+0x13be/0x19e0 kernel/bpf/syscall.c:3089
__sys_bpf+0x5c8/0x8a0 kernel/bpf/syscall.c:6228
__do_sys_bpf kernel/bpf/syscall.c:6341 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6339 [inline]
__x64_sys_bpf+0x81/0x90 kernel/bpf/syscall.c:6339
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0x760 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f01a50d3b6d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f01a3326018 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f01a5345fa0 RCX: 00007f01a50d3b6d
RDX: 0000000000000080 RSI: 0000200000000140 RDI: 0000000000000005
RBP: 00007f01a5177c3e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f01a5346038 R14: 00007f01a5345fa0 R15: 00007ffe12d33220
</TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
0: a7 cmpsl %es:(%rdi),%ds:(%rsi)
1: 00 00 add %al,(%rax)
3: 41 88 1e mov %bl,(%r14)
6: 83 7c 24 08 00 cmpl $0x0,0x8(%rsp)
b: 0f 84 8e 00 00 00 je 0x9f
11: e8 0a 1e de ff call 0xffde1e20
16: e9 fc 40 00 00 jmp 0x4117
1b: e8 00 1e de ff call 0xffde1e20
20: 48 8d 3d f9 87 ef 0f lea 0xfef87f9(%rip),%rdi # 0xfef8820
27: 89 de mov %ebx,%esi
* 29: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2e: 48 8b bc 24 78 01 00 mov 0x178(%rsp),%rdi
35: 00
36: 48 c7 c6 c0 7f 78 8c mov $0xffffffff8c787fc0,%rsi
3d: 89 da mov %ebx,%edx
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
Modules linked in:
CPU: 0 UID: 0 PID: 11999 Comm: syz.5.97 Not tainted 7.0.0-rc1 #1 PREEMPT_{RT,(full)}
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:bpf_check+0x11a79/0x1c9a0
Code: 84 a7 00 00 41 88 1e 83 7c 24 08 00 0f 84 8e 00 00 00 e8 0a 1e de ff e9 fc 40 00 00 e8 00 1e de ff 48 8d 3d f9 87 ef 0f 89 de <67> 48 0f b9 3a 48 8b bc 24 78 01 00 00 48 c7 c6 c0 7f 78 8c 89 da
RSP: 0018:ffffc9000c19f640 EFLAGS: 00010283
RAX: ffffffff81bb16f0 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000f4d1000 RSI: 0000000000000001 RDI: ffffffff91aa9ef0
RBP: ffffc9000c19fb30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000040 R12: 0000000000000004
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000002
FS: 00007f01a33266c0(0000) GS:ffff88809826b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f01a5347dac CR3: 000000004a65a000 CR4: 00000000000006f0
Call Trace:
<TASK>
bpf_prog_load+0x13be/0x19e0
__sys_bpf+0x5c8/0x8a0
__x64_sys_bpf+0x81/0x90
do_syscall_64+0x160/0x760
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f01a50d3b6d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f01a3326018 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f01a5345fa0 RCX: 00007f01a50d3b6d
RDX: 0000000000000080 RSI: 0000200000000140 RDI: 0000000000000005
RBP: 00007f01a5177c3e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f01a5346038 R14: 00007f01a5345fa0 R15: 00007ffe12d33220
</TASK>
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 0 UID: 0 PID: 11999 Comm: syz.5.97 Not tainted 7.0.0-rc1 #1 PREEMPT_{RT,(full)}
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
vpanic+0x424/0xa30
panic+0xbe/0xc0
__warn+0x31c/0x500
__report_bug+0x28d/0x500
report_bug_entry+0x19a/0x280
handle_bug+0xca/0x200
exc_invalid_op+0x1a/0x50
asm_exc_invalid_op+0x1a/0x20
RIP: 0010:bpf_check+0x11a79/0x1c9a0
Code: 84 a7 00 00 41 88 1e 83 7c 24 08 00 0f 84 8e 00 00 00 e8 0a 1e de ff e9 fc 40 00 00 e8 00 1e de ff 48 8d 3d f9 87 ef 0f 89 de <67> 48 0f b9 3a 48 8b bc 24 78 01 00 00 48 c7 c6 c0 7f 78 8c 89 da
RSP: 0018:ffffc9000c19f640 EFLAGS: 00010283
RAX: ffffffff81bb16f0 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000f4d1000 RSI: 0000000000000001 RDI: ffffffff91aa9ef0
RBP: ffffc9000c19fb30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000040 R12: 0000000000000004
R13: 0000000000000004 R14: 0000000000000000 R15: 0000000000000002
bpf_prog_load+0x13be/0x19e0
__sys_bpf+0x5c8/0x8a0
__x64_sys_bpf+0x81/0x90
do_syscall_64+0x160/0x760
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f01a50d3b6d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f01a3326018 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f01a5345fa0 RCX: 00007f01a50d3b6d
RDX: 0000000000000080 RSI: 0000200000000140 RDI: 0000000000000005
RBP: 00007f01a5177c3e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f01a5346038 R14: 00007f01a5345fa0 R15: 00007ffe12d33220
</TASK>
Kernel Offset: disabled
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
reply other threads:[~2026-06-26 21:29 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a3eef1a.516c2524.21c3a2.afcd@mx.google.com \
--to=sanan.hasanou@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=contact@pgazz.com \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox