syzbot


KCSAN: data-race in bcmp / stack_map_get_build_id_offset

Status: moderation: reported on 2025/09/22 10:49
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+0462708d433602258c29@syzkaller.appspotmail.com
First crash: 95d, last: 33d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in bcmp / stack_map_get_build_id_offset

write to 0xffffc90002f44be8 of 8 bytes by task 29436 on cpu 0:
 stack_map_get_build_id_offset+0x2e3/0x570 kernel/bpf/stackmap.c:182
 __bpf_get_stackid+0x617/0x800 kernel/bpf/stackmap.c:266
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xe9/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1628 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1617
 bpf_prog_ff69ba342f4eb966+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1350 [inline]
 __bpf_prog_run include/linux/filter.h:721 [inline]
 bpf_prog_run include/linux/filter.h:728 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run4+0x117/0x1d0 kernel/trace/bpf_trace.c:2118
 __do_trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 __alloc_frozen_pages_noprof+0x32d/0x360 mm/page_alloc.c:5200
 alloc_pages_mpol+0xb3/0x260 mm/mempolicy.c:2416
 alloc_frozen_pages_noprof mm/mempolicy.c:2487 [inline]
 alloc_pages_noprof+0x90/0x130 mm/mempolicy.c:2507
 pagetable_alloc_noprof include/linux/mm.h:2987 [inline]
 pmd_alloc_one_noprof include/asm-generic/pgalloc.h:142 [inline]
 __pmd_alloc+0x47/0x420 mm/memory.c:6591
 pmd_alloc include/linux/mm.h:2944 [inline]
 __handle_mm_fault mm/memory.c:6297 [inline]
 handle_mm_fault+0x19d4/0x2be0 mm/memory.c:6505
 do_user_addr_fault+0x630/0x1080 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

read to 0xffffc90002f44be8 of 8 bytes by task 29435 on cpu 1:
 memcmp lib/string.c:683 [inline]
 bcmp+0x23/0x90 lib/string.c:715
 memcmp include/linux/fortify-string.h:727 [inline]
 __bpf_get_stackid+0x65a/0x800 kernel/bpf/stackmap.c:269
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xe9/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1628 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1617
 bpf_prog_ff69ba342f4eb966+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1350 [inline]
 __bpf_prog_run include/linux/filter.h:721 [inline]
 bpf_prog_run include/linux/filter.h:728 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run4+0x117/0x1d0 kernel/trace/bpf_trace.c:2118
 __do_trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 __alloc_frozen_pages_noprof+0x32d/0x360 mm/page_alloc.c:5200
 alloc_pages_mpol+0xb3/0x260 mm/mempolicy.c:2416
 folio_alloc_mpol_noprof mm/mempolicy.c:2435 [inline]
 vma_alloc_folio_noprof+0x1aa/0x300 mm/mempolicy.c:2470
 folio_prealloc mm/memory.c:-1 [inline]
 wp_page_copy mm/memory.c:3680 [inline]
 do_wp_page+0xf60/0x2510 mm/memory.c:4141
 handle_pte_fault mm/memory.c:6211 [inline]
 __handle_mm_fault mm/memory.c:6336 [inline]
 handle_mm_fault+0x77d/0x2be0 mm/memory.c:6505
 do_user_addr_fault+0x630/0x1080 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

value changed: 0x00007fdc851355f3 -> 0x00000000000555f3

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 29435 Comm: modprobe Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/24 04:54 upstream d0e88704d96c 4fb8ef37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / stack_map_get_build_id_offset
2025/11/19 04:43 upstream 5bebe8de1926 ef766cd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / stack_map_get_build_id_offset
2025/11/15 09:59 upstream 7a0892d2836e f7988ea4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / stack_map_get_build_id_offset
2025/09/29 11:52 upstream e5f0a698b34e 86341da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / stack_map_get_build_id_offset
2025/09/22 10:49 upstream 07e27ad16399 0ac7291c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / stack_map_get_build_id_offset
* Struck through repros no longer work on HEAD.