syzbot


KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy

Status: upstream: reported on 2026/04/20 14:13
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+44044637ef892e79ca2b@syzkaller.appspotmail.com
First crash: 6d01h, last: 6d01h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
927ccc03-b65a-449c-a2fd-bf5ddc75070e assessment-kcsan Benign: ❌  Confident: ✅  KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy 2026/04/20 10:15 2026/04/20 10:15 2026/04/20 10:35 303e2802d4760a2024848e19b613070c0df2a791
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bpf?] KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy 1 (2) 2026/04/20 17:37

Sample crash report:
netlink: 676 bytes leftover after parsing attributes in process `syz.4.735'.
==================================================================
BUG: KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy

write to 0xffffe8ffffa24c00 of 1404 bytes by task 6603 on cpu 0:
 bpf_obj_memcpy+0x13c/0x1a0 include/linux/bpf.h:-1
 copy_map_value include/linux/bpf.h:557 [inline]
 bpf_percpu_array_update+0x1e1/0x2d0 kernel/bpf/arraymap.c:443
 bpf_map_update_value+0x260/0x570 kernel/bpf/syscall.c:275
 generic_map_update_batch+0x52d/0x680 kernel/bpf/syscall.c:2025
 bpf_map_do_batch+0x25c/0x380 kernel/bpf/syscall.c:5689
 __sys_bpf+0x6a2/0x7e0 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6361 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6359 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6359
 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffffe8ffffa24c00 of 1404 bytes by task 6604 on cpu 1:
 bpf_obj_memcpy+0x13c/0x1a0 include/linux/bpf.h:-1
 copy_map_value include/linux/bpf.h:557 [inline]
 bpf_percpu_array_update+0x1e1/0x2d0 kernel/bpf/arraymap.c:443
 bpf_map_update_value+0x260/0x570 kernel/bpf/syscall.c:275
 generic_map_update_batch+0x52d/0x680 kernel/bpf/syscall.c:2025
 bpf_map_do_batch+0x25c/0x380 kernel/bpf/syscall.c:5689
 __sys_bpf+0x6a2/0x7e0 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6361 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6359 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6359
 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 6604 Comm: syz.4.735 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/20 10:15 upstream c1f49dea2b8f 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy
* Struck through repros no longer work on HEAD.