syzbot


KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid

Status: moderation: reported on 2025/06/23 19:59
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+50d2ee6aa58d2a3db47e@syzkaller.appspotmail.com
First crash: 65d, last: 6d20h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid

write to 0xffff888127a4b464 of 4 bytes by task 13679 on cpu 0:
 __bpf_get_stackid+0x77a/0x800 kernel/bpf/stackmap.c:292
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1810 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1799
 bpf_prog_e6fc920cfeff8120+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1332 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2257 [inline]
 bpf_trace_run2+0x104/0x1c0 kernel/trace/bpf_trace.c:2298
 __traceiter_kfree+0x2b/0x50 include/trace/events/kmem.h:94
 __do_trace_kfree include/trace/events/kmem.h:94 [inline]
 trace_kfree include/trace/events/kmem.h:94 [inline]
 kfree+0x27b/0x320 mm/slub.c:4866
 krealloc_noprof+0x136/0x2d0 mm/slub.c:-1
 push_jmp_history+0x135/0x3d0 kernel/bpf/verifier.c:3984
 check_stack_write_fixed_off kernel/bpf/verifier.c:5231 [inline]
 check_stack_write+0x2c69/0x2d90 kernel/bpf/verifier.c:5670
 check_mem_access+0xc71/0x17d0 kernel/bpf/verifier.c:7703
 check_store_reg+0x167/0x340 kernel/bpf/verifier.c:7846
 do_check_insn kernel/bpf/verifier.c:19863 [inline]
 do_check+0x307c/0x7a10 kernel/bpf/verifier.c:20093
 do_check_common+0xc3a/0x12a0 kernel/bpf/verifier.c:23260
 do_check_main kernel/bpf/verifier.c:23343 [inline]
 bpf_check+0x942b/0xd9e0 kernel/bpf/verifier.c:24703
 bpf_prog_load+0xedd/0x1070 kernel/bpf/syscall.c:2979
 __sys_bpf+0x462/0x7b0 kernel/bpf/syscall.c:6029
 __do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6137
 x64_sys_call+0x2aea/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888127a4b464 of 4 bytes by task 13559 on cpu 1:
 __bpf_get_stackid+0x33a/0x800 kernel/bpf/stackmap.c:278
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1810 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1799
 bpf_prog_e6fc920cfeff8120+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1332 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2257 [inline]
 bpf_trace_run2+0x104/0x1c0 kernel/trace/bpf_trace.c:2298
 __traceiter_kfree+0x2b/0x50 include/trace/events/kmem.h:94
 __do_trace_kfree include/trace/events/kmem.h:94 [inline]
 trace_kfree include/trace/events/kmem.h:94 [inline]
 kfree+0x27b/0x320 mm/slub.c:4866
 ___sys_recvmsg+0x135/0x370 net/socket.c:2877
 do_recvmmsg+0x1ef/0x540 net/socket.c:2971
 __sys_recvmmsg net/socket.c:3045 [inline]
 __do_sys_recvmmsg net/socket.c:3068 [inline]
 __se_sys_recvmmsg net/socket.c:3061 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3061
 x64_sys_call+0x27a6/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000b -> 0x00000013

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 13559 Comm: syz.3.2833 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/21 19:39 upstream 068a56e56fa8 3e79b825 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/20 03:50 upstream b19a97d57c15 79512909 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/19 18:46 upstream b19a97d57c15 254a27c1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/19 02:30 upstream be48bcf004f9 523f460e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/18 13:07 upstream c17b750b3ad9 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/14 23:33 upstream 0cc53520e68b 5d8c2ac2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/12 22:33 upstream 0e39a731820a 22ec1469 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/04 16:45 upstream d2eedaa3909b 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/08/03 09:55 upstream 186f3edfdd41 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/07/29 16:02 upstream ae388edd4a8f c4a95487 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/07/28 17:11 upstream 038d61fd6422 6654ea9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/07/21 14:53 upstream 89be9a83ccf1 56d87229 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/07/15 16:52 upstream 155a3c003e55 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/07/04 03:50 upstream 17bbde2e1716 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
2025/06/23 19:58 upstream 86731a2a651e d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid
* Struck through repros no longer work on HEAD.