syzbot


possible deadlock in bpf_lru_push_free (2)

Status: upstream: reported C repro on 2025/11/13 04:26
Subsystems: bpf
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+18b26edb69b2e19f3b33@syzkaller.appspotmail.com
Fix commit: 89edbdfc5d03 bpf: Fix NMI/tracepoint re-entry deadlock on lru locks
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-riscv64 ci-upstream-gce-arm64 ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-usb]
First crash: 218d, last: 104d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: the issue occurs on the latest tested release (bisect log)
  
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
12b9daf2-1a5c-46e5-a7d3-d851aa2a1d6b assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ possible deadlock in bpf_lru_push_free (2) 2026/05/20 07:14 2026/05/20 07:14 2026/05/20 08:22 0909d65fc692e54fa1900b68b476e89207bc7f34

			
		
Discussions (6)
Title Replies (including bot) Last reply
[PATCH bpf-next v3 0/3] bpf: Fix LRU NMI/tracepoint re-entry deadlock 4 (4) 2026/06/08 02:00
[PATCH RFC bpf-next v2 0/3] bpf: Fix LRU NMI/tracepoint re-entry deadlock 4 (4) 2026/06/07 20:25
[PATCH RFC bpf-next 0/3] bpf: Fix LRU NMI/tracepoint re-entry deadlock 3 (3) 2026/05/28 18:59
[syzbot] Monthly bpf report (Mar 2026) 0 (1) 2026/03/09 23:06
[syzbot] Monthly bpf report (Dec 2025) 0 (1) 2025/12/06 09:24
[syzbot] [bpf?] possible deadlock in bpf_lru_push_free (2) 3 (4) 2025/11/15 11:20
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in bpf_lru_push_free bpf 4 C done 609 2309d 2315d 15/29 fixed on 2020/04/15 17:19
linux-6.1 possible deadlock in bpf_lru_push_free origin:upstream 4 C error 2 150d 218d 0/3 upstream: reported C repro on 2025/11/12 20:01
Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/05/16 14:17 28m retest repro bpf log
2026/03/07 09:43 24m retest repro bpf report log
2025/11/27 05:34 25m retest repro bpf report log

Sample crash report:
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz-executor149/10558 is trying to acquire lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:514 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_push_free+0x33b/0xbb0 kernel/bpf/bpf_lru_list.c:553

but task is already holding lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&loc_l->lock);
  lock(&loc_l->lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor149/10558:
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_percpu_hash_update+0x2b/0x200 kernel/bpf/hashtab.c:2409
 #1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
 #1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2074 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x186/0x4b0 kernel/trace/bpf_trace.c:2116

stack backtrace:

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/12 20:04 bpf e427054ae7bc 07e030de .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in bpf_lru_push_free
* Struck through repros no longer work on HEAD.