syzbot


possible deadlock in bpf_lru_push_free (2)

Status: upstream: reported C repro on 2025/11/13 04:26
Subsystems: bpf
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+18b26edb69b2e19f3b33@syzkaller.appspotmail.com
First crash: 190d, last: 75d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: the issue occurs on the latest tested release (bisect log)
  
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
12b9daf2-1a5c-46e5-a7d3-d851aa2a1d6b assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ possible deadlock in bpf_lru_push_free (2) 2026/05/20 07:14 2026/05/20 07:14 2026/05/20 08:22 0909d65fc692e54fa1900b68b476e89207bc7f34
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] Monthly bpf report (Mar 2026) 0 (1) 2026/03/09 23:06
[syzbot] Monthly bpf report (Dec 2025) 0 (1) 2025/12/06 09:24
[syzbot] [bpf?] possible deadlock in bpf_lru_push_free (2) 3 (4) 2025/11/15 11:20
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in bpf_lru_push_free bpf 4 C done 609 2280d 2286d 15/29 fixed on 2020/04/15 17:19
linux-6.1 possible deadlock in bpf_lru_push_free origin:upstream 4 C error 2 122d 190d 0/3 upstream: reported C repro on 2025/11/12 20:01
Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/05/16 14:17 28m retest repro bpf log
2026/03/07 09:43 24m retest repro bpf report log
2025/11/27 05:34 25m retest repro bpf report log

Sample crash report:
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz-executor149/10558 is trying to acquire lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:514 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_push_free+0x33b/0xbb0 kernel/bpf/bpf_lru_list.c:553

but task is already holding lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&loc_l->lock);
  lock(&loc_l->lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor149/10558:
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_percpu_hash_update+0x2b/0x200 kernel/bpf/hashtab.c:2409
 #1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
 #1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2074 [inline]
 #2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x186/0x4b0 kernel/trace/bpf_trace.c:2116

stack backtrace:

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/12 20:04 bpf e427054ae7bc 07e030de .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce possible deadlock in bpf_lru_push_free
* Struck through repros no longer work on HEAD.