syzbot


KCSAN: data-race in bcmp / parse_build_id

Status: moderation: reported on 2025/09/28 15:26
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+34ed7a3bbe17728f901f@syzkaller.appspotmail.com
First crash: 49d, last: 2d19h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in bcmp / parse_build_id

write to 0xffff888119a0d014 of 20 bytes by task 15810 on cpu 1:
 parse_build_id+0x249/0x2b0 lib/buildid.c:200
 get_build_id_64 lib/buildid.c:279 [inline]
 __build_id_parse+0x253/0x4a0 lib/buildid.c:324
 build_id_parse_nofault+0x27/0x40 lib/buildid.c:343
 fetch_build_id kernel/bpf/stackmap.c:130 [inline]
 stack_map_get_build_id_offset+0x258/0x570 kernel/bpf/stackmap.c:175
 __bpf_get_stackid+0x617/0x800 kernel/bpf/stackmap.c:266
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xe9/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1628 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1617
 bpf_prog_ff69ba342f4eb966+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1350 [inline]
 __bpf_prog_run include/linux/filter.h:721 [inline]
 bpf_prog_run include/linux/filter.h:728 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run4+0x117/0x1d0 kernel/trace/bpf_trace.c:2118
 __do_trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 __alloc_frozen_pages_noprof+0x32d/0x360 mm/page_alloc.c:5205
 __alloc_pages_noprof+0x9/0x20 mm/page_alloc.c:5217
 __alloc_pages_node_noprof include/linux/gfp.h:285 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:312 [inline]
 pcpu_alloc_pages mm/percpu-vm.c:95 [inline]
 pcpu_populate_chunk+0x206/0xa70 mm/percpu-vm.c:285
 pcpu_alloc_noprof+0xac2/0x1250 mm/percpu.c:1870
 bpf_map_alloc_percpu+0xb3/0x200 kernel/bpf/syscall.c:575
 bpf_array_alloc_percpu kernel/bpf/arraymap.c:39 [inline]
 array_map_alloc+0x28b/0x3c0 kernel/bpf/arraymap.c:153
 map_create+0x840/0xda0 kernel/bpf/syscall.c:1512
 __sys_bpf+0x54e/0x7c0 kernel/bpf/syscall.c:6131
 __do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6257
 x64_sys_call+0x2aee/0x3000 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888119a0d020 of 8 bytes by task 15806 on cpu 0:
 memcmp lib/string.c:683 [inline]
 bcmp+0x23/0x90 lib/string.c:715
 memcmp include/linux/fortify-string.h:727 [inline]
 __bpf_get_stackid+0x65a/0x800 kernel/bpf/stackmap.c:269
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xe9/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1628 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1617
 bpf_prog_ff69ba342f4eb966+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1350 [inline]
 __bpf_prog_run include/linux/filter.h:721 [inline]
 bpf_prog_run include/linux/filter.h:728 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run4+0x117/0x1d0 kernel/trace/bpf_trace.c:2118
 __do_trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 __alloc_frozen_pages_noprof+0x32d/0x360 mm/page_alloc.c:5205
 alloc_pages_mpol+0xb3/0x260 mm/mempolicy.c:2416
 folio_alloc_mpol_noprof+0x39/0x80 mm/mempolicy.c:2435
 shmem_alloc_folio mm/shmem.c:1871 [inline]
 shmem_alloc_and_add_folio mm/shmem.c:1913 [inline]
 shmem_get_folio_gfp+0x3cf/0xd60 mm/shmem.c:2536
 shmem_fault+0xf6/0x250 mm/shmem.c:2737
 __do_fault+0xbc/0x200 mm/memory.c:5281
 do_read_fault mm/memory.c:5716 [inline]
 do_fault mm/memory.c:5850 [inline]
 do_pte_missing mm/memory.c:4362 [inline]
 handle_pte_fault mm/memory.c:6195 [inline]
 __handle_mm_fault mm/memory.c:6336 [inline]
 handle_mm_fault+0xf78/0x2be0 mm/memory.c:6505
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x102a/0x1ed0 mm/gup.c:1428
 populate_vma_page_range mm/gup.c:1860 [inline]
 __mm_populate+0x243/0x3a0 mm/gup.c:1963
 mm_populate include/linux/mm.h:3471 [inline]
 vm_mmap_pgoff+0x232/0x2e0 mm/util.c:586
 ksys_mmap_pgoff+0xc2/0x310 mm/mmap.c:604
 x64_sys_call+0x14a3/0x3000 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0x38f79f68947c4346

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 15806 Comm: syz.2.4171 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/14 18:02 upstream 6da43bbeb691 f7988ea4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
2025/11/14 18:02 upstream 6da43bbeb691 f7988ea4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
2025/10/30 08:39 upstream e53642b87a4f fd2207e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
2025/09/28 15:25 upstream 51a24b7deaae 001c9061 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
* Struck through repros no longer work on HEAD.