syzbot


KCSAN: data-race in __bpf_get_stackid / bcmp

Status: moderation: reported on 2025/06/18 12:38
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+505324320caac3303e6f@syzkaller.appspotmail.com
First crash: 19d, last: 20h18m

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __bpf_get_stackid / bcmp

write to 0xffff888128a3a190 of 160 bytes by task 3307 on cpu 1:
 __bpf_get_stackid+0x761/0x800 kernel/bpf/stackmap.c:288
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1811 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1800
 bpf_prog_e6fc920cfeff8120+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2258 [inline]
 bpf_trace_run2+0x104/0x1c0 kernel/trace/bpf_trace.c:2299
 __traceiter_kfree+0x2e/0x50 include/trace/events/kmem.h:94
 __do_trace_kfree include/trace/events/kmem.h:94 [inline]
 trace_kfree include/trace/events/kmem.h:94 [inline]
 kfree+0x27b/0x320 mm/slub.c:4829
 netlbl_secattr_free include/net/netlabel.h:400 [inline]
 selinux_netlbl_sk_security_free+0x18b/0x1d0 security/selinux/netlabel.c:162
 selinux_sk_free_security+0x3b/0x50 security/selinux/hooks.c:5391
 security_sk_free+0x65/0x80 security/security.c:4873
 sk_prot_free net/core/sock.c:2279 [inline]
 __sk_destruct+0x353/0x480 net/core/sock.c:2381
 sk_destruct net/core/sock.c:2409 [inline]
 __sk_free+0x227/0x270 net/core/sock.c:2420
 sk_free+0x39/0x80 net/core/sock.c:2431
 sock_put include/net/sock.h:1960 [inline]
 tcp_close+0x8d/0xd0 net/ipv4/tcp.c:3281
 inet_release+0xce/0xf0 net/ipv4/af_inet.c:435
 __sock_release net/socket.c:647 [inline]
 sock_close+0x6b/0x150 net/socket.c:1391
 __fput+0x29b/0x650 fs/file_table.c:465
 fput_close_sync+0x6e/0x120 fs/file_table.c:570
 __do_sys_close fs/open.c:1589 [inline]
 __se_sys_close fs/open.c:1574 [inline]
 __x64_sys_close+0x56/0xf0 fs/open.c:1574
 x64_sys_call+0x2747/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:4
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888128a3a1e0 of 8 bytes by task 8434 on cpu 0:
 memcmp lib/string.c:683 [inline]
 bcmp+0x23/0x90 lib/string.c:715
 memcmp include/linux/fortify-string.h:727 [inline]
 __bpf_get_stackid+0x371/0x800 kernel/bpf/stackmap.c:279
 ____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
 bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1811 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1800
 bpf_prog_e6fc920cfeff8120+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2258 [inline]
 bpf_trace_run2+0x104/0x1c0 kernel/trace/bpf_trace.c:2299
 __traceiter_kfree+0x2e/0x50 include/trace/events/kmem.h:94
 __do_trace_kfree include/trace/events/kmem.h:94 [inline]
 trace_kfree include/trace/events/kmem.h:94 [inline]
 kfree+0x27b/0x320 mm/slub.c:4829
 ___sys_recvmsg+0x135/0x370 net/socket.c:2829
 do_recvmmsg+0x1ef/0x540 net/socket.c:2923
 __sys_recvmmsg net/socket.c:2997 [inline]
 __do_sys_recvmmsg net/socket.c:3020 [inline]
 __se_sys_recvmmsg net/socket.c:3013 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3013
 x64_sys_call+0x1c6a/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffffffff81000130 -> 0xffffffff84451309

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 8434 Comm: syz.4.1532 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/07 00:44 upstream d7b8f8e20813 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/07/05 11:40 upstream a79a588fc176 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/07/03 07:22 upstream b4911fb0b060 115ceea7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/07/01 01:15 upstream 66701750d556 6e83b42d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/30 14:59 upstream d0b3b7b22dfa fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/29 15:51 upstream dfba48a70cb6 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/28 00:41 upstream 67a993863163 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/27 08:45 upstream f02769e7f272 803ce19b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/26 00:01 upstream 92ca6c498a5e 26d77996 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/24 18:27 upstream 78f4e737a53e 26d77996 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/24 08:18 upstream 78f4e737a53e e2f27c35 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/23 08:07 upstream b67ec639010f d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
2025/06/18 12:37 upstream 52da431bf03b ca631f70 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_get_stackid / bcmp
* Struck through repros no longer work on HEAD.