syzbot


KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem (5)

Status: fixed on 2023/09/28 17:51
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+ebe648a84e8784763f82@syzkaller.appspotmail.com
Fix commit: ee9fd0ac3017 bpf: Address KCSAN report on bpf_lru_list
First crash: 404d, last: 338d
Discussions (11)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 4.14 2/4] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:16
[PATCH AUTOSEL 4.19 2/5] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:16
[PATCH AUTOSEL 5.4 2/6] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:16
[PATCH AUTOSEL 5.10 3/7] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:15
[PATCH AUTOSEL 5.15 03/10] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:15
[PATCH AUTOSEL 6.1 05/18] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:14
[PATCH AUTOSEL 6.3 05/22] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:13
[PATCH AUTOSEL 6.4 05/26] bpf: Address KCSAN report on bpf_lru_list 1 (1) 2023/07/09 15:12
[PATCH bpf-next] bpf: Address KCSAN report on bpf_lru_list 3 (3) 2023/05/12 19:10
[syzbot] Monthly bpf report (May 2023) 0 (1) 2023/05/10 07:04
[syzbot] [bpf?] KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem (5) 2 (3) 2023/04/25 16:21
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem (2) bpf 2 1226d 1253d 0/26 auto-closed as invalid on 2021/02/23 14:15
upstream KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem (3) bpf 91 543d 899d 0/26 auto-obsoleted due to no activity on 2023/01/14 15:11
upstream KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem (4) bpf 1 474d 474d 0/26 auto-obsoleted due to no activity on 2023/03/24 04:11
upstream KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem bpf 12 1330d 1411d 0/26 auto-closed as invalid on 2020/11/11 05:04

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem

write to 0xffff8881437a7ba3 of 1 bytes by task 13025 on cpu 0:
 bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:71 [inline]
 __htab_lru_percpu_map_update_elem+0x3c0/0x560 kernel/bpf/hashtab.c:1351
 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2372
 bpf_map_update_value+0x2ae/0x370 kernel/bpf/syscall.c:204
 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1702
 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4568
 __sys_bpf+0x317/0x800
 __do_sys_bpf kernel/bpf/syscall.c:5176 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5174 [inline]
 __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5174
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff8881437a7ba3 of 1 bytes by task 13038 on cpu 1:
 bpf_lru_node_is_ref kernel/bpf/bpf_lru_list.c:44 [inline]
 __bpf_lru_list_rotate_inactive kernel/bpf/bpf_lru_list.c:190 [inline]
 __bpf_lru_list_rotate+0x528/0x750 kernel/bpf/bpf_lru_list.c:242
 bpf_percpu_lru_pop_free kernel/bpf/bpf_lru_list.c:412 [inline]
 bpf_lru_pop_free+0x8b/0xe20 kernel/bpf/bpf_lru_list.c:497
 prealloc_lru_pop kernel/bpf/hashtab.c:301 [inline]
 __htab_lru_percpu_map_update_elem+0xf5/0x560 kernel/bpf/hashtab.c:1335
 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2372
 bpf_map_update_value+0x2ae/0x370 kernel/bpf/syscall.c:204
 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1702
 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4568
 __sys_bpf+0x317/0x800
 __do_sys_bpf kernel/bpf/syscall.c:5176 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5174 [inline]
 __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5174
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 13038 Comm: syz-executor.4 Not tainted 6.4.0-rc7-syzkaller-00234-g547cc9be86f4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
==================================================================

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/06/26 02:58 upstream 547cc9be86f4 79782afc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/06/22 14:24 upstream dad9774deaf1 79782afc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/06/21 07:46 upstream 99ec1ed7c2ed 79782afc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/29 12:34 upstream 7877cb91f108 cf184559 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/24 16:42 upstream 9d646009f65d 4bce1a3e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/24 02:26 upstream 27e462c8fad4 4bce1a3e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/23 13:18 upstream ae8373a5add4 4bce1a3e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/23 04:13 upstream 421ca22e3138 4bce1a3e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/12 09:21 upstream 105131df9c3b adb9a3cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/10 02:33 upstream 1dc3731daf1f 30aa2a7e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/08 03:15 upstream 17784de648be 90c93c40 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/05/04 21:56 upstream 1a5304fecee5 518a39a6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
2023/04/21 00:48 upstream 6a66fdd29ea1 2b32bd34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
* Struck through repros no longer work on HEAD.