KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy

Status: upstream: reported on 2026/04/20 14:13
Subsystems: bpf
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+44044637ef892e79ca2b@syzkaller.appspotmail.com
Fix commit: bpf: Annotate bpf_obj_memcpy with data_race
Patched on: [ci-upstream-bpf-next-kasan-gce ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 138d, last: 7d11h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
4ba95b45 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy 2026/05/15 20:10 2026/05/15 20:10 2026/05/15 20:38 efdaf0f9
927ccc03 assessment-kcsan Benign: ❌ Confident: ✅ KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy 2026/04/20 10:15 2026/04/20 10:15 2026/04/20 10:35 303e2802
Discussions (4)
Title Replies (including bot) Last reply
[PATCH v3] bpf: Annotate bpf_obj_memcpy with data_race 2 (2) 2026/08/23 19:40
[PATCH v2] bpf: Annotate bpf_obj_memcpy with data_race 3 (3) 2026/08/21 19:08
[PATCH] bpf: Annotate bpf_obj_memcpy with data_race 2 (2) 2026/08/19 16:49
[syzbot] [bpf?] KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy 1 (2) 2026/04/20 17:37

Sample crash report:
==================================================================
BUG: KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy

write to 0xffffe8ffffd59070 of 11 bytes by task 4121 on cpu 1:
 bpf_obj_memcpy+0x16a/0x190 include/linux/bpf.h:-1
 copy_map_value include/linux/bpf.h:591 [inline]
 bpf_percpu_array_update+0x1cb/0x2a0 kernel/bpf/arraymap.c:472
 bpf_map_update_value+0x260/0x570 kernel/bpf/syscall.c:275
 generic_map_update_batch+0x52d/0x680 kernel/bpf/syscall.c:2106
 bpf_map_do_batch+0x25b/0x380 kernel/bpf/syscall.c:5781
 __sys_bpf+0xa8e/0xc30 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0x69/0x80 kernel/bpf/syscall.c:6483
 x64_sys_call+0xf26/0x2550 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffffe8ffffd59070 of 11 bytes by task 4116 on cpu 0:
 bpf_obj_memcpy+0x16a/0x190 include/linux/bpf.h:-1
 copy_map_value include/linux/bpf.h:591 [inline]
 bpf_percpu_array_update+0x1cb/0x2a0 kernel/bpf/arraymap.c:472
 bpf_map_update_value+0x260/0x570 kernel/bpf/syscall.c:275
 generic_map_update_batch+0x52d/0x680 kernel/bpf/syscall.c:2106
 bpf_map_do_batch+0x25b/0x380 kernel/bpf/syscall.c:5781
 __sys_bpf+0xa8e/0xc30 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0x69/0x80 kernel/bpf/syscall.c:6483
 x64_sys_call+0xf26/0x2550 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4116 Comm: syz.5.92 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/29 16:18 upstream c20313e98b04 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy
2026/06/28 12:24 upstream 780d569e6c4b fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy
2026/06/13 20:11 upstream 062871f1371b 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy
2026/04/20 10:15 upstream c1f49dea2b8f 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy
* Struck through repros no longer work on HEAD.