KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push

KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
Status: fixed on 2021/04/09 19:46
Reported-by: syzbot+3536db46dfa58c573458@syzkaller.appspotmail.com
Fix commit: 6df8fb83301d bpf_lru_list: Read double-checked variable once without lock
First crash: 533d, last: 287d

Sample crash report:

==================================================================
BUG: KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free

write to 0xffff888015c622ca of 1 bytes by task 13647 on cpu 0:
 __bpf_lru_node_move_in kernel/bpf/bpf_lru_list.c:91 [inline]
 __local_list_flush kernel/bpf/bpf_lru_list.c:298 [inline]
 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:327 [inline]
 bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline]
 bpf_lru_pop_free+0x314/0xed0 kernel/bpf/bpf_lru_list.c:499
 prealloc_lru_pop kernel/bpf/hashtab.c:264 [inline]
 htab_lru_map_update_elem+0xaf/0x4a0 kernel/bpf/hashtab.c:1099
 bpf_map_update_value+0x1b9/0x300 kernel/bpf/syscall.c:201
 generic_map_update_batch+0x344/0x450 kernel/bpf/syscall.c:1350
 bpf_map_do_batch+0x286/0x2f0 kernel/bpf/syscall.c:3990
 __do_sys_bpf+0x87c/0x9950 kernel/bpf/syscall.c:4446
 __se_sys_bpf kernel/bpf/syscall.c:4340 [inline]
 __x64_sys_bpf+0x3d/0x50 kernel/bpf/syscall.c:4340
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888015c622ca of 1 bytes by task 13644 on cpu 1:
 bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:507 [inline]
 bpf_lru_push_free+0xd7/0x590 kernel/bpf/bpf_lru_list.c:555
 htab_lru_map_update_elem+0x454/0x4a0 kernel/bpf/hashtab.c:1130
 bpf_map_update_value+0x1b9/0x300 kernel/bpf/syscall.c:201
 generic_map_update_batch+0x344/0x450 kernel/bpf/syscall.c:1350
 bpf_map_do_batch+0x286/0x2f0 kernel/bpf/syscall.c:3990
 __do_sys_bpf+0x87c/0x9950 kernel/bpf/syscall.c:4446
 __se_sys_bpf kernel/bpf/syscall.c:4340 [inline]
 __x64_sys_bpf+0x3d/0x50 kernel/bpf/syscall.c:4340
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 13644 Comm: syz-executor.3 Not tainted 5.11.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (237):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Title
ci2-upstream-kcsan-gce	2021/02/20 12:35	upstream	f40ddce88593	3e5ed8b4	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/19 17:27	upstream	f40ddce88593	f689d40a	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/17 19:28	upstream	f40ddce88593	14052202	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/17 07:40	upstream	f40ddce88593	052f8d9f	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/15 01:21	upstream	f40ddce88593	98682e5e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/14 12:01	upstream	358feceebbf6	98682e5e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/13 10:08	upstream	c6d8570e4d64	98682e5e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/12 21:07	upstream	dcc0b49040c7	98682e5e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/11 23:17	upstream	291009f656e8	a5f86b15	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/11 01:21	upstream	291009f656e8	a52ee10a	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/10 09:12	upstream	e0756cfc7d7c	9c8b8541	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/08 13:11	upstream	92bf22614b21	2ce644fc	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/07 23:00	upstream	b75dba7f472c	2ce644fc	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/07 08:57	upstream	825b5991a46e	2ce644fc	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/07 01:20	upstream	964d069f93c4	0655e081	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/06 06:22	upstream	1e0d27fce010	23a562df	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/05 13:48	upstream	dd86e7fa07a3	23a562df	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/05 02:26	upstream	5c279c4cf206	23a562df	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/04 13:16	upstream	61556703b610	42b90a7c	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/03 23:03	upstream	3afe9076a7c1	624dad51	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/02 22:56	upstream	3aaf0a27ffc2	624dad51	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/02 09:41	upstream	88bb507a74ea	19e09687	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/01 20:12	upstream	88bb507a74ea	e6b95f32	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/01 16:03	upstream	1048ba83fb1c	e6b95f32	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/02/01 03:45	upstream	1048ba83fb1c	fc9fd31e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/31 14:07	upstream	6642d600b541	fc9fd31e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/31 05:34	upstream	8c947645151c	fc9fd31e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/30 09:44	upstream	0e9bcda5d286	fc9fd31e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/30 02:45	upstream	bec4c2968fce	fc9fd31e	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/28 20:30	upstream	e5ff2cb9cf67	7df34f59	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/28 06:14	upstream	76c057c84d28	eefc07f2	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/28 00:34	upstream	76c057c84d28	a57db36f	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/27 19:22	upstream	2ab38c17aac1	a57db36f	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/27 08:42	upstream	2ab38c17aac1	a0ebf917	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/26 18:14	upstream	13391c60da33	55a7d4df	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/25 22:36	upstream	f8ad8187c3b5	52e37319	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/25 10:11	upstream	6ee1d745b7c9	52e37319	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/24 20:28	upstream	e68061375f79	52e37319	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/24 04:10	upstream	e1ae4b0be158	52e37319	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/23 10:13	upstream	fe75a21824e7	52e37319	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/22 19:59	upstream	83d09ad4b950	52e37319	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/22 09:58	upstream	83d09ad4b950	d4f4eca5	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/21 18:48	upstream	9791581c049c	d4f4eca5	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/20 23:35	upstream	75439bc439e0	d4f4eca5	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/20 10:12	upstream	45dfb8a5659a	d4f4eca5	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/20 05:20	upstream	45dfb8a5659a	63631df1	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/19 00:09	upstream	1e2a199f6ccd	63631df1	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/18 19:51	upstream	19c329f68089	63631df1	.config	log	report	info	KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
ci2-upstream-kcsan-gce	2021/01/17 11:06	upstream	0da0a8a0a0e1	813be542	.config	log	report	info
ci2-upstream-kcsan-gce	2020/08/17 15:08	upstream	9123e3a74ec7	5ce13532	.config	log	report
ci2-upstream-kcsan-gce	2020/08/15 10:59	upstream	c9c9735c46f5	5ce13532	.config	log	report
ci2-upstream-kcsan-gce	2020/06/19 10:40	upstream	5e857ce6eae7	bc258b50	.config	log	report