syzbot


KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free

Status: fixed on 2021/04/09 19:46
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+3536db46dfa58c573458@syzkaller.appspotmail.com
Fix commit: 6df8fb83301d bpf_lru_list: Read double-checked variable once without lock
First crash: 1368d, last: 1122d
Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.19 000/247] 4.19.178-rc1 review 277 (277) 2022/03/02 15:52
[PATCH 5.10 000/663] 5.10.20-rc1 review 673 (673) 2021/03/05 18:03
[PATCH 5.4 000/340] 5.4.102-rc1 review 348 (348) 2021/03/04 09:26
[PATCH 5.11 000/775] 5.11.3-rc1 review 776 (776) 2021/03/01 16:15
[PATCH 4.14 000/176] 4.14.223-rc1 review 177 (177) 2021/03/01 16:14
[PATCH] bpf_lru_list: Read double-checked variable once without lock 4 (4) 2021/02/11 00:00

Sample crash report:
==================================================================
BUG: KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free

write to 0xffff888015c622ca of 1 bytes by task 13647 on cpu 0:
 __bpf_lru_node_move_in kernel/bpf/bpf_lru_list.c:91 [inline]
 __local_list_flush kernel/bpf/bpf_lru_list.c:298 [inline]
 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:327 [inline]
 bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline]
 bpf_lru_pop_free+0x314/0xed0 kernel/bpf/bpf_lru_list.c:499
 prealloc_lru_pop kernel/bpf/hashtab.c:264 [inline]
 htab_lru_map_update_elem+0xaf/0x4a0 kernel/bpf/hashtab.c:1099
 bpf_map_update_value+0x1b9/0x300 kernel/bpf/syscall.c:201
 generic_map_update_batch+0x344/0x450 kernel/bpf/syscall.c:1350
 bpf_map_do_batch+0x286/0x2f0 kernel/bpf/syscall.c:3990
 __do_sys_bpf+0x87c/0x9950 kernel/bpf/syscall.c:4446
 __se_sys_bpf kernel/bpf/syscall.c:4340 [inline]
 __x64_sys_bpf+0x3d/0x50 kernel/bpf/syscall.c:4340
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888015c622ca of 1 bytes by task 13644 on cpu 1:
 bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:507 [inline]
 bpf_lru_push_free+0xd7/0x590 kernel/bpf/bpf_lru_list.c:555
 htab_lru_map_update_elem+0x454/0x4a0 kernel/bpf/hashtab.c:1130
 bpf_map_update_value+0x1b9/0x300 kernel/bpf/syscall.c:201
 generic_map_update_batch+0x344/0x450 kernel/bpf/syscall.c:1350
 bpf_map_do_batch+0x286/0x2f0 kernel/bpf/syscall.c:3990
 __do_sys_bpf+0x87c/0x9950 kernel/bpf/syscall.c:4446
 __se_sys_bpf kernel/bpf/syscall.c:4340 [inline]
 __x64_sys_bpf+0x3d/0x50 kernel/bpf/syscall.c:4340
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 13644 Comm: syz-executor.3 Not tainted 5.11.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (237):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/02/20 12:35 upstream f40ddce88593 3e5ed8b4 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/19 17:27 upstream f40ddce88593 f689d40a .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/17 19:28 upstream f40ddce88593 14052202 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/17 07:40 upstream f40ddce88593 052f8d9f .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/15 01:21 upstream f40ddce88593 98682e5e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/14 12:01 upstream 358feceebbf6 98682e5e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/13 10:08 upstream c6d8570e4d64 98682e5e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/12 21:07 upstream dcc0b49040c7 98682e5e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/11 23:17 upstream 291009f656e8 a5f86b15 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/11 01:21 upstream 291009f656e8 a52ee10a .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/10 09:12 upstream e0756cfc7d7c 9c8b8541 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/08 13:11 upstream 92bf22614b21 2ce644fc .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/07 23:00 upstream b75dba7f472c 2ce644fc .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/07 08:57 upstream 825b5991a46e 2ce644fc .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/07 01:20 upstream 964d069f93c4 0655e081 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/06 06:22 upstream 1e0d27fce010 23a562df .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/05 13:48 upstream dd86e7fa07a3 23a562df .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/05 02:26 upstream 5c279c4cf206 23a562df .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/04 13:16 upstream 61556703b610 42b90a7c .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/03 23:03 upstream 3afe9076a7c1 624dad51 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/02 22:56 upstream 3aaf0a27ffc2 624dad51 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/02 09:41 upstream 88bb507a74ea 19e09687 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/01 20:12 upstream 88bb507a74ea e6b95f32 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/01 16:03 upstream 1048ba83fb1c e6b95f32 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/02/01 03:45 upstream 1048ba83fb1c fc9fd31e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/31 14:07 upstream 6642d600b541 fc9fd31e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/31 05:34 upstream 8c947645151c fc9fd31e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/30 09:44 upstream 0e9bcda5d286 fc9fd31e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/30 02:45 upstream bec4c2968fce fc9fd31e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/28 20:30 upstream e5ff2cb9cf67 7df34f59 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/28 06:14 upstream 76c057c84d28 eefc07f2 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/28 00:34 upstream 76c057c84d28 a57db36f .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/27 19:22 upstream 2ab38c17aac1 a57db36f .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/27 08:42 upstream 2ab38c17aac1 a0ebf917 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/26 18:14 upstream 13391c60da33 55a7d4df .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/25 22:36 upstream f8ad8187c3b5 52e37319 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/25 10:11 upstream 6ee1d745b7c9 52e37319 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/24 20:28 upstream e68061375f79 52e37319 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/24 04:10 upstream e1ae4b0be158 52e37319 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/23 10:13 upstream fe75a21824e7 52e37319 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/22 19:59 upstream 83d09ad4b950 52e37319 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/22 09:58 upstream 83d09ad4b950 d4f4eca5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/21 18:48 upstream 9791581c049c d4f4eca5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/20 23:35 upstream 75439bc439e0 d4f4eca5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/20 10:12 upstream 45dfb8a5659a d4f4eca5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/20 05:20 upstream 45dfb8a5659a 63631df1 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/19 00:09 upstream 1e2a199f6ccd 63631df1 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/18 19:51 upstream 19c329f68089 63631df1 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in bpf_lru_pop_free / bpf_lru_push_free
2021/01/17 11:06 upstream 0da0a8a0a0e1 813be542 .config console log report info ci2-upstream-kcsan-gce
2020/08/17 15:08 upstream 9123e3a74ec7 5ce13532 .config console log report ci2-upstream-kcsan-gce
2020/08/15 10:59 upstream c9c9735c46f5 5ce13532 .config console log report ci2-upstream-kcsan-gce
2020/06/19 10:40 upstream 5e857ce6eae7 bc258b50 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.