syzbot


KCSAN: data-race in __perf_event_overflow / perf_event_attach_bpf_prog (2)

Status: closed as dup on 2026/02/06 06:54
Subsystems: bpf trace
[Documentation on labels]
Reported-by: syzbot+42ab71a59b6d956a1ef7@syzkaller.appspotmail.com
First crash: 104d, last: 33d
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
bf1db540-c717-4b4a-a027-f975de1b7632 assessment-kcsan Benign: ❌  Confident: ✅  KCSAN: data-race in __perf_event_overflow / perf_event_attach_bpf_prog (2) 2026/01/15 21:32 2026/01/15 21:32 2026/01/15 21:59 a9d6a79219801d2130df3b1a792c57f0e5428e9f
Duplicate of
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported
KCSAN: data-race in __perf_event_overflow / __perf_event_set_bpf_prog race:harmful perf 6 10 27d 88d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __perf_event_overflow / perf_event_attach_bpf_prog bpf trace 6 1 433d 433d 0/29 auto-obsoleted due to no activity on 2025/04/12 23:45

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __perf_event_overflow / perf_event_attach_bpf_prog

write to 0xffff88811ca18418 of 8 bytes by task 16702 on cpu 1:
 perf_event_attach_bpf_prog+0x138/0x1d0 kernel/trace/bpf_trace.c:1954
 __perf_event_set_bpf_prog+0x44d/0x470 kernel/events/core.c:11662
 _perf_ioctl kernel/events/core.c:6663 [inline]
 perf_ioctl+0x92e/0x15d0 kernel/events/core.c:6723
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x1563/0x3020 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811ca18418 of 8 bytes by task 16670 on cpu 0:
 __perf_event_overflow+0x252/0x920 kernel/events/core.c:10700
 perf_swevent_overflow kernel/events/core.c:10842 [inline]
 perf_swevent_event+0x3f4/0x4d0 kernel/events/core.c:10903
 perf_tp_event+0x347/0x1660 kernel/events/core.c:11415
 perf_trace_run_bpf_submit+0xac/0x110 kernel/events/core.c:11334
 do_perf_trace_kfree include/trace/events/kmem.h:97 [inline]
 perf_trace_kfree+0xc2/0x100 include/trace/events/kmem.h:97
 __do_trace_kfree include/trace/events/kmem.h:97 [inline]
 trace_kfree include/trace/events/kmem.h:97 [inline]
 kfree+0x303/0x380 mm/slub.c:6469
 ___sys_recvmsg+0x135/0x3b0 net/socket.c:2855
 do_recvmmsg+0x1ef/0x560 net/socket.c:2949
 __sys_recvmmsg net/socket.c:3023 [inline]
 __do_sys_recvmmsg net/socket.c:3046 [inline]
 __se_sys_recvmmsg net/socket.c:3039 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3039
 x64_sys_call+0x80f/0x3020 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0xffffc900038b1000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 16670 Comm: syz.8.3768 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/23 04:15 upstream ec69c9e88315 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __perf_event_overflow / perf_event_attach_bpf_prog
2026/01/17 20:50 upstream d3eeb99bbc99 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __perf_event_overflow / perf_event_attach_bpf_prog
2026/01/11 05:10 upstream 97313d6113ab d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __perf_event_overflow / perf_event_attach_bpf_prog
* Struck through repros no longer work on HEAD.