syzbot
possible deadlock in bpf_lru_push_free (2)
Status:
fixed on 2026/07/15 08:27
Subsystems:
bpf
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+18b26edb69b2e19f3b33@syzkaller.appspotmail.com
Fix commit:
89edbdfc5d03
bpf: Fix NMI/tracepoint re-entry deadlock on lru locks
First crash: 257d, last: 142d
Fix bisection:
the issue occurs on the latest tested release
(bisect log)
▶
▼
Last patch testing requests (3)
| Created |
Duration |
User |
Patch |
Repo |
Result |
| 2026/05/16 14:17 |
28m
|
retest repro
|
|
bpf |
log
|
| 2026/03/07 09:43 |
24m
|
retest repro
|
|
bpf |
report
log
|
| 2025/11/27 05:34 |
25m
|
retest repro
|
|
bpf |
report
log
|
Sample crash report:
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz-executor149/10558 is trying to acquire lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:514 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_push_free+0x33b/0xbb0 kernel/bpf/bpf_lru_list.c:553
but task is already holding lock:
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&loc_l->lock);
lock(&loc_l->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by syz-executor149/10558:
#0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_percpu_hash_update+0x2b/0x200 kernel/bpf/hashtab.c:2409
#1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:440 [inline]
#1: ffffe8ffffc41588 (&loc_l->lock){....}-{2:2}, at: bpf_lru_pop_free+0x1ab/0x19b0 kernel/bpf/bpf_lru_list.c:496
#2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2074 [inline]
#2: ffffffff8df3d620 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x186/0x4b0 kernel/trace/bpf_trace.c:2116
stack backtrace:
* Struck through repros no longer work on HEAD.