syzbot


KCSAN: data-race in bcmp / parse_build_id

Status: moderation: reported on 2025/09/28 15:26
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+34ed7a3bbe17728f901f@syzkaller.appspotmail.com
First crash: 124d, last: 26d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in bcmp / parse_build_id

write to 0xffffc9000f831cf4 of 20 bytes by task 18187 on cpu 0:
 parse_build_id+0x249/0x2b0 lib/buildid.c:184
 get_build_id_64 lib/buildid.c:263 [inline]
 __build_id_parse+0x253/0x4a0 lib/buildid.c:308
 build_id_parse_nofault+0x27/0x40 lib/buildid.c:327
 fetch_build_id kernel/bpf/stackmap.c:152 [inline]
 stack_map_get_build_id_offset+0x226/0x530 kernel/bpf/stackmap.c:197
 __bpf_get_stackid+0x60b/0x7d0 kernel/bpf/stackmap.c:289
 ____bpf_get_stackid kernel/bpf/stackmap.c:344 [inline]
 bpf_get_stackid+0xf3/0x130 kernel/bpf/stackmap.c:323
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1628 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1617
 bpf_prog_ff69ba342f4eb966+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1378 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run4+0x117/0x1e0 kernel/trace/bpf_trace.c:2118
 __do_trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 __alloc_frozen_pages_noprof+0x336/0x360 mm/page_alloc.c:5232
 alloc_pages_mpol+0xb3/0x260 mm/mempolicy.c:2486
 folio_alloc_mpol_noprof+0x39/0x80 mm/mempolicy.c:2505
 shmem_alloc_folio mm/shmem.c:1890 [inline]
 shmem_alloc_and_add_folio mm/shmem.c:1932 [inline]
 shmem_get_folio_gfp+0x3cf/0xd50 mm/shmem.c:2556
 shmem_get_folio mm/shmem.c:2662 [inline]
 shmem_write_begin+0xfc/0x1f0 mm/shmem.c:3315
 generic_perform_write+0x184/0x490 mm/filemap.c:4314
 shmem_file_write_iter+0xc5/0xf0 mm/shmem.c:3490
 __kernel_write_iter+0x2d6/0x540 fs/read_write.c:619
 dump_emit_page fs/coredump.c:1298 [inline]
 dump_user_range+0x61e/0x8f0 fs/coredump.c:1372
 elf_core_dump+0x1de7/0x1f80 fs/binfmt_elf.c:2111
 coredump_write+0xacf/0xdf0 fs/coredump.c:1049
 do_coredump fs/coredump.c:1126 [inline]
 vfs_coredump+0x24f7/0x2e60 fs/coredump.c:1200
 get_signal+0xd84/0xf70 kernel/signal.c:3019
 arch_do_signal_or_restart+0x96/0x450 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:75 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
 irqentry_exit+0xfb/0x560 kernel/entry/common.c:196
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

read to 0xffffc9000f831d00 of 8 bytes by task 18266 on cpu 1:
 memcmp lib/string.c:683 [inline]
 bcmp+0x23/0x90 lib/string.c:715
 memcmp include/linux/fortify-string.h:727 [inline]
 __bpf_get_stackid+0x648/0x7d0 kernel/bpf/stackmap.c:292
 ____bpf_get_stackid kernel/bpf/stackmap.c:344 [inline]
 bpf_get_stackid+0xf3/0x130 kernel/bpf/stackmap.c:323
 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1628 [inline]
 bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1617
 bpf_prog_ff69ba342f4eb966+0x2a/0x32
 bpf_dispatcher_nop_func include/linux/bpf.h:1378 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline]
 bpf_trace_run4+0x117/0x1e0 kernel/trace/bpf_trace.c:2118
 __do_trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 __alloc_frozen_pages_noprof+0x336/0x360 mm/page_alloc.c:5232
 alloc_pages_mpol+0xb3/0x260 mm/mempolicy.c:2486
 folio_alloc_mpol_noprof+0x39/0x80 mm/mempolicy.c:2505
 shmem_alloc_folio mm/shmem.c:1890 [inline]
 shmem_alloc_and_add_folio mm/shmem.c:1932 [inline]
 shmem_get_folio_gfp+0x3cf/0xd50 mm/shmem.c:2556
 shmem_fault+0xf6/0x250 mm/shmem.c:2757
 __do_fault+0xbc/0x200 mm/memory.c:5320
 do_read_fault mm/memory.c:5755 [inline]
 do_fault mm/memory.c:5889 [inline]
 do_pte_missing mm/memory.c:4401 [inline]
 handle_pte_fault mm/memory.c:6273 [inline]
 __handle_mm_fault mm/memory.c:6411 [inline]
 handle_mm_fault+0xfab/0x2c60 mm/memory.c:6580
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x1024/0x1ed0 mm/gup.c:1428
 populate_vma_page_range mm/gup.c:1860 [inline]
 __mm_populate+0x243/0x3a0 mm/gup.c:1963
 mm_populate include/linux/mm.h:3701 [inline]
 vm_mmap_pgoff+0x232/0x2e0 mm/util.c:586
 ksys_mmap_pgoff+0xc2/0x310 mm/mmap.c:604
 x64_sys_call+0x16bb/0x3000 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0xf042c5f12da5e5e6

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 18266 Comm: syz.9.4420 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/03 21:03 upstream 805f9a061372 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
2025/11/14 18:02 upstream 6da43bbeb691 f7988ea4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
2025/11/14 18:02 upstream 6da43bbeb691 f7988ea4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
2025/10/30 08:39 upstream e53642b87a4f fd2207e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
2025/09/28 15:25 upstream 51a24b7deaae 001c9061 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in bcmp / parse_build_id
* Struck through repros no longer work on HEAD.