syzbot


KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free (3)

Status: moderation: reported on 2026/02/02 07:55
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+a9df912d90719592f2fd@syzkaller.appspotmail.com
First crash: 2d06h, last: 2d06h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free bpf 6 10 1984d 2056d 0/29 auto-closed as invalid on 2020/10/03 23:58
upstream KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free (2) bpf 6 32 1816d 1885d 20/29 fixed on 2021/04/09 19:46

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free

write to 0xffff8881056adc6a of 1 bytes by task 5115 on cpu 0:
 __bpf_lru_node_move kernel/bpf/bpf_lru_list.c:108 [inline]
 __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:148 [inline]
 __bpf_lru_list_rotate+0x2ec/0x780 kernel/bpf/bpf_lru_list.c:237
 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:326 [inline]
 bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:444 [inline]
 bpf_lru_pop_free+0x640/0xe40 kernel/bpf/bpf_lru_list.c:496
 prealloc_lru_pop kernel/bpf/hashtab.c:299 [inline]
 htab_lru_map_update_elem+0xc6/0x700 kernel/bpf/hashtab.c:1215
 bpf_map_update_value+0x4f3/0x570 kernel/bpf/syscall.c:294
 generic_map_update_batch+0x3eb/0x540 kernel/bpf/syscall.c:2038
 bpf_map_do_batch+0x25c/0x380 kernel/bpf/syscall.c:5647
 __sys_bpf+0x5f8/0x7b0 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6272
 x64_sys_call+0x28e1/0x3000 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881056adc6a of 1 bytes by task 5114 on cpu 1:
 bpf_lru_list_push_free kernel/bpf/bpf_lru_list.c:307 [inline]
 bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:530 [inline]
 bpf_lru_push_free+0x578/0x590 kernel/bpf/bpf_lru_list.c:553
 htab_lru_push_free kernel/bpf/hashtab.c:1183 [inline]
 htab_lru_map_update_elem+0x5a4/0x700 kernel/bpf/hashtab.c:1247
 bpf_map_update_value+0x4f3/0x570 kernel/bpf/syscall.c:294
 generic_map_update_batch+0x3eb/0x540 kernel/bpf/syscall.c:2038
 bpf_map_do_batch+0x25c/0x380 kernel/bpf/syscall.c:5647
 __sys_bpf+0x5f8/0x7b0 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6272
 x64_sys_call+0x28e1/0x3000 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 5114 Comm: syz.0.477 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/02 07:55 upstream 9f2693489ef8 6b8752f2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free
* Struck through repros no longer work on HEAD.