KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free (4)

Status: moderation: reported on 2026/10/01 13:17
Subsystems: bpf
Labels: race:benign
[Documentation on labels]
Reported-by: syzbot+1ea4f564bf6f1f3d1dc4@syzkaller.appspotmail.com
First crash: 5h47m, last: 5h47m
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
cac919b4 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free (4) 2026/10/01 14:29 2026/10/01 14:29 2026/10/01 15:16 6d32eb1f
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free bpf 6 10 2223d 2295d 0/29 auto-closed as invalid on 2020/10/03 23:58
upstream KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free (3) bpf 6 2 223d 241d 0/29 auto-obsoleted due to no activity on 2026/04/17 07:22
upstream KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free (2) bpf 6 32 2055d 2124d 20/29 fixed on 2021/04/09 19:46

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free

write to 0xffff88811b758022 of 1 bytes by task 4756 on cpu 1:
 __bpf_lru_node_move kernel/bpf/bpf_lru_list.c:97 [inline]
 __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:137 [inline]
 __bpf_lru_list_rotate+0x2e6/0x750 kernel/bpf/bpf_lru_list.c:228
 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:325 [inline]
 bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:453 [inline]
 bpf_lru_pop_free+0xa62/0x1cf0 kernel/bpf/bpf_lru_list.c:522
 prealloc_lru_pop kernel/bpf/hashtab.c:306 [inline]
 htab_lru_map_update_elem+0xe0/0x6d0 kernel/bpf/hashtab.c:1316
 bpf_map_update_value+0x4ee/0x570 kernel/bpf/syscall.c:297
 generic_map_update_batch+0x4d7/0x700 kernel/bpf/syscall.c:2106
 bpf_map_do_batch+0x25b/0x380 kernel/bpf/syscall.c:5781
 __sys_bpf+0xa8e/0xc30 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6489 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __x64_sys_bpf+0x69/0x80 kernel/bpf/syscall.c:6486
 x64_sys_call+0xf26/0x2550 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811b758022 of 1 bytes by task 4752 on cpu 0:
 bpf_lru_list_push_free kernel/bpf/bpf_lru_list.c:301 [inline]
 bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:562 [inline]
 bpf_lru_push_free+0xc68/0xda0 kernel/bpf/bpf_lru_list.c:588
 htab_lru_push_free+0x17d/0x1a0 kernel/bpf/hashtab.c:1284
 htab_lru_map_update_elem+0x642/0x6d0 kernel/bpf/hashtab.c:1348
 bpf_map_update_value+0x4ee/0x570 kernel/bpf/syscall.c:297
 generic_map_update_batch+0x4d7/0x700 kernel/bpf/syscall.c:2106
 bpf_map_do_batch+0x25b/0x380 kernel/bpf/syscall.c:5781
 __sys_bpf+0xa8e/0xc30 kernel/bpf/syscall.c:-1
 __do_sys_bpf kernel/bpf/syscall.c:6489 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __x64_sys_bpf+0x69/0x80 kernel/bpf/syscall.c:6486
 x64_sys_call+0xf26/0x2550 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4752 Comm: syz.1.522 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/01 13:16 upstream 551c722f4080 f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bpf_lru_list_rotate / bpf_lru_push_free
* Struck through repros no longer work on HEAD.