[moderation] [bpf?] KCSAN: data-race in bcmp / parse_build_id

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 51a24b7deaae Merge tag 'trace-tools-v6.17-rc5' of git://gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=119df2e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7f65ba98bb01573
dashboard link: https://syzkaller.appspot.com/bug?extid=34ed7a3bbe17728f901f
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
CC: [and...@kernel.org a...@kernel.org b...@vger.kernel.org dan...@iogearbox.net edd...@gmail.com hao...@google.com john.fa...@gmail.com jo...@kernel.org kps...@kernel.org linux-...@vger.kernel.org marti...@linux.dev s...@fomichev.me so...@kernel.org yongho...@linux.dev]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d68c6049bbc0/disk-51a24b7d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ef1f5d9dfc12/vmlinux-51a24b7d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7549561d646b/bzImage-51a24b7d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+34ed7a...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in bcmp / parse_build_id

write to 0xffff8881190a39a4 of 20 bytes by task 6764 on cpu 1:
parse_build_id+0x249/0x2b0 lib/buildid.c:200
get_build_id_64 lib/buildid.c:279 [inline]
__build_id_parse+0x253/0x4a0 lib/buildid.c:324
build_id_parse_nofault+0x27/0x40 lib/buildid.c:343
fetch_build_id kernel/bpf/stackmap.c:130 [inline]
stack_map_get_build_id_offset+0x258/0x570 kernel/bpf/stackmap.c:175
__bpf_get_stackid+0x617/0x800 kernel/bpf/stackmap.c:266
____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1810 [inline]
bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1799
bpf_prog_33c66cfd8c9e7eb0+0x2a/0x32
bpf_dispatcher_nop_func include/linux/bpf.h:1332 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2257 [inline]
bpf_trace_run4+0x117/0x1d0 kernel/trace/bpf_trace.c:2300
__do_trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
__alloc_frozen_pages_noprof+0x32d/0x360 mm/page_alloc.c:5170
__alloc_pages_noprof+0x9/0x20 mm/page_alloc.c:5182
__alloc_pages_node_noprof include/linux/gfp.h:284 [inline]
alloc_pages_node_noprof include/linux/gfp.h:311 [inline]
pcpu_alloc_pages mm/percpu-vm.c:95 [inline]
pcpu_populate_chunk+0x206/0xa70 mm/percpu-vm.c:285
pcpu_alloc_noprof+0xac2/0x1250 mm/percpu.c:1870
bpf_map_alloc_percpu+0xb3/0x200 kernel/bpf/syscall.c:558
prealloc_init+0x19f/0x490 kernel/bpf/hashtab.c:336
htab_map_alloc+0x4ba/0x6d0 kernel/bpf/hashtab.c:561
map_create+0x843/0xca0 kernel/bpf/syscall.c:1480
__sys_bpf+0x545/0x7b0 kernel/bpf/syscall.c:6011
__do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
__x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6137
x64_sys_call+0x2aea/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:322
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881190a39a8 of 8 bytes by task 6765 on cpu 0:
memcmp lib/string.c:683 [inline]
bcmp+0x23/0x90 lib/string.c:715
memcmp include/linux/fortify-string.h:727 [inline]
__bpf_get_stackid+0x65a/0x800 kernel/bpf/stackmap.c:269
____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1810 [inline]
bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1799
bpf_prog_33c66cfd8c9e7eb0+0x2a/0x32
bpf_dispatcher_nop_func include/linux/bpf.h:1332 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2257 [inline]
bpf_trace_run4+0x117/0x1d0 kernel/trace/bpf_trace.c:2300
__do_trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
trace_mm_page_alloc include/trace/events/kmem.h:177 [inline]
__alloc_frozen_pages_noprof+0x32d/0x360 mm/page_alloc.c:5170
alloc_pages_mpol+0xb3/0x250 mm/mempolicy.c:2416
folio_alloc_mpol_noprof+0x39/0x80 mm/mempolicy.c:2435
shmem_alloc_folio mm/shmem.c:1908 [inline]
shmem_alloc_and_add_folio mm/shmem.c:1947 [inline]
shmem_get_folio_gfp+0x3cf/0xd60 mm/shmem.c:2597
shmem_fault+0xf6/0x250 mm/shmem.c:2798
__do_fault+0xbc/0x200 mm/memory.c:5152
do_read_fault mm/memory.c:5573 [inline]
do_fault mm/memory.c:5707 [inline]
do_pte_missing mm/memory.c:4234 [inline]
handle_pte_fault mm/memory.c:6052 [inline]
__handle_mm_fault mm/memory.c:6195 [inline]
handle_mm_fault+0xf78/0x2c20 mm/memory.c:6364
faultin_page mm/gup.c:1144 [inline]
__get_user_pages+0x102e/0x1fa0 mm/gup.c:1446
populate_vma_page_range mm/gup.c:1880 [inline]
__mm_populate+0x243/0x3a0 mm/gup.c:1983
mm_populate include/linux/mm.h:3367 [inline]
vm_mmap_pgoff+0x232/0x2e0 mm/util.c:585
ksys_mmap_pgoff+0xc2/0x310 mm/mmap.c:604
x64_sys_call+0x14a3/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:10
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0x7a70cfc339c916d7

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6765 Comm: syz.0.986 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup