[moderation] [bpf?] KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid

Hello,

syzbot found the following issue on:

HEAD commit: 86731a2a651e Linux 6.16-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1659bb0c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=39acdbb3c95d37e5
dashboard link: https://syzkaller.appspot.com/bug?extid=50d2ee6aa58d2a3db47e
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
CC: [[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/15aec36f548c/disk-86731a2a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a569b058a29e/vmlinux-86731a2a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0029b45574c4/bzImage-86731a2a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

==================================================================
BUG: KCSAN: data-race in __bpf_get_stackid / __bpf_get_stackid

write to 0xffff8881021b4308 of 4 bytes by task 7032 on cpu 0:
__bpf_get_stackid+0x76b/0x800 kernel/bpf/stackmap.c:291
____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1811 [inline]
bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1800
bpf_prog_e6fc920cfeff8120+0x2a/0x32
bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2258 [inline]
bpf_trace_run2+0x104/0x1c0 kernel/trace/bpf_trace.c:2299
__traceiter_kfree+0x2e/0x50 include/trace/events/kmem.h:94
__do_trace_kfree include/trace/events/kmem.h:94 [inline]
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x27b/0x320 mm/slub.c:4829
genl_family_rcv_msg_attrs_free net/netlink/genetlink.c:956 [inline]
genl_family_rcv_msg_doit+0x17f/0x1b0 net/netlink/genetlink.c:1121
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x422/0x460 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x120/0x220 net/netlink/af_netlink.c:2534
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x59e/0x670 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x58b/0x6b0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x142/0x180 net/socket.c:727
__sys_sendto+0x268/0x330 net/socket.c:2180
__do_sys_sendto net/socket.c:2187 [inline]
__se_sys_sendto net/socket.c:2183 [inline]
__x64_sys_sendto+0x76/0x90 net/socket.c:2183
x64_sys_call+0x2eb6/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:45
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881021b4308 of 4 bytes by task 7026 on cpu 1:
__bpf_get_stackid+0x287/0x800 kernel/bpf/stackmap.c:249
____bpf_get_stackid kernel/bpf/stackmap.c:324 [inline]
bpf_get_stackid+0xee/0x120 kernel/bpf/stackmap.c:300
____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1811 [inline]
bpf_get_stackid_raw_tp+0xf6/0x120 kernel/trace/bpf_trace.c:1800
bpf_prog_e6fc920cfeff8120+0x2a/0x32
bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2258 [inline]
bpf_trace_run2+0x104/0x1c0 kernel/trace/bpf_trace.c:2299
__traceiter_kfree+0x2e/0x50 include/trace/events/kmem.h:94
__do_trace_kfree include/trace/events/kmem.h:94 [inline]
trace_kfree include/trace/events/kmem.h:94 [inline]
kfree+0x27b/0x320 mm/slub.c:4829
___sys_recvmsg+0x135/0x370 net/socket.c:2829
do_recvmmsg+0x1ef/0x540 net/socket.c:2923
__sys_recvmmsg net/socket.c:2997 [inline]
__do_sys_recvmmsg net/socket.c:3020 [inline]
__se_sys_recvmmsg net/socket.c:3013 [inline]
__x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3013
x64_sys_call+0x1c6a/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:300
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x78477b0d -> 0x932b7988

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 7026 Comm: syz.1.1034 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup