syzbot


KCSAN: data-race in can_rcv_filter / can_rcv_filter (13)

Status: moderation: reported on 2025/09/29 00:33
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+d92de0baa57e75f2d5d9@syzkaller.appspotmail.com
First crash: 20d, last: 2d06h
Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (11) can 6 5 232d 223d 0/29 auto-obsoleted due to no activity on 2025/04/25 09:54
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter can 6 3 2087d 2099d 0/29 auto-closed as invalid on 2020/04/11 00:08
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (12) can 6 7 100d 135d 0/29 auto-obsoleted due to no activity on 2025/09/04 19:07
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (2) can 6 1 1683d 1683d 0/29 auto-closed as invalid on 2021/04/14 07:16
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (9) can 6 9 510d 570d 0/29 auto-obsoleted due to no activity on 2024/06/30 06:15
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (8) can 6 9 836d 953d 0/29 auto-obsoleted due to no activity on 2023/08/09 14:18
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (5) can 6 1 1259d 1259d 0/29 auto-closed as invalid on 2022/06/12 10:04
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (7) can 6 3 1028d 1059d 0/29 auto-obsoleted due to no activity on 2023/02/28 05:31
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (4) can 6 6 1295d 1361d 0/29 auto-closed as invalid on 2022/05/07 18:40
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (10) can 6 1 366d 366d 0/29 auto-obsoleted due to no activity on 2024/11/22 01:30
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (3) can 6 2 1404d 1404d 0/29 auto-closed as invalid on 2022/01/19 00:57
upstream KCSAN: data-race in can_rcv_filter / can_rcv_filter (6) can 6 7 1105d 1182d 0/29 auto-obsoleted due to no activity on 2022/11/13 19:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter

read-write to 0xffff8881015a3248 of 8 bytes by interrupt on cpu 1:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x163/0x1c0 net/can/af_can.c:666
 can_rcv+0xed/0x190 net/can/af_can.c:690
 __netif_receive_skb_one_core net/core/dev.c:6079 [inline]
 __netif_receive_skb+0x120/0x270 net/core/dev.c:6192
 process_backlog+0x229/0x420 net/core/dev.c:6544
 __napi_poll+0x66/0x310 net/core/dev.c:7594
 napi_poll net/core/dev.c:7657 [inline]
 net_rx_action+0x423/0x8c0 net/core/dev.c:7784
 handle_softirqs+0xba/0x290 kernel/softirq.c:622
 do_softirq+0x5d/0x90 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:835 [inline]
 nsim_dev_trap_report_work+0x52b/0x630 drivers/net/netdevsim/dev.c:866
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3346
 worker_thread+0x582/0x770 kernel/workqueue.c:3427
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x122/0x1b0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff8881015a3248 of 8 bytes by interrupt on cpu 0:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x163/0x1c0 net/can/af_can.c:666
 can_rcv+0xed/0x190 net/can/af_can.c:690
 __netif_receive_skb_one_core net/core/dev.c:6079 [inline]
 __netif_receive_skb+0x120/0x270 net/core/dev.c:6192
 process_backlog+0x229/0x420 net/core/dev.c:6544
 __napi_poll+0x66/0x310 net/core/dev.c:7594
 napi_poll net/core/dev.c:7657 [inline]
 net_rx_action+0x423/0x8c0 net/core/dev.c:7784
 handle_softirqs+0xba/0x290 kernel/softirq.c:622
 do_softirq+0x5d/0x90 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 srcu_invoke_callbacks+0x16c/0x250 kernel/rcu/srcutree.c:1818
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3346
 worker_thread+0x582/0x770 kernel/workqueue.c:3427
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x122/0x1b0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x0000000000003fc9 -> 0x0000000000003fca

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3398 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: rcu_gp srcu_invoke_callbacks
==================================================================
vcan0: j1939_tp_rxtimer: 0xffff888119d1f200: rx timeout, send abort
vcan0: j1939_tp_rxtimer: 0xffff888119d1f200: abort rx timeout. Force session deactivation

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/16 20:37 upstream 98ac9cc4b445 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_rcv_filter / can_rcv_filter
2025/10/16 08:43 upstream 7ea30958b305 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_rcv_filter / can_rcv_filter
2025/10/16 08:40 upstream 7ea30958b305 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_rcv_filter / can_rcv_filter
2025/09/29 00:32 upstream 8f9736633f8c 001c9061 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_rcv_filter / can_rcv_filter
* Struck through repros no longer work on HEAD.