syzbot


KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (5)

Status: moderation: reported on 2025/12/15 04:17
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+a34b5a7b2a9e0fa0cf77@syzkaller.appspotmail.com
First crash: 75d, last: 3d13h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
15b877cf-65aa-4ab6-aff6-801c328ece03 assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (5) 2026/01/15 13:04 2026/01/15 13:04 2026/01/15 13:08 a9d6a79219801d2130df3b1a792c57f0e5428e9f
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv can 6 4 658d 703d 0/29 auto-obsoleted due to no activity on 2024/06/14 15:49
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (4) can 6 9 174d 267d 0/29 auto-obsoleted due to no activity on 2025/11/02 07:50
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (3) can 6 4 371d 356d 0/29 auto-obsoleted due to no activity on 2025/04/19 08:20
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (2) can 6 1 480d 480d 0/29 auto-obsoleted due to no activity on 2024/12/30 16:15

Sample crash report:
==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff88810016dec0 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __alloc_skb+0x658/0x690 net/core/skbuff.c:697
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:819 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:876 [inline]
 nsim_dev_trap_report_work+0x18a/0x630 drivers/net/netdevsim/dev.c:922
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff88810016dec0 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __alloc_skb+0x658/0x690 net/core/skbuff.c:697
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nlmsg_new include/net/netlink.h:1055 [inline]
 inet_netconf_notify_devconf+0x173/0x230 net/ipv4/devinet.c:2209
 __devinet_sysctl_register+0x20e/0x260 net/ipv4/devinet.c:2683
 devinet_sysctl_register+0x101/0x150 net/ipv4/devinet.c:2717
 inetdev_init+0x1de/0x340 net/ipv4/devinet.c:291
 inetdev_event+0x404/0xba0 net/ipv4/devinet.c:1590
 notifier_call_chain kernel/notifier.c:85 [inline]
 raw_notifier_call_chain+0x83/0x1c0 kernel/notifier.c:453
 call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
 call_netdevice_notifiers+0xb5/0x110 net/core/dev.c:2301
 register_netdevice+0xe30/0x1000 net/core/dev.c:11449
 tun_set_iff+0x5f1/0x8a0 drivers/net/tun.c:2807
 __tun_chr_ioctl+0x65e/0x14d0 drivers/net/tun.c:3088
 tun_chr_ioctl+0x27/0x40 drivers/net/tun.c:3337
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x1563/0x3020 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0015c6cb -> 0x0015c6cc

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 11553 Comm: syz.4.2998 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter

read-write to 0xffff888100a80f18 of 8 bytes by interrupt on cpu 0:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline]
 _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 ptr_ring_consume_bh include/linux/ptr_ring.h:377 [inline]
 wg_packet_encrypt_worker+0xd9c/0xde0 drivers/net/wireguard/send.c:293
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888100a80f18 of 8 bytes by interrupt on cpu 1:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
 copy_fpstate_to_sigframe+0x31e/0x7f0 arch/x86/kernel/fpu/signal.c:220
 get_sigframe+0x34c/0x470 arch/x86/kernel/signal.c:163
 x64_setup_rt_frame+0xa7/0x4e0 arch/x86/kernel/signal_64.c:175
 setup_rt_frame arch/x86/kernel/signal.c:250 [inline]
 handle_signal arch/x86/kernel/signal.c:294 [inline]
 arch_do_signal_or_restart+0x24b/0x450 arch/x86/kernel/signal.c:339
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x6a/0x6f0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x249/0x370 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000161333 -> 0x0000000000161334

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3318 Comm: syz-executor Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter

read-write to 0xffff888100a80f18 of 8 bytes by interrupt on cpu 0:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline]
 _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:891 [inline]
 nsim_dev_trap_report_work+0x52b/0x630 drivers/net/netdevsim/dev.c:922
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888100a80f18 of 8 bytes by interrupt on cpu 1:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline]
 _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 neigh_periodic_work+0x5e9/0x690 net/core/neighbour.c:1038
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00000000001a0ac1 -> 0x00000000001a0ac2

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3416 Comm: kworker/1:4 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_power_efficient neigh_periodic_work
==================================================================
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter

read-write to 0xffff888101cd0568 of 8 bytes by interrupt on cpu 0:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 update_defense_level+0x59d/0x5d0 net/netfilter/ipvs/ip_vs_ctl.c:209
 defense_work_handler+0x1f/0x80 net/netfilter/ipvs/ip_vs_ctl.c:234
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888101cd0568 of 8 bytes by interrupt on cpu 1:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline]
 _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:185 [inline]
 batadv_dat_purge+0x1e3/0x270 net/batman-adv/distributed-arp-table.c:204
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x0000000000040f61 -> 0x0000000000040f62

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 406 Comm: kworker/u8:7 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: bat_events batadv_dat_purge
==================================================================
==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff88810016dec0 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
 kernel_fpu_end+0x6c/0x80 arch/x86/kernel/fpu/core.c:506
 blake2s_compress+0x67/0x1740 lib/crypto/x86/blake2s.h:42
 blake2s_final+0x6a/0xa0 lib/crypto/blake2s.c:142
 blake2s include/crypto/blake2s.h:157 [inline]
 compute_mac1 drivers/net/wireguard/cookie.c:80 [inline]
 wg_cookie_add_mac_to_packet+0x17f/0x3a0 drivers/net/wireguard/cookie.c:163
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:35 [inline]
 wg_packet_handshake_send_worker+0xd0/0x160 drivers/net/wireguard/send.c:51
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff88810016dec0 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1063
 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x001db99f -> 0x001db9a0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 22 Comm: ksoftirqd/1 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter

read-write to 0xffff888100a80f18 of 8 bytes by interrupt on cpu 0:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
 kernel_fpu_end+0x6c/0x80 arch/x86/kernel/fpu/core.c:506
 blake2s_compress+0x67/0x1740 lib/crypto/x86/blake2s.h:42
 blake2s_final+0x6a/0xa0 lib/crypto/blake2s.c:142
 hmac+0x3a1/0x400 drivers/net/wireguard/noise.c:333
 kdf+0xa9/0x1e0 drivers/net/wireguard/noise.c:367
 mix_dh drivers/net/wireguard/noise.c:413 [inline]
 wg_noise_handshake_create_initiation+0x1b0/0x610 drivers/net/wireguard/noise.c:550
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:34 [inline]
 wg_packet_handshake_send_worker+0xb2/0x160 drivers/net/wireguard/send.c:51
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888100a80f18 of 8 bytes by interrupt on cpu 1:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 update_defense_level+0x59d/0x5d0 net/netfilter/ipvs/ip_vs_ctl.c:209
 defense_work_handler+0x1f/0x80 net/netfilter/ipvs/ip_vs_ctl.c:234
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00000000001e1b61 -> 0x00000000001e1b62

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 35 Comm: kworker/1:1 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_long defense_work_handler
==================================================================
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter

read-write to 0xffff888101cd0568 of 8 bytes by interrupt on cpu 0:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
 kernel_fpu_end+0x6c/0x80 arch/x86/kernel/fpu/core.c:506
 blake2s_compress+0x67/0x1740 lib/crypto/x86/blake2s.h:42
 blake2s_update+0xa3/0x160 lib/crypto/blake2s.c:119
 hmac+0x20c/0x400 drivers/net/wireguard/noise.c:324
 kdf+0x118/0x1e0 drivers/net/wireguard/noise.c:375
 mix_precomputed_dh drivers/net/wireguard/noise.c:426 [inline]
 wg_noise_handshake_create_initiation+0x372/0x610 drivers/net/wireguard/noise.c:560
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:34 [inline]
 wg_packet_handshake_send_worker+0xb2/0x160 drivers/net/wireguard/send.c:51
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888101cd0568 of 8 bytes by interrupt on cpu 1:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline]
 _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 ptr_ring_consume_bh include/linux/ptr_ring.h:377 [inline]
 wg_packet_encrypt_worker+0xd9c/0xde0 drivers/net/wireguard/send.c:293
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x000000000007986a -> 0x000000000007986b

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3359 Comm: kworker/1:2 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: wg-crypt-wg0 wg_packet_encrypt_worker
==================================================================
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter

read-write to 0xffff888101cd0568 of 8 bytes by interrupt on cpu 0:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __alloc_skb+0x658/0x690 net/core/skbuff.c:697
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:819 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:876 [inline]
 nsim_dev_trap_report_work+0x18a/0x630 drivers/net/netdevsim/dev.c:922
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888101cd0568 of 8 bytes by interrupt on cpu 1:
 deliver net/can/af_can.c:576 [inline]
 can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6156 [inline]
 __netif_receive_skb net/core/dev.c:6269 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6620
 __napi_poll+0x61/0x330 net/core/dev.c:7684
 napi_poll net/core/dev.c:7747 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7899
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/24 23:52 upstream 7dff99b35460 787dfb7c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/21 11:31 upstream d79526b89571 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/20 12:09 upstream 8bf22c33e7a1 17d780d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/19 20:10 upstream 2b7a25df823d c8d8c52d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/08 18:46 upstream e98f34af6116 4c131dc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/26 13:03 upstream 63804fed149a a4c52dd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/21 19:55 upstream cf38b2340c0e 8fc37797 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/21 15:41 upstream 6c790212c588 6f1aa2f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/20 16:01 upstream 24d479d26b25 06648d9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2025/12/15 04:16 upstream 8f0b4cce4481 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
* Struck through repros no longer work on HEAD.