================================================================== BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv read-write to 0xffff888104788080 of 4 bytes by interrupt on cpu 0: can_can_gw_rcv+0x807/0x820 net/can/gw.c:566 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:890 [inline] nsim_dev_trap_report_work+0x52b/0x630 drivers/net/netdevsim/dev.c:921 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff888104788080 of 4 bytes by interrupt on cpu 1: can_can_gw_rcv+0x807/0x820 net/can/gw.c:566 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1063 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x0000062b -> 0x0000062c Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 22 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 ================================================================== ================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff8881009c5158 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] __alloc_skb+0x477/0x4b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1383 [inline] nlmsg_new include/net/netlink.h:1055 [inline] inet6_ifmcaddr_notify+0xd6/0x190 net/ipv6/mcast.c:909 __ipv6_dev_mc_inc+0x4e4/0x5b0 net/ipv6/mcast.c:973 ipv6_dev_mc_inc+0x1f/0x30 net/ipv6/mcast.c:981 ipv6_add_dev+0x955/0xac0 net/ipv6/addrconf.c:472 addrconf_notify+0x4a5/0x8f0 net/ipv6/addrconf.c:3650 notifier_call_chain kernel/notifier.c:85 [inline] raw_notifier_call_chain+0x6f/0x1b0 kernel/notifier.c:453 call_netdevice_notifiers_info net/core/dev.c:2243 [inline] call_netdevice_notifiers_extack net/core/dev.c:2281 [inline] call_netdevice_notifiers+0xb5/0x110 net/core/dev.c:2295 register_netdevice+0xc84/0xdd0 net/core/dev.c:11444 rtnl_newlink_create+0x1f3/0x650 net/core/rtnetlink.c:3842 __rtnl_newlink net/core/rtnetlink.c:3957 [inline] rtnl_newlink+0xf5b/0x1370 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:6985 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5c0/0x690 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x145/0x170 net/socket.c:742 __sys_sendto+0x2b2/0x380 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0x76/0x90 net/socket.c:2209 x64_sys_call+0x29a7/0x3000 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read-write to 0xffff8881009c5158 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x39/0xc0 kernel/softirq.c:723 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x1a/0x30 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] unlock_page_lruvec_irqrestore include/linux/memcontrol.h:1481 [inline] folios_put_refs+0x232/0x2d0 mm/swap.c:994 free_pages_and_swap_cache+0x2ca/0x450 mm/swap_state.c:355 __tlb_batch_free_encoded_pages mm/mmu_gather.c:137 [inline] tlb_batch_pages_flush mm/mmu_gather.c:150 [inline] tlb_flush_mmu_free mm/mmu_gather.c:398 [inline] tlb_flush_mmu+0x2e6/0x460 mm/mmu_gather.c:405 tlb_finish_mmu+0x8d/0x110 mm/mmu_gather.c:530 exit_mmap+0x313/0x6c0 mm/mmap.c:1290 __mmput+0x28/0x1c0 kernel/fork.c:1173 mmput+0x40/0x50 kernel/fork.c:1196 exit_mm+0xe3/0x180 kernel/exit.c:581 do_exit+0x3fa/0x1590 kernel/exit.c:959 do_group_exit+0x138/0x140 kernel/exit.c:1112 __do_sys_exit_group kernel/exit.c:1123 [inline] __se_sys_exit_group kernel/exit.c:1121 [inline] __x64_sys_exit_group+0x1f/0x20 kernel/exit.c:1121 x64_sys_call+0x2fff/0x3000 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000000038cb -> 0x00000000000038cc Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 3307 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 ================================================================== ================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff8881019d74c8 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1063 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff8881019d74c8 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] j1939_sk_queue_session net/can/j1939/socket.c:107 [inline] j1939_sk_send_loop net/can/j1939/socket.c:1170 [inline] j1939_sk_sendmsg+0x906/0xc00 net/can/j1939/socket.c:1288 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x145/0x170 net/socket.c:742 ____sys_sendmsg+0x345/0x4a0 net/socket.c:2592 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x185/0x320 net/socket.c:2735 __do_sys_sendmmsg net/socket.c:2762 [inline] __se_sys_sendmmsg net/socket.c:2759 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000000262a5 -> 0x00000000000262a6 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 10127 Comm: syz.3.2598 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 ================================================================== ================================================================== BUG: KCSAN: data-race in vxcan_xmit / vxcan_xmit read-write to 0xffff888109ce8228 of 8 bytes by interrupt on cpu 0: vxcan_xmit+0x28b/0x340 drivers/net/can/vxcan.c:74 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:890 [inline] nsim_dev_trap_report_work+0x52b/0x630 drivers/net/netdevsim/dev.c:921 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff888109ce8228 of 8 bytes by interrupt on cpu 1: vxcan_xmit+0x28b/0x340 drivers/net/can/vxcan.c:74 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1315 batadv_tt_purge+0x2b/0x610 net/batman-adv/translation-table.c:3509 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x000000000002a655 -> 0x000000000002a656 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 8481 Comm: kworker/u8:28 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: bat_events batadv_tt_purge ================================================================== ================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff8881009c5158 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] j1939_sk_queue_session net/can/j1939/socket.c:107 [inline] j1939_sk_send_loop net/can/j1939/socket.c:1170 [inline] j1939_sk_sendmsg+0x906/0xc00 net/can/j1939/socket.c:1288 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x145/0x170 net/socket.c:742 ____sys_sendmsg+0x345/0x4a0 net/socket.c:2592 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x185/0x320 net/socket.c:2735 __do_sys_sendmmsg net/socket.c:2762 [inline] __se_sys_sendmmsg net/socket.c:2759 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read-write to 0xffff8881009c5158 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1315 batadv_tt_purge+0x2b/0x610 net/batman-adv/translation-table.c:3509 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x000000000003c994 -> 0x000000000003c995 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 8481 Comm: kworker/u8:28 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: bat_events batadv_tt_purge ================================================================== ================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff8881019d74c8 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] __alloc_skb+0x477/0x4b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1383 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:818 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:875 [inline] nsim_dev_trap_report_work+0x18a/0x630 drivers/net/netdevsim/dev.c:921 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff8881019d74c8 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1315 batadv_tt_purge+0x2b/0x610 net/batman-adv/translation-table.c:3509 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x000000000004403c -> 0x000000000004403d Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 8481 Comm: kworker/u8:28 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: bat_events batadv_tt_purge ================================================================== ================================================================== BUG: KCSAN: data-race in vxcan_xmit / vxcan_xmit read-write to 0xffff888109ce8228 of 8 bytes by interrupt on cpu 0: vxcan_xmit+0x28b/0x340 drivers/net/can/vxcan.c:74 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] j1939_session_list_unlock net/can/j1939/transport.c:243 [inline] j1939_session_activate+0x1d3/0x220 net/can/j1939/transport.c:1582 j1939_sk_send_loop net/can/j1939/socket.c:1174 [inline] j1939_sk_sendmsg+0x96a/0xc00 net/can/j1939/socket.c:1288 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x145/0x170 net/socket.c:742 ____sys_sendmsg+0x345/0x4a0 net/socket.c:2592 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x185/0x320 net/socket.c:2735 __do_sys_sendmmsg net/socket.c:2762 [inline] __se_sys_sendmmsg net/socket.c:2759 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read-write to 0xffff888109ce8228 of 8 bytes by interrupt on cpu 1: vxcan_xmit+0x28b/0x340 drivers/net/can/vxcan.c:74 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline] batadv_tt_purge+0x2cd/0x610 net/batman-adv/translation-table.c:3510 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x000000000005c7af -> 0x000000000005c7b0 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 8481 Comm: kworker/u8:28 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: bat_events batadv_tt_purge ================================================================== ================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff8881009c5388 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline] kernel_fpu_end+0x6c/0x80 arch/x86/kernel/fpu/core.c:506 blake2s_compress+0x67/0x1740 lib/crypto/x86/blake2s.h:42 blake2s_update+0xa3/0x160 lib/crypto/blake2s.c:119 hmac+0x396/0x400 drivers/net/wireguard/noise.c:332 kdf drivers/net/wireguard/noise.c:367 [inline] message_ephemeral+0x1e6/0x260 drivers/net/wireguard/noise.c:493 wg_noise_handshake_create_initiation+0x15e/0x610 drivers/net/wireguard/noise.c:545 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:34 [inline] wg_packet_handshake_send_worker+0xb2/0x160 drivers/net/wireguard/send.c:51 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff8881009c5388 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb+0x120/0x270 net/core/dev.c:6265 process_backlog+0x228/0x420 net/core/dev.c:6617 __napi_poll+0x5f/0x300 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline] batadv_tt_purge+0x2cd/0x610 net/batman-adv/translation-table.c:3510 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x581/0x770 kernel/workqueue.c:3421 kthread+0x488/0x510 kernel/kthread.c:463 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x000000000005f1dc -> 0x000000000005f1dd Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 8481 Comm: kworker/u8:28 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: bat_events batadv_tt_purge ==================================================================