================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff8881199e31f8 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:890 [inline] nsim_dev_trap_report_work+0x52b/0x630 drivers/net/netdevsim/dev.c:921 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x6bc/0x8b0 kernel/workqueue.c:3421 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff8881199e31f8 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x39/0xc0 kernel/softirq.c:723 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x1a/0x30 kernel/locking/spinlock.c:194 unlock_hrtimer_base kernel/time/hrtimer.c:1013 [inline] hrtimer_start_range_ns+0xd3b/0x10d0 kernel/time/hrtimer.c:1325 hrtimer_start include/linux/hrtimer.h:259 [inline] j1939_tp_schedule_txtimer+0x68/0xa0 net/can/j1939/transport.c:703 j1939_sk_send_loop net/can/j1939/socket.c:1175 [inline] j1939_sk_sendmsg+0x991/0xc00 net/can/j1939/socket.c:1288 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0x5af/0x600 net/socket.c:2592 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x185/0x320 net/socket.c:2735 __do_sys_sendmmsg net/socket.c:2762 [inline] __se_sys_sendmmsg net/socket.c:2759 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x0000000000000aa4 -> 0x0000000000000aa5 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 20883 Comm: syz.0.5042 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 ================================================================== ================================================================== BUG: KCSAN: data-race in vxcan_xmit / vxcan_xmit read-write to 0xffff888119e68228 of 8 bytes by interrupt on cpu 0: vxcan_xmit+0x28b/0x340 drivers/net/can/vxcan.c:74 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1063 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff888119e68228 of 8 bytes by interrupt on cpu 1: vxcan_xmit+0x28b/0x340 drivers/net/can/vxcan.c:74 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] j1939_session_list_unlock net/can/j1939/transport.c:243 [inline] j1939_session_activate+0x1d3/0x220 net/can/j1939/transport.c:1582 j1939_sk_send_loop net/can/j1939/socket.c:1174 [inline] j1939_sk_sendmsg+0x96a/0xc00 net/can/j1939/socket.c:1288 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0x5af/0x600 net/socket.c:2592 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x185/0x320 net/socket.c:2735 __do_sys_sendmmsg net/socket.c:2762 [inline] __se_sys_sendmmsg net/socket.c:2759 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000000061d5 -> 0x00000000000061d6 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 20883 Comm: syz.0.5042 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 ================================================================== ================================================================== BUG: KCSAN: data-race in vxcan_xmit / vxcan_xmit read-write to 0xffff88810d0b0220 of 8 bytes by interrupt on cpu 0: vxcan_xmit+0x2c8/0x340 drivers/net/can/vxcan.c:77 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1063 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff88810d0b0220 of 8 bytes by interrupt on cpu 1: vxcan_xmit+0x2c8/0x340 drivers/net/can/vxcan.c:77 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] __batadv_dat_purge net/batman-adv/distributed-arp-table.c:185 [inline] batadv_dat_purge+0x1e3/0x270 net/batman-adv/distributed-arp-table.c:204 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x6bc/0x8b0 kernel/workqueue.c:3421 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x000000000003d1dd -> 0x000000000003d1de Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 30 Comm: kworker/u8:1 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: bat_events batadv_dat_purge ================================================================== ================================================================== BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv read-write to 0xffff88811d140020 of 4 bytes by interrupt on cpu 0: can_can_gw_rcv+0x807/0x820 net/can/gw.c:566 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] lock_sock_nested+0x132/0x160 net/core/sock.c:3787 lock_sock include/net/sock.h:1700 [inline] sockopt_lock_sock+0x41/0x50 net/core/sock.c:1152 do_ip_getsockopt+0xaa8/0x1070 net/ipv4/ip_sockglue.c:1703 ip_getsockopt+0x5c/0x180 net/ipv4/ip_sockglue.c:1765 tcp_getsockopt+0xad/0xe0 net/ipv4/tcp.c:4832 sock_common_getsockopt+0x60/0x70 net/core/sock.c:3946 do_sock_getsockopt+0x1c4/0x210 net/socket.c:2383 __sys_getsockopt net/socket.c:2412 [inline] __do_sys_getsockopt net/socket.c:2419 [inline] __se_sys_getsockopt net/socket.c:2416 [inline] __x64_sys_getsockopt+0x11d/0x1a0 net/socket.c:2416 x64_sys_call+0x2dc7/0x3000 arch/x86/include/generated/asm/syscalls_64.h:56 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read-write to 0xffff88811d140020 of 4 bytes by interrupt on cpu 1: can_can_gw_rcv+0x807/0x820 net/can/gw.c:566 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] __batadv_dat_purge net/batman-adv/distributed-arp-table.c:185 [inline] batadv_dat_purge+0x1e3/0x270 net/batman-adv/distributed-arp-table.c:204 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x6bc/0x8b0 kernel/workqueue.c:3421 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x00042820 -> 0x00042821 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 30 Comm: kworker/u8:1 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: bat_events batadv_dat_purge ================================================================== ================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff8881199e31f8 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline] kernel_fpu_end+0x6c/0x80 arch/x86/kernel/fpu/core.c:506 blake2s_compress+0x67/0x1740 lib/crypto/x86/blake2s.h:42 blake2s_update+0xa3/0x160 lib/crypto/blake2s.c:119 hmac+0x20c/0x400 drivers/net/wireguard/noise.c:324 kdf+0x7d/0x1e0 drivers/net/wireguard/noise.c:360 mix_dh drivers/net/wireguard/noise.c:413 [inline] wg_noise_handshake_create_initiation+0x1b0/0x610 drivers/net/wireguard/noise.c:550 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:34 [inline] wg_packet_handshake_send_worker+0xb2/0x160 drivers/net/wireguard/send.c:51 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x6bc/0x8b0 kernel/workqueue.c:3421 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff8881199e31f8 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0x242/0x4f0 net/can/af_can.c:609 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_table_free+0x21f/0x290 net/batman-adv/translation-table.c:1348 batadv_tt_free+0x64/0x5f0 net/batman-adv/translation-table.c:3531 batadv_mesh_free+0x64/0xc0 net/batman-adv/main.c:265 batadv_meshif_free+0x15/0x30 net/batman-adv/mesh-interface.c:989 netdev_run_todo+0x784/0x8b0 net/core/dev.c:11706 rtnl_unlock+0xe/0x20 net/core/rtnetlink.c:157 default_device_exit_batch+0x5eb/0x640 net/core/dev.c:13052 ops_exit_list net/core/net_namespace.c:205 [inline] ops_undo_list+0x2ca/0x420 net/core/net_namespace.c:252 cleanup_net+0x31c/0x550 net/core/net_namespace.c:696 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x6bc/0x8b0 kernel/workqueue.c:3421 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x00000000000a57a8 -> 0x00000000000a57aa Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 40 Comm: kworker/u8:2 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: netns cleanup_net ================================================================== ================================================================== BUG: KCSAN: data-race in vxcan_xmit / vxcan_xmit read-write to 0xffff88810d0b0220 of 8 bytes by interrupt on cpu 0: vxcan_xmit+0x2c8/0x340 drivers/net/can/vxcan.c:77 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1063 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff88810d0b0220 of 8 bytes by interrupt on cpu 1: vxcan_xmit+0x2c8/0x340 drivers/net/can/vxcan.c:77 __netdev_start_xmit include/linux/netdevice.h:5273 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3882 __dev_queue_xmit+0xdb1/0x1f20 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] can_send+0x589/0x720 net/can/af_can.c:279 can_can_gw_rcv+0x7bb/0x820 net/can/gw.c:563 deliver net/can/af_can.c:575 [inline] can_rcv_filter+0xc7/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_table_free+0x21f/0x290 net/batman-adv/translation-table.c:1348 batadv_tt_free+0x64/0x5f0 net/batman-adv/translation-table.c:3531 batadv_mesh_free+0x64/0xc0 net/batman-adv/main.c:265 batadv_meshif_free+0x15/0x30 net/batman-adv/mesh-interface.c:989 netdev_run_todo+0x784/0x8b0 net/core/dev.c:11706 rtnl_unlock+0xe/0x20 net/core/rtnetlink.c:157 default_device_exit_batch+0x5eb/0x640 net/core/dev.c:13052 ops_exit_list net/core/net_namespace.c:205 [inline] ops_undo_list+0x2ca/0x420 net/core/net_namespace.c:252 cleanup_net+0x31c/0x550 net/core/net_namespace.c:696 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x6bc/0x8b0 kernel/workqueue.c:3421 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0x00000000000b8816 -> 0x00000000000b8817 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 40 Comm: kworker/u8:2 Tainted: G W syzkaller #0 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: netns cleanup_net ================================================================== ================================================================== BUG: KCSAN: data-race in can_rcv_filter / can_rcv_filter read-write to 0xffff888117b272e8 of 8 bytes by interrupt on cpu 0: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:890 [inline] nsim_dev_trap_report_work+0x52b/0x630 drivers/net/netdevsim/dev.c:921 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340 worker_thread+0x6bc/0x8b0 kernel/workqueue.c:3421 kthread+0x22a/0x280 kernel/kthread.c:467 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 read-write to 0xffff888117b272e8 of 8 bytes by interrupt on cpu 1: deliver net/can/af_can.c:576 [inline] can_rcv_filter+0xd9/0x4f0 net/can/af_can.c:602 can_receive+0x163/0x1c0 net/can/af_can.c:666 can_rcv+0xed/0x190 net/can/af_can.c:690 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x363/0x670 net/core/dev.c:6617 __napi_poll+0x5f/0x310 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x452/0x930 net/core/dev.c:7896