syzbot

==================================================================
BUG: KCSAN: data-race in can_send / can_send

read-write to 0xffff888112cdb4f0 of 8 bytes by interrupt on cpu 1:
 can_send+0x570/0x5d0 net/can/af_can.c:290
 bcm_can_tx+0x314/0x420 net/can/bcm.c:314
 bcm_tx_timeout_handler+0xdb/0x260
 __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
 __hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756
 hrtimer_run_softirq+0xe4/0x2d0 kernel/time/hrtimer.c:1773
 __do_softirq+0xc8/0x285 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:633 [inline]
 irq_exit_rcu+0x3c/0x90 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline]
 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
 _raw_spin_unlock_irq+0x2f/0x50 kernel/locking/spinlock.c:202
 process_one_work kernel/workqueue.c:3223 [inline]
 process_scheduled_works+0x41a/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read-write to 0xffff888112cdb4f0 of 8 bytes by interrupt on cpu 0:
 can_send+0x570/0x5d0 net/can/af_can.c:290
 j1939_send_one+0x19c/0x1d0 net/can/j1939/main.c:357
 j1939_tp_tx_dat net/can/j1939/transport.c:646 [inline]
 j1939_session_tx_dat net/can/j1939/transport.c:838 [inline]
 j1939_xtp_txnext_transmiter net/can/j1939/transport.c:900 [inline]
 j1939_tp_txtimer+0xca9/0x1a70 net/can/j1939/transport.c:1160
 __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
 __hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756
 hrtimer_run_softirq+0xe4/0x2d0 kernel/time/hrtimer.c:1773
 __do_softirq+0xc8/0x285 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:633 [inline]
 irq_exit_rcu+0x3c/0x90 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 slab_free_hook mm/slub.c:2081 [inline]
 slab_free mm/slub.c:4280 [inline]
 kmem_cache_free+0xbc/0x250 mm/slub.c:4344
 io_req_caches_free+0x11d/0x220 io_uring/io_uring.c:2874
 io_ring_exit_work+0x20d/0x500 io_uring/io_uring.c:3084
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0x000000000000014a -> 0x000000000000014b

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 49 Comm: kworker/u8:3 Not tainted 6.9.0-rc5-syzkaller-00042-ge88c4cfcb7b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: iou_exit io_ring_exit_work
==================================================================
==================================================================
BUG: KCSAN: data-race in can_receive / can_receive

read-write to 0xffff888112cdb488 of 8 bytes by interrupt on cpu 1:
 can_receive+0x4e/0x1f0 net/can/af_can.c:649
 canfd_rcv+0xe7/0x180 net/can/af_can.c:702
 __netif_receive_skb_one_core net/core/dev.c:5544 [inline]
 __netif_receive_skb+0x123/0x280 net/core/dev.c:5658
 process_backlog+0x21f/0x380 net/core/dev.c:5987
 __napi_poll+0x63/0x3c0 net/core/dev.c:6638
 napi_poll net/core/dev.c:6707 [inline]
 net_rx_action+0x324/0x720 net/core/dev.c:6822
 __do_softirq+0xc8/0x285 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:633 [inline]
 irq_exit_rcu+0x3c/0x90 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 is_atomic kernel/kcsan/core.c:264 [inline]
 should_watch kernel/kcsan/core.c:277 [inline]
 check_access kernel/kcsan/core.c:752 [inline]
 __tsan_read8+0xfe/0x180 kernel/kcsan/core.c:1025
 batadv_nc_purge_paths+0x6d/0x270 net/batman-adv/network-coding.c:439
 batadv_nc_worker+0x3db/0xac0 net/batman-adv/network-coding.c:720
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read-write to 0xffff888112cdb488 of 8 bytes by interrupt on cpu 0:
 can_receive+0x4e/0x1f0 net/can/af_can.c:649
 can_rcv+0xe7/0x180 net/can/af_can.c:687
 __netif_receive_skb_one_core net/core/dev.c:5544 [inline]
 __netif_receive_skb+0x123/0x280 net/core/dev.c:5658
 process_backlog+0x21f/0x380 net/core/dev.c:5987
 __napi_poll+0x63/0x3c0 net/core/dev.c:6638
 napi_poll net/core/dev.c:6707 [inline]
 net_rx_action+0x324/0x720 net/core/dev.c:6822
 __do_softirq+0xc8/0x285 kernel/softirq.c:554
 run_ksoftirqd+0x17/0x30 kernel/softirq.c:924
 smpboot_thread_fn+0x31c/0x4c0 kernel/smpboot.c:164
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0x0000000000462d0a -> 0x0000000000462d0b

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 6.9.0-rc5-syzkaller-00042-ge88c4cfcb7b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================
vxcan0: j1939_xtp_rx_dat: no tx connection found
vxcan0: j1939_tp_rxtimer: 0xffff888116842400: rx timeout, send abort
vxcan0: j1939_tp_rxtimer: 0xffff888116842400: abort rx timeout. Force session deactivation