syzbot


KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (5)

Status: moderation: reported on 2025/12/15 04:17
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+a34b5a7b2a9e0fa0cf77@syzkaller.appspotmail.com
First crash: 140d, last: 2d15h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
15b877cf-65aa-4ab6-aff6-801c328ece03 assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (5) 2026/01/15 13:04 2026/01/15 13:04 2026/01/15 13:08 a9d6a79219801d2130df3b1a792c57f0e5428e9f
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv can 6 4 724d 768d 0/29 auto-obsoleted due to no activity on 2024/06/14 15:49
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (4) can 6 9 239d 332d 0/29 auto-obsoleted due to no activity on 2025/11/02 07:50
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (3) can 6 4 436d 421d 0/29 auto-obsoleted due to no activity on 2025/04/19 08:20
upstream KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv (2) can 6 1 546d 546d 0/29 auto-obsoleted due to no activity on 2024/12/30 16:15

Sample crash report:
==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff88814d907f80 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6202 [inline]
 __netif_receive_skb net/core/dev.c:6315 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6666
 __napi_poll+0x61/0x300 net/core/dev.c:7730
 napi_poll net/core/dev.c:7793 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7950
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x42/0xd0 kernel/softirq.c:735
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1061
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 finish_task_switch+0x132/0x320 kernel/sched/core.c:5244
 context_switch kernel/sched/core.c:5390 [inline]
 __schedule+0x936/0xd20 kernel/sched/core.c:7188
 __schedule_loop kernel/sched/core.c:7267 [inline]
 schedule+0x5e/0xd0 kernel/sched/core.c:7282
 schedule_timeout+0x53/0x180 kernel/time/sleep_timeout.c:75
 unix_wait_for_peer+0x135/0x1a0 net/unix/af_unix.c:1622
 unix_dgram_sendmsg+0x8de/0x1050 net/unix/af_unix.c:2261
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698
 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752
 __sys_sendmmsg+0x185/0x320 net/socket.c:2841
 __do_sys_sendmmsg net/socket.c:2868 [inline]
 __se_sys_sendmmsg net/socket.c:2865 [inline]
 __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2865
 x64_sys_call+0x27aa/0x3020 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read-write to 0xffff88814d907f80 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6202 [inline]
 __netif_receive_skb net/core/dev.c:6315 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6666
 __napi_poll+0x61/0x300 net/core/dev.c:7730
 napi_poll net/core/dev.c:7793 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7950
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
 copy_fpstate_to_sigframe+0x30d/0x7c0 arch/x86/kernel/fpu/signal.c:220
 get_sigframe+0x34c/0x470 arch/x86/kernel/signal.c:163
 x64_setup_rt_frame+0xa7/0x4e0 arch/x86/kernel/signal_64.c:175
 setup_rt_frame arch/x86/kernel/signal.c:250 [inline]
 handle_signal arch/x86/kernel/signal.c:294 [inline]
 arch_do_signal_or_restart+0x24b/0x450 arch/x86/kernel/signal.c:339
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:252 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:323 [inline]
 irqentry_exit+0x140/0x5b0 kernel/entry/common.c:162
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

value changed: 0x0014c2d2 -> 0x0014c2d3

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 28439 Comm: syz.3.6273 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
==================================================================

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/02 06:58 upstream 6fe0be6dc7fa 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/05/01 05:41 upstream 26fd6bff2c05 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/30 10:35 upstream e75a43c7cec4 005438fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/30 10:34 upstream e75a43c7cec4 005438fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/28 08:47 upstream 3b3bea6d4b9c ce741359 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/28 00:45 upstream 3b3bea6d4b9c ce741359 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/27 18:18 upstream 254f49634ee1 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/24 14:32 upstream dd6c438c3e64 1c2b9291 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/21 21:43 upstream 4ee64205ffaa 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/21 16:27 upstream b4e07588e743 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/15 18:18 upstream 1f5ffc672165 c441f497 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/04/09 23:37 upstream 8b02520ec5f7 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/03/31 15:19 upstream d0c3bcd5b897 aeea1c72 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/24 23:52 upstream 7dff99b35460 787dfb7c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/21 11:31 upstream d79526b89571 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/20 12:09 upstream 8bf22c33e7a1 17d780d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/19 20:10 upstream 2b7a25df823d c8d8c52d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/02/08 18:46 upstream e98f34af6116 4c131dc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/26 13:03 upstream 63804fed149a a4c52dd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/21 19:55 upstream cf38b2340c0e 8fc37797 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/21 15:41 upstream 6c790212c588 6f1aa2f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2026/01/20 16:01 upstream 24d479d26b25 06648d9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
2025/12/15 04:16 upstream 8f0b4cce4481 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv
* Struck through repros no longer work on HEAD.