==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff88811bdd2b00 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x812/0x820 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x354/0x680 net/core/dev.c:6728
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x456/0x930 net/core/dev.c:8007
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1108
 smpboot_thread_fn+0x32f/0x520 kernel/smpboot.c:160
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff88811bdd2b00 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x812/0x820 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x354/0x680 net/core/dev.c:6728
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x456/0x930 net/core/dev.c:8007
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x44/0xe0 kernel/softirq.c:767
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 kcsan_setup_watchpoint+0x42b/0x4a0 kernel/kcsan/core.c:713
 folio_test_anon include/linux/page-flags.h:718 [inline]
 mm_counter include/linux/mm.h:3437 [inline]
 zap_present_folio_ptes mm/memory.c:1727 [inline]
 zap_present_ptes mm/memory.c:1799 [inline]
 do_zap_pte_range mm/memory.c:1901 [inline]
 zap_pte_range mm/memory.c:2003 [inline]
 zap_pmd_range mm/memory.c:2089 [inline]
 zap_pud_range mm/memory.c:2117 [inline]
 zap_p4d_range mm/memory.c:2138 [inline]
 __zap_vma_range+0x139d/0x2c70 mm/memory.c:2178
 unmap_vmas+0x200/0x310 mm/memory.c:2247
 exit_mmap+0x1a2/0x5e0 mm/mmap.c:1315
 __mmput+0x28/0x1c0 kernel/fork.c:1193
 mmput+0x40/0x50 kernel/fork.c:1216
 exit_mm+0x113/0x1a0 kernel/exit.c:614
 do_exit+0x438/0x1510 kernel/exit.c:996
 do_group_exit+0xfe/0x140 kernel/exit.c:1151
 get_signal+0xe07/0xf10 kernel/signal.c:3046
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x15d/0x8c0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
 do_syscall_64+0x212/0x360 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00002b02 -> 0x00002b03

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 19267 Comm: syz.4.4096 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff88811bdd2b00 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x812/0x820 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x354/0x680 net/core/dev.c:6728
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x456/0x930 net/core/dev.c:8007
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 do_softirq+0x46/0x60 kernel/softirq.c:546
 __local_bh_enable_ip+0x79/0x80 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:816 [inline]
 nsim_dev_trap_report_work+0x521/0x630 drivers/net/netdevsim/dev.c:847
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3470
 worker_thread+0x569/0x750 kernel/workqueue.c:3551
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff88811bdd2b00 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x812/0x820 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x354/0x680 net/core/dev.c:6728
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x456/0x930 net/core/dev.c:8007
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1108
 smpboot_thread_fn+0x32f/0x520 kernel/smpboot.c:160
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x000404ac -> 0x000404ad

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 14 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff88811bdd2b00 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x812/0x820 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x354/0x680 net/core/dev.c:6728
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x456/0x930 net/core/dev.c:8007
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 do_softirq+0x46/0x60 kernel/softirq.c:546
 __local_bh_enable_ip+0x79/0x80 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:816 [inline]
 nsim_dev_trap_report_work+0x521/0x630 drivers/net/netdevsim/dev.c:847
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3470
 worker_thread+0x569/0x750 kernel/workqueue.c:3551
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff88811bdd2b00 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x812/0x820 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6264 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x354/0x680 net/core/dev.c:6728
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x456/0x930 net/core/dev.c:8007
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 do_softirq+0x46/0x60 kernel/softirq.c:546
 __local_bh_enable_ip+0x79/0x80 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:816 [inline]
 nsim_dev_trap_report_work+0x521/0x630 drivers/net/netdevsim/dev.c:847
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3470
 worker_thread+0x569/0x750 kernel/workqueue.c:3551
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x0008d01b -> 0x0008d01c

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 19293 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound nsim_dev_trap_report_work
==================================================================