syzbot


KCSAN: data-race in can_rcv_filter / can_rx_unregister (4)

Status: moderation: reported on 2026/01/22 13:31
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+ab65362e0b709912d594@syzkaller.appspotmail.com
First crash: 2d01h, last: 2d01h
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in can_rcv_filter / can_rx_unregister can 6 1 1002d 1002d 0/29 auto-obsoleted due to no activity on 2023/06/01 19:55
upstream KCSAN: data-race in can_rcv_filter / can_rx_unregister (2) can 6 1 942d 942d 0/29 auto-obsoleted due to no activity on 2023/08/01 12:06
upstream KCSAN: data-race in can_rcv_filter / can_rx_unregister (3) can 6 1 611d 611d 0/29 auto-obsoleted due to no activity on 2024/06/27 05:25

Sample crash report:
==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rx_unregister

read-write to 0xffff88810a84e020 of 4 bytes by task 10292 on cpu 0:
 can_rx_unregister+0x44b/0x540 net/can/af_can.c:556
 raw_disable_filters net/can/raw.c:256 [inline]
 raw_disable_allfilters net/can/raw.c:277 [inline]
 raw_release+0x2d6/0x610 net/can/raw.c:427
 __sock_release net/socket.c:662 [inline]
 sock_close+0x6b/0x150 net/socket.c:1455
 __fput+0x29b/0x650 fs/file_table.c:468
 ____fput+0x1c/0x30 fs/file_table.c:496
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0x1f7/0x6f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x1d3/0x2a0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810a84e020 of 4 bytes by interrupt on cpu 1:
 can_rcv_filter+0x40/0x4f0 net/can/af_can.c:586
 can_receive+0xfb/0x1c0 net/can/af_can.c:662
 canfd_rcv+0xed/0x190 net/can/af_can.c:705
 __netif_receive_skb_one_core net/core/dev.c:6152 [inline]
 __netif_receive_skb+0x120/0x270 net/core/dev.c:6265
 process_backlog+0x228/0x420 net/core/dev.c:6617
 __napi_poll+0x5f/0x300 net/core/dev.c:7681
 napi_poll net/core/dev.c:7744 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7896
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:185 [inline]
 batadv_dat_hash_free net/batman-adv/distributed-arp-table.c:796 [inline]
 batadv_dat_free+0x1c7/0x240 net/batman-adv/distributed-arp-table.c:840
 batadv_mesh_free+0x4c/0xc0 net/batman-adv/main.c:256
 batadv_meshif_free+0x15/0x30 net/batman-adv/mesh-interface.c:989
 netdev_run_todo+0x784/0x8b0 net/core/dev.c:11706
 rtnl_unlock+0xe/0x20 net/core/rtnetlink.c:157
 default_device_exit_batch+0x5ff/0x650 net/core/dev.c:13052
 ops_exit_list net/core/net_namespace.c:205 [inline]
 ops_undo_list+0x2ca/0x420 net/core/net_namespace.c:252
 cleanup_net+0x31c/0x550 net/core/net_namespace.c:696
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x581/0x770 kernel/workqueue.c:3421
 kthread+0x488/0x510 kernel/kthread.c:463
 ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0x00000045 -> 0x00000036

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4793 Comm: kworker/u8:54 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/22 13:30 upstream a66191c590b3 a16aed1d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_rcv_filter / can_rx_unregister
* Struck through repros no longer work on HEAD.