================================================================== BUG: KCSAN: data-race in can_receive / can_receive read-write to 0xffff888104c0dde8 of 8 bytes by interrupt on cpu 0: can_receive+0x62/0x1f0 net/can/af_can.c:650 canfd_rcv+0xe7/0x180 net/can/af_can.c:702 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 process_backlog+0x21f/0x380 net/core/dev.c:5894 __napi_poll+0x60/0x3b0 net/core/dev.c:6460 napi_poll net/core/dev.c:6527 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6660 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:406 [inline] batadv_nc_worker+0x8d/0xac0 net/batman-adv/network-coding.c:719 process_one_work+0x434/0x860 kernel/workqueue.c:2597 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2748 kthread+0x1d7/0x210 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read-write to 0xffff888104c0dde8 of 8 bytes by interrupt on cpu 1: can_receive+0x62/0x1f0 net/can/af_can.c:650 canfd_rcv+0xe7/0x180 net/can/af_can.c:702 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 process_backlog+0x21f/0x380 net/core/dev.c:5894 __napi_poll+0x60/0x3b0 net/core/dev.c:6460 napi_poll net/core/dev.c:6527 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6660 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 value changed: 0x0000000000001044 -> 0x0000000000001045 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 3071 Comm: syz-executor.1 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 ================================================================== ================================================================== BUG: KCSAN: data-race in can_send / can_send read-write to 0xffff88812375ff70 of 8 bytes by interrupt on cpu 0: can_send+0x572/0x5d0 net/can/af_can.c:290 bcm_can_tx+0x314/0x410 net/can/bcm.c:302 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1752 hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1769 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 get_ctx kernel/kcsan/core.c:206 [inline] check_access kernel/kcsan/core.c:750 [inline] __tsan_read8+0xe1/0x180 kernel/kcsan/core.c:1025 skb_dst_drop include/net/dst.h:281 [inline] skb_release_head_state+0x1e/0x1a0 net/core/skbuff.c:985 skb_release_all net/core/skbuff.c:1000 [inline] __kfree_skb+0x16/0x140 net/core/skbuff.c:1016 consume_skb+0x57/0x180 net/core/skbuff.c:1232 nsim_dev_trap_report drivers/net/netdevsim/dev.c:824 [inline] nsim_dev_trap_report_work+0x4d7/0x5a0 drivers/net/netdevsim/dev.c:853 process_one_work+0x434/0x860 kernel/workqueue.c:2597 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2748 kthread+0x1d7/0x210 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read-write to 0xffff88812375ff70 of 8 bytes by interrupt on cpu 1: can_send+0x572/0x5d0 net/can/af_can.c:290 bcm_can_tx+0x314/0x410 net/can/bcm.c:302 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1752 hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1769 __do_softirq+0xc1/0x265 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 local_bh_enable+0x1f/0x20 include/linux/bottom_half.h:33 dccp_close+0x8d9/0x9c0 net/dccp/proto.c:1074 inet_release+0xc9/0xf0 net/ipv4/af_inet.c:427 inet6_release+0x3e/0x50 net/ipv6/af_inet6.c:480 __sock_release net/socket.c:654 [inline] sock_close+0x70/0x150 net/socket.c:1386 __fput+0x303/0x600 fs/file_table.c:378 ____fput+0x15/0x20 fs/file_table.c:406 task_work_run+0x135/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xd1/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6c/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:297 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000001bf8 -> 0x0000000000001bf9 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 9993 Comm: syz-executor.5 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 ================================================================== ================================================================== BUG: KCSAN: data-race in can_send / can_send read-write to 0xffff88812375ff10 of 8 bytes by interrupt on cpu 0: can_send+0x55e/0x5d0 net/can/af_can.c:289 bcm_can_tx+0x314/0x410 net/can/bcm.c:302 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1752 hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1769 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 get_current arch/x86/include/asm/current.h:41 [inline] __sanitizer_cov_trace_pc+0x10/0x60 kernel/kcov.c:206 should_zap_page mm/memory.c:1356 [inline] zap_pte_range mm/memory.c:1429 [inline] zap_pmd_range mm/memory.c:1570 [inline] zap_pud_range mm/memory.c:1599 [inline] zap_p4d_range mm/memory.c:1620 [inline] unmap_page_range+0x6ab/0x1da0 mm/memory.c:1641 unmap_single_vma+0x142/0x1d0 mm/memory.c:1687 unmap_vmas+0x157/0x200 mm/memory.c:1726 exit_mmap+0x15f/0x5f0 mm/mmap.c:3218 __mmput+0x28/0x1c0 kernel/fork.c:1347 mmput+0x4c/0x60 kernel/fork.c:1369 exit_mm+0xe3/0x180 kernel/exit.c:567 do_exit+0x580/0x1670 kernel/exit.c:861 do_group_exit+0x141/0x150 kernel/exit.c:1024 __do_sys_exit_group kernel/exit.c:1035 [inline] __se_sys_exit_group kernel/exit.c:1033 [inline] __x64_sys_exit_group+0x1f/0x20 kernel/exit.c:1033 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read-write to 0xffff88812375ff10 of 8 bytes by interrupt on cpu 1: can_send+0x55e/0x5d0 net/can/af_can.c:289 bcm_can_tx+0x314/0x410 net/can/bcm.c:302 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1752 hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1769 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 release_pages+0x643/0x7f0 free_pages_and_swap_cache+0x6e/0x80 mm/swap_state.c:316 tlb_batch_pages_flush mm/mmu_gather.c:97 [inline] tlb_flush_mmu_free mm/mmu_gather.c:292 [inline] tlb_flush_mmu+0x2e2/0x360 mm/mmu_gather.c:299 zap_pte_range mm/memory.c:1531 [inline] zap_pmd_range mm/memory.c:1570 [inline] zap_pud_range mm/memory.c:1599 [inline] zap_p4d_range mm/memory.c:1620 [inline] unmap_page_range+0x19dc/0x1da0 mm/memory.c:1641 unmap_single_vma+0x142/0x1d0 mm/memory.c:1687 unmap_vmas+0x157/0x200 mm/memory.c:1726 exit_mmap+0x15f/0x5f0 mm/mmap.c:3218 __mmput+0x28/0x1c0 kernel/fork.c:1347 mmput+0x4c/0x60 kernel/fork.c:1369 exit_mm+0xe3/0x180 kernel/exit.c:567 do_exit+0x580/0x1670 kernel/exit.c:861 do_group_exit+0x101/0x150 kernel/exit.c:1024 get_signal+0xeb7/0xff0 kernel/signal.c:2877 arch_do_signal_or_restart+0x89/0x2a0 arch/x86/kernel/signal.c:308 exit_to_user_mode_loop+0x6f/0xe0 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x6c/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:297 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000000045ac -> 0x00000000000045ad Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 9998 Comm: syz-executor.0 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 ================================================================== ================================================================== BUG: KCSAN: data-race in can_receive / can_receive read-write to 0xffff88812375ff68 of 8 bytes by interrupt on cpu 0: can_receive+0x62/0x1f0 net/can/af_can.c:650 canfd_rcv+0xe7/0x180 net/can/af_can.c:702 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 process_backlog+0x21f/0x380 net/core/dev.c:5894 __napi_poll+0x60/0x3b0 net/core/dev.c:6460 napi_poll net/core/dev.c:6527 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6660 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 arch_atomic64_read arch/x86/include/asm/atomic64_64.h:15 [inline] raw_atomic64_read include/linux/atomic/atomic-arch-fallback.h:2560 [inline] raw_atomic_long_read include/linux/atomic/atomic-long.h:38 [inline] atomic_long_read include/linux/atomic/atomic-instrumented.h:3161 [inline] find_watchpoint kernel/kcsan/core.c:131 [inline] check_access kernel/kcsan/core.c:737 [inline] __tsan_unaligned_write8+0x3a/0x180 kernel/kcsan/core.c:1025 sock_init_data_uid+0x301/0x500 net/core/sock.c:3435 sock_init_data+0x65/0x70 net/core/sock.c:3485 inet6_create+0x3c3/0x810 net/ipv6/af_inet6.c:196 __sock_create+0x2d7/0x4e0 net/socket.c:1536 sock_create net/socket.c:1587 [inline] __sys_socket_create net/socket.c:1624 [inline] __sys_socket+0x9f/0x220 net/socket.c:1652 __do_sys_socket net/socket.c:1665 [inline] __se_sys_socket net/socket.c:1663 [inline] __x64_sys_socket+0x3f/0x50 net/socket.c:1663 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read-write to 0xffff88812375ff68 of 8 bytes by interrupt on cpu 1: can_receive+0x62/0x1f0 net/can/af_can.c:650 canfd_rcv+0xe7/0x180 net/can/af_can.c:702 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 process_backlog+0x21f/0x380 net/core/dev.c:5894 __napi_poll+0x60/0x3b0 net/core/dev.c:6460 napi_poll net/core/dev.c:6527 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6660 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:409 [inline] batadv_nc_worker+0x9a/0xac0 net/batman-adv/network-coding.c:719 process_one_work+0x434/0x860 kernel/workqueue.c:2597 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2748 kthread+0x1d7/0x210 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 value changed: 0x0000000000009a40 -> 0x0000000000009a41 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 6649 Comm: kworker/u4:7 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: bat_events batadv_nc_worker ================================================================== ================================================================== BUG: KCSAN: data-race in can_receive / can_receive read-write to 0xffff88812375ff08 of 8 bytes by interrupt on cpu 0: can_receive+0x4e/0x1f0 net/can/af_can.c:649 canfd_rcv+0xe7/0x180 net/can/af_can.c:702 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 process_backlog+0x21f/0x380 net/core/dev.c:5894 __napi_poll+0x60/0x3b0 net/core/dev.c:6460 napi_poll net/core/dev.c:6527 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6660 __do_softirq+0xc1/0x265 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:395 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:823 [inline] nsim_dev_trap_report_work+0x4cf/0x5a0 drivers/net/netdevsim/dev.c:853 process_one_work+0x434/0x860 kernel/workqueue.c:2597 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2748 kthread+0x1d7/0x210 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read-write to 0xffff88812375ff08 of 8 bytes by interrupt on cpu 1: can_receive+0x4e/0x1f0 net/can/af_can.c:649 canfd_rcv+0xe7/0x180 net/can/af_can.c:702 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 process_backlog+0x21f/0x380 net/core/dev.c:5894 __napi_poll+0x60/0x3b0 net/core/dev.c:6460 napi_poll net/core/dev.c:6527 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6660 __do_softirq+0xc1/0x265 kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1109 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irq+0x2f/0x40 kernel/locking/spinlock.c:202 process_one_work+0x3f7/0x860 kernel/workqueue.c:2569 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2748 kthread+0x1d7/0x210 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 value changed: 0x0000000000025d0d -> 0x0000000000025d0e Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 3151 Comm: kworker/1:3 Not tainted 6.4.0-syzkaller-08686-ge55e5df193d2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: rcu_gp process_srcu ==================================================================