vxcan1: j1939_tp_rxtimer: 0xffff88807b18c800: rx timeout, send abort
vxcan1: j1939_tp_rxtimer: 0xffff8880778fc000: rx timeout, send abort
vxcan1: j1939_tp_rxtimer: 0xffff88807b18c800: abort rx timeout. Force session deactivation
------------[ cut here ]------------
WARNING: CPU: 1 PID: 14489 at net/can/j1939/socket.c:181 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
WARNING: CPU: 1 PID: 14489 at net/can/j1939/socket.c:181 j1939_sk_queue_activate_next+0x34d/0x460 net/can/j1939/socket.c:205
Modules linked in:
CPU: 1 PID: 14489 Comm: kworker/u4:7 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound fsnotify_connector_destroy_workfn
RIP: 0010:j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
RIP: 0010:j1939_sk_queue_activate_next+0x34d/0x460 net/can/j1939/socket.c:205
Code: 1c 83 c0 0a 89 44 24 04 eb 9d 48 c7 c7 8c 68 91 8d e8 77 d9 9b f9 e9 73 fd ff ff e8 6d d9 9b f9 e9 19 fe ff ff e8 23 18 55 f9 <0f> 0b 49 8d bf b8 00 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84
RSP: 0018:ffffc90000dc0d90 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807a817000 RCX: 0000000000000100
RDX: ffff88802176d700 RSI: ffffffff8822933d RDI: 0000000000000003
RBP: ffff88807a8175a8 R08: 0000000000000000 R09: ffffffff8ff74ba7
R10: ffffffff88229298 R11: 0000000000000001 R12: ffff88807b18e400
R13: ffff88807a8175e8 R14: dffffc0000000000 R15: ffff88807b18e418
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fec0aa1e1b8 CR3: 00000000402c1000 CR4: 0000000000350ee0
Call Trace:
j1939_session_deactivate_activate_next+0x2e/0x35 net/can/j1939/transport.c:1101
j1939_tp_rxtimer.cold+0xbc/0x1aa net/can/j1939/transport.c:1228
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:164 [inline]
RIP: 0010:unwind_next_frame+0x276/0x1ce0 arch/x86/kernel/unwind_orc.c:443
Code: 48 89 54 24 30 48 89 74 24 28 44 89 5c 24 20 e8 b0 6f 8a 00 48 8b 54 24 30 48 8b 74 24 28 44 8b 5c 24 20 8b 0c 95 20 c0 a9 8e <8d> 56 01 48 b8 00 00 00 00 00 fc ff df 48 8d 3c 95 20 c0 a9 8e 49
RSP: 0018:ffffc9000e39f790 EFLAGS: 00000246
RAX: 0000000000000007 RBX: 1ffff92001c73efa RCX: 000000000000d46f
RDX: 000000000000341d RSI: 000000000000341d RDI: ffffffff8eaa9094
RBP: 0000000000000001 R08: ffffffff8b9fa2a0 R09: ffffc9000e39f8b8
R10: fffff52001c73f22 R11: 000000000008808a R12: ffffc9000e39f900
R13: ffffc9000e39f8ed R14: ffffc9000e39f8b8 R15: ffffffff81341d05
__unwind_start+0x51b/0x800 arch/x86/kernel/unwind_orc.c:712
unwind_start arch/x86/include/asm/unwind.h:64 [inline]
arch_stack_walk+0x5c/0xe0 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:46
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0xff/0x130 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1723 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1749
slab_free mm/slub.c:3513 [inline]
kmem_cache_free+0xbd/0x5d0 mm/slub.c:3530
fsnotify_connector_destroy_workfn+0x7d/0xa0 fs/notify/mark.c:168
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 48 89 54 24 30 mov %rdx,0x30(%rsp)
5: 48 89 74 24 28 mov %rsi,0x28(%rsp)
a: 44 89 5c 24 20 mov %r11d,0x20(%rsp)
f: e8 b0 6f 8a 00 callq 0x8a6fc4
14: 48 8b 54 24 30 mov 0x30(%rsp),%rdx
19: 48 8b 74 24 28 mov 0x28(%rsp),%rsi
1e: 44 8b 5c 24 20 mov 0x20(%rsp),%r11d
23: 8b 0c 95 20 c0 a9 8e mov -0x71563fe0(,%rdx,4),%ecx
* 2a: 8d 56 01 lea 0x1(%rsi),%edx <-- trapping instruction
2d: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
34: fc ff df
37: 48 8d 3c 95 20 c0 a9 lea -0x71563fe0(,%rdx,4),%rdi
3e: 8e
3f: 49 rex.WB