================================================================== BUG: KCSAN: data-race in j1939_xtp_rx_dat_one / j1939_xtp_rx_dat_one write to 0xffff888138c342ac of 4 bytes by interrupt on cpu 1: j1939_xtp_rx_dat_one+0x47d/0x9c0 net/can/j1939/transport.c:1881 j1939_xtp_rx_dat net/can/j1939/transport.c:1945 [inline] j1939_tp_recv+0x2bb/0xa20 net/can/j1939/transport.c:2129 j1939_can_recv+0x3dd/0x4c0 net/can/j1939/main.c:108 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x234/0x4e0 net/can/af_can.c:608 can_receive+0x182/0x1f0 net/can/af_can.c:665 can_rcv+0x9e/0x170 net/can/af_can.c:696 __netif_receive_skb_one_core net/core/dev.c:5485 [inline] __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5599 process_backlog+0x23f/0x3b0 net/core/dev.c:5927 __napi_poll+0x65/0x390 net/core/dev.c:6511 napi_poll net/core/dev.c:6578 [inline] net_rx_action+0x37e/0x730 net/core/dev.c:6689 __do_softirq+0x158/0x2e3 kernel/softirq.c:571 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:934 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 read to 0xffff888138c342ac of 4 bytes by interrupt on cpu 0: j1939_xtp_rx_dat_one+0x205/0x9c0 net/can/j1939/transport.c:1841 j1939_xtp_rx_dat net/can/j1939/transport.c:1945 [inline] j1939_tp_recv+0x2bb/0xa20 net/can/j1939/transport.c:2129 j1939_can_recv+0x3dd/0x4c0 net/can/j1939/main.c:108 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x234/0x4e0 net/can/af_can.c:608 can_receive+0x182/0x1f0 net/can/af_can.c:665 can_rcv+0x9e/0x170 net/can/af_can.c:696 __netif_receive_skb_one_core net/core/dev.c:5485 [inline] __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5599 process_backlog+0x23f/0x3b0 net/core/dev.c:5927 __napi_poll+0x65/0x390 net/core/dev.c:6511 napi_poll net/core/dev.c:6578 [inline] net_rx_action+0x37e/0x730 net/core/dev.c:6689 __do_softirq+0x158/0x2e3 kernel/softirq.c:571 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:934 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 value changed: 0x0000004b -> 0x0000004c Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G W 6.0.0-rc3-syzkaller-00041-g2880e1a175b9-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 ================================================================== vcan0: j1939_xtp_rx_dat_one: 0xffff888138c34200: should have been completed vcan0: j1939_xtp_rx_dat_one: 0xffff888138cfd200: last 15 vcan0: j1939_xtp_rx_dat_one: 0xffff888138b64000: last 15 vcan0: j1939_xtp_rx_dat_one: 0xffff888138df9e00: last 15 vcan0: j1939_xtp_rx_dat_one: 0xffff888138c2d000: should have been completed vcan0: j1939_xtp_rx_dat_one: 0xffff8881393ce600: last 00 vcan0: j1939_xtp_rx_dat_one: 0xffff88813ca9ec00: last 15 vcan0: j1939_xtp_rx_abort_one: 0xffff8881393ce600: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff8881393ce400: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff88813ca9ec00: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff8881393ce000: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff8881393ce200: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff8881390ff200: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff888138dbba00: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff888138dbbc00: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff888139081200: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff88813caad200: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff888138d64200: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_tp_rxtimer: 0xffff88813c3b5a00: rx timeout, send abort vcan0: j1939_xtp_rx_abort_one: 0xffff888138e08400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff88813900dc00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_tp_rxtimer: 0xffff88813c3b5a00: abort rx timeout. Force session deactivation vcan0: j1939_tp_rxtimer: 0xffff888139387400: rx timeout, send abort vcan0: j1939_xtp_rx_abort_one: 0xffff88810759a200: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff888138e0ec00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_tp_rxtimer: 0xffff888139387400: abort rx timeout. Force session deactivation vcan0: j1939_tp_rxtimer: 0xffff8881393d5800: rx timeout, send abort vcan0: j1939_xtp_rx_abort_one: 0xffff888138ee6400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff888138b89400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff8881391fb600: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_dpo: no connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_xtp_rx_dat: no rx connection found vcan0: j1939_tp_rxtimer: 0xffff8881393d5800: abort rx timeout. Force session deactivation vcan0: j1939_xtp_rx_dat: no tx connection found vcan0: j1939_tp_rxtimer: 0xffff888137d48e00: rx timeout, send abort vcan0: j1939_xtp_rx_abort_one: 0xffff888138f72a00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff88814a8d8400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.