vcan0: j1939_xtp_rx_dat_one: 0xffff88812a638c00: last 00 vcan0: j1939_xtp_rx_dat: no rx connection found ================================================================== BUG: KCSAN: data-race in j1939_xtp_rx_dat_one / j1939_xtp_rx_dat_one write to 0xffff88812b4af6ac of 4 bytes by interrupt on cpu 1: j1939_xtp_rx_dat_one+0x889/0x1040 net/can/j1939/transport.c:1875 j1939_xtp_rx_dat net/can/j1939/transport.c:1939 [inline] j1939_tp_recv+0x2b8/0xa20 net/can/j1939/transport.c:2123 j1939_can_recv+0x3f9/0x4e0 net/can/j1939/main.c:108 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x254/0x520 net/can/af_can.c:608 can_receive+0x1a2/0x220 net/can/af_can.c:665 can_rcv+0x9e/0x170 net/can/af_can.c:696 __netif_receive_skb_one_core net/core/dev.c:5405 [inline] __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5519 process_backlog+0x23f/0x3c0 net/core/dev.c:5847 __napi_poll+0x65/0x3f0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x29e/0x650 net/core/dev.c:6567 __do_softirq+0x158/0x2de kernel/softirq.c:558 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:921 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164 kthread+0x1bf/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 read to 0xffff88812b4af6ac of 4 bytes by interrupt on cpu 0: j1939_xtp_rx_dat_one+0x857/0x1040 net/can/j1939/transport.c:1874 j1939_xtp_rx_dat net/can/j1939/transport.c:1939 [inline] j1939_tp_recv+0x2b8/0xa20 net/can/j1939/transport.c:2123 j1939_can_recv+0x3f9/0x4e0 net/can/j1939/main.c:108 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x254/0x520 net/can/af_can.c:608 can_receive+0x1a2/0x220 net/can/af_can.c:665 can_rcv+0x9e/0x170 net/can/af_can.c:696 __netif_receive_skb_one_core net/core/dev.c:5405 [inline] __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5519 process_backlog+0x23f/0x3c0 net/core/dev.c:5847 __napi_poll+0x65/0x3f0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x29e/0x650 net/core/dev.c:6567 __do_softirq+0x158/0x2de kernel/softirq.c:558 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:921 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164 kthread+0x1bf/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 value changed: 0x00000133 -> 0x00000134 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G W 5.17.0-syzkaller-11406-gf82da161ea75-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ================================================================== vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_dat_one: 0xffff88812b19b400: no skb found vcan0: j1939_xtp_rx_abort_one: 0xffff88812b19b400: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_xtp_rx_abort_one: 0xffff88812a04c200: 0x00000: (5) Maximal retransmit request limit reached vcan0: j1939_tp_rxtimer: 0xffff88812b151a00: rx timeout, send abort vcan0: j1939_xtp_rx_abort_one: 0xffff888129f1f400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff888129f1f200: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff888129f1f000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_tp_rxtimer: 0xffff88812b151a00: abort rx timeout. Force session deactivation vcan0: j1939_tp_rxtimer: 0xffff88812a17b600: rx timeout, send abort vcan0: j1939_tp_rxtimer: 0xffff88812b66b600: rx timeout, send abort vcan0: j1939_xtp_rx_abort_one: 0xffff88812a17b600: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. vcan0: j1939_xtp_rx_abort_one: 0xffff88812b66b600: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.