vxcan1: j1939_tp_rxtimer: 0xffff888077a39800: abort rx timeout. Force session deactivation
------------[ cut here ]------------
WARNING: CPU: 1 PID: 2970 at net/can/j1939/socket.c:181 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
WARNING: CPU: 1 PID: 2970 at net/can/j1939/socket.c:181 j1939_sk_queue_activate_next+0x34d/0x460 net/can/j1939/socket.c:205
Modules linked in:
CPU: 1 PID: 2970 Comm: systemd-udevd Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline]
RIP: 0010:j1939_sk_queue_activate_next+0x34d/0x460 net/can/j1939/socket.c:205
Code: 1c 83 c0 0a 89 44 24 04 eb 9d 48 c7 c7 cc d0 91 8d e8 47 10 8f f9 e9 73 fd ff ff e8 3d 10 8f f9 e9 19 fe ff ff e8 c3 54 48 f9 <0f> 0b 49 8d bf b8 00 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84
RSP: 0018:ffffc90000dc0d90 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88802a74b000 RCX: 0000000000000100
RDX: ffff888018f75700 RSI: ffffffff882f434d RDI: 0000000000000003
RBP: ffff88802a74b5a0 R08: 0000000000000000 R09: ffffffff8ff7eb37
R10: ffffffff882f42a8 R11: 0000000000000001 R12: ffff88806ec05400
R13: ffff88802a74b5e0 R14: dffffc0000000000 R15: ffff88806ec05418
FS:  00007f437056a8c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d127000 CR3: 00000000228a4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 j1939_session_deactivate_activate_next+0x2e/0x35 net/can/j1939/transport.c:1101
 j1939_tp_rxtimer.cold+0xbc/0x1aa net/can/j1939/transport.c:1228
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:tomoyo_check_path_acl+0x80/0x210 security/tomoyo/file.c:258
Code: bd d5 fd 49 8d 7c 24 1a 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 <84> d2 0f 85 40 01 00 00 41 0f b7 5c 24 1a 44 89 e9 31 ff 45 31 ed
RSP: 0018:ffffc90001f3fa80 EFLAGS: 00000206
RAX: 0000000000000003 RBX: ffff88801cfb8e00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff83a1da39 RDI: ffff88801cfb8e1a
RBP: ffffc90001f3fbe8 R08: 0000000031f53a67 R09: 0000000000000005
R10: ffffffff83a1da2a R11: 000000000000001f R12: ffff88801cfb8e00
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
 tomoyo_check_acl+0x13c/0x450 security/tomoyo/domain.c:175
 tomoyo_path_permission security/tomoyo/file.c:586 [inline]
 tomoyo_path_permission+0x1ff/0x3a0 security/tomoyo/file.c:573
 tomoyo_path_perm+0x2f0/0x400 security/tomoyo/file.c:838
 security_inode_getattr+0xcf/0x140 security/security.c:1334
 vfs_getattr fs/stat.c:157 [inline]
 vfs_fstat+0x43/0xb0 fs/stat.c:182
 __do_sys_newfstat+0x81/0x100 fs/stat.c:422
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f436f3dc2e2
Code: 48 8b 05 b9 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 77 33 48 63 fe b8 05 00 00 00 48 89 d6 0f 05 <48> 3d 00 f0 ff ff 77 06 f3 c3 0f 1f 40 00 48 8b 15 81 db 2b 00 f7
RSP: 002b:00007ffddc2d6da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000005
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f436f3dc2e2
RDX: 00007ffddc2d6dc0 RSI: 00007ffddc2d6dc0 RDI: 000000000000000e
RBP: 00007ffddc2d6f60 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000080000 R11: 0000000000000246 R12: 00005582fa237f20
R13: 00005582fa222010 R14: 00005582fa234e10 R15: 00007ffddc2d6f20
 </TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	fd                   	std
   1:	49 8d 7c 24 1a       	lea    0x1a(%r12),%rdi
   6:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   d:	fc ff df
  10:	48 89 fa             	mov    %rdi,%rdx
  13:	48 c1 ea 03          	shr    $0x3,%rdx
  17:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx
  1b:	48 89 f8             	mov    %rdi,%rax
  1e:	83 e0 07             	and    $0x7,%eax
  21:	83 c0 01             	add    $0x1,%eax
  24:	38 d0                	cmp    %dl,%al
  26:	7c 08                	jl     0x30
* 28:	84 d2                	test   %dl,%dl <-- trapping instruction
  2a:	0f 85 40 01 00 00    	jne    0x170
  30:	41 0f b7 5c 24 1a    	movzwl 0x1a(%r12),%ebx
  36:	44 89 e9             	mov    %r13d,%ecx
  39:	31 ff                	xor    %edi,%edi
  3b:	45 31 ed             	xor    %r13d,%r13d