================================================================== BUG: KCSAN: data-race in can_send / can_send read-write to 0xffff888112cdb4f0 of 8 bytes by interrupt on cpu 1: can_send+0x570/0x5d0 net/can/af_can.c:290 bcm_can_tx+0x314/0x420 net/can/bcm.c:314 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756 hrtimer_run_softirq+0xe4/0x2d0 kernel/time/hrtimer.c:1773 __do_softirq+0xc8/0x285 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0x3c/0x90 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irq+0x2f/0x50 kernel/locking/spinlock.c:202 process_one_work kernel/workqueue.c:3223 [inline] process_scheduled_works+0x41a/0x990 kernel/workqueue.c:3335 worker_thread+0x526/0x730 kernel/workqueue.c:3416 kthread+0x1d1/0x210 kernel/kthread.c:388 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 read-write to 0xffff888112cdb4f0 of 8 bytes by interrupt on cpu 0: can_send+0x570/0x5d0 net/can/af_can.c:290 j1939_send_one+0x19c/0x1d0 net/can/j1939/main.c:357 j1939_tp_tx_dat net/can/j1939/transport.c:646 [inline] j1939_session_tx_dat net/can/j1939/transport.c:838 [inline] j1939_xtp_txnext_transmiter net/can/j1939/transport.c:900 [inline] j1939_tp_txtimer+0xca9/0x1a70 net/can/j1939/transport.c:1160 __run_hrtimer kernel/time/hrtimer.c:1692 [inline] __hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756 hrtimer_run_softirq+0xe4/0x2d0 kernel/time/hrtimer.c:1773 __do_softirq+0xc8/0x285 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0x3c/0x90 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 slab_free_hook mm/slub.c:2081 [inline] slab_free mm/slub.c:4280 [inline] kmem_cache_free+0xbc/0x250 mm/slub.c:4344 io_req_caches_free+0x11d/0x220 io_uring/io_uring.c:2874 io_ring_exit_work+0x20d/0x500 io_uring/io_uring.c:3084 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335 worker_thread+0x526/0x730 kernel/workqueue.c:3416 kthread+0x1d1/0x210 kernel/kthread.c:388 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 value changed: 0x000000000000014a -> 0x000000000000014b Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 49 Comm: kworker/u8:3 Not tainted 6.9.0-rc5-syzkaller-00042-ge88c4cfcb7b8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: iou_exit io_ring_exit_work ================================================================== ================================================================== BUG: KCSAN: data-race in can_receive / can_receive read-write to 0xffff888112cdb488 of 8 bytes by interrupt on cpu 1: can_receive+0x4e/0x1f0 net/can/af_can.c:649 canfd_rcv+0xe7/0x180 net/can/af_can.c:702 __netif_receive_skb_one_core net/core/dev.c:5544 [inline] __netif_receive_skb+0x123/0x280 net/core/dev.c:5658 process_backlog+0x21f/0x380 net/core/dev.c:5987 __napi_poll+0x63/0x3c0 net/core/dev.c:6638 napi_poll net/core/dev.c:6707 [inline] net_rx_action+0x324/0x720 net/core/dev.c:6822 __do_softirq+0xc8/0x285 kernel/softirq.c:554 invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:633 [inline] irq_exit_rcu+0x3c/0x90 kernel/softirq.c:645 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 is_atomic kernel/kcsan/core.c:264 [inline] should_watch kernel/kcsan/core.c:277 [inline] check_access kernel/kcsan/core.c:752 [inline] __tsan_read8+0xfe/0x180 kernel/kcsan/core.c:1025 batadv_nc_purge_paths+0x6d/0x270 net/batman-adv/network-coding.c:439 batadv_nc_worker+0x3db/0xac0 net/batman-adv/network-coding.c:720 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335 worker_thread+0x526/0x730 kernel/workqueue.c:3416 kthread+0x1d1/0x210 kernel/kthread.c:388 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 read-write to 0xffff888112cdb488 of 8 bytes by interrupt on cpu 0: can_receive+0x4e/0x1f0 net/can/af_can.c:649 can_rcv+0xe7/0x180 net/can/af_can.c:687 __netif_receive_skb_one_core net/core/dev.c:5544 [inline] __netif_receive_skb+0x123/0x280 net/core/dev.c:5658 process_backlog+0x21f/0x380 net/core/dev.c:5987 __napi_poll+0x63/0x3c0 net/core/dev.c:6638 napi_poll net/core/dev.c:6707 [inline] net_rx_action+0x324/0x720 net/core/dev.c:6822 __do_softirq+0xc8/0x285 kernel/softirq.c:554 run_ksoftirqd+0x17/0x30 kernel/softirq.c:924 smpboot_thread_fn+0x31c/0x4c0 kernel/smpboot.c:164 kthread+0x1d1/0x210 kernel/kthread.c:388 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 value changed: 0x0000000000462d0a -> 0x0000000000462d0b Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 6.9.0-rc5-syzkaller-00042-ge88c4cfcb7b8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 ================================================================== vxcan0: j1939_xtp_rx_dat: no tx connection found vxcan0: j1939_tp_rxtimer: 0xffff888116842400: rx timeout, send abort vxcan0: j1939_tp_rxtimer: 0xffff888116842400: abort rx timeout. Force session deactivation