==================================================================
BUG: KCSAN: data-race in kick_pool / wq_worker_running

read-write to 0xffff888237c29d64 of 4 bytes by task 2919 on cpu 0:
 wq_worker_running+0x95/0x120 kernel/workqueue.c:1404
 schedule_timeout+0xb7/0x170 kernel/time/sleep_timeout.c:99
 schedule_timeout_uninterruptible kernel/time/sleep_timeout.c:158 [inline]
 msleep+0x50/0x90 kernel/time/sleep_timeout.c:318
 nsim_fib6_rt_add drivers/net/netdevsim/fib.c:693 [inline]
 nsim_fib6_rt_insert drivers/net/netdevsim/fib.c:759 [inline]
 nsim_fib6_event drivers/net/netdevsim/fib.c:856 [inline]
 nsim_fib_event drivers/net/netdevsim/fib.c:889 [inline]
 nsim_fib_event_work+0x1ebc/0x21a0 drivers/net/netdevsim/fib.c:1493
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319
 worker_thread+0x582/0x770 kernel/workqueue.c:3400
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x11f/0x1b0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff888237c29d64 of 4 bytes by interrupt on cpu 1:
 need_more_worker kernel/workqueue.c:938 [inline]
 kick_pool+0x49/0x2d0 kernel/workqueue.c:1244
 __queue_work+0x8cb/0xb50 kernel/workqueue.c:2340
 queue_work_on+0xd1/0x160 kernel/workqueue.c:2390
 wg_queue_enqueue_per_device_and_peer drivers/net/wireguard/queueing.h:176 [inline]
 wg_packet_create_data drivers/net/wireguard/send.c:320 [inline]
 wg_packet_send_staged_packets+0x83d/0xab0 drivers/net/wireguard/send.c:388
 wg_packet_send_keepalive+0xeb/0x100 drivers/net/wireguard/send.c:239
 wg_expired_send_persistent_keepalive+0x3c/0x50 drivers/net/wireguard/timers.c:144
 call_timer_fn+0x38/0x2c0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x415/0x610 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0x31/0x70 kernel/time/timer.c:2403
 handle_softirqs+0xb7/0x290 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x3a/0xc0 kernel/softirq.c:680
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1050
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 check_kcov_mode kernel/kcov.c:183 [inline]
 __sanitizer_cov_trace_pc+0x31/0x70 kernel/kcov.c:217
 folios_put_refs+0x99/0x2d0 mm/swap.c:954
 free_pages_and_swap_cache+0x278/0x400 mm/swap_state.c:264
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu+0x2dc/0x450 mm/mmu_gather.c:404
 zap_pte_range mm/memory.c:1765 [inline]
 zap_pmd_range mm/memory.c:1818 [inline]
 zap_pud_range mm/memory.c:1847 [inline]
 zap_p4d_range mm/memory.c:1868 [inline]
 unmap_page_range+0x237e/0x2680 mm/memory.c:1889
 unmap_single_vma mm/memory.c:1932 [inline]
 unmap_vmas+0x23d/0x3a0 mm/memory.c:1976
 exit_mmap+0x1b0/0x6c0 mm/mmap.c:1280
 __mmput+0x28/0x1c0 kernel/fork.c:1129
 mmput+0x40/0x50 kernel/fork.c:1152
 exit_mm+0xe4/0x190 kernel/exit.c:582
 do_exit+0x417/0x15c0 kernel/exit.c:949
 do_group_exit+0x139/0x140 kernel/exit.c:1102
 __do_sys_exit_group kernel/exit.c:1113 [inline]
 __se_sys_exit_group kernel/exit.c:1111 [inline]
 __x64_sys_exit_group+0x1f/0x20 kernel/exit.c:1111
 x64_sys_call+0x2fe2/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 22554 Comm: syz.8.17126 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
==================================================================
vcan0: j1939_tp_rxtimer: 0xffff888118b43400: rx timeout, send abort
vcan0: j1939_tp_rxtimer: 0xffff888133d16a00: rx timeout, send abort
vcan0: j1939_xtp_rx_abort_one: 0xffff888118b43400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.
vcan0: j1939_xtp_rx_abort_one: 0xffff888133d16a00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session.