------------[ cut here ]------------ WARNING: CPU: 1 PID: 141 at net/can/j1939/socket.c:181 j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline] WARNING: CPU: 1 PID: 141 at net/can/j1939/socket.c:181 j1939_sk_queue_activate_next+0x34d/0x460 net/can/j1939/socket.c:205 Modules linked in: CPU: 1 PID: 141 Comm: kworker/1:2 Tainted: G W 5.17.0-syzkaller-07570-gb50d3b46f842 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events nsim_dev_trap_report_work RIP: 0010:j1939_sk_queue_activate_next_locked net/can/j1939/socket.c:181 [inline] RIP: 0010:j1939_sk_queue_activate_next+0x34d/0x460 net/can/j1939/socket.c:205 Code: 1c 83 c0 0a 89 44 24 04 eb 9d 48 c7 c7 ac 78 b5 8d e8 17 33 89 f9 e9 73 fd ff ff e8 0d 33 89 f9 e9 19 fe ff ff e8 c3 91 3d f9 <0f> 0b 49 8d bf b8 00 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 RSP: 0018:ffffc900001e0a60 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888079afd000 RCX: 0000000000000100 RDX: ffff888018a51d00 RSI: ffffffff883b815d RDI: 0000000000000003 RBP: ffff888079afd5a8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff883b80b8 R11: 0000000000000001 R12: ffff888075cf3800 R13: ffff888079afd5e8 R14: dffffc0000000000 R15: ffff888075cf3818 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff4d9f08920 CR3: 000000000ba8e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: j1939_session_deactivate_activate_next net/can/j1939/transport.c:1101 [inline] j1939_session_completed+0x19a/0x1f0 net/can/j1939/transport.c:1214 j1939_xtp_rx_eoma_one net/can/j1939/transport.c:1384 [inline] j1939_xtp_rx_eoma+0x2a6/0x5f0 net/can/j1939/transport.c:1399 j1939_tp_cmd_recv net/can/j1939/transport.c:2088 [inline] j1939_tp_recv+0x930/0xcb0 net/can/j1939/transport.c:2133 j1939_can_recv+0x6ff/0x9a0 net/can/j1939/main.c:108 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x5d4/0x8d0 net/can/af_can.c:608 can_receive+0x31d/0x580 net/can/af_can.c:665 can_rcv+0x120/0x1c0 net/can/af_can.c:696 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 process_backlog+0x3a0/0x7c0 net/core/dev.c:5847 __napi_poll+0xb3/0x6e0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x8ec/0xc60 net/core/dev.c:6567 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:49 Code: 48 89 47 18 48 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d9 90 c3 0f 1f 80 00 00 00 00 b9 00 10 00 00 31 c0 aa c3 cc cc cc cc cc cc 41 57 41 56 41 55 41 54 55 53 48 89 fb RSP: 0018:ffffc9000202f738 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000bc0 RDX: ffffea0001360d40 RSI: ffff888000000000 RDI: ffff88804d835440 RBP: ffffea0001360c00 R08: 0000160000000000 R09: ffffea0001360e00 R10: fffff9400026c186 R11: 0000000000000100 R12: 0000000000000003 R13: 00000000001d2a20 R14: 0000000000000008 R15: 0000000000000003 clear_page arch/x86/include/asm/page_64.h:50 [inline] clear_highpage include/linux/highmem.h:217 [inline] kernel_init_free_pages mm/page_alloc.c:1285 [inline] kernel_init_free_pages mm/page_alloc.c:1270 [inline] post_alloc_hook+0x265/0x2e0 mm/page_alloc.c:2371 prep_new_page mm/page_alloc.c:2382 [inline] get_page_from_freelist+0xba2/0x3df0 mm/page_alloc.c:4123 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5349 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2262 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [inline] ___slab_alloc+0x8df/0xf20 mm/slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [inline] __kmalloc_node_track_caller+0x2cb/0x360 mm/slub.c:4947 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0xde/0x340 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1300 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:742 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:799 [inline] nsim_dev_trap_report_work+0x291/0xba0 drivers/net/netdevsim/dev.c:840 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 48 89 47 18 mov %rax,0x18(%rdi) 4: 48 89 47 20 mov %rax,0x20(%rdi) 8: 48 89 47 28 mov %rax,0x28(%rdi) c: 48 89 47 30 mov %rax,0x30(%rdi) 10: 48 89 47 38 mov %rax,0x38(%rdi) 14: 48 8d 7f 40 lea 0x40(%rdi),%rdi 18: 75 d9 jne 0xfffffff3 1a: 90 nop 1b: c3 retq 1c: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 23: b9 00 10 00 00 mov $0x1000,%ecx 28: 31 c0 xor %eax,%eax * 2a: f3 aa rep stos %al,%es:(%rdi) <-- trapping instruction 2c: c3 retq 2d: cc int3 2e: cc int3 2f: cc int3 30: cc int3 31: cc int3 32: cc int3 33: 41 57 push %r15 35: 41 56 push %r14 37: 41 55 push %r13 39: 41 54 push %r12 3b: 55 push %rbp 3c: 53 push %rbx 3d: 48 89 fb mov %rdi,%rbx