[moderation] [can?] KCSAN: data-race in can_rcv_filter / can_rx_unregister (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a66191c590b3 Merge tag 'hyperv-fixes-signed-20260121' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=139da7fc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6c9e86480ac654d3
dashboard link: https://syzkaller.appspot.com/bug?extid=ab65362e0b709912d594
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
CC: [linu...@vger.kernel.org linux-...@vger.kernel.org m...@pengutronix.de sock...@hartkopp.net]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/47495cf87c20/disk-a66191c5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2ddc7273c432/vmlinux-a66191c5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/45267480b20c/bzImage-a66191c5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ab6536...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in can_rcv_filter / can_rx_unregister

read-write to 0xffff88810a84e020 of 4 bytes by task 10292 on cpu 0:
can_rx_unregister+0x44b/0x540 net/can/af_can.c:556
raw_disable_filters net/can/raw.c:256 [inline]
raw_disable_allfilters net/can/raw.c:277 [inline]
raw_release+0x2d6/0x610 net/can/raw.c:427
__sock_release net/socket.c:662 [inline]
sock_close+0x6b/0x150 net/socket.c:1455
__fput+0x29b/0x650 fs/file_table.c:468
____fput+0x1c/0x30 fs/file_table.c:496
task_work_run+0x130/0x1a0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0x1f7/0x6f0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x1d3/0x2a0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810a84e020 of 4 bytes by interrupt on cpu 1:
can_rcv_filter+0x40/0x4f0 net/can/af_can.c:586
can_receive+0xfb/0x1c0 net/can/af_can.c:662
canfd_rcv+0xed/0x190 net/can/af_can.c:705
__netif_receive_skb_one_core net/core/dev.c:6152 [inline]
__netif_receive_skb+0x120/0x270 net/core/dev.c:6265
process_backlog+0x228/0x420 net/core/dev.c:6617
__napi_poll+0x5f/0x300 net/core/dev.c:7681
napi_poll net/core/dev.c:7744 [inline]
net_rx_action+0x452/0x930 net/core/dev.c:7896
handle_softirqs+0xb9/0x280 kernel/softirq.c:622
do_softirq+0x45/0x60 kernel/softirq.c:523
__local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
_raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
spin_unlock_bh include/linux/spinlock.h:396 [inline]
__batadv_dat_purge net/batman-adv/distributed-arp-table.c:185 [inline]
batadv_dat_hash_free net/batman-adv/distributed-arp-table.c:796 [inline]
batadv_dat_free+0x1c7/0x240 net/batman-adv/distributed-arp-table.c:840
batadv_mesh_free+0x4c/0xc0 net/batman-adv/main.c:256
batadv_meshif_free+0x15/0x30 net/batman-adv/mesh-interface.c:989
netdev_run_todo+0x784/0x8b0 net/core/dev.c:11706
rtnl_unlock+0xe/0x20 net/core/rtnetlink.c:157
default_device_exit_batch+0x5ff/0x650 net/core/dev.c:13052
ops_exit_list net/core/net_namespace.c:205 [inline]
ops_undo_list+0x2ca/0x420 net/core/net_namespace.c:252
cleanup_net+0x31c/0x550 net/core/net_namespace.c:696
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0x4cd/0x9d0 kernel/workqueue.c:3340
worker_thread+0x581/0x770 kernel/workqueue.c:3421
kthread+0x488/0x510 kernel/kthread.c:463
ret_from_fork+0x148/0x280 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0x00000045 -> 0x00000036

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4793 Comm: kworker/u8:54 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup