syzbot

==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff888123dab860 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6181 [inline]
 __netif_receive_skb net/core/dev.c:6294 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6645
 __napi_poll+0x61/0x330 net/core/dev.c:7709
 napi_poll net/core/dev.c:7772 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7929
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x39/0xc0 kernel/softirq.c:723
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 kcsan_setup_watchpoint+0x404/0x410 kernel/kcsan/core.c:705
 instrument_read_write include/linux/instrumented.h:56 [inline]
 atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1301 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:159 [inline]
 _raw_spin_lock+0x4a/0xa0 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:341 [inline]
 inode_add_bytes+0x2a/0xe0 fs/stat.c:919
 __dquot_alloc_space+0x180/0x8a0 fs/quota/dquot.c:1698
 dquot_alloc_space_nodirty include/linux/quotaops.h:299 [inline]
 dquot_alloc_block_nodirty include/linux/quotaops.h:326 [inline]
 shmem_inode_acct_blocks+0x192/0x230 mm/shmem.c:242
 shmem_alloc_and_add_folio mm/shmem.c:2002 [inline]
 shmem_get_folio_gfp+0x5b2/0xd60 mm/shmem.c:2567
 shmem_fault+0xf6/0x250 mm/shmem.c:2768
 __do_fault+0xbc/0x200 mm/memory.c:5364
 do_read_fault mm/memory.c:5799 [inline]
 do_fault mm/memory.c:5933 [inline]
 do_pte_missing mm/memory.c:4477 [inline]
 handle_pte_fault mm/memory.c:6317 [inline]
 __handle_mm_fault mm/memory.c:6455 [inline]
 handle_mm_fault+0x11e2/0x3020 mm/memory.c:6624
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x1023/0x1ea0 mm/gup.c:1428
 populate_vma_page_range mm/gup.c:1860 [inline]
 __mm_populate+0x242/0x390 mm/gup.c:1963
 mm_populate include/linux/mm.h:3894 [inline]
 vm_mmap_pgoff+0x23b/0x2d0 mm/util.c:586
 ksys_mmap_pgoff+0xc1/0x310 mm/mmap.c:605
 x64_sys_call+0x14df/0x3020 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read-write to 0xffff888123dab860 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6181 [inline]
 __netif_receive_skb net/core/dev.c:6294 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6645
 __napi_poll+0x61/0x330 net/core/dev.c:7709
 napi_poll net/core/dev.c:7772 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7929
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:196 [inline]
 _raw_spin_unlock_bh+0x18/0x20 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 neigh_periodic_work+0x5e9/0x690 net/core/neighbour.c:1039
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0x513/0xa10 kernel/workqueue.c:3359
 worker_thread+0x58a/0x780 kernel/workqueue.c:3440
 kthread+0x22a/0x280 kernel/kthread.c:436
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x0062e7d6 -> 0x0062e7d7

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 6791 Comm: kworker/1:9 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: events_power_efficient neigh_periodic_work
==================================================================
==================================================================
BUG: KCSAN: data-race in can_can_gw_rcv / can_can_gw_rcv

read-write to 0xffff888123dab8c0 of 4 bytes by interrupt on cpu 0:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6181 [inline]
 __netif_receive_skb net/core/dev.c:6294 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6645
 __napi_poll+0x61/0x330 net/core/dev.c:7709
 napi_poll net/core/dev.c:7772 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7929
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1063
 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160
 kthread+0x22a/0x280 kernel/kthread.c:436
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888123dab8c0 of 4 bytes by interrupt on cpu 1:
 can_can_gw_rcv+0x863/0x870 net/can/gw.c:572
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0xc3/0x480 net/can/af_can.c:602
 can_receive+0x13e/0x190 net/can/af_can.c:674
 can_rcv+0x17d/0x1f0 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6181 [inline]
 __netif_receive_skb net/core/dev.c:6294 [inline]
 process_backlog+0x363/0x670 net/core/dev.c:6645
 __napi_poll+0x61/0x330 net/core/dev.c:7709
 napi_poll net/core/dev.c:7772 [inline]
 net_rx_action+0x452/0x930 net/core/dev.c:7929
 handle_softirqs+0xb9/0x2a0 kernel/softirq.c:622
 do_softirq+0x45/0x60 kernel/softirq.c:523
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __alloc_skb+0x658/0x690 net/core/skbuff.c:697
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:819 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:876 [inline]
 nsim_dev_trap_report_work+0x18a/0x630 drivers/net/netdevsim/dev.c:922
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0x513/0xa10 kernel/workqueue.c:3359
 worker_thread+0x58a/0x780 kernel/workqueue.c:3440
 kthread+0x22a/0x280 kernel/kthread.c:436
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00684197 -> 0x00684198

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 7293 Comm: kworker/u8:14 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: events_unbound nsim_dev_trap_report_work
==================================================================