==================================================================
BUG: KCSAN: data-race in vcan_tx / vcan_tx

read-write to 0xffff88811aad8228 of 8 bytes by interrupt on cpu 1:
 vcan_tx+0x325/0x5d0 drivers/net/can/vcan.c:110
 __netdev_start_xmit include/linux/netdevice.h:5432 [inline]
 netdev_start_xmit include/linux/netdevice.h:5441 [inline]
 xmit_one net/core/dev.c:3953 [inline]
 dev_hard_start_xmit+0x10c/0x380 net/core/dev.c:3969
 __dev_queue_xmit+0xbfd/0x1ec0 net/core/dev.c:4958
 dev_queue_xmit include/linux/netdevice.h:3464 [inline]
 can_send+0x584/0x720 net/can/af_can.c:279
 bcm_can_tx+0x3ba/0x5b0 net/can/bcm.c:367
 bcm_tx_timeout_handler+0x1b2/0x360 net/can/bcm.c:546
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0xde/0x290 kernel/time/hrtimer.c:2148
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x44/0xe0 kernel/softirq.c:758
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 finish_task_switch+0x12b/0x340 kernel/sched/core.c:5384
 context_switch kernel/sched/core.c:5536 [inline]
 __schedule+0x79e/0xd20 kernel/sched/core.c:7284
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0x5b/0xa0 kernel/sched/core.c:7376
 schedule_timeout+0xca/0x180 kernel/time/sleep_timeout.c:99
 ip_vs_estimation_kthread+0x151f/0x1940 net/netfilter/ipvs/ip_vs_est.c:216
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff88811aad8228 of 8 bytes by interrupt on cpu 0:
 vcan_tx+0x325/0x5d0 drivers/net/can/vcan.c:110
 __netdev_start_xmit include/linux/netdevice.h:5432 [inline]
 netdev_start_xmit include/linux/netdevice.h:5441 [inline]
 xmit_one net/core/dev.c:3953 [inline]
 dev_hard_start_xmit+0x10c/0x380 net/core/dev.c:3969
 __dev_queue_xmit+0xbfd/0x1ec0 net/core/dev.c:4958
 dev_queue_xmit include/linux/netdevice.h:3464 [inline]
 can_send+0x584/0x720 net/can/af_can.c:279
 bcm_can_tx+0x3ba/0x5b0 net/can/bcm.c:367
 bcm_tx_timeout_handler+0x1b2/0x360 net/can/bcm.c:546
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0xde/0x290 kernel/time/hrtimer.c:2148
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x44/0xe0 kernel/softirq.c:758
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 __sanitizer_cov_trace_const_cmp8+0x0/0xa0 kernel/kcov.c:312
 free_pages_and_swap_cache+0x257/0x3b0 mm/swap_state.c:587
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
 tlb_flush_mmu+0x552/0x6d0 mm/mmu_gather.c:424
 zap_pte_range mm/memory.c:2104 [inline]
 zap_pmd_range mm/memory.c:2151 [inline]
 zap_pud_range mm/memory.c:2179 [inline]
 zap_p4d_range mm/memory.c:2200 [inline]
 __zap_vma_range+0x2594/0x2ce0 mm/memory.c:2240
 unmap_vmas+0x200/0x310 mm/memory.c:2309
 exit_mmap+0x1a2/0x5e0 mm/mmap.c:1315
 __mmput+0x28/0x1c0 kernel/fork.c:1193
 mmput+0x40/0x50 kernel/fork.c:1216
 exit_mm+0x11b/0x1b0 kernel/exit.c:592
 do_exit+0x438/0x1510 kernel/exit.c:974
 do_group_exit+0xfe/0x140 kernel/exit.c:1129
 get_signal+0xe07/0xf10 kernel/signal.c:3112
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x15d/0x8c0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x212/0x360 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000000025ef -> 0x00000000000025f0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 8856 Comm: syz.7.1260 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================