BUG: scheduling while atomic in drain_urb_queue

Status: upstream: reported on 2026/08/23 02:47
Subsystems: kernel
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+919c31c248e8a37b89d1@syzkaller.appspotmail.com
First crash: 8d14h, last: 2h05m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
54a058c6 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ✅ BUG: scheduling while atomic in drain_urb_queue 2026/08/21 00:00 2026/08/21 00:00 2026/08/21 01:03 1e72964b
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernel?] BUG: scheduling while atomic in drain_urb_queue 0 (1) 2026/08/23 02:47

Sample crash report:
BUG: scheduling while atomic: kworker/1:3/5739/0x00010001
locks held by kworker/1:3/5739: 7, on CPU#1:
 #0: ffff888023281d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3362
 #1: ffffc90003837d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3363
 #2: ffff88802ab8d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #2: ffff88802ab8d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 drivers/usb/core/hub.c:5907
 #3: ffff88807ecde1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #3: ffff88807ecde1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
 #4: ffff88804fccd1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #4: ffff88804fccd1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
 #5: ffffffff90bc0880 (register_mutex#7){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #5: ffffffff90bc0880 (register_mutex#7){+.+.}-{4:4}, at: usb_audio_probe+0x385/0x3b10 sound/usb/card.c:985
 #6: ffff88807ee40160 (&rmidi->open_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #6: ffff88807ee40160 (&rmidi->open_mutex){+.+.}-{4:4}, at: rawmidi_release_priv+0x45/0x280 sound/core/rawmidi.c:574
Modules linked in:
Preemption disabled at:
[<ffffffff8bcc3ceb>] __mutex_lock_common kernel/locking/mutex.c:645 [inline]
[<ffffffff8bcc3ceb>] __mutex_lock+0x17b/0x1bc0 kernel/locking/mutex.c:821
Kernel panic - not syncing: scheduling while atomic: panic_on_warn set ...
CPU: 1 UID: 0 PID: 5739 Comm: kworker/1:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 vpanic+0x553/0x970 kernel/panic.c:651
 panic+0xd1/0xe0 kernel/panic.c:788
 check_panic_on_warn kernel/panic.c:525 [inline]
 check_panic_on_warn.cold+0x19/0x34 kernel/panic.c:520
 __schedule_bug.cold+0xc4/0xf4 kernel/sched/core.c:6076
 schedule_debug kernel/sched/core.c:6105 [inline]
 __schedule+0x4066/0x6920 kernel/sched/core.c:7119
 __schedule_loop kernel/sched/core.c:7347 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7362
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 drain_urb_queue.part.0+0x303/0x470 sound/usb/midi2.c:246
 drain_urb_queue sound/usb/midi2.c:242 [inline]
 snd_usb_midi_v2_drain+0x79/0xb0 sound/usb/midi2.c:383
 snd_ump_rawmidi_drain+0x85/0xb0 sound/core/ump.c:294
 snd_rawmidi_drain_output+0x3b3/0x880 sound/core/rawmidi.c:282
 close_substream.part.0+0x3eb/0x860 sound/core/rawmidi.c:551
 close_substream include/linux/mutex.h:253 [inline]
 rawmidi_release_priv+0x210/0x280 sound/core/rawmidi.c:580
 snd_rawmidi_kernel_release+0x3a/0xd0 sound/core/rawmidi.c:596
 ump_request_close sound/core/ump.c:623 [inline]
 snd_ump_parse_endpoint+0x15f/0xb00 sound/core/ump.c:1135
 parse_ump_endpoints sound/usb/midi2.c:810 [inline]
 snd_usb_midi_v2_create+0x1b97/0x4070 sound/usb/midi2.c:1158
 snd_usb_create_stream.isra.0+0x386/0x4d0 sound/usb/card.c:290
 snd_usb_create_streams sound/usb/card.c:392 [inline]
 usb_audio_probe+0xf0b/0x3b10 sound/usb/card.c:1065
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868
 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x64/0x160 drivers/base/bus.c:620
 device_add+0x121d/0x1970 drivers/base/core.c:3776
 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2703
 usb_new_device include/linux/workqueue.h:714 [inline]
 hub_port_connect drivers/usb/core/hub.c:5575 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
 port_event drivers/usb/core/hub.c:5879 [inline]
 hub_event.cold+0x1e3/0xe90 drivers/usb/core/hub.c:5961
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
 process_scheduled_works kernel/workqueue.c:3470 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/25 06:43 upstream 66498c75b4f8 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root BUG: scheduling while atomic in drain_urb_queue
2026/08/24 20:01 upstream 0a0d1d55dad5 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: scheduling while atomic in drain_urb_queue
2026/08/24 20:01 upstream 0a0d1d55dad5 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: scheduling while atomic in drain_urb_queue
2026/08/22 09:52 upstream 26260251022f 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root BUG: scheduling while atomic in drain_urb_queue
2026/08/20 11:31 upstream cb8a75eec087 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root BUG: scheduling while atomic in drain_urb_queue
2026/08/27 15:00 upstream 818bebeb63dd c53a1b9c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: scheduling while atomic in drain_urb_queue
2026/08/20 16:27 upstream a4ff2be345d0 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: scheduling while atomic in drain_urb_queue
2026/08/19 16:13 upstream bd5f485f3f02 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: scheduling while atomic in drain_urb_queue
2026/08/19 02:41 upstream b126f6f5940f 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream BUG: scheduling while atomic in drain_urb_queue
2026/08/22 07:56 linux-next 903c1cf6dff9 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce BUG: scheduling while atomic in drain_urb_queue
2026/08/20 08:42 linux-next 6a746cd265ae 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: scheduling while atomic in drain_urb_queue
2026/08/20 08:42 linux-next 6a746cd265ae 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root BUG: scheduling while atomic in drain_urb_queue
* Struck through repros no longer work on HEAD.