BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 187, name: kworker/0:2 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 7 locks held by kworker/0:2/187: #0: ffff88801f6e8140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc9000200fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88802b1bf1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #2: ffff88802b1bf1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4a60 drivers/usb/core/hub.c:5899 #3: ffff88801caefaa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x49/0x120 fs/kernfs/dir.c:1791 #4: ffff88801caef980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x51/0x120 fs/kernfs/dir.c:1792 #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline] #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: kernfs_root+0x23/0x2a0 fs/kernfs/kernfs-internal.h:76 #6: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 Preemption disabled at: [] preempt_schedule_irq+0x40/0x90 kernel/sched/core.c:7554 CPU: 0 UID: 0 PID: 187 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9197 __cancel_work_sync kernel/workqueue.c:4487 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4568 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 kernel/sched/core.c:5361 Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 8d 7f 48 e8 d0 25 e8 09 e8 ab b1 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 RSP: 0018:ffffc9000200f4a8 EFLAGS: 00000202 RAX: 0000000000011ba7 RBX: ffff88801eb68000 RCX: 0000000000000040 RDX: 0000000000000000 RSI: ffffffff8e1a8186 RDI: ffff88801eb696f8 RBP: ffffc9000200f500 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81d6005c R12: ffff888037358000 R13: 0000000000000000 R14: ffffffff9122baa4 R15: ffff8880b843b4c0 context_switch kernel/sched/core.c:5513 [inline] __schedule+0x1264/0x6730 kernel/sched/core.c:7234 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7556 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x205/0xa00 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:128 [inline] RIP: 0010:lock_release kernel/locking/lockdep.c:5885 [inline] RIP: 0010:lock_release+0x8d/0x310 kernel/locking/lockdep.c:5875 Code: 00 00 65 4c 8b 25 fb 85 7e 12 41 8b bc 24 9c 0b 00 00 85 ff 0f 85 21 01 00 00 48 81 3b 80 49 6b 94 0f 84 14 01 00 00 9c 41 5e 48 c7 c7 cc e6 29 8e e8 26 51 d5 09 65 ff 05 7f cc 7e 12 8b 35 RSP: 0018:ffffc9000200f788 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffffffff8ebe8200 RCX: ffffc9001a1f6000 RDX: 0000000000000000 RSI: ffffffff8c402600 RDI: 0000000000000000 RBP: ffffffff82beecfe R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88801eb68000 R13: 0000000000000000 R14: 0000000000000202 R15: 0000000000000000 rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock include/linux/rcupdate.h:871 [inline] class_rcu_destructor include/linux/rcupdate.h:1183 [inline] kernfs_root+0xf3/0x2a0 fs/kernfs/kernfs-internal.h:76 kernfs_find_ns+0x41b/0x700 fs/kernfs/dir.c:894 kernfs_remove_by_name_ns+0x5f/0x120 fs/kernfs/dir.c:1794 kernfs_remove_by_name include/linux/kernfs.h:644 [inline] sysfs_unmerge_group+0xe7/0x170 fs/sysfs/group.c:408 dpm_sysfs_remove+0x8e/0xb0 drivers/base/power/sysfs.c:833 device_del+0x180/0x9b0 drivers/base/core.c:3936 usb_disconnect+0x5b5/0x9a0 drivers/usb/core/hub.c:2376 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1c4f/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1483 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 7 locks held by kworker/0:2/187: #0: ffff88801f6e8140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc9000200fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88802b1bf1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #2: ffff88802b1bf1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4a60 drivers/usb/core/hub.c:5899 #3: ffff88801caefaa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x49/0x120 fs/kernfs/dir.c:1791 #4: ffff88801caef980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x51/0x120 fs/kernfs/dir.c:1792 #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline] #5: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: kernfs_root+0x23/0x2a0 fs/kernfs/kernfs-internal.h:76 #6: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 stack backtrace: CPU: 0 UID: 0 PID: 187 Comm: kworker/0:2 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 lockdep_rcu_suspicious.cold+0x4f/0xb1 kernel/locking/lockdep.c:6876 __synchronize_srcu+0x29d/0x300 kernel/rcu/srcutree.c:1483 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2636 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3880 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:finish_task_switch.isra.0+0x2cd/0x10c0 kernel/sched/core.c:5361 Code: ab 0a 00 00 41 c7 87 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 8d 7f 48 e8 d0 25 e8 09 e8 ab b1 3c 00 fb 48 8d bb f8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 RSP: 0018:ffffc9000200f4a8 EFLAGS: 00000202 RAX: 0000000000011ba7 RBX: ffff88801eb68000 RCX: 0000000000000040 RDX: 0000000000000000 RSI: ffffffff8e1a8186 RDI: ffff88801eb696f8 RBP: ffffc9000200f500 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81d6005c R12: ffff888037358000 R13: 0000000000000000 R14: ffffffff9122baa4 R15: ffff8880b843b4c0 context_switch kernel/sched/core.c:5513 [inline] __schedule+0x1264/0x6730 kernel/sched/core.c:7234 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7556 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x205/0xa00 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:128 [inline] RIP: 0010:lock_release kernel/locking/lockdep.c:5885 [inline] RIP: 0010:lock_release+0x8d/0x310 kernel/locking/lockdep.c:5875 Code: 00 00 65 4c 8b 25 fb 85 7e 12 41 8b bc 24 9c 0b 00 00 85 ff 0f 85 21 01 00 00 48 81 3b 80 49 6b 94 0f 84 14 01 00 00 9c 41 5e 48 c7 c7 cc e6 29 8e e8 26 51 d5 09 65 ff 05 7f cc 7e 12 8b 35 RSP: 0018:ffffc9000200f788 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffffffff8ebe8200 RCX: ffffc9001a1f6000 RDX: 0000000000000000 RSI: ffffffff8c402600 RDI: 0000000000000000 RBP: ffffffff82beecfe R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88801eb68000 R13: 0000000000000000 R14: 0000000000000202 R15: 0000000000000000 rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock include/linux/rcupdate.h:871 [inline] class_rcu_destructor include/linux/rcupdate.h:1183 [inline] kernfs_root+0xf3/0x2a0 fs/kernfs/kernfs-internal.h:76 kernfs_find_ns+0x41b/0x700 fs/kernfs/dir.c:894 kernfs_remove_by_name_ns+0x5f/0x120 fs/kernfs/dir.c:1794 kernfs_remove_by_name include/linux/kernfs.h:644 [inline] sysfs_unmerge_group+0xe7/0x170 fs/sysfs/group.c:408 dpm_sysfs_remove+0x8e/0xb0 drivers/base/power/sysfs.c:833 device_del+0x180/0x9b0 drivers/base/core.c:3936 usb_disconnect+0x5b5/0x9a0 drivers/usb/core/hub.c:2376 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1c4f/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ODEBUG: object ffffc90000007a70 is NOT on stack ffffc90002008000, but annotated. ====================================================== ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 00 00 add %al,(%rax) 2: 41 c7 87 20 0e 00 00 movl $0x0,0xe20(%r15) 9: 00 00 00 00 d: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 12: 49 8d 7f 48 lea 0x48(%r15),%rdi 16: e8 d0 25 e8 09 call 0x9e825eb 1b: e8 ab b1 3c 00 call 0x3cb1cb 20: fb sti 21: 48 8d bb f8 16 00 00 lea 0x16f8(%rbx),%rdi * 28: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction 2f: fc ff df 32: 48 89 fa mov %rdi,%rdx 35: 48 c1 ea 03 shr $0x3,%rdx 39: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax 3d: 84 .byte 0x84