============================= WARNING: suspicious RCU usage syzkaller #0 Not tainted ----------------------------- kernel/sched/core.c:9218 Illegal context switch in RCU-sched read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 locks held by syz.3.153/5729: 5, last CPU#1: #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299 #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 mm/pgtable-generic.c:290 #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404 #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:947 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xbc/0x4b0 include/linux/mmzone.h:2276 #4: ffffc900001b8c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 1 UID: 0 PID: 5729 Comm: syz.3.153 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 lockdep_rcu_suspicious.cold+0x4f/0xb2 kernel/locking/lockdep.c:6972 __might_resched+0x2d9/0x330 kernel/sched/core.c:9218 __cancel_work_sync kernel/workqueue.c:4561 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4642 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 kernel/kcov.c:213 Code: 00 01 00 ff 74 1e f6 c4 01 74 44 a9 00 00 00 0f 75 3d f7 c1 00 00 00 f0 75 35 8b 82 5c 16 00 00 85 c0 74 2b 8b 82 30 16 00 00 <83> f8 02 75 20 48 8b 8a 38 16 00 00 8b 92 34 16 00 00 48 8b 01 48 RSP: 0018:ffffc90005e2f488 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 00000000001291a7 RCX: 0000000000000002 RDX: ffff888117b58000 RSI: ffffffff8224d754 RDI: ffff888117b58000 RBP: ffff88823ff154a0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000001 R12: ffffea000000000f R13: 0000000000000002 R14: ffff888112868a20 R15: 80000001291a7007 early_section include/linux/mmzone.h:2136 [inline] pfn_valid+0x144/0x4b0 include/linux/mmzone.h:2285 page_table_check_clear+0x21/0x540 mm/page_table_check.c:70 __page_table_check_pte_clear+0x10f/0x120 mm/page_table_check.c:155 page_table_check_pte_clear include/linux/page_table_check.h:55 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1259 [inline] get_and_clear_full_ptes include/linux/pgtable.h:879 [inline] zap_present_folio_ptes mm/memory.c:1779 [inline] zap_present_ptes mm/memory.c:1861 [inline] do_zap_pte_range mm/memory.c:1963 [inline] zap_pte_range mm/memory.c:2065 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x25e1/0x4090 mm/memory.c:2240 unmap_vmas+0x299/0x5f0 mm/memory.c:2309 exit_mmap+0x1ef/0xa00 mm/mmap.c:1315 __mmput kernel/fork.c:1193 [inline] mmput+0xe0/0x430 kernel/fork.c:1216 exit_mm kernel/exit.c:614 [inline] do_exit+0x833/0x2a50 kernel/exit.c:996 do_group_exit+0xd5/0x2a0 kernel/exit.c:1151 get_signal+0x1ec7/0x21e0 kernel/signal.c:3039 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0xd2/0x530 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x55a/0x710 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a25d3e159 Code: Unable to access opcode bytes at 0x7f3a25d3e12f. RSP: 002b:00007f3a247970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3a25fc5fa8 RCX: 00007f3a25d3e159 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3a25fc5fa8 RBP: 00007f3a25fc5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3a25fc6038 R14: 00007ffc657505c0 R15: 00007ffc657506a8 BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5729, name: syz.3.153 preempt_count: 102, expected: 0 RCU nest depth: 1, expected: 0 locks held by syz.3.153/5729: 5, last CPU#1: #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299 #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 mm/pgtable-generic.c:290 #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404 #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:947 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xbc/0x4b0 include/linux/mmzone.h:2276 #4: ffffc900001b8c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 5729 Comm: syz.3.153 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9256 __cancel_work_sync kernel/workqueue.c:4561 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4642 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 kernel/kcov.c:213 Code: 00 01 00 ff 74 1e f6 c4 01 74 44 a9 00 00 00 0f 75 3d f7 c1 00 00 00 f0 75 35 8b 82 5c 16 00 00 85 c0 74 2b 8b 82 30 16 00 00 <83> f8 02 75 20 48 8b 8a 38 16 00 00 8b 92 34 16 00 00 48 8b 01 48 RSP: 0018:ffffc90005e2f488 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 00000000001291a7 RCX: 0000000000000002 RDX: ffff888117b58000 RSI: ffffffff8224d754 RDI: ffff888117b58000 RBP: ffff88823ff154a0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000001 R12: ffffea000000000f R13: 0000000000000002 R14: ffff888112868a20 R15: 80000001291a7007 early_section include/linux/mmzone.h:2136 [inline] pfn_valid+0x144/0x4b0 include/linux/mmzone.h:2285 page_table_check_clear+0x21/0x540 mm/page_table_check.c:70 __page_table_check_pte_clear+0x10f/0x120 mm/page_table_check.c:155 page_table_check_pte_clear include/linux/page_table_check.h:55 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1259 [inline] get_and_clear_full_ptes include/linux/pgtable.h:879 [inline] zap_present_folio_ptes mm/memory.c:1779 [inline] zap_present_ptes mm/memory.c:1861 [inline] do_zap_pte_range mm/memory.c:1963 [inline] zap_pte_range mm/memory.c:2065 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x25e1/0x4090 mm/memory.c:2240 unmap_vmas+0x299/0x5f0 mm/memory.c:2309 exit_mmap+0x1ef/0xa00 mm/mmap.c:1315 __mmput kernel/fork.c:1193 [inline] mmput+0xe0/0x430 kernel/fork.c:1216 exit_mm kernel/exit.c:614 [inline] do_exit+0x833/0x2a50 kernel/exit.c:996 do_group_exit+0xd5/0x2a0 kernel/exit.c:1151 get_signal+0x1ec7/0x21e0 kernel/signal.c:3039 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0xd2/0x530 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x55a/0x710 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a25d3e159 Code: Unable to access opcode bytes at 0x7f3a25d3e12f. RSP: 002b:00007f3a247970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3a25fc5fa8 RCX: 00007f3a25d3e159 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3a25fc5fa8 RBP: 00007f3a25fc5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3a25fc6038 R14: 00007ffc657505c0 R15: 00007ffc657506a8 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1464 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 locks held by syz.3.153/5729: 5, last CPU#1: #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299 #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 mm/pgtable-generic.c:290 #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404 #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:947 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xbc/0x4b0 include/linux/mmzone.h:2276 #4: ffffc900001b8c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 1 UID: 0 PID: 5729 Comm: syz.3.153 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 lockdep_rcu_suspicious.cold+0x4f/0xb2 kernel/locking/lockdep.c:6972 __synchronize_srcu+0x29d/0x300 kernel/rcu/srcutree.c:1464 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 kernel/kcov.c:213 Code: 00 01 00 ff 74 1e f6 c4 01 74 44 a9 00 00 00 0f 75 3d f7 c1 00 00 00 f0 75 35 8b 82 5c 16 00 00 85 c0 74 2b 8b 82 30 16 00 00 <83> f8 02 75 20 48 8b 8a 38 16 00 00 8b 92 34 16 00 00 48 8b 01 48 RSP: 0018:ffffc90005e2f488 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 00000000001291a7 RCX: 0000000000000002 RDX: ffff888117b58000 RSI: ffffffff8224d754 RDI: ffff888117b58000 RBP: ffff88823ff154a0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000001 R12: ffffea000000000f R13: 0000000000000002 R14: ffff888112868a20 R15: 80000001291a7007 early_section include/linux/mmzone.h:2136 [inline] pfn_valid+0x144/0x4b0 include/linux/mmzone.h:2285 page_table_check_clear+0x21/0x540 mm/page_table_check.c:70 __page_table_check_pte_clear+0x10f/0x120 mm/page_table_check.c:155 page_table_check_pte_clear include/linux/page_table_check.h:55 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1259 [inline] get_and_clear_full_ptes include/linux/pgtable.h:879 [inline] zap_present_folio_ptes mm/memory.c:1779 [inline] zap_present_ptes mm/memory.c:1861 [inline] do_zap_pte_range mm/memory.c:1963 [inline] zap_pte_range mm/memory.c:2065 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x25e1/0x4090 mm/memory.c:2240 unmap_vmas+0x299/0x5f0 mm/memory.c:2309 exit_mmap+0x1ef/0xa00 mm/mmap.c:1315 __mmput kernel/fork.c:1193 [inline] mmput+0xe0/0x430 kernel/fork.c:1216 exit_mm kernel/exit.c:614 [inline] do_exit+0x833/0x2a50 kernel/exit.c:996 do_group_exit+0xd5/0x2a0 kernel/exit.c:1151 get_signal+0x1ec7/0x21e0 kernel/signal.c:3039 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0xd2/0x530 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x55a/0x710 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a25d3e159 Code: Unable to access opcode bytes at 0x7f3a25d3e12f. RSP: 002b:00007f3a247970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3a25fc5fa8 RCX: 00007f3a25d3e159 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3a25fc5fa8 RBP: 00007f3a25fc5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3a25fc6038 R14: 00007ffc657505c0 R15: 00007ffc657506a8 BUG: sleeping function called from invali BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5729, name: syz.3.153 preempt_count: 102, expected: 0 RCU nest depth: 1, expected: 0 locks held by syz.3.153/5729: 5, last CPU#1: #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff888105299cb8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299 #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff898e4c20 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x300 mm/pgtable-generic.c:290 #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #2: ffff8881093677f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404 #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:947 [inline] #3: ffffffff898e4b60 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xbc/0x4b0 include/linux/mmzone.h:2276 #4: ffffc900001b8c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 5729 Comm: syz.3.153 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9256 __synchronize_srcu+0x13c/0x300 kernel/rcu/srcutree.c:1472 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 kernel/kcov.c:213 Code: 00 01 00 ff 74 1e f6 c4 01 74 44 a9 00 00 00 0f 75 3d f7 c1 00 00 00 f0 75 35 8b 82 5c 16 00 00 85 c0 74 2b 8b 82 30 16 00 00 <83> f8 02 75 20 48 8b 8a 38 16 00 00 8b 92 34 16 00 00 48 8b 01 48 RSP: 0018:ffffc90005e2f488 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 00000000001291a7 RCX: 0000000000000002 RDX: ffff888117b58000 RSI: ffffffff8224d754 RDI: ffff888117b58000 RBP: ffff88823ff154a0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000001 R12: ffffea000000000f R13: 0000000000000002 R14: ffff888112868a20 R15: 80000001291a7007 early_section include/linux/mmzone.h:2136 [inline] pfn_valid+0x144/0x4b0 include/linux/mmzone.h:2285 page_table_check_clear+0x21/0x540 mm/page_table_check.c:70 __page_table_check_pte_clear+0x10f/0x120 mm/page_table_check.c:155 page_table_check_pte_clear include/linux/page_table_check.h:55 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1259 [inline] get_and_clear_full_ptes include/linux/pgtable.h:879 [inline] zap_present_folio_ptes mm/memory.c:1779 [inline] zap_present_ptes mm/memory.c:1861 [inline] do_zap_pte_range mm/memory.c:1963 [inline] zap_pte_range mm/memory.c:2065 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x25e1/0x4090 mm/memory.c:2240 unmap_vmas+0x299/0x5f0 mm/memory.c:2309 exit_mmap+0x1ef/0xa00 mm/mmap.c:1315 __mmput kernel/fork.c:1193 [inline] mmput+0xe0/0x430 kernel/fork.c:1216 exit_mm kernel/exit.c:614 [inline] do_exit+0x833/0x2a50 kernel/exit.c:996 do_group_exit+0xd5/0x2a0 kernel/exit.c:1151 get_signal+0x1ec7/0x21e0 kernel/signal.c:3039 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0xd2/0x530 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x55a/0x710 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a25d3e159 Code: Unable to access opcode bytes at 0x7f3a25d3e12f. RSP: 002b:00007f3a247970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3a25fc5fa8 RCX: 00007f3a25d3e159 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3a25fc5fa8 RBP: 00007f3a25fc5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3a25fc6038 R14: 00007ffc657505c0 R15: 00007ffc657506a8 ODEBUG: object ffffc900001b8a60 is NOT on stack ffffc90005e28000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: syz.3.153/5729 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705, CPU#1: syz.3.153/5729 Modules linked in: CPU: 1 UID: 0 PID: 5729 Comm: syz.3.153 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705 Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 83 c5 01 89 2d 60 bc 0e 13 4c 89 e6 48 c7 c7 c0 c2 d2 87 e8 61 c3 fa ff 90 <0f> 0b 90 e9 12 3b bb 01 83 c5 01 89 2d 3f bc 0e 13 49 39 c4 73 da RSP: 0018:ffffc900001b88f0 EFLAGS: 00010082 RAX: 0000000000000050 RBX: ffff88811ab4b230 RCX: 0000000000000000 RDX: 0000000000000050 RSI: ffffffff81938669 RDI: fffff5200003710f RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000103 R11: 0000000000000001 R12: ffffc900001b8a60 R13: ffff888117b58000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8882684e2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c349449 CR3: 0000000117dd6000 CR4: 00000000003506f0 Call Trace: lookup_object_or_alloc lib/debugobjects.c:682 [inline] __debug_object_init+0x2a9/0x3d0 lib/debugobjects.c:798 __synchronize_srcu+0x1c3/0x300 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 kernel/kcov.c:213 Code: 00 01 00 ff 74 1e f6 c4 01 74 44 a9 00 00 00 0f 75 3d f7 c1 00 00 00 f0 75 35 8b 82 5c 16 00 00 85 c0 74 2b 8b 82 30 16 00 00 <83> f8 02 75 20 48 8b 8a 38 16 00 00 8b 92 34 16 00 00 48 8b 01 48 RSP: 0018:ffffc90005e2f488 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 00000000001291a7 RCX: 0000000000000002 RDX: ffff888117b58000 RSI: ffffffff8224d754 RDI: ffff888117b58000 RBP: ffff88823ff154a0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000001 R12: ffffea000000000f R13: 0000000000000002 R14: ffff888112868a20 R15: 80000001291a7007 early_section include/linux/mmzone.h:2136 [inline] pfn_valid+0x144/0x4b0 include/linux/mmzone.h:2285 page_table_check_clear+0x21/0x540 mm/page_table_check.c:70 __page_table_check_pte_clear+0x10f/0x120 mm/page_table_check.c:155 page_table_check_pte_clear include/linux/page_table_check.h:55 [inline] ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1259 [inline] get_and_clear_full_ptes include/linux/pgtable.h:879 [inline] zap_present_folio_ptes mm/memory.c:1779 [inline] zap_present_ptes mm/memory.c:1861 [inline] do_zap_pte_range mm/memory.c:1963 [inline] zap_pte_range mm/memory.c:2065 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x25e1/0x4090 mm/memory.c:2240 unmap_vmas+0x299/0x5f0 mm/memory.c:2309 exit_mmap+0x1ef/0xa00 mm/mmap.c:1315 __mmput kernel/fork.c:1193 [inline] mmput+0xe0/0x430 kernel/fork.c:1216 exit_mm kernel/exit.c:614 [inline] do_exit+0x833/0x2a50 kernel/exit.c:996 do_group_exit+0xd5/0x2a0 kernel/exit.c:1151 get_signal+0x1ec7/0x21e0 kernel/signal.c:3039 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0xd2/0x530 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x55a/0x710 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a25d3e159 Code: Unable to access opcode bytes at 0x7f3a25d3e12f. RSP: 002b:00007f3a247970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3a25fc5fa8 RCX: 00007f3a25d3e159 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3a25fc5fa8 RBP: 00007f3a25fc5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3a25fc6038 R14: 00007ffc657505c0 R15: 00007ffc657506a8 ---------------- Code disassembly (best guess): 0: 00 01 add %al,(%rcx) 2: 00 ff add %bh,%bh 4: 74 1e je 0x24 6: f6 c4 01 test $0x1,%ah 9: 74 44 je 0x4f b: a9 00 00 00 0f test $0xf000000,%eax 10: 75 3d jne 0x4f 12: f7 c1 00 00 00 f0 test $0xf0000000,%ecx 18: 75 35 jne 0x4f 1a: 8b 82 5c 16 00 00 mov 0x165c(%rdx),%eax 20: 85 c0 test %eax,%eax 22: 74 2b je 0x4f 24: 8b 82 30 16 00 00 mov 0x1630(%rdx),%eax * 2a: 83 f8 02 cmp $0x2,%eax <-- trapping instruction 2d: 75 20 jne 0x4f 2f: 48 8b 8a 38 16 00 00 mov 0x1638(%rdx),%rcx 36: 8b 92 34 16 00 00 mov 0x1634(%rdx),%edx 3c: 48 8b 01 mov (%rcx),%rax 3f: 48 rex.W