BUG: sleeping function called from invalid context at kernel/workqueue.c:3039 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 28253, name: systemd-udevd preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 4 locks held by systemd-udevd/28253: #0: ffff88807f2ec460 (sb_writers#3){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:3389 [inline] #0: ffff88807f2ec460 (sb_writers#3){.+.+}-{0:0}, at: path_openat+0x28d1/0x2940 fs/namei.c:3606 #1: ffff88807b72ba70 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: inode_lock include/linux/fs.h:777 [inline] #1: ffff88807b72ba70 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: open_last_lookups fs/namei.c:3397 [inline] #1: ffff88807b72ba70 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: path_openat+0x94b/0x2940 fs/namei.c:3606 #2: ffff88806f8ce800 (&dentry->d_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline] #2: ffff88806f8ce800 (&dentry->d_lock){+.+.}-{2:2}, at: __d_add fs/dcache.c:2724 [inline] #2: ffff88806f8ce800 (&dentry->d_lock){+.+.}-{2:2}, at: d_add+0x3f5/0x690 fs/dcache.c:2761 #3: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline] #3: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1411 irq event stamp: 9547 hardirqs last enabled at (9546): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (9546): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202 hardirqs last disabled at (9547): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (9547): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162 softirqs last enabled at (8530): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last enabled at (8530): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 softirqs last disabled at (9539): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last disabled at (9539): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 PID: 28253 Comm: systemd-udevd Not tainted 5.16.0-rc4-next-20211208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9583 start_flush_work kernel/workqueue.c:3039 [inline] __flush_work+0x109/0xb10 kernel/workqueue.c:3103 __cancel_work_timer+0x3f9/0x570 kernel/workqueue.c:3191 hci_cmd_sync_cancel net/bluetooth/hci_sync.c:346 [inline] hci_cmd_sync_cancel+0xe1/0x170 net/bluetooth/hci_sync.c:338 btusb_intr_complete+0x3d3/0x4a0 drivers/bluetooth/btusb.c:969 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1656 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1726 dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1987 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5607 Code: 9d a5 7e 83 f8 01 0f 85 b4 02 00 00 9c 58 f6 c4 02 0f 85 9f 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24 RSP: 0018:ffffc900052f77c8 EFLAGS: 00000206 RAX: dffffc0000000000 RBX: 1ffff92000a5eefb RCX: ffffffff815c89af RDX: 1ffff11003ab214c RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff8ff9e94f R10: fffffbfff1ff3d29 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff88806f8ce800 R15: 0000000000000000 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:354 [inline] __d_add fs/dcache.c:2724 [inline] d_add+0x3f5/0x690 fs/dcache.c:2761 simple_lookup fs/libfs.c:75 [inline] simple_lookup+0xc9/0x110 fs/libfs.c:69 lookup_open.isra.0+0x9b0/0x16a0 fs/namei.c:3308 open_last_lookups fs/namei.c:3400 [inline] path_openat+0x9b1/0x2940 fs/namei.c:3606 do_filp_open+0x1aa/0x400 fs/namei.c:3636 do_sys_openat2+0x16d/0x4d0 fs/open.c:1214 do_sys_open fs/open.c:1230 [inline] __do_sys_open fs/open.c:1238 [inline] __se_sys_open fs/open.c:1234 [inline] __x64_sys_open+0x119/0x1c0 fs/open.c:1234 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f2dc32a6840 Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24 RSP: 002b:00007ffc5148eba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0000000000000124 RCX: 00007f2dc32a6840 RDX: 0000000000000124 RSI: 0000000000080141 RDI: 00007ffc5148ebd0 RBP: 00007ffc5148ebd0 R08: 000000000000fec8 R09: 0000000000000000 R10: 00007ffc5148ebc0 R11: 0000000000000246 R12: 0000000000000018 R13: 00007ffc5148ebd0 R14: 00005575c0397820 R15: 000000000000000e BUG: sleeping function called from invalid context at kernel/workqueue.c:3039 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 12690, name: syz-executor.0 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 4 locks held by syz-executor.0/12690: #0: ffff88814b2aa460 (sb_writers#5){.+.+}-{0:0}, at: do_unlinkat+0x17f/0x650 fs/namei.c:4197 #1: ffff8880827b21d8 (&type->i_mutex_dir_key#4/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:812 [inline] #1: ffff8880827b21d8 (&type->i_mutex_dir_key#4/1){+.+.}-{3:3}, at: do_unlinkat+0x269/0x650 fs/namei.c:4201 #2: ffffffff8c3628d8 (tomoyo_ss){....}-{0:0}, at: tomoyo_path_perm+0x1c1/0x400 security/tomoyo/file.c:847 #3: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline] #3: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1411 irq event stamp: 8099641 hardirqs last enabled at (8099640): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (8099640): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202 hardirqs last disabled at (8099641): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (8099641): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162 softirqs last enabled at (8087982): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last enabled at (8087982): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 softirqs last disabled at (8099637): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last disabled at (8099637): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:396 [inline] [] __do_softirq+0xe1/0x9c2 kernel/softirq.c:534 CPU: 1 PID: 12690 Comm: syz-executor.0 Tainted: G W 5.16.0-rc4-next-20211208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9583 start_flush_work kernel/workqueue.c:3039 [inline] __flush_work+0x109/0xb10 kernel/workqueue.c:3103 __cancel_work_timer+0x3f9/0x570 kernel/workqueue.c:3191 hci_cmd_sync_cancel net/bluetooth/hci_sync.c:346 [inline] hci_cmd_sync_cancel+0xe1/0x170 net/bluetooth/hci_sync.c:338 btusb_intr_complete+0x3d3/0x4a0 drivers/bluetooth/btusb.c:969 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1656 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1726 dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1987 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:tomoyo_domain_quota_is_ok+0x300/0x550 security/tomoyo/util.c:1093 Code: 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 41 bc 01 00 00 00 31 db e8 8f e9 c7 fd 89 d9 44 89 e0 31 ff d3 f8 83 e0 01 41 89 c7 <89> c6 e8 99 eb c7 fd 45 85 ff 74 09 e8 6f e9 c7 fd 41 83 c5 01 e8 RSP: 0018:ffffc9000539f8c0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000009 RCX: 0000000000000009 RDX: ffff888031e4d7c0 RSI: ffffffff83aff9c1 RDI: 0000000000000000 RBP: ffff88807023d680 R08: 0000000000000000 R09: 0000000000000009 R10: ffffffff83aff9fa R11: 0000000000000010 R12: 0000000000000062 R13: 0000000000000141 R14: dffffc0000000000 R15: 0000000000000000 tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x270/0x3a0 security/tomoyo/file.c:573 tomoyo_path_perm+0x2f0/0x400 security/tomoyo/file.c:838 tomoyo_path_unlink+0x8e/0xd0 security/tomoyo/tomoyo.c:149 security_path_unlink+0xd7/0x150 security/security.c:1148 do_unlinkat+0x360/0x650 fs/namei.c:4214 __do_sys_unlink fs/namei.c:4266 [inline] __se_sys_unlink fs/namei.c:4264 [inline] __x64_sys_unlink+0xc6/0x110 fs/namei.c:4264 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fe308c17437 Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc4c3c8b08 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe308c17437 RDX: 00007ffc4c3c8b40 RSI: 00007ffc4c3c8b40 RDI: 00007ffc4c3c8bd0 RBP: 00007ffc4c3c8bd0 R08: 0000000000000001 R09: 00007ffc4c3c89a0 R10: 0000555555fa08e3 R11: 0000000000000206 R12: 00007fe308c7118a R13: 00007ffc4c3c9c90 R14: 0000555555fa0810 R15: 00007ffc4c3c9cd0 BUG: sleeping function called from invalid context at kernel/workqueue.c:3039 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 28432, name: syz-executor.5 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by syz-executor.5/28432: #0: ffffffff8c3628d8 (tomoyo_ss){....}-{0:0}, at: tomoyo_path_number_perm+0x18d/0x590 security/tomoyo/file.c:720 #1: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline] #1: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1411 irq event stamp: 2429 hardirqs last enabled at (2428): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (2428): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202 hardirqs last disabled at (2429): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (2429): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162 softirqs last enabled at (1972): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last enabled at (1972): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 softirqs last disabled at (2425): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last disabled at (2425): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:396 [inline] [] __do_softirq+0xe1/0x9c2 kernel/softirq.c:534 CPU: 1 PID: 28432 Comm: syz-executor.5 Tainted: G W 5.16.0-rc4-next-20211208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9583 start_flush_work kernel/workqueue.c:3039 [inline] __flush_work+0x109/0xb10 kernel/workqueue.c:3103 __cancel_work_timer+0x3f9/0x570 kernel/workqueue.c:3191 hci_cmd_sync_cancel net/bluetooth/hci_sync.c:346 [inline] hci_cmd_sync_cancel+0xe1/0x170 net/bluetooth/hci_sync.c:338 btusb_intr_complete+0x3d3/0x4a0 drivers/bluetooth/btusb.c:969 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1656 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1726 dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1987 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:tomoyo_domain_quota_is_ok+0x32a/0x550 security/tomoyo/util.c:1092 Code: 89 c6 e8 99 eb c7 fd 45 85 ff 74 09 e8 6f e9 c7 fd 41 83 c5 01 e8 66 e9 c7 fd 8d 73 01 bf 10 00 00 00 83 c3 01 e8 36 ed c7 fd <83> fb 10 75 bd e9 bf fd ff ff 41 bc 01 00 00 00 eb 91 45 31 e4 eb RSP: 0018:ffffc900020b7a40 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 000000000000000f RCX: ffff88801de4ba80 RDX: 0000000000000000 RSI: ffff88801de4ba80 RDI: 0000000000000003 RBP: ffff88807e014900 R08: 0000000000000000 R09: 000000000000000f R10: ffffffff83aff9fa R11: 0000000000000010 R12: 0000000000000001 R13: 00000000000001b6 R14: dffffc0000000000 R15: 0000000000000000 tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089 tomoyo_audit_path_number_log security/tomoyo/file.c:235 [inline] tomoyo_path_number_perm+0x419/0x590 security/tomoyo/file.c:734 security_file_ioctl+0x50/0xb0 security/security.c:1533 __do_sys_ioctl fs/ioctl.c:868 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0xb3/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f298b5568b7 Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 04 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f298a4ca5f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 00007f298b5568b7 RDX: 00007f298a4cabf0 RSI: 000000008138ae83 RDI: 0000000000000006 RBP: 00000000ffffffff R08: 0000000000000001 R09: 0000000000000049 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000fec00000 R13: 00007f298a4cad30 R14: 0000000000000018 R15: 0000000020017000 BUG: sleeping function called from invalid context at kernel/workqueue.c:3039 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 7905, name: kworker/1:3 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by kworker/1:3/7905: #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2289 #1: ffffc9000e59fdb0 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2293 #2: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline] #2: ffffc90000dc0d70 ((&dum_hcd->timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1411 irq event stamp: 1565105 hardirqs last enabled at (1565104): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (1565104): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202 hardirqs last disabled at (1565105): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (1565105): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162 softirqs last enabled at (1564978): [] spin_unlock_bh include/linux/spinlock.h:399 [inline] softirqs last enabled at (1564978): [] nsim_dev_trap_report drivers/net/netdevsim/dev.c:817 [inline] softirqs last enabled at (1564978): [] nsim_dev_trap_report_work+0x855/0xbc0 drivers/net/netdevsim/dev.c:843 softirqs last disabled at (1565101): [] invoke_softirq kernel/softirq.c:432 [inline] softirqs last disabled at (1565101): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:396 [inline] [] __do_softirq+0xe1/0x9c2 kernel/softirq.c:534 CPU: 1 PID: 7905 Comm: kworker/1:3 Tainted: G W 5.16.0-rc4-next-20211208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events pwq_unbound_release_workfn Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9583 start_flush_work kernel/workqueue.c:3039 [inline] __flush_work+0x109/0xb10 kernel/workqueue.c:3103 __cancel_work_timer+0x3f9/0x570 kernel/workqueue.c:3191 hci_cmd_sync_cancel net/bluetooth/hci_sync.c:346 [inline] hci_cmd_sync_cancel+0xe1/0x170 net/bluetooth/hci_sync.c:338 btusb_intr_complete+0x3d3/0x4a0 drivers/bluetooth/btusb.c:969 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1656 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1726 dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1987 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:lockdep_unregister_key+0x1c9/0x250 kernel/locking/lockdep.c:6328 Code: 00 00 00 48 89 ee e8 46 fd ff ff 4c 89 f7 e8 4e c9 ff ff e8 f9 cb ff ff 9c 58 f6 c4 02 75 26 41 f7 c4 00 02 00 00 74 01 fb 5b <5d> 41 5c 41 5d 41 5e 41 5f e9 99 42 08 00 0f 0b 5b 5d 41 5c 41 5d RSP: 0018:ffffc9000e59fcb0 EFLAGS: 00000206 RAX: 0000000000000046 RBX: ffff88807c2d8c98 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880206f5128 R08: ffffffff8bb8be80 R09: ffffffff9069167b R10: fffffbfff20d22cf R11: 000000000001f4f1 R12: 0000000000000246 R13: 0000000000000000 R14: ffffffff8ff968f8 R15: ffffffff9011f1b0 wq_unregister_lockdep kernel/workqueue.c:3519 [inline] pwq_unbound_release_workfn+0x235/0x340 kernel/workqueue.c:3757 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2318 worker_thread+0x658/0x11f0 kernel/workqueue.c:2465 kthread+0x405/0x4f0 kernel/kthread.c:345 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 9d popfq 1: a5 movsl %ds:(%rsi),%es:(%rdi) 2: 7e 83 jle 0xffffff87 4: f8 clc 5: 01 0f add %ecx,(%rdi) 7: 85 b4 02 00 00 9c 58 test %esi,0x589c0000(%rdx,%rax,1) e: f6 c4 02 test $0x2,%ah 11: 0f 85 9f 02 00 00 jne 0x2b6 17: 48 83 7c 24 08 00 cmpq $0x0,0x8(%rsp) 1d: 74 01 je 0x20 1f: fb sti 20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 27: fc ff df * 2a: 48 01 c3 add %rax,%rbx <-- trapping instruction 2d: 48 c7 03 00 00 00 00 movq $0x0,(%rbx) 34: 48 c7 43 08 00 00 00 movq $0x0,0x8(%rbx) 3b: 00 3c: 48 rex.W 3d: 8b .byte 0x8b 3e: 84 .byte 0x84 3f: 24 .byte 0x24