BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 31166, name: syz.8.5918 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 locks held by syz.8.5918/31166: 3, last CPU#1: #0: ffff888031df03b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff888031df03b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323 #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 mm/page_owner.c:301 #2: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xab/0x860 kernel/softirq.c:621 CPU: 1 UID: 0 PID: 31166 Comm: syz.8.5918 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9256 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 f0 c9 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 42 b5 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 07 3a da RSP: 0000:ffffc90006bef240 EFLAGS: 00000292 RAX: 7c696e3ad1bfee00 RBX: 0000000000000000 RCX: 0000000000000046 RDX: 0000000042a7df5c RSI: ffffffff8e6fe7fc RDI: ffffffff8c6d9a80 RBP: ffff8880686c9f40 R08: ffffffff8241df0e R09: 0000000000000000 R10: 000000000000000f R11: ffffffff81b285d0 R12: ffffffff8ed5c8a0 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] __update_page_owner_free_handle+0x4b/0x4a0 mm/page_owner.c:301 __reset_page_owner+0x85/0x1f0 mm/page_owner.c:339 reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] free_unref_folios+0xdc2/0x14e0 mm/page_alloc.c:3022 folios_put_refs+0x9e9/0xb30 mm/folio.c:1034 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:595 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:424 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:549 exit_mmap+0x4b2/0x9f0 mm/mmap.c:1328 __mmput+0x118/0x420 kernel/fork.c:1193 exit_mm+0x221/0x2d0 kernel/exit.c:617 do_exit+0x6cd/0x2360 kernel/exit.c:999 do_group_exit+0x22d/0x2f0 kernel/exit.c:1154 get_signal+0x121b/0x12c0 kernel/signal.c:3051 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_int80_emulation+0x314/0x500 arch/x86/entry/syscall_32.c:169 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf7fd50ec Code: Unable to access opcode bytes at 0xf7fd50c2. RSP: 002b:00000000f54965bc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 RAX: fffffffffffffe00 RBX: 00000000f7494f88 RCX: 0000000000000080 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7494f8c RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W L ----------------------------- kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 locks held by syz.8.5918/31166: 3, last CPU#1: #0: ffff888031df03b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff888031df03b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323 #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 mm/page_owner.c:301 #2: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 1 UID: 0 PID: 31166 Comm: syz.8.5918 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972 __synchronize_srcu+0x157/0x2f0 kernel/rcu/srcutree.c:1464 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 f0 c9 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 42 b5 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 07 3a da RSP: 0000:ffffc90006bef240 EFLAGS: 00000292 RAX: 7c696e3ad1bfee00 RBX: 0000000000000000 RCX: 0000000000000046 RDX: 0000000042a7df5c RSI: ffffffff8e6fe7fc RDI: ffffffff8c6d9a80 RBP: ffff8880686c9f40 R08: ffffffff8241df0e R09: 0000000000000000 R10: 000000000000000f R11: ffffffff81b285d0 R12: ffffffff8ed5c8a0 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] __update_page_owner_free_handle+0x4b/0x4a0 mm/page_owner.c:301 __reset_page_owner+0x85/0x1f0 mm/page_owner.c:339 reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] free_unref_folios+0xdc2/0x14e0 mm/page_alloc.c:3022 folios_put_refs+0x9e9/0xb30 mm/folio.c:1034 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:595 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:424 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:549 exit_mmap+0x4b2/0x9f0 mm/mmap.c:1328 __mmput+0x118/0x420 kernel/fork.c:1193 exit_mm+0x221/0x2d0 kernel/exit.c:617 do_exit+0x6cd/0x2360 kernel/exit.c:999 do_group_exit+0x22d/0x2f0 kernel/exit.c:1154 get_signal+0x121b/0x12c0 kernel/signal.c:3051 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_int80_emulation+0x314/0x500 arch/x86/entry/syscall_32.c:169 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf7fd50ec Code: Unable to access opcode bytes at 0xf7fd50c2. RSP: 002b:00000000f54965bc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 RAX: fffffffffffffe00 RBX: 00000000f7494f88 RCX: 0000000000000080 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7494f8c RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 31166, name: syz.8.5918 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 locks held by syz.8.5918/31166: 3, last CPU#1: #0: ffff888031df03b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff888031df03b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323 #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 mm/page_owner.c:301 #2: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xab/0x860 kernel/softirq.c:621 CPU: 1 UID: 0 PID: 31166 Comm: syz.8.5918 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9256 __synchronize_srcu+0x1a1/0x2f0 kernel/rcu/srcutree.c:1472 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 f0 c9 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 42 b5 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 07 3a da RSP: 0000:ffffc90006bef240 EFLAGS: 00000292 RAX: 7c696e3ad1bfee00 RBX: 0000000000000000 RCX: 0000000000000046 RDX: 0000000042a7df5c RSI: ffffffff8e6fe7fc RDI: ffffffff8c6d9a80 RBP: ffff8880686c9f40 R08: ffffffff8241df0e R09: 0000000000000000 R10: 000000000000000f R11: ffffffff81b285d0 R12: ffffffff8ed5c8a0 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] __update_page_owner_free_handle+0x4b/0x4a0 mm/page_owner.c:301 __reset_page_owner+0x85/0x1f0 mm/page_owner.c:339 reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] free_unref_folios+0xdc2/0x14e0 mm/page_alloc.c:3022 folios_put_refs+0x9e9/0xb30 mm/folio.c:1034 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:595 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:424 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:549 exit_mmap+0x4b2/0x9f0 mm/mmap.c:1328 __mmput+0x118/0x420 kernel/fork.c:1193 exit_mm+0x221/0x2d0 kernel/exit.c:617 do_exit+0x6cd/0x2360 kernel/exit.c:999 do_group_exit+0x22d/0x2f0 kernel/exit.c:1154 get_signal+0x121b/0x12c0 kernel/signal.c:3051 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_int80_emulation+0x314/0x500 arch/x86/entry/syscall_32.c:169 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf7fd50ec Code: Unable to access opcode bytes at 0xf7fd50c2. RSP: 002b:00000000f54965bc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 RAX: fffffffffffffe00 RBX: 00000000f7494f88 RCX: 0000000000000080 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7494f8c RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ODEBUG: object ffffc90000a18a80 is NOT on stack ffffc90006be8000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: syz.8.5918/31166 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#1: syz.8.5918/31166 WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#1: syz.8.5918/31166 Modules linked in: CPU: 1 UID: 0 PID: 31166 Comm: syz.8.5918 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline] RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798 Code: fd 06 cc 41 ff c7 44 89 3d 29 5d e8 15 48 c7 c1 80 a3 6d 8c 48 c7 c7 e0 a3 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 ad 71 3d fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 81 57 6e 0a 3b 05 7f RSP: 0000:ffffc90000a189b8 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: 7c696e3ad1bfee00 RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff8880686c9f60 R08: 0000000000000100 R09: 1ffffffff1ed1e8c R10: dffffc0000000000 R11: fffffbfff1ed1e8d R12: 1ffff9200014314c R13: ffff888078356620 R14: dffffc0000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888124dd2000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000008008a018 CR3: 000000000eb48000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000008f06 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 f0 c9 41 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 42 b5 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 07 3a da RSP: 0000:ffffc90006bef240 EFLAGS: 00000292 RAX: 7c696e3ad1bfee00 RBX: 0000000000000000 RCX: 0000000000000046 RDX: 0000000042a7df5c RSI: ffffffff8e6fe7fc RDI: ffffffff8c6d9a80 RBP: ffff8880686c9f40 R08: ffffffff8241df0e R09: 0000000000000000 R10: 000000000000000f R11: ffffffff81b285d0 R12: ffffffff8ed5c8a0 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] __update_page_owner_free_handle+0x4b/0x4a0 mm/page_owner.c:301 __reset_page_owner+0x85/0x1f0 mm/page_owner.c:339 reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] free_unref_folios+0xdc2/0x14e0 mm/page_alloc.c:3022 folios_put_refs+0x9e9/0xb30 mm/folio.c:1034 free_pages_and_swap_cache+0x41e/0x490 mm/swap_state.c:595 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:424 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:549 exit_mmap+0x4b2/0x9f0 mm/mmap.c:1328 __mmput+0x118/0x420 kernel/fork.c:1193 exit_mm+0x221/0x2d0 kernel/exit.c:617 do_exit+0x6cd/0x2360 kernel/exit.c:999 do_group_exit+0x22d/0x2f0 kernel/exit.c:1154 get_signal+0x121b/0x12c0 kernel/signal.c:3051 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_int80_emulation+0x314/0x500 arch/x86/entry/syscall_32.c:169 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf7fd50ec Code: Unable to access opcode bytes at 0xf7fd50c2. RSP: 002b:00000000f54965bc EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 RAX: fffffffffffffe00 RBX: 00000000f7494f88 RCX: 0000000000000080 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7494f8c RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: ff ljmp (bad) 1: e8 f0 c9 41 0a call 0xa41c9f6 6: f7 44 24 10 00 02 00 testl $0x200,0x10(%rsp) d: 00 e: 0f 84 38 ff ff ff je 0xffffff4c 14: 65 48 8b 05 42 b5 f1 mov %gs:0x11f1b542(%rip),%rax # 0x11f1b55e 1b: 11 1c: 48 3b 44 24 50 cmp 0x50(%rsp),%rax 21: 75 33 jne 0x56 23: fb sti 24: 48 83 c4 58 add $0x58,%rsp * 28: 5b pop %rbx <-- trapping instruction 29: 41 5c pop %r12 2b: 41 5d pop %r13 2d: 41 5e pop %r14 2f: 41 5f pop %r15 31: 5d pop %rbp 32: c3 ret 33: cc int3 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: 48 rex.W 39: 8d .byte 0x8d 3a: 3d .byte 0x3d 3b: 07 (bad) 3c: 3a da cmp %dl,%bl