BUG: sleeping function called from invalid context at kernel/workqueue.c:3414 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6439, name: syz.3.200 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by syz.3.200/6439: #0: ffff88803010cda0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:146 [inline] #0: ffff88803010cda0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x182/0xb90 mm/mmap.c:3287 #1: ffffc90000007be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:419 [inline] [] handle_softirqs+0x101/0x820 kernel/softirq.c:554 CPU: 0 PID: 6439 Comm: syz.3.200 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 start_flush_work kernel/workqueue.c:3414 [inline] __flush_work+0x10f/0xac0 kernel/workqueue.c:3474 __cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:694 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x570/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:arch_atomic_dec_and_test arch/x86/include/asm/atomic.h:67 [inline] RIP: 0010:raw_atomic_dec_and_test include/linux/atomic/atomic-arch-fallback.h:2257 [inline] RIP: 0010:atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1376 [inline] RIP: 0010:page_ref_dec_and_test include/linux/page_ref.h:210 [inline] RIP: 0010:put_page_testzero include/linux/mm.h:1111 [inline] RIP: 0010:folio_put_testzero include/linux/mm.h:1116 [inline] RIP: 0010:release_pages+0x33a/0x2300 mm/swap.c:992 Code: 00 44 8b 3b 31 ff 44 89 fe e8 c2 eb cb ff 45 85 ff 0f 84 bc 1d 00 00 48 89 df be 04 00 00 00 e8 0c cb 24 00 45 31 ff f0 ff 0b <0f> 94 c3 41 0f 94 c7 bf 02 00 00 00 44 89 fe e8 72 ea cb ff 31 ff RSP: 0018:ffffc9000c54f5a0 EFLAGS: 00000206 RAX: ffffffff81bba801 RBX: ffffea0001878174 RCX: ffffffff81bba8b4 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffea0001878174 RBP: ffffc9000c54f6c0 R08: ffffea0001878177 R09: 1ffffd400030f02e R10: dffffc0000000000 R11: fffff9400030f02f R12: 0000000000000d40 R13: 0000000000000000 R14: ffffea0001878140 R15: 0000000000000000 tlb_batch_pages_flush mm/mmu_gather.c:99 [inline] tlb_flush_mmu_free mm/mmu_gather.c:294 [inline] tlb_flush_mmu+0x379/0x510 mm/mmu_gather.c:301 zap_pte_range mm/memory.c:1532 [inline] zap_pmd_range mm/memory.c:1571 [inline] zap_pud_range mm/memory.c:1600 [inline] zap_p4d_range mm/memory.c:1621 [inline] unmap_page_range+0x2929/0x32f0 mm/memory.c:1642 unmap_vmas+0x286/0x3f0 mm/memory.c:1732 exit_mmap+0x238/0xb90 mm/mmap.c:3302 __mmput+0x118/0x3a0 kernel/fork.c:1362 exit_mm+0x23f/0x340 kernel/exit.c:576 do_exit+0x909/0x2530 kernel/exit.c:877 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032 __do_sys_exit_group kernel/exit.c:1043 [inline] __se_sys_exit_group kernel/exit.c:1041 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1041 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f5b7bd9e559 Code: Unable to access opcode bytes at 0x7f5b7bd9e52f. RSP: 002b:00007ffdd592a528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b7bd9e559 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007ffdd592a58c R08: 0000000000000000 R09: 00000000000927c0 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000025 R13: 00000000000927c0 R14: 000000000001a961 R15: 00007ffdd592a5e0 ODEBUG: object ffffc900000079c0 is NOT on stack ffffc9000c548000, but annotated. ====================================================== ---------------- Code disassembly (best guess): 0: 00 44 8b 3b add %al,0x3b(%rbx,%rcx,4) 4: 31 ff xor %edi,%edi 6: 44 89 fe mov %r15d,%esi 9: e8 c2 eb cb ff call 0xffcbebd0 e: 45 85 ff test %r15d,%r15d 11: 0f 84 bc 1d 00 00 je 0x1dd3 17: 48 89 df mov %rbx,%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 0c cb 24 00 call 0x24cb30 24: 45 31 ff xor %r15d,%r15d 27: f0 ff 0b lock decl (%rbx) * 2a: 0f 94 c3 sete %bl <-- trapping instruction 2d: 41 0f 94 c7 sete %r15b 31: bf 02 00 00 00 mov $0x2,%edi 36: 44 89 fe mov %r15d,%esi 39: e8 72 ea cb ff call 0xffcbeab0 3e: 31 ff xor %edi,%edi