================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz-executor/4331 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff0000dc110660 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0xe4/0x1ec kernel/workqueue.c:3069 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676 __flush_work+0x10c/0x1ec kernel/workqueue.c:3072 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 __mmc_stop_host drivers/mmc/core/core.c:2303 [inline] mmc_stop_host+0xd4/0x3b8 drivers/mmc/core/core.c:2308 mmc_remove_host+0x20/0x68 drivers/mmc/core/host.c:651 vub300_disconnect+0x120/0x278 drivers/mmc/host/vub300.c:2388 usb_unbind_interface+0x1a4/0x738 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:549 [inline] __device_release_driver drivers/base/dd.c:1279 [inline] device_release_driver_internal+0x424/0x6e4 drivers/base/dd.c:1305 device_release_driver+0x28/0x38 drivers/base/dd.c:1328 bus_remove_device+0x294/0x384 drivers/base/bus.c:531 device_del+0x580/0x990 drivers/base/core.c:3900 usb_disable_device+0x33c/0x780 drivers/usb/core/message.c:1472 usb_disconnect+0x290/0x790 drivers/usb/core/hub.c:2319 hub_port_connect drivers/usb/core/hub.c:5366 [inline] hub_port_connect_change drivers/usb/core/hub.c:5662 [inline] port_event drivers/usb/core/hub.c:5822 [inline] hub_event+0x1640/0x3e74 drivers/usb/core/hub.c:5904 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 process_scheduled_works kernel/workqueue.c:2355 [inline] worker_thread+0xafc/0xfe8 kernel/workqueue.c:2441 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 irq event stamp: 227050 hardirqs last enabled at (227050): [] __cancel_work_timer+0x2bc/0x450 kernel/workqueue.c:3156 hardirqs last disabled at (227049): [] try_to_grab_pending+0xcc/0x658 kernel/workqueue.c:1267 softirqs last enabled at (226720): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (226985): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((work_completion)(&(&host->detect)->work)); lock((work_completion)(&(&host->detect)->work)); *** DEADLOCK *** 3 locks held by syz-executor/4331: #0: ffff0000d4945548 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #0: ffff0000d4945548 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:595 [inline] #0: ffff0000d4945548 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1552 [inline] #0: ffff0000d4945548 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x238/0x1208 kernel/fork.c:1601 #1: ffff0000db5c4348 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline] #1: ffff0000db5c4348 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap kernel/fork.c:604 [inline] #1: ffff0000db5c4348 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mm kernel/fork.c:1552 [inline] #1: ffff0000db5c4348 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x304/0x1208 kernel/fork.c:1601 #2: ffff800008007c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:41 [inline] #2: ffff800008007c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x96c kernel/time/timer.c:1691 stack backtrace: CPU: 0 PID: 4331 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 print_usage_bug+0x4c0/0x6dc kernel/locking/lockdep.c:3962 valid_state kernel/locking/lockdep.c:3974 [inline] mark_lock_irq+0x858/0xab8 kernel/locking/lockdep.c:-1 mark_lock+0x224/0x320 kernel/locking/lockdep.c:4633 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xa88/0x6634 kernel/locking/lockdep.c:5017 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676 __flush_work+0x10c/0x1ec kernel/workqueue.c:3072 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 mmc_free_host+0x20/0x40 drivers/mmc/core/host.c:672 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline] raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline] finish_lock_switch+0xb8/0x1c8 kernel/sched/core.c:5005 finish_task_switch+0x120/0x658 kernel/sched/core.c:5123 context_switch kernel/sched/core.c:5249 [inline] __schedule+0xdb8/0x1a6c kernel/sched/core.c:6563 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 dup_mmap kernel/fork.c:627 [inline] dup_mm kernel/fork.c:1552 [inline] copy_mm+0x6d8/0x1208 kernel/fork.c:1601 copy_process+0x16d8/0x38b4 kernel/fork.c:2358 kernel_clone+0x1ec/0x938 kernel/fork.c:2765 __do_sys_clone kernel/fork.c:2906 [inline] __se_sys_clone kernel/fork.c:2874 [inline] __arm64_sys_clone+0x15c/0x1c8 kernel/fork.c:2874 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 BUG: sleeping function called from invalid context at kernel/workqueue.c:3013 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4331, name: syz-executor preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] preempt_schedule_irq+0x7c/0x1ac kernel/sched/core.c:6873 CPU: 0 PID: 4331 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 __might_resched+0x354/0x4e0 kernel/sched/core.c:9970 __might_sleep+0x94/0x110 kernel/sched/core.c:9899 start_flush_work+0x44/0x7d0 kernel/workqueue.c:3013 __flush_work+0x130/0x1ec kernel/workqueue.c:3075 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 mmc_free_host+0x20/0x40 drivers/mmc/core/host.c:672 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline] raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline] finish_lock_switch+0xb8/0x1c8 kernel/sched/core.c:5005 finish_task_switch+0x120/0x658 kernel/sched/core.c:5123 context_switch kernel/sched/core.c:5249 [inline] __schedule+0xdb8/0x1a6c kernel/sched/core.c:6563 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 dup_mmap kernel/fork.c:627 [inline] dup_mm kernel/fork.c:1552 [inline] copy_mm+0x6d8/0x1208 kernel/fork.c:1601 copy_process+0x16d8/0x38b4 kernel/fork.c:2358 kernel_clone+0x1ec/0x938 kernel/fork.c:2765 __do_sys_clone kernel/fork.c:2906 [inline] __se_sys_clone kernel/fork.c:2874 [inline] __arm64_sys_clone+0x15c/0x1c8 kernel/fork.c:2874 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 ODEBUG: object 00000000b31a625b is NOT on stack 000000002f3cbfcd, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4331 at lib/debugobjects.c:558 debug_object_is_on_stack lib/debugobjects.c:-1 [inline] WARNING: CPU: 0 PID: 4331 at lib/debugobjects.c:558 lookup_object_or_alloc lib/debugobjects.c:591 [inline] WARNING: CPU: 0 PID: 4331 at lib/debugobjects.c:558 __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 Modules linked in: CPU: 0 PID: 4331 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : debug_object_is_on_stack lib/debugobjects.c:-1 [inline] pc : lookup_object_or_alloc lib/debugobjects.c:591 [inline] pc : __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 lr : debug_object_is_on_stack lib/debugobjects.c:-1 [inline] lr : lookup_object_or_alloc lib/debugobjects.c:591 [inline] lr : __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 sp : ffff8000080078c0 x29: ffff8000080078c0 x28: dfff800000000000 x27: 0000000000000000 x26: ffff80001c928000 x25: ffff0000df078020 x24: 0000000000000001 x23: ffff0000d2eb6700 x22: 0000000000000000 x21: ffff80001c7f5c60 x20: ffff800011d0ea20 x19: ffff800008007960 x18: 1fffe00033e6df7e x17: 6463666263336632 x16: ffff800011ba0e90 x15: 206b63617473206e x14: 0000000000000001 x13: 1ffff00001000e80 x12: 0000000000000000 x11: ff00800008315498 x10: 0000000000000000 x9 : 617a43f45a3b9900 x8 : 617a43f45a3b9900 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800008007398 x4 : ffff800015484e80 x3 : ffff80000a929b3c x2 : ffff00019f36fd10 x1 : 0000000000000102 x0 : 0000000000000050 Call trace: debug_object_is_on_stack lib/debugobjects.c:-1 [inline] lookup_object_or_alloc lib/debugobjects.c:591 [inline] __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 debug_object_init_on_stack+0x20/0x2c lib/debugobjects.c:723 init_rcu_head_on_stack+0x18/0x24 kernel/rcu/update.c:447 __synchronize_srcu+0x1e4/0x304 kernel/rcu/srcutree.c:1241 synchronize_srcu+0x194/0x1ac kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x108/0x180 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:77 device_release+0x94/0x1b4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 put_device+0x28/0x40 drivers/base/core.c:3820 mmc_free_host+0x30/0x40 drivers/mmc/core/host.c:674 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline] raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline] finish_lock_switch+0xb8/0x1c8 kernel/sched/core.c:5005 finish_task_switch+0x120/0x658 kernel/sched/core.c:5123 context_switch kernel/sched/core.c:5249 [inline] __schedule+0xdb8/0x1a6c kernel/sched/core.c:6563 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 dup_mmap kernel/fork.c:627 [inline] dup_mm kernel/fork.c:1552 [inline] copy_mm+0x6d8/0x1208 kernel/fork.c:1601 copy_process+0x16d8/0x38b4 kernel/fork.c:2358 kernel_clone+0x1ec/0x938 kernel/fork.c:2765 __do_sys_clone kernel/fork.c:2906 [inline] __se_sys_clone kernel/fork.c:2874 [inline] __arm64_sys_clone+0x15c/0x1c8 kernel/fork.c:2874 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 227050 hardirqs last enabled at (227050): [] __cancel_work_timer+0x2bc/0x450 kernel/workqueue.c:3156 hardirqs last disabled at (227049): [] try_to_grab_pending+0xcc/0x658 kernel/workqueue.c:1267 softirqs last enabled at (226720): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (226985): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- BUG: scheduling while atomic: syz-executor/4331/0x00000102 INFO: lockdep is turned off. Modules linked in: Preemption disabled at: [] preempt_schedule_irq+0x7c/0x1ac kernel/sched/core.c:6873 CPU: 0 PID: 4331 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 __schedule_bug+0x124/0x1bc kernel/sched/core.c:5794 schedule_debug kernel/sched/core.c:5821 [inline] __schedule+0xe48/0x1a6c kernel/sched/core.c:6456 schedule+0xc4/0x170 kernel/sched/core.c:6639 schedule_timeout+0xc8/0x2f4 kernel/time/timer.c:2144 do_wait_for_common+0x28c/0x3ec kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x44/0x5c kernel/sched/completion.c:138 __synchronize_srcu+0x26c/0x304 kernel/rcu/srcutree.c:1243 synchronize_srcu+0x194/0x1ac kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x108/0x180 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:77 device_release+0x94/0x1b4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 put_device+0x28/0x40 drivers/base/core.c:3820 mmc_free_host+0x30/0x40 drivers/mmc/core/host.c:674 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline] raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline] finish_lock_switch+0xb8/0x1c8 kernel/sched/core.c:5005 finish_task_switch+0x120/0x658 kernel/sched/core.c:5123 context_switch kernel/sched/core.c:5249 [inline] __schedule+0xdb8/0x1a6c kernel/sched/core.c:6563 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 dup_mmap kernel/fork.c:627 [inline] dup_mm kernel/fork.c:1552 [inline] copy_mm+0x6d8/0x1208 kernel/fork.c:1601 copy_process+0x16d8/0x38b4 kernel/fork.c:2358 kernel_clone+0x1ec/0x938 kernel/fork.c:2765 __do_sys_clone kernel/fork.c:2906 [inline] __se_sys_clone kernel/fork.c:2874 [inline] __arm64_sys_clone+0x15c/0x1c8 kernel/fork.c:2874 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 ================================================================== BUG: KASAN: stack-out-of-bounds in kasan_save_stack+0x30/0x70 mm/kasan/common.c:43 Write of size 512 at addr ffff800008007890 by task kworker/0:6/4381 CPU: 0 PID: 4381 Comm: kworker/0:6 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 Workqueue: rcu_gp srcu_invoke_callbacks Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report+0xa8/0xfc mm/kasan/report.c:524 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x258/0x290 mm/kasan/generic.c:189 memset+0x40/0x70 mm/kasan/shadow.c:44 kasan_save_stack+0x30/0x70 mm/kasan/common.c:43 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496 insert_work+0x64/0x37c kernel/workqueue.c:1361 __queue_work+0xd00/0x1280 kernel/workqueue.c:1520 delayed_work_timer_fn+0x74/0x94 kernel/workqueue.c:1646 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1747 [inline] __run_timers+0x4d0/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 do_softirq+0xf8/0x1a0 kernel/softirq.c:497 __local_bh_enable_ip+0x250/0x37c kernel/softirq.c:421 local_bh_enable+0x20/0x2c include/linux/bottom_half.h:33 srcu_invoke_callbacks+0x16c/0x374 kernel/rcu/srcutree.c:1597 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 The buggy address belongs to a 8-page vmalloc region starting at 0xffff800008000000 allocated at init_IRQ+0x14/0x24 arch/arm64/kernel/irq.c:124 The buggy address belongs to the physical page: page:00000000753c3f8a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1001ce flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800008007780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff800008007800: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 >ffff800008007880: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff800008007900: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 ffff800008007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================