BUG: sleeping function called from invalid context at drivers/usb/core/urb.c:705
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2860, name: udevd
preempt_count: 100, expected: 0
RCU nest depth: 0, expected: 0
1 lock held by udevd/2860:
 #0: ffff8881170e1f68 (
&u->iolock
){+.+.}-{4:4}
, at: __unix_dgram_recvmsg+0x255/0xc30 net/unix/af_unix.c:2570
irq event stamp: 11159963
hardirqs last  enabled at (11159962): [<ffffffff876c80e2>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline]
hardirqs last  enabled at (11159962): [<ffffffff876c80e2>] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:194
hardirqs last disabled at (11159963): [<ffffffff876c7df2>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:130 [inline]
hardirqs last disabled at (11159963): [<ffffffff876c7df2>] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:162
softirqs last  enabled at (11159916): [<ffffffff8177002d>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last  enabled at (11159916): [<ffffffff8177002d>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last  enabled at (11159916): [<ffffffff8177002d>] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
softirqs last disabled at (11159959): [<ffffffff8177002d>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (11159959): [<ffffffff8177002d>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (11159959): [<ffffffff8177002d>] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
Preemption disabled at:
[<ffffffff8176f5d5>] softirq_handle_begin kernel/softirq.c:463 [inline]
[<ffffffff8176f5d5>] handle_softirqs+0xf5/0x9d0 kernel/softirq.c:598
CPU: 0 UID: 0 PID: 2860 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:8888
 usb_kill_urb+0x8e/0x320 drivers/usb/core/urb.c:705
 usb_tx_block+0x91/0x320 drivers/net/wireless/marvell/libertas/if_usb.c:429
 if_usb_send_fw_pkt.isra.0+0x2e4/0x550 drivers/net/wireless/marvell/libertas/if_usb.c:366
 if_usb_receive_fwload+0x5d3/0x780 drivers/net/wireless/marvell/libertas/if_usb.c:592
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
 __run_hrtimer kernel/time/hrtimer.c:1785 [inline]
 __hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866
 handle_softirqs+0x1de/0x9d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:map_id_range_up+0x85/0x3b0 kernel/user_namespace.c:387
Code: c7 40 04 00 04 f3 f3 65 48 8b 05 ce 8c 47 0b 48 89 44 24 78 31 c0 e8 fa 18 04 00 49 8d 7e 3c 48 89 f8 48 c1 e8 03 0f b6 14 28 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 96 02 00 00 48
RSP: 0018:ffffc90001a4f6b8 EFLAGS: 00000a07
RAX: 1ffffffff12b1eb7 RBX: 0000000000000001 RCX: ffffffff864a50de
RDX: 0000000000000000 RSI: ffffffff81ade346 RDI: ffffffff8958f5bc
RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc90001a4fe30 R14: ffffffff8958f580 R15: 0000000000000001
 map_id_up kernel/user_namespace.c:406 [inline]
 from_kuid kernel/user_namespace.c:444 [inline]
 from_kuid_munged+0x92/0x130 kernel/user_namespace.c:469
 __scm_recv_common.isra.0+0x2bf/0x520 net/core/scm.c:513
 scm_recv_unix+0x99/0x400 net/core/scm.c:541
 __unix_dgram_recvmsg+0x744/0xc30 net/unix/af_unix.c:2652
 unix_dgram_recvmsg+0xd0/0x110 net/unix/af_unix.c:2672
 sock_recvmsg_nosec net/socket.c:1078 [inline]
 sock_recvmsg+0x1a4/0x1f0 net/socket.c:1100
 ____sys_recvmsg+0x218/0x640 net/socket.c:2812
 ___sys_recvmsg+0x16a/0x1a0 net/socket.c:2854
 __sys_recvmsg+0x16d/0x220 net/socket.c:2887
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0x7b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe4aaead407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fffe2144480 EFLAGS: 00000202 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 00007fe4aadbf880 RCX: 00007fe4aaead407
RDX: 0000000000000040 RSI: 00007fffe21445a0 RDI: 0000000000000009
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 000055fa6409c100 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
BUG: scheduling while atomic: udevd/2860/0x00000101
1 lock held by udevd/2860:
 #0: ffff8881170e1f68 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x255/0xc30 net/unix/af_unix.c:2570
Modules linked in:
irq event stamp: 11159963
hardirqs last  enabled at (11159962): [<ffffffff876c80e2>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline]
hardirqs last  enabled at (11159962): [<ffffffff876c80e2>] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:194
hardirqs last disabled at (11159963): [<ffffffff876c7df2>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:130 [inline]
hardirqs last disabled at (11159963): [<ffffffff876c7df2>] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:162
softirqs last  enabled at (11159916): [<ffffffff8177002d>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last  enabled at (11159916): [<ffffffff8177002d>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last  enabled at (11159916): [<ffffffff8177002d>] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
softirqs last disabled at (11159959): [<ffffffff8177002d>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (11159959): [<ffffffff8177002d>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (11159959): [<ffffffff8177002d>] __irq_exit_rcu+0xed/0x150 kernel/softirq.c:723
Preemption disabled at:
[<ffffffff8176f5d5>] softirq_handle_begin kernel/softirq.c:463 [inline]
[<ffffffff8176f5d5>] handle_softirqs+0xf5/0x9d0 kernel/softirq.c:598
----------------
Code disassembly (best guess):
   0:	c7 40 04 00 04 f3 f3 	movl   $0xf3f30400,0x4(%rax)
   7:	65 48 8b 05 ce 8c 47 	mov    %gs:0xb478cce(%rip),%rax        # 0xb478cdd
   e:	0b
   f:	48 89 44 24 78       	mov    %rax,0x78(%rsp)
  14:	31 c0                	xor    %eax,%eax
  16:	e8 fa 18 04 00       	call   0x41915
  1b:	49 8d 7e 3c          	lea    0x3c(%r14),%rdi
  1f:	48 89 f8             	mov    %rdi,%rax
  22:	48 c1 e8 03          	shr    $0x3,%rax
  26:	0f b6 14 28          	movzbl (%rax,%rbp,1),%edx
* 2a:	48 89 f8             	mov    %rdi,%rax <-- trapping instruction
  2d:	83 e0 07             	and    $0x7,%eax
  30:	83 c0 03             	add    $0x3,%eax
  33:	38 d0                	cmp    %dl,%al
  35:	7c 08                	jl     0x3f
  37:	84 d2                	test   %dl,%dl
  39:	0f 85 96 02 00 00    	jne    0x2d5
  3f:	48                   	rex.W