BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6300, name: syz.3.165 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by syz.3.165/6300: #0: ffffffff9002dec0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff9002dec0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x767/0xc00 net/core/rtnetlink.c:7082 #1: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:463 [inline] [] handle_softirqs+0xab/0x840 kernel/softirq.c:598 CPU: 0 UID: 0 PID: 6300 Comm: syz.3.165 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x378/0x4d0 kernel/sched/core.c:9197 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4487 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x225/0x840 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lockdep_unregister_key+0x2d5/0x350 kernel/locking/lockdep.c:6616 Code: 11 0c 09 00 89 c6 48 c7 c7 d0 99 75 96 e8 f3 fa 30 0a 90 e9 65 fe ff ff e8 38 2a 2e 0a 41 f7 c7 00 02 00 00 74 b3 fb 40 84 ed <75> b2 eb c3 90 0f 0b 90 e9 26 ff ff ff 90 0f 0b 90 e9 2e ff ff ff RSP: 0018:ffffc9000dc171a0 EFLAGS: 00000246 RAX: 0000000000000046 RBX: ffff88802b9f4268 RCX: 0000000000000046 RDX: ffffffff94311538 RSI: ffffffff8e249c31 RDI: ffffffff8c4bdd80 RBP: ffff888030f6be00 R08: ffffffff81b04d78 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000000 R13: ffff88802b9f4269 R14: 0000000000001000 R15: 0000000000000a87 qdisc_lock_uninit include/net/pkt_sched.h:332 [inline] __qdisc_destroy+0x1ab/0x470 net/sched/sch_generic.c:1124 qdisc_graft+0xe35/0x1600 net/sched/sch_api.c:1155 __tc_modify_qdisc net/sched/sch_api.c:1779 [inline] tc_modify_qdisc+0x1968/0x2390 net/sched/sch_api.c:1835 rtnetlink_rcv_msg+0x7b9/0xc00 net/core/rtnetlink.c:7085 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775 __sock_sendmsg net/socket.c:790 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2684 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2738 __sys_sendmsg+0x177/0x240 net/socket.c:2770 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x23e/0x6f0 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf6fdf0ec Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ODEBUG: object ffffc90000007a80 is NOT on stack ffffc9000dc10000, but annotated. ====================================================== ---------------- Code disassembly (best guess): 0: 11 0c 09 adc %ecx,(%rcx,%rcx,1) 3: 00 89 c6 48 c7 c7 add %cl,-0x3838b73a(%rcx) 9: d0 99 75 96 e8 f3 rcrb $1,-0xc17698b(%rcx) f: fa cli 10: 30 0a xor %cl,(%rdx) 12: 90 nop 13: e9 65 fe ff ff jmp 0xfffffe7d 18: e8 38 2a 2e 0a call 0xa2e2a55 1d: 41 f7 c7 00 02 00 00 test $0x200,%r15d 24: 74 b3 je 0xffffffd9 26: fb sti 27: 40 84 ed test %bpl,%bpl * 2a: 75 b2 jne 0xffffffde <-- trapping instruction 2c: eb c3 jmp 0xfffffff1 2e: 90 nop 2f: 0f 0b ud2 31: 90 nop 32: e9 26 ff ff ff jmp 0xffffff5d 37: 90 nop 38: 0f 0b ud2 3a: 90 nop 3b: e9 2e ff ff ff jmp 0xffffff6e