BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 12439, name: rm preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 3 locks held by rm/12439: #0: ffff8881533e03b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:536 [inline] #0: ffff8881533e03b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x22c/0xa00 mm/mmap.c:1308 #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline] #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495 #2: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:463 [inline] [] handle_softirqs+0xf0/0x9b0 kernel/softirq.c:598 CPU: 0 UID: 0 PID: 12439 Comm: rm Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9197 __cancel_work_sync kernel/workqueue.c:4487 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4568 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872 Code: 05 bb 8b 7e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 46 92 3c 0f 0f 82 ac 02 00 00 8b 35 0e c6 3c 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 5d 8b 7e 12 0f 85 ec 02 00 00 48 83 c4 RSP: 0018:ffffc90005c573c8 EFLAGS: 00000206 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8e1823aa RDI: ffffffff8c402680 RBP: ffffffff8ebe8200 R08: 000000000b2d5154 R09: 0000000000000007 R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:300 [inline] rcu_read_lock include/linux/rcupdate.h:840 [inline] class_rcu_constructor include/linux/rcupdate.h:1183 [inline] unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 __call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3159 slab_free_hook mm/slub.c:2641 [inline] slab_free mm/slub.c:6377 [inline] kmem_cache_free+0x43e/0x6b0 mm/slub.c:6504 tear_down_vmas+0x2a5/0x600 mm/mmap.c:1262 exit_mmap+0x469/0xa00 mm/mmap.c:1320 __mmput+0x12a/0x410 kernel/fork.c:1187 mmput+0x67/0x80 kernel/fork.c:1210 setup_new_exec+0x1d9/0x2a0 fs/exec.c:1353 load_elf_binary+0xa8f/0x51c0 fs/binfmt_elf.c:1024 search_binary_handler fs/exec.c:1694 [inline] exec_binprm fs/exec.c:1726 [inline] bprm_execve fs/exec.c:1778 [inline] bprm_execve+0x8fb/0x1730 fs/exec.c:1754 do_execveat_common.isra.0+0x4a5/0x580 fs/exec.c:1876 __do_sys_execve fs/exec.c:1949 [inline] __se_sys_execve fs/exec.c:1943 [inline] __x64_sys_execve+0x93/0xd0 fs/exec.c:1943 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f889c5b7107 Code: Unable to access opcode bytes at 0x7f889c5b70dd. RSP: 002b:00007ffdb0612ae8 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 0000563020d3eda0 RCX: 00007f889c5b7107 RDX: 0000563020d3edc0 RSI: 0000563020d3eda0 RDI: 0000563020d3ee48 RBP: 0000563020d3ee48 R08: 00007ffdb0615ea6 R09: 0000000000000000 R10: 0000000000000008 R11: 0000000000000246 R12: 0000563020d3edc0 R13: 00007f889c77ce8b R14: 0000563020d3edc0 R15: 0000000000000000 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1483 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by rm/12439: #0: ffff8881533e03b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:536 [inline] #0: ffff8881533e03b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x22c/0xa00 mm/mmap.c:1308 #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline] #1: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495 #2: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 stack backtrace: CPU: 0 UID: 0 PID: 12439 Comm: rm Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 lockdep_rcu_suspicious.cold+0x4f/0xb1 kernel/locking/lockdep.c:6876 __synchronize_srcu+0x29d/0x300 kernel/rcu/srcutree.c:1483 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2636 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3880 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872 Code: 05 bb 8b 7e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 46 92 3c 0f 0f 82 ac 02 00 00 8b 35 0e c6 3c 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 5d 8b 7e 12 0f 85 ec 02 00 00 48 83 c4 RSP: 0018:ffffc90005c573c8 EFLAGS: 00000206 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8e1823aa RDI: ffffffff8c402680 RBP: ffffffff8ebe8200 R08: 000000000b2d5154 R09: 0000000000000007 R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:300 [inline] rcu_read_lock include/linux/rcupdate.h:840 [inline] class_rcu_constructor include/linux/rcupdate.h:1183 [inline] unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 __call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3159 slab_free_hook mm/slub.c:2641 [inline] slab_free mm/slub.c:6377 [inline] kmem_cache_free+0x43e/0x6b0 mm/slub.c:6504 tear_down_vmas+0x2a5/0x600 mm/mmap.c:1262 exit_mmap+0x469/0xa00 mm/mmap.c:1320 __mmput+0x12a/0x410 kernel/fork.c:1187 mmput+0x67/0x80 kernel/fork.c:1210 setup_new_exec+0x1d9/0x2a0 fs/exec.c:1353 load_elf_binary+0xa8f/0x51c0 fs/binfmt_elf.c:1024 search_binary_handler fs/exec.c:1694 [inline] exec_binprm fs/exec.c:1726 [inline] bprm_execve fs/exec.c:1778 [inline] bprm_execve+0x8fb/0x1730 fs/exec.c:1754 do_execveat_common.isra.0+0x4a5/0x580 fs/exec.c:1876 __do_sys_execve fs/exec.c:1949 [inline] __se_sys_execve fs/exec.c:1943 [inline] __x64_sys_execve+0x93/0xd0 fs/exec.c:1943 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f889c5b7107 Code: Unable to access opcode bytes at 0x7f889c5b70dd. RSP: 002b:00007ffdb0612ae8 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 0000563020d3eda0 RCX: 00007f889c5b7107 RDX: 0000563020d3edc0 RSI: 0000563020d3eda0 RDI: 0000563020d3ee48 RBP: 0000563020d3ee48 R08: 00007ffdb0615ea6 R09: 0000000000000000 R10: 0000000000000008 R11: 0000000000000246 R12: 0000563020d3edc0 R13: 00007f889c77ce8b R14: 0000563020d3edc0 R15: 0000000000000000 ODEBUG: object ffffc90000007a70 is NOT on stack ffffc90005c50000, but annotated. ====================================================== ---------------- Code disassembly (best guess): 0: 05 bb 8b 7e 12 add $0x127e8bbb,%eax 5: 83 f8 07 cmp $0x7,%eax 8: 0f 87 da 00 00 00 ja 0xe8 e: 48 0f a3 05 46 92 3c bt %rax,0xf3c9246(%rip) # 0xf3c925c 15: 0f 16: 0f 82 ac 02 00 00 jb 0x2c8 1c: 8b 35 0e c6 3c 0f mov 0xf3cc60e(%rip),%esi # 0xf3cc630 22: 85 f6 test %esi,%esi 24: 0f 85 c7 00 00 00 jne 0xf1 * 2a: 48 8b 44 24 30 mov 0x30(%rsp),%rax <-- trapping instruction 2f: 65 48 2b 05 5d 8b 7e sub %gs:0x127e8b5d(%rip),%rax # 0x127e8b94 36: 12 37: 0f 85 ec 02 00 00 jne 0x329 3d: 48 rex.W 3e: 83 .byte 0x83 3f: c4 .byte 0xc4