================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz-executor/4332 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff0000f4f54660 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0xe4/0x1ec kernel/workqueue.c:3069 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790 process_one_work+0x710/0x13bc kernel/workqueue.c:2268 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 irq event stamp: 895574 hardirqs last enabled at (895574): [] __cancel_work_timer+0x2bc/0x450 kernel/workqueue.c:3156 hardirqs last disabled at (895573): [] try_to_grab_pending+0xcc/0x658 kernel/workqueue.c:1267 softirqs last enabled at (895310): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (895509): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((work_completion)(&(&host->detect)->work)); lock((work_completion)(&(&host->detect)->work)); *** DEADLOCK *** 1 lock held by syz-executor/4332: #0: ffff800008007c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:41 [inline] #0: ffff800008007c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x96c kernel/time/timer.c:1691 stack backtrace: CPU: 0 PID: 4332 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 print_usage_bug+0x4cc/0x6e8 kernel/locking/lockdep.c:4029 valid_state kernel/locking/lockdep.c:4041 [inline] mark_lock_irq+0x858/0xab8 kernel/locking/lockdep.c:-1 mark_lock+0x224/0x320 kernel/locking/lockdep.c:4706 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xc70/0x7280 kernel/locking/lockdep.c:5125 lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790 __flush_work+0x10c/0x1ec kernel/workqueue.c:3072 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 mmc_free_host+0x20/0x48 drivers/mmc/core/host.c:672 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:288 [inline] schedule_debug kernel/sched/core.c:5824 [inline] __schedule+0x1f0/0x1a6c kernel/sched/core.c:6456 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 local_daif_restore arch/arm64/include/asm/daifflags.h:117 [inline] do_notify_resume+0x110/0x2c84 arch/arm64/kernel/signal.c:1136 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_interrupt+0xc8/0x1bc arch/arm64/kernel/entry-common.c:719 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x18c/0x190 arch/arm64/kernel/entry.S:586 BUG: sleeping function called from invalid context at kernel/workqueue.c:3013 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4332, name: syz-executor preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] preempt_schedule_irq+0x7c/0x1ac kernel/sched/core.c:6873 CPU: 0 PID: 4332 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 __might_resched+0x354/0x4e0 kernel/sched/core.c:9970 __might_sleep+0x94/0x110 kernel/sched/core.c:9899 start_flush_work+0x44/0x7d0 kernel/workqueue.c:3013 __flush_work+0x130/0x1ec kernel/workqueue.c:3075 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 mmc_free_host+0x20/0x48 drivers/mmc/core/host.c:672 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:288 [inline] schedule_debug kernel/sched/core.c:5824 [inline] __schedule+0x1f0/0x1a6c kernel/sched/core.c:6456 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 local_daif_restore arch/arm64/include/asm/daifflags.h:117 [inline] do_notify_resume+0x110/0x2c84 arch/arm64/kernel/signal.c:1136 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_interrupt+0xc8/0x1bc arch/arm64/kernel/entry-common.c:719 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x18c/0x190 arch/arm64/kernel/entry.S:586 ODEBUG: object 00000000faf34574 is NOT on stack 000000007ca59159, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4332 at lib/debugobjects.c:558 debug_object_is_on_stack lib/debugobjects.c:-1 [inline] WARNING: CPU: 0 PID: 4332 at lib/debugobjects.c:558 lookup_object_or_alloc lib/debugobjects.c:591 [inline] WARNING: CPU: 0 PID: 4332 at lib/debugobjects.c:558 __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 Modules linked in: CPU: 0 PID: 4332 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : debug_object_is_on_stack lib/debugobjects.c:-1 [inline] pc : lookup_object_or_alloc lib/debugobjects.c:591 [inline] pc : __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 lr : debug_object_is_on_stack lib/debugobjects.c:-1 [inline] lr : lookup_object_or_alloc lib/debugobjects.c:591 [inline] lr : __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 sp : ffff8000080078c0 x29: ffff8000080078c0 x28: dfff800000000000 x27: 0000000000000000 x26: ffff80001d9c3000 x25: ffff0000d89e9c20 x24: 0000000000000001 x23: ffff0000cb17b770 x22: 0000000000000000 x21: ffff80001d8919e0 x20: ffff800011d3eac0 x19: ffff800008007960 x18: 1fffe00033c1877e x17: 3935313935616337 x16: ffff800011bcac18 x15: 206b63617473206e x14: 0000000000000001 x13: 1ffff00001000e80 x12: 0000000000000000 x11: ff008000083170c8 x10: 0000000000000000 x9 : 55064db11cdc6700 x8 : 55064db11cdc6700 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800008007398 x4 : ffff800016504f40 x3 : ffff80000a93497c x2 : ffff00019e0c3d10 x1 : 0000000000000102 x0 : 0000000000000050 Call trace: debug_object_is_on_stack lib/debugobjects.c:-1 [inline] lookup_object_or_alloc lib/debugobjects.c:591 [inline] __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 debug_object_init_on_stack+0x20/0x2c lib/debugobjects.c:723 init_rcu_head_on_stack+0x18/0x24 kernel/rcu/update.c:447 __synchronize_srcu+0x1e4/0x304 kernel/rcu/srcutree.c:1241 synchronize_srcu+0x194/0x1ac kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x108/0x180 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:77 device_release+0x94/0x1b4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 put_device+0x28/0x40 drivers/base/core.c:3820 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:675 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:288 [inline] schedule_debug kernel/sched/core.c:5824 [inline] __schedule+0x1f0/0x1a6c kernel/sched/core.c:6456 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 local_daif_restore arch/arm64/include/asm/daifflags.h:117 [inline] do_notify_resume+0x110/0x2c84 arch/arm64/kernel/signal.c:1136 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_interrupt+0xc8/0x1bc arch/arm64/kernel/entry-common.c:719 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x18c/0x190 arch/arm64/kernel/entry.S:586 irq event stamp: 895574 hardirqs last enabled at (895574): [] __cancel_work_timer+0x2bc/0x450 kernel/workqueue.c:3156 hardirqs last disabled at (895573): [] try_to_grab_pending+0xcc/0x658 kernel/workqueue.c:1267 softirqs last enabled at (895310): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (895509): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- BUG: scheduling while atomic: syz-executor/4332/0x00000102 INFO: lockdep is turned off. Modules linked in: Preemption disabled at: [] preempt_schedule_irq+0x7c/0x1ac kernel/sched/core.c:6873 CPU: 0 PID: 4332 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 __schedule_bug+0x124/0x1bc kernel/sched/core.c:5794 schedule_debug kernel/sched/core.c:5821 [inline] __schedule+0xe48/0x1a6c kernel/sched/core.c:6456 schedule+0xc4/0x170 kernel/sched/core.c:6639 schedule_timeout+0xc8/0x2f4 kernel/time/timer.c:2144 do_wait_for_common+0x28c/0x3ec kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x44/0x5c kernel/sched/completion.c:138 __synchronize_srcu+0x26c/0x304 kernel/rcu/srcutree.c:1243 synchronize_srcu+0x194/0x1ac kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x108/0x180 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:77 device_release+0x94/0x1b4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 put_device+0x28/0x40 drivers/base/core.c:3820 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:675 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 arch_local_irq_restore+0x8/0x10 arch/arm64/include/asm/irqflags.h:122 lock_is_held include/linux/lockdep.h:288 [inline] schedule_debug kernel/sched/core.c:5824 [inline] __schedule+0x1f0/0x1a6c kernel/sched/core.c:6456 preempt_schedule_irq+0x8c/0x1ac kernel/sched/core.c:6875 arm64_preempt_schedule_irq+0x44/0x54 arch/arm64/kernel/entry-common.c:265 __el1_irq arch/arm64/kernel/entry-common.c:474 [inline] el1_interrupt+0x3c/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 local_daif_restore arch/arm64/include/asm/daifflags.h:117 [inline] do_notify_resume+0x110/0x2c84 arch/arm64/kernel/signal.c:1136 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_interrupt+0xc8/0x1bc arch/arm64/kernel/entry-common.c:719 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x18c/0x190 arch/arm64/kernel/entry.S:586 ================================================================== BUG: KASAN: stack-out-of-bounds in kasan_save_stack+0x30/0x70 mm/kasan/common.c:43 Write of size 512 at addr ffff800008007890 by task kworker/0:8/7004 CPU: 0 PID: 7004 Comm: kworker/0:8 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: wg-crypt-wg1 wg_packet_decrypt_worker Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report+0xa8/0xfc mm/kasan/report.c:524 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x258/0x290 mm/kasan/generic.c:189 memset+0x40/0x70 mm/kasan/shadow.c:44 kasan_save_stack+0x30/0x70 mm/kasan/common.c:43 __kasan_record_aux_stack+0xc0/0xdc mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496 insert_work+0x64/0x37c kernel/workqueue.c:1361 __queue_work+0xd00/0x1280 kernel/workqueue.c:1520 delayed_work_timer_fn+0x74/0x94 kernel/workqueue.c:1646 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1747 [inline] __run_timers+0x4d0/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 do_softirq+0xf8/0x1a0 kernel/softirq.c:497 __local_bh_enable_ip+0x250/0x37c kernel/softirq.c:421 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x48/0x58 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x250/0x9f4 drivers/net/wireguard/receive.c:499 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 The buggy address belongs to a 8-page vmalloc region starting at 0xffff800008000000 allocated at init_IRQ+0x14/0x24 arch/arm64/kernel/irq.c:124 The buggy address belongs to the physical page: page:00000000e4574460 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1001ce flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800008007780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff800008007800: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 >ffff800008007880: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff800008007900: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 ffff800008007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================