================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz.3.1015/7410 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff0000ce054660 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0xe4/0x1ec kernel/workqueue.c:3069 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5678 __flush_work+0x10c/0x1ec kernel/workqueue.c:3072 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 __mmc_stop_host drivers/mmc/core/core.c:2303 [inline] mmc_stop_host+0xd4/0x3b8 drivers/mmc/core/core.c:2308 mmc_remove_host+0x20/0x68 drivers/mmc/core/host.c:651 vub300_disconnect+0x120/0x278 drivers/mmc/host/vub300.c:2388 usb_unbind_interface+0x1a4/0x738 drivers/usb/core/driver.c:457 device_remove drivers/base/dd.c:549 [inline] __device_release_driver drivers/base/dd.c:1279 [inline] device_release_driver_internal+0x424/0x6e4 drivers/base/dd.c:1305 device_release_driver+0x28/0x38 drivers/base/dd.c:1328 bus_remove_device+0x294/0x384 drivers/base/bus.c:531 device_del+0x580/0x990 drivers/base/core.c:3900 usb_disable_device+0x33c/0x780 drivers/usb/core/message.c:1472 usb_disconnect+0x290/0x790 drivers/usb/core/hub.c:2319 hub_port_connect drivers/usb/core/hub.c:5366 [inline] hub_port_connect_change drivers/usb/core/hub.c:5662 [inline] port_event drivers/usb/core/hub.c:5822 [inline] hub_event+0x1640/0x3e74 drivers/usb/core/hub.c:5904 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292 process_scheduled_works kernel/workqueue.c:2355 [inline] worker_thread+0xafc/0xfe8 kernel/workqueue.c:2441 kthread+0x254/0x2e0 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850 irq event stamp: 31018 hardirqs last enabled at (31018): [] __cancel_work_timer+0x2bc/0x450 kernel/workqueue.c:3156 hardirqs last disabled at (31017): [] try_to_grab_pending+0xcc/0x658 kernel/workqueue.c:1267 softirqs last enabled at (24442): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (24442): [] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624 softirqs last disabled at (30953): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((work_completion)(&(&host->detect)->work)); lock((work_completion)(&(&host->detect)->work)); *** DEADLOCK *** 1 lock held by syz.3.1015/7410: #0: ffff800008007c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:41 [inline] #0: ffff800008007c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x96c kernel/time/timer.c:1691 stack backtrace: CPU: 0 PID: 7410 Comm: syz.3.1015 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 print_usage_bug+0x4c0/0x6dc kernel/locking/lockdep.c:3962 valid_state kernel/locking/lockdep.c:3974 [inline] mark_lock_irq+0x858/0xab8 kernel/locking/lockdep.c:-1 mark_lock+0x224/0x320 kernel/locking/lockdep.c:4633 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xa88/0x6634 kernel/locking/lockdep.c:5017 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5678 __flush_work+0x10c/0x1ec kernel/workqueue.c:3072 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 mmc_free_host+0x20/0x40 drivers/mmc/core/host.c:672 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 __might_resched+0x11c/0x4e0 kernel/sched/core.c:9934 __might_sleep+0x94/0x110 kernel/sched/core.c:9899 __might_fault+0x7c/0x124 mm/memory.c:5848 ____sys_recvmsg+0x464/0x754 net/socket.c:2759 ___sys_recvmsg net/socket.c:2780 [inline] do_recvmmsg+0x36c/0x9d8 net/socket.c:2874 __sys_recvmmsg net/socket.c:2953 [inline] __do_sys_recvmmsg net/socket.c:2976 [inline] __se_sys_recvmmsg net/socket.c:2969 [inline] __arm64_sys_recvmmsg+0x184/0x244 net/socket.c:2969 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 vkms_vblank_simulate: vblank timer overrun BUG: sleeping function called from invalid context at kernel/workqueue.c:3013 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 7410, name: syz.3.1015 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:434 [inline] [] handle_softirqs+0xe8/0xc90 kernel/softirq.c:572 CPU: 0 PID: 7410 Comm: syz.3.1015 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 __might_resched+0x354/0x4e0 kernel/sched/core.c:9970 __might_sleep+0x94/0x110 kernel/sched/core.c:9899 start_flush_work+0x44/0x7d0 kernel/workqueue.c:3013 __flush_work+0x130/0x1ec kernel/workqueue.c:3075 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:3304 mmc_free_host+0x20/0x40 drivers/mmc/core/host.c:672 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 __might_resched+0x11c/0x4e0 kernel/sched/core.c:9934 __might_sleep+0x94/0x110 kernel/sched/core.c:9899 __might_fault+0x7c/0x124 mm/memory.c:5848 ____sys_recvmsg+0x464/0x754 net/socket.c:2759 ___sys_recvmsg net/socket.c:2780 [inline] do_recvmmsg+0x36c/0x9d8 net/socket.c:2874 __sys_recvmmsg net/socket.c:2953 [inline] __do_sys_recvmmsg net/socket.c:2976 [inline] __se_sys_recvmmsg net/socket.c:2969 [inline] __arm64_sys_recvmmsg+0x184/0x244 net/socket.c:2969 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 vkms_vblank_simulate: vblank timer overrun ODEBUG: object 0000000034840ef9 is NOT on stack 000000009495c563, but annotated. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 7410 at lib/debugobjects.c:558 debug_object_is_on_stack lib/debugobjects.c:-1 [inline] WARNING: CPU: 0 PID: 7410 at lib/debugobjects.c:558 lookup_object_or_alloc lib/debugobjects.c:591 [inline] WARNING: CPU: 0 PID: 7410 at lib/debugobjects.c:558 __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 Modules linked in: CPU: 0 PID: 7410 Comm: syz.3.1015 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : debug_object_is_on_stack lib/debugobjects.c:-1 [inline] pc : lookup_object_or_alloc lib/debugobjects.c:591 [inline] pc : __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 lr : debug_object_is_on_stack lib/debugobjects.c:-1 [inline] lr : lookup_object_or_alloc lib/debugobjects.c:591 [inline] lr : __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 sp : ffff8000080078c0 x29: ffff8000080078c0 x28: dfff800000000000 x27: 0000000000000000 x26: ffff80001c942000 x25: ffff0000d849d420 x24: 0000000000000001 x23: ffff0000f619b930 x22: 0000000000000000 x21: ffff80001c80fce0 x20: ffff800011d2ea20 x19: ffff800008007960 x18: 0000000000000000 x17: 3336356335393439 x16: ffff800011bb65f8 x15: 206b63617473206e x14: 0000000000000001 x13: 1ffff00001000e80 x12: 0000000000000000 x11: ff008000083154bc x10: 0000000000000000 x9 : aa2e4b97013e8200 x8 : aa2e4b97013e8200 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800008007398 x4 : ffff8000154a4e80 x3 : ffff80000a92ec3c x2 : ffff00019f34cd10 x1 : 0000000000000101 x0 : 0000000000000050 Call trace: debug_object_is_on_stack lib/debugobjects.c:-1 [inline] lookup_object_or_alloc lib/debugobjects.c:591 [inline] __debug_object_init+0x36c/0x434 lib/debugobjects.c:672 debug_object_init_on_stack+0x20/0x2c lib/debugobjects.c:723 init_rcu_head_on_stack+0x18/0x24 kernel/rcu/update.c:447 __synchronize_srcu+0x1e4/0x304 kernel/rcu/srcutree.c:1241 synchronize_srcu+0x194/0x1ac kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x108/0x180 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:77 device_release+0x94/0x1b4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 put_device+0x28/0x40 drivers/base/core.c:3820 mmc_free_host+0x30/0x40 drivers/mmc/core/host.c:674 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 __might_resched+0x11c/0x4e0 kernel/sched/core.c:9934 __might_sleep+0x94/0x110 kernel/sched/core.c:9899 __might_fault+0x7c/0x124 mm/memory.c:5848 ____sys_recvmsg+0x464/0x754 net/socket.c:2759 ___sys_recvmsg net/socket.c:2780 [inline] do_recvmmsg+0x36c/0x9d8 net/socket.c:2874 __sys_recvmmsg net/socket.c:2953 [inline] __do_sys_recvmmsg net/socket.c:2976 [inline] __se_sys_recvmmsg net/socket.c:2969 [inline] __arm64_sys_recvmmsg+0x184/0x244 net/socket.c:2969 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 31018 hardirqs last enabled at (31018): [] __cancel_work_timer+0x2bc/0x450 kernel/workqueue.c:3156 hardirqs last disabled at (31017): [] try_to_grab_pending+0xcc/0x658 kernel/workqueue.c:1267 softirqs last enabled at (24442): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (24442): [] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624 softirqs last disabled at (30953): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- vkms_vblank_simulate: vblank timer overrun BUG: scheduling while atomic: syz.3.1015/7410/0x00000101 INFO: lockdep is turned off. Modules linked in: Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:434 [inline] [] handle_softirqs+0xe8/0xc90 kernel/softirq.c:572 CPU: 0 PID: 7410 Comm: syz.3.1015 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 __schedule_bug+0x124/0x1bc kernel/sched/core.c:5794 schedule_debug kernel/sched/core.c:5821 [inline] __schedule+0xe48/0x1a6c kernel/sched/core.c:6456 schedule+0xc4/0x170 kernel/sched/core.c:6639 schedule_timeout+0xc8/0x2f4 kernel/time/timer.c:2144 do_wait_for_common+0x28c/0x3ec kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x44/0x5c kernel/sched/completion.c:138 __synchronize_srcu+0x26c/0x304 kernel/rcu/srcutree.c:1243 synchronize_srcu+0x194/0x1ac kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x108/0x180 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:77 device_release+0x94/0x1b4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 put_device+0x28/0x40 drivers/base/core.c:3820 mmc_free_host+0x30/0x40 drivers/mmc/core/host.c:674 vub300_delete drivers/mmc/host/vub300.c:378 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0x17c/0x3f8 drivers/mmc/host/vub300.c:746 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x478/0x6d8 kernel/time/timer.c:2023 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036 handle_softirqs+0x318/0xc90 kernel/softirq.c:596 __do_softirq+0x14/0x20 kernel/softirq.c:630 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:477 [inline] __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581 __might_resched+0x11c/0x4e0 kernel/sched/core.c:9934 __might_sleep+0x94/0x110 kernel/sched/core.c:9899 __might_fault+0x7c/0x124 mm/memory.c:5848 ____sys_recvmsg+0x464/0x754 net/socket.c:2759 ___sys_recvmsg net/socket.c:2780 [inline] do_recvmmsg+0x36c/0x9d8 net/socket.c:2874 __sys_recvmmsg net/socket.c:2953 [inline] __do_sys_recvmmsg net/socket.c:2976 [inline] __se_sys_recvmmsg net/socket.c:2969 [inline] __arm64_sys_recvmmsg+0x184/0x244 net/socket.c:2969 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585