BUG: sleeping function called from invalid context at kernel/workqueue.c:4487
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5628, name: udevd
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
6 locks held by udevd/5628:
 #0: ffff88807fed0450 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:494
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 fs/namei.c:5566
 #2: ffff888027f9bed8 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #2: ffff888027f9bed8 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: vfs_unlink+0xd5/0x6d0 fs/namei.c:5501
 #3: ffff88807f621ea0 (&simple_offset_lock_class){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
 #3: ffff88807f621ea0 (&simple_offset_lock_class){+.+.}-{3:3}, at: mtree_erase+0x121/0x1a0 lib/maple_tree.c:5925
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
 #5: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 UID: 0 PID: 5628 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x378/0x4d0 kernel/sched/core.c:9197
 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4487
 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700
 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:unwind_next_frame+0x46e/0x2550 arch/x86/kernel/unwind_orc.c:520
Code: d1 48 89 15 a4 0b fc 11 48 85 d2 0f 84 2e 02 00 00 48 8d 5a 04 48 89 54 24 18 4c 8d 6a 05 48 89 d8 48 c1 e8 03 42 0f b6 04 20 <84> c0 0f 85 b4 19 00 00 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0
RSP: 0018:ffffc9000391eba0 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: ffffffff9198b0ec RCX: ffffffff90e22b28
RDX: ffffffff9198b0e8 RSI: ffffffff9198b0e8 RDI: ffffffff8c4bdd20
RBP: ffffffff8bc905b1 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: dffffc0000000000
R13: ffffffff9198b0ed R14: ffffc9000391ec48 R15: ffffffff90e22b28
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 kmem_cache_alloc_from_sheaf_noprof+0x9b/0x1b0 mm/slub.c:5246
 mas_pop_node lib/maple_tree.c:1065 [inline]
 dst_setup+0x7e8/0x1160 lib/maple_tree.c:2350
 mas_wr_rebalance lib/maple_tree.c:3503 [inline]
 mas_wr_store_entry+0x1cc2/0x80c0 lib/maple_tree.c:3540
 mas_erase+0x6da/0x8b0 lib/maple_tree.c:5595
 mtree_erase+0x129/0x1a0 lib/maple_tree.c:5926
 simple_offset_remove+0x58/0x90 fs/libfs.c:332
 shmem_unlink+0x16d/0x250 mm/shmem.c:3923
 vfs_unlink+0x27b/0x6d0 fs/namei.c:5515
 filename_unlinkat+0x3cd/0x610 fs/namei.c:5585
 __do_sys_unlink fs/namei.c:5620 [inline]
 __se_sys_unlink+0x2e/0x140 fs/namei.c:5617
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f85a9715937
Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007ffdc6dd69f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85a9715937
RDX: 0000000000000000 RSI: 00000000000003e5 RDI: 00007ffdc6dd6a10
RBP: 0000560f9ee00e20 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000010 R11: 0000000000000246 R12: 00007ffdc6dd6a10
R13: 0000560f9ee15920 R14: 0000560f8c6db100 R15: 0000560f8c6db140
 </TASK>

=============================
WARNING: suspicious RCU usage
syzkaller #0 Tainted: G        W          
-----------------------------
kernel/rcu/srcutree.c:1487 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
6 locks held by udevd/5628:
 #0: ffff88807fed0450 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:494
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 fs/namei.c:5566
 #2: ffff888027f9bed8 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #2: ffff888027f9bed8 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: vfs_unlink+0xd5/0x6d0 fs/namei.c:5501
 #3: ffff88807f621ea0 (&simple_offset_lock_class){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
 #3: ffff88807f621ea0 (&simple_offset_lock_class){+.+.}-{3:3}, at: mtree_erase+0x121/0x1a0 lib/maple_tree.c:5925
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
 #5: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745

stack backtrace:
CPU: 1 UID: 0 PID: 5628 Comm: udevd Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876
 __synchronize_srcu+0x157/0x2f0 kernel/rcu/srcutree.c:1483
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237
 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x222/0x550 lib/kobject.c:737
 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:unwind_next_frame+0x46e/0x2550 arch/x86/kernel/unwind_orc.c:520
Code: d1 48 89 15 a4 0b fc 11 48 85 d2 0f 84 2e 02 00 00 48 8d 5a 04 48 89 54 24 18 4c 8d 6a 05 48 89 d8 48 c1 e8 03 42 0f b6 04 20 <84> c0 0f 85 b4 19 00 00 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0
RSP: 0018:ffffc9000391eba0 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: ffffffff9198b0ec RCX: ffffffff90e22b28
RDX: ffffffff9198b0e8 RSI: ffffffff9198b0e8 RDI: ffffffff8c4bdd20
RBP: ffffffff8bc905b1 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: dffffc0000000000
R13: ffffffff9198b0ed R14: ffffc9000391ec48 R15: ffffffff90e22b28
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 kmem_cache_alloc_from_sheaf_noprof+0x9b/0x1b0 mm/slub.c:5246
 mas_pop_node lib/maple_tree.c:1065 [inline]
 dst_setup+0x7e8/0x1160 lib/maple_tree.c:2350
 mas_wr_rebalance lib/maple_tree.c:3503 [inline]
 mas_wr_store_entry+0x1cc2/0x80c0 lib/maple_tree.c:3540
 mas_erase+0x6da/0x8b0 lib/maple_tree.c:5595
 mtree_erase+0x129/0x1a0 lib/maple_tree.c:5926
 simple_offset_remove+0x58/0x90 fs/libfs.c:332
 shmem_unlink+0x16d/0x250 mm/shmem.c:3923
 vfs_unlink+0x27b/0x6d0 fs/namei.c:5515
 filename_unlinkat+0x3cd/0x610 fs/namei.c:5585
 __do_sys_unlink fs/namei.c:5620 [inline]
 __se_sys_unlink+0x2e/0x140 fs/namei.c:5617
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f85a9715937
Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007ffdc6dd69f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85a9715937
RDX: 0000000000000000 RSI: 00000000000003e5 RDI: 00007ffdc6dd6a10
RBP: 0000560f9ee00e20 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000010 R11: 0000000000000246 R12: 00007ffdc6dd6a10
R13: 0000560f9ee15920 R14: 0000560f8c6db100 R15: 0000560f8c6db140
 </TASK>
BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1491
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5628, name: udevd
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
6 locks held by udevd/5628:
 #0: ffff88807fed0450 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:494
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline]
 #1: ffff88807f6220b0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2a7/0x610 fs/namei.c:5566
 #2: ffff888027f9bed8 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #2: ffff888027f9bed8 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: vfs_unlink+0xd5/0x6d0 fs/namei.c:5501
 #3: ffff88807f621ea0 (&simple_offset_lock_class){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]
 #3: ffff88807f621ea0 (&simple_offset_lock_class){+.+.}-{3:3}, at: mtree_erase+0x121/0x1a0 lib/maple_tree.c:5925
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
 #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
 #5: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 UID: 0 PID: 5628 Comm: udevd Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x378/0x4d0 kernel/sched/core.c:9197
 __synchronize_srcu+0x1a1/0x2f0 kernel/rcu/srcutree.c:1491
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237
 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x222/0x550 lib/kobject.c:737
 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:unwind_next_frame+0x46e/0x2550 arch/x86/kernel/unwind_orc.c:520
Code: d1 48 89 15 a4 0b fc 11 48 85 d2 0f 84 2e 02 00 00 48 8d 5a 04 48 89 54 24 18 4c 8d 6a 05 48 89 d8 48 c1 e8 03 42 0f b6 04 20 <84> c0 0f 85 b4 19 00 00 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0
RSP: 0018:ffffc9000391eba0 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: ffffffff9198b0ec RCX: ffffffff90e22b28
RDX: ffffffff9198b0e8 RSI: ffffffff9198b0e8 RDI: ffffffff8c4bdd20
RBP: ffffffff8bc905b1 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: dffffc0000000000
R13: ffffffff9198b0ed R14: ffffc9000391ec48 R15: ffffffff90e22b28
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 kmem_cache_alloc_from_sheaf_noprof+0x9b/0x1b0 mm/slub.c:5246
 mas_pop_node lib/maple_tree.c:1065 [inline]
 dst_setup+0x7e8/0x1160 lib/maple_tree.c:2350
 mas_wr_rebalance lib/maple_tree.c:3503 [inline]
 mas_wr_store_entry+0x1cc2/0x80c0 lib/maple_tree.c:3540
 mas_erase+0x6da/0x8b0 lib/maple_tree.c:5595
 mtree_erase+0x129/0x1a0 lib/maple_tree.c:5926
 simple_offset_remove+0x58/0x90 fs/libfs.c:332
 shmem_unlink+0x16d/0x250 mm/shmem.c:3923
 vfs_unlink+0x27b/0x6d0 fs/namei.c:5515
 filename_unlinkat+0x3cd/0x610 fs/namei.c:5585
 __do_sys_unlink fs/namei.c:5620 [inline]
 __se_sys_unlink+0x2e/0x140 fs/namei.c:5617
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f85a9715937
Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007ffdc6dd69f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85a9715937
RDX: 0000000000000000 RSI: 00000000000003e5 RDI: 00007ffdc6dd6a10
RBP: 0000560f9ee00e20 R08: 0000000000000000 R09: 0000000000000020
R10: 0000000000000010 R11: 0000000000000246 R12: 00007ffdc6dd6a10
R13: 0000560f9ee15920 R14: 0000560f8c6db100 R15: 0000560f8c6db140
 </TASK>
ODEBUG: object ffffc90000a08a80 is NOT on stack ffffc90003918000, but annotated.

======================================================
----------------
Code disassembly (best guess):
   0:	d1 48 89             	rorl   $1,-0x77(%rax)
   3:	15 a4 0b fc 11       	adc    $0x11fc0ba4,%eax
   8:	48 85 d2             	test   %rdx,%rdx
   b:	0f 84 2e 02 00 00    	je     0x23f
  11:	48 8d 5a 04          	lea    0x4(%rdx),%rbx
  15:	48 89 54 24 18       	mov    %rdx,0x18(%rsp)
  1a:	4c 8d 6a 05          	lea    0x5(%rdx),%r13
  1e:	48 89 d8             	mov    %rbx,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	0f 85 b4 19 00 00    	jne    0x19e6
  32:	4c 89 e8             	mov    %r13,%rax
  35:	48 c1 e8 03          	shr    $0x3,%rax
  39:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
  3e:	84 c0                	test   %al,%al