BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1289, name: kworker/0:3 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 locks held by kworker/0:3/1289: 4, last CPU#0: #0: ffff888100069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002a7fd18 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x219/0x1a30 net/netfilter/nf_conntrack_core.c:1532 #3: ffffc90000007c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xf3/0x9b0 kernel/softirq.c:621 CPU: 0 UID: 0 PID: 1289 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: events_power_efficient gc_worker Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9264 __cancel_work_sync kernel/workqueue.c:4561 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4642 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:write_comp_data+0x47/0xa0 kernel/kcov.c:242 Code: 00 01 00 ff 74 1e f6 c4 01 74 68 a9 00 00 00 0f 75 61 f7 c2 00 00 00 f0 75 59 8b 87 64 16 00 00 85 c0 74 4f 8b 87 38 16 00 00 <83> f8 03 75 44 48 8b 87 40 16 00 00 8b bf 3c 16 00 00 48 8b 30 48 RSP: 0018:ffffc90002a7fb30 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8695e293 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888110378000 RBP: ffff888112800000 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000040000 R15: 000000000002a0a4 nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:351 [inline] gc_worker+0x303/0x1a30 net/netfilter/nf_conntrack_core.c:1534 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1464 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 locks held by kworker/0:3/1289: 4, last CPU#0: #0: ffff888100069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002a7fd18 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x219/0x1a30 net/netfilter/nf_conntrack_core.c:1532 #3: ffffc90000007c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 0 UID: 0 PID: 1289 Comm: kworker/0:3 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: events_power_efficient gc_worker Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 lockdep_rcu_suspicious.cold+0x4f/0xb2 kernel/locking/lockdep.c:6972 __synchronize_srcu+0x29d/0x300 kernel/rcu/srcutree.c:1464 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:write_comp_data+0x47/0xa0 kernel/kcov.c:242 Code: 00 01 00 ff 74 1e f6 c4 01 74 68 a9 00 00 00 0f 75 61 f7 c2 00 00 00 f0 75 59 8b 87 64 16 00 00 85 c0 74 4f 8b 87 38 16 00 00 <83> f8 03 75 44 48 8b 87 40 16 00 00 8b bf 3c 16 00 00 48 8b 30 48 RSP: 0018:ffffc90002a7fb30 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8695e293 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888110378000 RBP: ffff888112800000 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000040000 R15: 000000000002a0a4 nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:351 [inline] gc_worker+0x303/0x1a30 net/netfilter/nf_conntrack_core.c:1534 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1289, name: kworker/0:3 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 locks held by kworker/0:3/1289: 4, last CPU#0: #0: ffff888100069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002a7fd18 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff898e6f20 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x219/0x1a30 net/netfilter/nf_conntrack_core.c:1532 #3: ffffc90000007c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xf3/0x9b0 kernel/softirq.c:621 CPU: 0 UID: 0 PID: 1289 Comm: kworker/0:3 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: events_power_efficient gc_worker Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9264 __synchronize_srcu+0x13c/0x300 kernel/rcu/srcutree.c:1472 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:write_comp_data+0x47/0xa0 kernel/kcov.c:242 Code: 00 01 00 ff 74 1e f6 c4 01 74 68 a9 00 00 00 0f 75 61 f7 c2 00 00 00 f0 75 59 8b 87 64 16 00 00 85 c0 74 4f 8b 87 38 16 00 00 <83> f8 03 75 44 48 8b 87 40 16 00 00 8b bf 3c 16 00 00 48 8b 30 48 RSP: 0018:ffffc90002a7fb30 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8695e293 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888110378000 RBP: ffff888112800000 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000040000 R15: 000000000002a0a4 nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:351 [inline] gc_worker+0x303/0x1a30 net/netfilter/nf_conntrack_core.c:1534 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ODEBUG: object ffffc90000007a60 is NOT on stack ffffc90002a78000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#0: kworker/0:3/1289 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705, CPU#0: kworker/0:3/1289 Modules linked in: CPU: 0 UID: 0 PID: 1289 Comm: kworker/0:3 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: events_power_efficient gc_worker RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705 Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 83 c5 01 89 2d 60 8b 0f 13 4c 89 e6 48 c7 c7 c0 c8 d2 87 e8 21 c2 fa ff 90 <0f> 0b 90 e9 b2 e0 bb 01 83 c5 01 89 2d 3f 8b 0f 13 49 39 c4 73 da RSP: 0018:ffffc900000078f0 EFLAGS: 00010082 RAX: 0000000000000050 RBX: ffff888109322f88 RCX: 0000000000000000 RDX: 0000000000000050 RSI: ffffffff8193b6e9 RDI: fffff52000000f0f RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000101 R11: 0000000000000001 R12: ffffc90000007a60 R13: ffff888110378000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8882683d5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe8091a86c0 CR3: 0000000116ca8000 CR4: 00000000003506f0 Call Trace: lookup_object_or_alloc lib/debugobjects.c:682 [inline] __debug_object_init+0x2a9/0x3d0 lib/debugobjects.c:798 __synchronize_srcu+0x1c3/0x300 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:write_comp_data+0x47/0xa0 kernel/kcov.c:242 Code: 00 01 00 ff 74 1e f6 c4 01 74 68 a9 00 00 00 0f 75 61 f7 c2 00 00 00 f0 75 59 8b 87 64 16 00 00 85 c0 74 4f 8b 87 38 16 00 00 <83> f8 03 75 44 48 8b 87 40 16 00 00 8b bf 3c 16 00 00 48 8b 30 48 RSP: 0018:ffffc90002a7fb30 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8695e293 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888110378000 RBP: ffff888112800000 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000040000 R15: 000000000002a0a4 nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:351 [inline] gc_worker+0x303/0x1a30 net/netfilter/nf_conntrack_core.c:1534 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: 00 01 add %al,(%rcx) 2: 00 ff add %bh,%bh 4: 74 1e je 0x24 6: f6 c4 01 test $0x1,%ah 9: 74 68 je 0x73 b: a9 00 00 00 0f test $0xf000000,%eax 10: 75 61 jne 0x73 12: f7 c2 00 00 00 f0 test $0xf0000000,%edx 18: 75 59 jne 0x73 1a: 8b 87 64 16 00 00 mov 0x1664(%rdi),%eax 20: 85 c0 test %eax,%eax 22: 74 4f je 0x73 24: 8b 87 38 16 00 00 mov 0x1638(%rdi),%eax * 2a: 83 f8 03 cmp $0x3,%eax <-- trapping instruction 2d: 75 44 jne 0x73 2f: 48 8b 87 40 16 00 00 mov 0x1640(%rdi),%rax 36: 8b bf 3c 16 00 00 mov 0x163c(%rdi),%edi 3c: 48 8b 30 mov (%rax),%rsi 3f: 48 rex.W