Extracting prog: 2m19.220202345s Minimizing prog: 13m44.098013106s Simplifying prog options: 0s Extracting C: 56.664413712s Simplifying C: 7m27.610671651s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f mm/pgtable-generic.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000600)={0x40}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f fs/eventpoll.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync simplifying C reproducer testing compiled C program (duration=52.759920558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program did not crash testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program did not crash testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync validation run: crashed=true testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync validation run: crashed=true testing program (duration=52.759920558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/mmc/core/host.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync validation run: crashed=true reproducing took 27m53.205847194s repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 locks held by swapper/0/0: 1, last CPU#0: #0: ffff80008f857c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745 Preemption disabled at: [] schedule_preempt_disabled+0x20/0x2c kernel/sched/core.c:7434 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 __might_resched+0x354/0x4c0 kernel/sched/core.c:9264 __might_sleep+0x84/0xdc kernel/sched/core.c:9193 __cancel_work_sync+0x78/0x144 kernel/workqueue.c:4561 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:4642 mmc_free_host+0x20/0x48 drivers/mmc/core/host.c:700 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x324/0xcbc kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 rest_init+0x390/0x3a8 init/main.c:732 start_kernel+0x374/0x3c0 init/main.c:1190 __primary_switched+0x8c/0x94 arch/arm64/kernel/head.S:245 ODEBUG: object 00000000b0f96439 is NOT on stack 00000000e11e96c7, but annotated. ------------[ cut here ]------------ WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1, CPU#0: swapper/0/0 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 lr : debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 sp : ffff80008f857780 x29: ffff80008f857780 x28: dfff800000000000 x27: 1fffe00019e26008 x26: 0000000000000000 x25: dfff800000000000 x24: 0000000000000000 x23: 0000000000000000 x22: ffff80008f768000 x21: ffff80008981c4e0 x20: 0000000000000001 x19: ffff80008f8578e0 x18: 00000000ffffffff x17: 3763363965313165 x16: 3030303030303030 x15: 206b63617473206e x14: 0000000000000826 x13: 0000000000000001 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000000103 x9 : 1d51c9665b4d4f00 x8 : 1d51c9665b4d4f00 x7 : ffff800080484084 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80008048eb84 x2 : 0000000100000102 x1 : ffff80008981c4c0 x0 : 0000000000000050 Call trace: debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 (P) lookup_object_or_alloc+0xfc/0x188 lib/debugobjects.c:705 __debug_object_init+0x8c/0x1e0 lib/debugobjects.c:798 debug_object_init_on_stack+0x20/0x2c lib/debugobjects.c:849 init_rcu_head_on_stack+0x18/0x24 kernel/rcu/update.c:487 __synchronize_srcu+0x1ac/0x268 kernel/rcu/srcutree.c:1475 synchronize_srcu+0x280/0x2e0 kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3884 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:703 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x324/0xcbc kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 rest_init+0x390/0x3a8 init/main.c:732 start_kernel+0x374/0x3c0 init/main.c:1190 __primary_switched+0x8c/0x94 arch/arm64/kernel/head.S:245 irq event stamp: 472973 hardirqs last enabled at (472972): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (472972): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (472973): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (472973): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:181 softirqs last enabled at (472850): [] softirq_handle_end kernel/softirq.c:491 [inline] softirqs last enabled at (472850): [] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673 softirqs last disabled at (472857): [] __do_softirq+0x14/0x20 kernel/softirq.c:679 ---[ end trace 0000000000000000 ]--- BUG: scheduling while atomic: swapper/0/0/0x00000102 locks held by swapper/0/0: 1, on CPU#0: #0: ffff80008f857c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745 Modules linked in: Preemption disabled at: [] schedule_preempt_disabled+0x20/0x2c kernel/sched/core.c:7434 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 __schedule_bug+0x10c/0x190 kernel/sched/core.c:6092 schedule_debug kernel/sched/core.c:6119 [inline] __schedule+0x1418/0x2b00 kernel/sched/core.c:7133 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7376 schedule_timeout+0xc0/0x28c kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common+0x220/0x394 kernel/sched/completion.c:132 wait_for_completion+0x18/0x24 kernel/sched/completion.c:153 __synchronize_srcu+0x1cc/0x268 kernel/rcu/srcutree.c:1477 synchronize_srcu+0x280/0x2e0 kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3884 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:703 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x324/0xcbc kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 rest_init+0x390/0x3a8 init/main.c:732 start_kernel+0x374/0x3c0 init/main.c:1190 __primary_switched+0x8c/0x94 arch/arm64/kernel/head.S:245 final repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 locks held by swapper/0/0: 1, last CPU#0: #0: ffff80008f857c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745 Preemption disabled at: [] schedule_preempt_disabled+0x20/0x2c kernel/sched/core.c:7434 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 __might_resched+0x354/0x4c0 kernel/sched/core.c:9264 __might_sleep+0x84/0xdc kernel/sched/core.c:9193 __cancel_work_sync+0x78/0x144 kernel/workqueue.c:4561 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:4642 mmc_free_host+0x20/0x48 drivers/mmc/core/host.c:700 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x324/0xcbc kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 rest_init+0x390/0x3a8 init/main.c:732 start_kernel+0x374/0x3c0 init/main.c:1190 __primary_switched+0x8c/0x94 arch/arm64/kernel/head.S:245 ODEBUG: object 00000000b0f96439 is NOT on stack 00000000e11e96c7, but annotated. ------------[ cut here ]------------ WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1, CPU#0: swapper/0/0 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 lr : debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 sp : ffff80008f857780 x29: ffff80008f857780 x28: dfff800000000000 x27: 1fffe00019e26008 x26: 0000000000000000 x25: dfff800000000000 x24: 0000000000000000 x23: 0000000000000000 x22: ffff80008f768000 x21: ffff80008981c4e0 x20: 0000000000000001 x19: ffff80008f8578e0 x18: 00000000ffffffff x17: 3763363965313165 x16: 3030303030303030 x15: 206b63617473206e x14: 0000000000000826 x13: 0000000000000001 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000000103 x9 : 1d51c9665b4d4f00 x8 : 1d51c9665b4d4f00 x7 : ffff800080484084 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80008048eb84 x2 : 0000000100000102 x1 : ffff80008981c4c0 x0 : 0000000000000050 Call trace: debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 (P) lookup_object_or_alloc+0xfc/0x188 lib/debugobjects.c:705 __debug_object_init+0x8c/0x1e0 lib/debugobjects.c:798 debug_object_init_on_stack+0x20/0x2c lib/debugobjects.c:849 init_rcu_head_on_stack+0x18/0x24 kernel/rcu/update.c:487 __synchronize_srcu+0x1ac/0x268 kernel/rcu/srcutree.c:1475 synchronize_srcu+0x280/0x2e0 kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3884 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:703 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x324/0xcbc kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 rest_init+0x390/0x3a8 init/main.c:732 start_kernel+0x374/0x3c0 init/main.c:1190 __primary_switched+0x8c/0x94 arch/arm64/kernel/head.S:245 irq event stamp: 472973 hardirqs last enabled at (472972): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (472972): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (472973): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (472973): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:181 softirqs last enabled at (472850): [] softirq_handle_end kernel/softirq.c:491 [inline] softirqs last enabled at (472850): [] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673 softirqs last disabled at (472857): [] __do_softirq+0x14/0x20 kernel/softirq.c:679 ---[ end trace 0000000000000000 ]--- BUG: scheduling while atomic: swapper/0/0/0x00000102 locks held by swapper/0/0: 1, on CPU#0: #0: ffff80008f857c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745 Modules linked in: Preemption disabled at: [] schedule_preempt_disabled+0x20/0x2c kernel/sched/core.c:7434 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 __schedule_bug+0x10c/0x190 kernel/sched/core.c:6092 schedule_debug kernel/sched/core.c:6119 [inline] __schedule+0x1418/0x2b00 kernel/sched/core.c:7133 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7376 schedule_timeout+0xc0/0x28c kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common+0x220/0x394 kernel/sched/completion.c:132 wait_for_completion+0x18/0x24 kernel/sched/completion.c:153 __synchronize_srcu+0x1cc/0x268 kernel/rcu/srcutree.c:1477 synchronize_srcu+0x280/0x2e0 kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3884 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:703 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x324/0xcbc kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:526 [inline] __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xa0/0xb8 kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 rest_init+0x390/0x3a8 init/main.c:732 start_kernel+0x374/0x3c0 init/main.c:1190 __primary_switched+0x8c/0x94 arch/arm64/kernel/head.S:245