BUG: sleeping function called from invalid context at kernel/workqueue.c:4552 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/2 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 locks held by swapper/2/0: 1, last CPU#2: #0: ffffc90000648c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] __pcs_replace_empty_main+0x1a2/0x680 mm/slub.c:4691 CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9234 __cancel_work_sync kernel/workqueue.c:4552 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4633 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x194/0x210 kernel/softirq.c:767 irq_exit_rcu+0x9/0x30 kernel/softirq.c:784 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: f8 a2 02 e9 43 4f 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 83 b0 24 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffc90000187e00 EFLAGS: 00000202 RAX: 000000000008481f RBX: ffff88801f2d4b00 RCX: ffffffff8bc6f115 RDX: 0000000000000001 RSI: ffffffff8e3d3fc0 RDI: ffffffff8c615f80 RBP: ffffed1003e5a960 R08: 0000000000000001 R09: ffffed100d4c678d R10: ffff88806a633c6b R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 1ffff92000030fc4 R15: dffffc0000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:768 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x158 ================================ WARNING: inconsistent lock state syzkaller #0 Tainted: G W -------------------------------- inconsistent {SOFTIRQ-ON-R} -> {IN-SOFTIRQ-W} usage. swapper/2/0 [HC0[0]:SC1[1]:HE1:SE0] takes: ffffffff8fe1a5d8 (wakeup_srcu){.+-+}-{0:0}, at: srcu_lock_sync include/linux/srcu.h:199 [inline] ffffffff8fe1a5d8 (wakeup_srcu){.+-+}-{0:0}, at: __synchronize_srcu+0x1c/0x300 kernel/rcu/srcutree.c:1481 {SOFTIRQ-ON-R} state was registered at: lock_acquire kernel/locking/lockdep.c:5886 [inline] lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5843 srcu_lock_acquire include/linux/srcu.h:187 [inline] srcu_read_lock include/linux/srcu.h:294 [inline] wakeup_sources_stats_seq_start+0x1bc/0x260 drivers/base/power/wakeup.c:1102 seq_read_iter+0x2c1/0x1270 fs/seq_file.c:226 seq_read+0x344/0x4d0 fs/seq_file.c:163 full_proxy_read+0x135/0x1a0 fs/debugfs/file.c:379 vfs_read+0x1e4/0xb40 fs/read_write.c:572 ksys_read+0x12a/0x250 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f irq event stamp: 542934 hardirqs last enabled at (542934): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (542934): [] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:221 hardirqs last disabled at (542933): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline] hardirqs last disabled at (542933): [] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:181 softirqs last enabled at (542722): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last enabled at (542722): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last enabled at (542722): [] __irq_exit_rcu+0x194/0x210 kernel/softirq.c:767 softirqs last disabled at (542753): [] __do_softirq kernel/softirq.c:679 [inline] softirqs last disabled at (542753): [] invoke_softirq kernel/softirq.c:519 [inline] softirqs last disabled at (542753): [] __irq_exit_rcu+0x194/0x210 kernel/softirq.c:767 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(wakeup_srcu); lock(wakeup_srcu); *** DEADLOCK *** locks held by swapper/2/0: 1, last CPU#2: #0: ffffc90000648c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_usage_bug.part.0+0x258/0x340 kernel/locking/lockdep.c:4058 print_usage_bug kernel/locking/lockdep.c:4026 [inline] valid_state kernel/locking/lockdep.c:4072 [inline] mark_lock_irq kernel/locking/lockdep.c:4289 [inline] mark_lock+0x8d5/0x1020 kernel/locking/lockdep.c:4769 mark_usage kernel/locking/lockdep.c:4658 [inline] __lock_acquire+0x6f6/0x1ec0 kernel/locking/lockdep.c:5207 lock_sync kernel/locking/lockdep.c:5934 [inline] lock_sync+0x9d/0x110 kernel/locking/lockdep.c:5922 srcu_lock_sync include/linux/srcu.h:199 [inline] __synchronize_srcu+0xa2/0x300 kernel/rcu/srcutree.c:1481 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x194/0x210 kernel/softirq.c:767 irq_exit_rcu+0x9/0x30 kernel/softirq.c:784 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: f8 a2 02 e9 43 4f 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 83 b0 24 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffc90000187e00 EFLAGS: 00000202 RAX: 000000000008481f RBX: ffff88801f2d4b00 RCX: ffffffff8bc6f115 RDX: 0000000000000001 RSI: ffffffff8e3d3fc0 RDI: ffffffff8c615f80 RBP: ffffed1003e5a960 R08: 0000000000000001 R09: ffffed100d4c678d R10: ffff88806a633c6b R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 1ffff92000030fc4 R15: dffffc0000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:768 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x158 ODEBUG: object ffffc90000648a60 is NOT on stack ffffc90000180000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#2: swapper/2/0 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705, CPU#2: swapper/2/0 Modules linked in: CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705 Code: 48 83 c4 60 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 83 c5 01 89 2d ca 7e 78 1a 4c 89 e6 48 c7 c7 c0 6a 61 8c e8 ab d3 eb ff 90 <0f> 0b 90 e9 1c ea f7 03 83 c5 01 89 2d a9 7e 78 1a 49 39 c4 73 da RSP: 0018:ffffc900006488f0 EFLAGS: 00010082 RAX: 0000000000000050 RBX: ffff8880573cbc40 RCX: 0000000000000000 RDX: 0000000000000050 RSI: ffffffff81e91639 RDI: fffff520000c910f RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000102 R11: 203a47554245444f R12: ffffc90000648a60 R13: ffff88801f2d4b00 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880d5da2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055da11e0db11 CR3: 000000002d8e9000 CR4: 0000000000352ef0 Call Trace: lookup_object_or_alloc lib/debugobjects.c:682 [inline] __debug_object_init+0x2a9/0x3d0 lib/debugobjects.c:798 __synchronize_srcu+0x1c3/0x300 kernel/rcu/srcutree.c:1494 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x194/0x210 kernel/softirq.c:767 irq_exit_rcu+0x9/0x30 kernel/softirq.c:784 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: f8 a2 02 e9 43 4f 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 83 b0 24 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0018:ffffc90000187e00 EFLAGS: 00000202 RAX: 000000000008481f RBX: ffff88801f2d4b00 RCX: ffffffff8bc6f115 RDX: 0000000000000001 RSI: ffffffff8e3d3fc0 RDI: ffffffff8c615f80 RBP: ffffed1003e5a960 R08: 0000000000000001 R09: ffffed100d4c678d R10: ffff88806a633c6b R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 1ffff92000030fc4 R15: dffffc0000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:768 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x158 ---------------- Code disassembly (best guess): 0: f8 clc 1: a2 02 e9 43 4f 03 00 movabs %al,0x1f0f00034f43e902 8: 0f 1f a: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax) 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: f3 0f 1e fa endbr64 1f: eb 07 jmp 0x28 21: 0f 00 2d 83 b0 24 00 verw 0x24b083(%rip) # 0x24b0ab 28: fb sti 29: f4 hlt * 2a: c3 ret <-- trapping instruction 2b: cc int3 2c: cc int3 2d: cc int3 2e: cc int3 2f: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 36: 00 00 00 39: 66 90 xchg %ax,%ax 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop