BUG: sleeping function called from invalid context in __hid_request

Status: upstream: reported C repro on 2026/08/21 07:30
Subsystems: input
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+912222e4cb82423535fa@syzkaller.appspotmail.com
First crash: 4d15h, last: 7h35m
Cause bisection: failed (error log, bisect log)
  
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
9afb33fd assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ BUG: sleeping function called from invalid context in __hid_request 2026/08/18 01:23 2026/08/18 01:23 2026/08/18 01:59 1e72964b
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [input?] BUG: sleeping function called from invalid context in __hid_request 0 (1) 2026/08/21 07:30

Sample crash report:
rc_core: IR keymap rc-rc6-mce not found
Registered IR keymap rc-empty
rc rc0: syz0 as /devices/virtual/misc/uhid/0003:04D8:C002.0001/rc/rc0
input: syz0 as /devices/virtual/misc/uhid/0003:04D8:C002.0001/rc/rc0/input6
BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:323
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
4 locks held by kworker/0:0/9:
 #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900000e7c40 ((work_completion)(&uhid->worker)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900000e7c40 ((work_completion)(&uhid->worker)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88807116da58 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #2: ffff88807116da58 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073
 #3: ffff888012576970 (&data->lock){....}-{3:3}, at: picolcd_set_contrast+0x135/0x300 drivers/hid/hid-picolcd_lcd.c:36
irq event stamp: 884670
hardirqs last  enabled at (884669): [<ffffffff8234ac1b>] kasan_quarantine_put+0xbb/0x1f0 mm/kasan/quarantine.c:234
hardirqs last disabled at (884670): [<ffffffff8bd51daa>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:130 [inline]
hardirqs last disabled at (884670): [<ffffffff8bd51daa>] _raw_spin_lock_irqsave+0x1a/0x60 kernel/locking/spinlock.c:166
softirqs last  enabled at (884626): [<ffffffff89988079>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last  enabled at (884626): [<ffffffff89988079>] __alloc_skb+0x189/0x7a0 net/core/skbuff.c:697
softirqs last disabled at (884622): [<ffffffff89988079>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (884622): [<ffffffff89988079>] __alloc_skb+0x189/0x7a0 net/core/skbuff.c:697
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events uhid_device_add_worker
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x378/0x4d0 kernel/sched/core.c:9197
 might_alloc include/linux/sched/mm.h:323 [inline]
 slab_pre_alloc_hook mm/slub.c:4537 [inline]
 slab_alloc_node mm/slub.c:4897 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_noprof+0xef/0x720 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 hid_alloc_report_buf drivers/hid/hid-core.c:1917 [inline]
 __hid_request+0xb2/0x490 drivers/hid/hid-core.c:2007
 picolcd_set_contrast+0x208/0x300 drivers/hid/hid-picolcd_lcd.c:39
 picolcd_init_lcd+0x1f9/0x2f0 drivers/hid/hid-picolcd_lcd.c:70
 picolcd_probe_lcd drivers/hid/hid-picolcd_core.c:477 [inline]
 picolcd_probe+0xbb1/0x16c0 drivers/hid/hid-picolcd_core.c:580
 __hid_device_probe drivers/hid/hid-core.c:2829 [inline]
 hid_device_probe+0x42c/0x7c0 drivers/hid/hid-core.c:2866
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 hid_add_device+0x272/0x3e0 drivers/hid/hid-core.c:3010
 uhid_device_add_worker+0x43/0xf0 drivers/hid/uhid.c:73
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
hid-picolcd 0003:04D8:C002.0001: No report with id 0x94 found
hid-picolcd 0003:04D8:C002.0001: failed to configure display

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/17 08:18 upstream dcb68831eac7 746171ee .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: sleeping function called from invalid context in __hid_request
2026/08/21 15:22 upstream 7f063b2f17ea 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 BUG: sleeping function called from invalid context in __hid_request
2026/08/18 11:16 upstream ff68e5f557f6 1e72964b .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:53 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:53 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:44 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:44 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:33 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:31 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:27 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:27 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:30 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 BUG: sleeping function called from invalid context in __hid_request
2026/08/17 07:28 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 BUG: sleeping function called from invalid context in __hid_request
2026/08/17 09:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: sleeping function called from invalid context in __hid_request
2026/08/17 09:26 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: sleeping function called from invalid context in __hid_request
2026/08/17 08:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: sleeping function called from invalid context in __hid_request
2026/08/17 08:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 21d6ac051080 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: sleeping function called from invalid context in __hid_request
* Struck through repros no longer work on HEAD.