================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. sed/11796 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888053f68710 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0xfa/0x210 kernel/workqueue.c:3090 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 __flush_work+0x116/0x210 kernel/workqueue.c:3090 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 __mmc_stop_host drivers/mmc/core/core.c:2294 [inline] mmc_stop_host+0xd5/0x460 drivers/mmc/core/core.c:2299 mmc_remove_host+0x11/0x60 drivers/mmc/core/host.c:642 vub300_disconnect+0x14b/0x2e0 drivers/mmc/host/vub300.c:2388 usb_unbind_interface+0x203/0x870 drivers/usb/core/driver.c:458 __device_release_driver drivers/base/dd.c:1249 [inline] device_release_driver_internal+0x487/0x710 drivers/base/dd.c:1282 bus_remove_device+0x2dd/0x400 drivers/base/bus.c:531 device_del+0x63f/0xa80 drivers/base/core.c:3615 usb_disable_device+0x3e7/0x8a0 drivers/usb/core/message.c:1472 usb_disconnect+0x33c/0x8a0 drivers/usb/core/hub.c:2292 hub_port_connect drivers/usb/core/hub.c:5346 [inline] hub_port_connect_change drivers/usb/core/hub.c:5642 [inline] port_event drivers/usb/core/hub.c:5804 [inline] hub_event+0x1d64/0x5260 drivers/usb/core/hub.c:5886 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xd93/0x12a0 kernel/workqueue.c:2459 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 irq event stamp: 4166 hardirqs last enabled at (4166): [] __cancel_work_timer+0x36a/0x560 kernel/workqueue.c:3174 hardirqs last disabled at (4165): [] try_to_grab_pending+0xfb/0x820 kernel/workqueue.c:1272 softirqs last enabled at (3182): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last enabled at (3182): [] invoke_softirq kernel/softirq.c:450 [inline] softirqs last enabled at (3182): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 softirqs last disabled at (4067): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last disabled at (4067): [] invoke_softirq kernel/softirq.c:450 [inline] softirqs last disabled at (4067): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((work_completion)(&(&host->detect)->work)); lock((work_completion)(&(&host->detect)->work)); *** DEADLOCK *** 3 locks held by sed/11796: #0: ffff888077285528 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #0: ffff888077285528 (&mm->mmap_lock){++++}-{3:3}, at: do_mprotect_pkey+0x174/0x910 mm/mprotect.c:551 #1: ffff888025518648 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: i_mmap_lock_write include/linux/fs.h:508 [inline] #1: ffff888025518648 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: __vma_adjust+0x3f1/0x1e30 mm/mmap.c:855 #2: ffffc90000007bc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline] #2: ffffc90000007bc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1638 stack backtrace: CPU: 0 PID: 11796 Comm: sed Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3932 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4135 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4591 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xc63/0x7b50 kernel/locking/lockdep.c:4966 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 __flush_work+0x116/0x210 kernel/workqueue.c:3090 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:663 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648 expire_timers kernel/time/timer.c:1699 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:1970 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0010:vma_interval_tree_insert+0xf1/0x310 mm/interval_tree.c:24 Code: 01 00 00 48 89 6c 24 08 4c 89 2c 24 41 b6 01 4c 8d 7b 18 4d 89 fd 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df 41 80 7c 05 00 00 <74> 08 4c 89 ff e8 f5 d9 12 00 49 8b 2f 48 89 ef 4c 89 e6 e8 07 a8 RSP: 0018:ffffc90003467b38 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff888065ef6688 RCX: ffff888023271dc0 RDX: 0000000000000000 RSI: 000000000000000e RDI: 000000000000000e RBP: 0000000000000000 R08: ffff8880255185e7 R09: 1ffff11004aa30bc R10: dffffc0000000000 R11: ffffed1004aa30bd R12: 000000000000000e R13: 1ffff1100cbdecd4 R14: 1ffff11004aa3000 R15: ffff888065ef66a0 __vma_link_file mm/mmap.c:672 [inline] __vma_adjust+0x4d3/0x1e30 mm/mmap.c:863 vma_adjust include/linux/mm.h:2567 [inline] __split_vma+0x346/0x410 mm/mmap.c:-1 mprotect_fixup+0x5bb/0x800 mm/mprotect.c:483 do_mprotect_pkey+0x658/0x910 mm/mprotect.c:636 __do_sys_mprotect mm/mprotect.c:662 [inline] __se_sys_mprotect mm/mprotect.c:659 [inline] __x64_sys_mprotect+0x7c/0x90 mm/mprotect.c:659 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f1aacd0a2c7 Code: 89 3d fd 3f 01 00 eb 90 0f 1f 00 f7 d8 89 05 f0 3f 01 00 48 c7 c0 ff ff ff ff eb 91 0f 1f 80 00 00 00 00 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d c9 3f 01 00 f7 d8 89 01 48 83 RSP: 002b:00007fff85c20c98 EFLAGS: 00000206 ORIG_RAX: 000000000000000a RAX: ffffffffffffffda RBX: 00007f1aacce7580 RCX: 00007f1aacd0a2c7 RDX: 0000000000000001 RSI: 0000000000001000 RDI: 00007f1aaca28000 RBP: 00007fff85c20f60 R08: 0000000000000000 R09: 00007f1aaca7c2e0 R10: 00007f1aacce7580 R11: 0000000000000206 R12: 0000000000000020 R13: 00000115990371b2 R14: 0000000000000000 R15: 00007f1aacd1e310 vkms_vblank_simulate: vblank timer overrun virtqueue callback for ffff888022e06400 (ffffffff85491a80) virtqueue callback for ffff888146c57f00 (ffffffff8444ab50) virtqueue interrupt with no work for ffff888146c57e00 virtqueue interrupt with no work for ffff888146c57d00 BUG: sleeping function called from invalid context at kernel/workqueue.c:3031 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 11796, name: sed INFO: lockdep is turned off. Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:414 [inline] [] handle_softirqs+0xfd/0x830 kernel/softirq.c:552 CPU: 0 PID: 11796 Comm: sed Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 ___might_sleep+0x493/0x610 kernel/sched/core.c:9658 start_flush_work+0x2e/0x830 kernel/workqueue.c:3031 __flush_work+0x148/0x210 kernel/workqueue.c:3093 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:663 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648 expire_timers kernel/time/timer.c:1699 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:1970 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0010:vma_interval_tree_insert+0xf1/0x310 mm/interval_tree.c:24 Code: 01 00 00 48 89 6c 24 08 4c 89 2c 24 41 b6 01 4c 8d 7b 18 4d 89 fd 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df 41 80 7c 05 00 00 <74> 08 4c 89 ff e8 f5 d9 12 00 49 8b 2f 48 89 ef 4c 89 e6 e8 07 a8 RSP: 0018:ffffc90003467b38 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff888065ef6688 RCX: ffff888023271dc0 RDX: 0000000000000000 RSI: 000000000000000e RDI: 000000000000000e RBP: 0000000000000000 R08: ffff8880255185e7 R09: 1ffff11004aa30bc R10: dffffc0000000000 R11: ffffed1004aa30bd R12: 000000000000000e R13: 1ffff1100cbdecd4 R14: 1ffff11004aa3000 R15: ffff888065ef66a0 __vma_link_file mm/mmap.c:672 [inline] __vma_adjust+0x4d3/0x1e30 mm/mmap.c:863 vma_adjust include/linux/mm.h:2567 [inline] __split_vma+0x346/0x410 mm/mmap.c:-1 mprotect_fixup+0x5bb/0x800 mm/mprotect.c:483 do_mprotect_pkey+0x658/0x910 mm/mprotect.c:636 __do_sys_mprotect mm/mprotect.c:662 [inline] __se_sys_mprotect mm/mprotect.c:659 [inline] __x64_sys_mprotect+0x7c/0x90 mm/mprotect.c:659 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f1aacd0a2c7 Code: 89 3d fd 3f 01 00 eb 90 0f 1f 00 f7 d8 89 05 f0 3f 01 00 48 c7 c0 ff ff ff ff eb 91 0f 1f 80 00 00 00 00 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d c9 3f 01 00 f7 d8 89 01 48 83 RSP: 002b:00007fff85c20c98 EFLAGS: 00000206 ORIG_RAX: 000000000000000a RAX: ffffffffffffffda RBX: 00007f1aacce7580 RCX: 00007f1aacd0a2c7 RDX: 0000000000000001 RSI: 0000000000001000 RDI: 00007f1aaca28000 RBP: 00007fff85c20f60 R08: 0000000000000000 R09: 00007f1aaca7c2e0 R10: 00007f1aacce7580 R11: 0000000000000206 R12: 0000000000000020 R13: 00000115990371b2 R14: 0000000000000000 R15: 00007f1aacd1e310 vkms_vblank_simulate: vblank timer overrun kobject: 'mmc0' (ffff888053f68008): kobject_cleanup, parent 0000000000000000 kobject: 'mmc0' (ffff888053f68008): calling ktype release BUG: scheduling while atomic: sed/11796/0x00000101 INFO: lockdep is turned off. Modules linked in: Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:414 [inline] [] handle_softirqs+0xfd/0x830 kernel/softirq.c:552 ---------------- Code disassembly (best guess): 0: 01 00 add %eax,(%rax) 2: 00 48 89 add %cl,-0x77(%rax) 5: 6c insb (%dx),%es:(%rdi) 6: 24 08 and $0x8,%al 8: 4c 89 2c 24 mov %r13,(%rsp) c: 41 b6 01 mov $0x1,%r14b f: 4c 8d 7b 18 lea 0x18(%rbx),%r15 13: 4d 89 fd mov %r15,%r13 16: 49 c1 ed 03 shr $0x3,%r13 1a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 21: fc ff df 24: 41 80 7c 05 00 00 cmpb $0x0,0x0(%r13,%rax,1) * 2a: 74 08 je 0x34 <-- trapping instruction 2c: 4c 89 ff mov %r15,%rdi 2f: e8 f5 d9 12 00 call 0x12da29 34: 49 8b 2f mov (%r15),%rbp 37: 48 89 ef mov %rbp,%rdi 3a: 4c 89 e6 mov %r12,%rsi 3d: e8 .byte 0xe8 3e: 07 (bad) 3f: a8 .byte 0xa8