BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5870, name: syz.0.19 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by syz.0.19/5870: #0: ffff88802f38d038 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline] #0: ffff88802f38d038 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1284 #1: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:463 [inline] [] handle_softirqs+0xf0/0x9b0 kernel/softirq.c:598 CPU: 0 UID: 0 PID: 5870 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9197 __cancel_work_sync kernel/workqueue.c:4487 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4568 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__might_resched+0x122/0x330 kernel/sched/core.c:9199 Code: 00 00 8b 05 34 8a 4c 0f 83 e8 01 83 f8 02 76 25 48 b8 00 00 00 00 00 fc ff df 48 c7 04 03 00 00 00 00 48 83 c4 40 5b 5d 41 5c <41> 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 f6 73 9b 48 ba 00 00 RSP: 0018:ffffc90004eaf540 EFLAGS: 00000286 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff8e1822c3 RDI: ffff8880330eb070 RBP: 00007f0fbb5f9000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90004eaf6d0 R13: 00000000000007e7 R14: ffff8880330ea540 R15: 0000000000000000 zap_pmd_range mm/memory.c:2023 [inline] zap_pud_range mm/memory.c:2048 [inline] zap_p4d_range mm/memory.c:2069 [inline] __zap_vma_range+0x17b1/0x4a30 mm/memory.c:2109 unmap_vmas+0x299/0x5f0 mm/memory.c:2178 exit_mmap+0x1ef/0xa00 mm/mmap.c:1300 __mmput+0x12a/0x410 kernel/fork.c:1187 mmput+0x67/0x80 kernel/fork.c:1210 exit_mm kernel/exit.c:615 [inline] do_exit+0x8b1/0x2ae0 kernel/exit.c:997 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152 get_signal+0x1ec7/0x21e0 kernel/signal.c:3046 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x139/0x6f0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0fbc39e019 Code: Unable to access opcode bytes at 0x7f0fbc39dfef. RSP: 002b:00007f0fbd2d60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f0fbc625fa8 RCX: 00007f0fbc39e019 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0fbc625fa8 RBP: 00007f0fbc625fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0fbc626038 R14: 00007ffed6234260 R15: 00007ffed6234348 ODEBUG: object ffffc90000007a70 is NOT on stack ffffc90004ea8000, but annotated. ====================================================== ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 8b 05 34 8a 4c 0f mov 0xf4c8a34(%rip),%eax # 0xf4c8a3c 8: 83 e8 01 sub $0x1,%eax b: 83 f8 02 cmp $0x2,%eax e: 76 25 jbe 0x35 10: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 17: fc ff df 1a: 48 c7 04 03 00 00 00 movq $0x0,(%rbx,%rax,1) 21: 00 22: 48 83 c4 40 add $0x40,%rsp 26: 5b pop %rbx 27: 5d pop %rbp 28: 41 5c pop %r12 * 2a: 41 5d pop %r13 <-- trapping instruction 2c: 41 5e pop %r14 2e: 41 5f pop %r15 30: c3 ret 31: cc int3 32: cc int3 33: cc int3 34: cc int3 35: 48 c7 c0 00 f6 73 9b mov $0xffffffff9b73f600,%rax 3c: 48 rex.W 3d: ba .byte 0xba