BUG: sleeping function called from invalid context at ker BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1127, name: kworker/1:2 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 locks held by kworker/1:2/1127: 6, last CPU#1: #0: ffff888102ebbd40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002bdfd18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88810ab451d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88810ab451d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4510 drivers/usb/core/hub.c:5912 #3: ffff888125a361d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888125a361d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073 #4: ffff888100e87180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x38/0xaa0 fs/kernfs/dir.c:825 #5: ffffc900001b8c98 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11d/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xf3/0x9b0 kernel/softirq.c:621 CPU: 1 UID: 0 PID: 1127 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1dc/0x222 kernel/sched/core.c:9256 __cancel_work_sync kernel/workqueue.c:4561 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4642 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:debug_lockdep_rcu_enabled+0x0/0x40 kernel/rcu/update.c:319 Code: 00 00 8b 44 24 04 eb b2 89 44 24 04 e8 29 fa ff ff 8b 44 24 04 eb aa 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 8b 05 ee 70 8d 03 85 c0 74 20 8b 05 80 7d 8d 03 85 c0 RSP: 0018:ffffc90002bdefa0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 1ffff9200057bdf5 RCX: 0000000000000001 RDX: 0000000000000046 RSI: ffffffff893088ad RDI: ffffffff87d2b780 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff87aa4760 R13: 000000000000065e R14: 0000000000000000 R15: ffff888100e87118 __might_resched+0x67/0x330 kernel/sched/core.c:9218 down_write+0x6a/0x1f0 kernel/locking/rwsem.c:1630 kernfs_add_one+0x4cb/0xaa0 fs/kernfs/dir.c:849 __kernfs_create_file+0x295/0x350 fs/kernfs/file.c:1079 sysfs_add_file_mode_ns+0x207/0x3c0 fs/sysfs/file.c:316 create_files fs/sysfs/group.c:82 [inline] internal_create_group+0x593/0xfb0 fs/sysfs/group.c:189 internal_create_groups+0x9d/0x150 fs/sysfs/group.c:229 device_add_groups drivers/base/core.c:2911 [inline] device_add_attrs drivers/base/core.c:2986 [inline] device_add+0x7c8/0x1970 drivers/base/core.c:3715 usb_create_ep_devs+0x160/0x2b0 drivers/usb/core/endpoint.c:162 create_intf_ep_devs.isra.0+0x161/0x200 drivers/usb/core/message.c:1312 usb_set_configuration+0xdb9/0x1c60 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3776 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ODEBUG: object ffffc900001b8a60 is NOT on stack ffffc90002bd8000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: kworker/1:2/1127 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705, CPU#1: kworker/1:2/1127 Modules linked in: CPU: 1 UID: 0 PID: 1127 Comm: kworker/1:2 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705 Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 83 c5 01 89 2d 60 bc 0e 13 4c 89 e6 48 c7 c7 c0 c2 d2 87 e8 61 c3 fa ff 90 <0f> 0b 90 e9 12 3b bb 01 83 c5 01 89 2d 3f bc 0e 13 49 39 c4 73 da RSP: 0018:ffffc900001b88f0 EFLAGS: 00010082 RAX: 0000000000000050 RBX: ffff888113ea59a0 RCX: 0000000000000000 RDX: 0000000000000050 RSI: ffffffff81938669 RDI: fffff5200003710f RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000101 R11: 0000000000000001 R12: ffffc900001b8a60 R13: ffff88810ebf9e40 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8882684e2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe37fd38060 CR3: 000000011ebde000 CR4: 00000000003506f0 Call Trace: lookup_object_or_alloc lib/debugobjects.c:682 [inline] __debug_object_init+0x2a9/0x3d0 lib/debugobjects.c:798 __synchronize_srcu+0x1c3/0x300 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1d9/0x9b0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0x168/0x210 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:debug_lockdep_rcu_enabled+0x0/0x40 kernel/rcu/update.c:319 Code: 00 00 8b 44 24 04 eb b2 89 44 24 04 e8 29 fa ff ff 8b 44 24 04 eb aa 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 8b 05 ee 70 8d 03 85 c0 74 20 8b 05 80 7d 8d 03 85 c0 RSP: 0018:ffffc90002bdefa0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 1ffff9200057bdf5 RCX: 0000000000000001 RDX: 0000000000000046 RSI: ffffffff893088ad RDI: ffffffff87d2b780 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff87aa4760 R13: 000000000000065e R14: 0000000000000000 R15: ffff888100e87118 __might_resched+0x67/0x330 kernel/sched/core.c:9218 down_write+0x6a/0x1f0 kernel/locking/rwsem.c:1630 kernfs_add_one+0x4cb/0xaa0 fs/kernfs/dir.c:849 __kernfs_create_file+0x295/0x350 fs/kernfs/file.c:1079 sysfs_add_file_mode_ns+0x207/0x3c0 fs/sysfs/file.c:316 create_files fs/sysfs/group.c:82 [inline] internal_create_group+0x593/0xfb0 fs/sysfs/group.c:189 internal_create_groups+0x9d/0x150 fs/sysfs/group.c:229 device_add_groups drivers/base/core.c:2911 [inline] device_add_attrs drivers/base/core.c:2986 [inline] device_add+0x7c8/0x1970 drivers/base/core.c:3715 usb_create_ep_devs+0x160/0x2b0 drivers/usb/core/endpoint.c:162 create_intf_ep_devs.isra.0+0x161/0x200 drivers/usb/core/message.c:1312 usb_set_configuration+0xdb9/0x1c60 drivers/usb/core/message.c:2274 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x210/0x460 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3776 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x69f/0xc90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 8b 44 24 04 mov 0x4(%rsp),%eax 6: eb b2 jmp 0xffffffba 8: 89 44 24 04 mov %eax,0x4(%rsp) c: e8 29 fa ff ff call 0xfffffa3a 11: 8b 44 24 04 mov 0x4(%rsp),%eax 15: eb aa jmp 0xffffffc1 17: 0f 1f 00 nopl (%rax) 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: 90 nop 23: 90 nop 24: 90 nop 25: 90 nop 26: 90 nop 27: 90 nop 28: 90 nop 29: 90 nop * 2a: f3 0f 1e fa endbr64 <-- trapping instruction 2e: 8b 05 ee 70 8d 03 mov 0x38d70ee(%rip),%eax # 0x38d7122 34: 85 c0 test %eax,%eax 36: 74 20 je 0x58 38: 8b 05 80 7d 8d 03 mov 0x38d7d80(%rip),%eax # 0x38d7dbe 3e: 85 c0 test %eax,%eax