BUG: sleeping function called from invalid context at kernel/workqueue.c:3414 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 8195, name: syz.1.812 preempt_count: 101, expected: 0 RCU nest depth: 1, expected: 0 2 locks held by syz.1.812/8195: #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: bpf_test_timer_enter+0x1a/0x140 net/bpf/test_run.c:39 #1: ffffc900001f0c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698 Preemption disabled at: [] local_bh_disable include/linux/bottom_half.h:20 [inline] [] bpf_test_run+0x210/0x870 net/bpf/test_run.c:420 CPU: 1 PID: 8195 Comm: syz.1.812 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 start_flush_work kernel/workqueue.c:3414 [inline] __flush_work+0x10f/0xac0 kernel/workqueue.c:3474 __cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:694 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x570/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 do_softirq+0xfa/0x1a0 kernel/softirq.c:479 __local_bh_enable_ip+0x184/0x1c0 kernel/softirq.c:406 local_bh_enable include/linux/bottom_half.h:33 [inline] bpf_test_run+0x3dd/0x870 net/bpf/test_run.c:425 bpf_prog_test_run_skb+0xdbb/0x18f0 net/bpf/test_run.c:1089 bpf_prog_test_run+0x31f/0x390 kernel/bpf/syscall.c:4140 __sys_bpf+0x49d/0x890 kernel/bpf/syscall.c:5509 __do_sys_bpf kernel/bpf/syscall.c:5595 [inline] __se_sys_bpf kernel/bpf/syscall.c:5593 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5593 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f00cdd9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f00cebd6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f00ce025fa0 RCX: 00007f00cdd9e159 RDX: 000000000000002d RSI: 00002000000002c0 RDI: 000000000000000a RBP: 00007f00cde3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f00ce026038 R14: 00007f00ce025fa0 R15: 00007ffe572c0688 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1377 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz.1.812/8195: #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: bpf_test_timer_enter+0x1a/0x140 net/bpf/test_run.c:39 #1: ffffc900001f0c80 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698 stack backtrace: CPU: 1 PID: 8195 Comm: syz.1.812 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 lockdep_rcu_suspicious+0x1e1/0x300 kernel/locking/lockdep.c:6733 __synchronize_srcu+0x150/0x3d0 kernel/rcu/srcutree.c:1373 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x116/0x190 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:77 device_release+0xbc/0x1e0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x21b/0x450 lib/kobject.c:737 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x570/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 do_softirq+0xfa/0x1a0 kernel/softirq.c:479 __local_bh_enable_ip+0x184/0x1c0 kernel/softirq.c:406 local_bh_enable include/linux/bottom_half.h:33 [inline] bpf_test_run+0x3dd/0x870 net/bpf/test_run.c:425 bpf_prog_test_run_skb+0xdbb/0x18f0 net/bpf/test_run.c:1089 bpf_prog_test_run+0x31f/0x390 kernel/bpf/syscall.c:4140 __sys_bpf+0x49d/0x890 kernel/bpf/syscall.c:5509 __do_sys_bpf kernel/bpf/syscall.c:5595 [inline] __se_sys_bpf kernel/bpf/syscall.c:5593 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5593 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f00cdd9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f00cebd6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f00ce025fa0 RCX: 00007f00cdd9e159 RDX: 000000000000002d RSI: 00002000000002c0 RDI: 000000000000000a RBP: 00007f00cde3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f00ce026038 R14: 00007f00ce025fa0 R15: 00007ffe572c0688 ODEBUG: object ffffc900001f0a60 is NOT on stack ffffc9000b850000, but annotated. ======================================================