BUG: sleeping function called from invalid context at kernel/workqueue.c:3414
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 13101, name: syz.8.1620
preempt_count: 101, expected: 0
RCU nest depth: 0, expected: 0
2 locks held by syz.8.1620/13101:
#0: ffff888078633818 (&sb->s_type->i_lock_key){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#0: ffff888078633818 (&sb->s_type->i_lock_key){+.+.}-{2:2}, at: filemap_remove_folio+0xdb/0x2c0 mm/filemap.c:255
#1: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 13101 Comm: syz.8.1620 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
__might_resched+0x48d/0x5f0 kernel/sched/core.c:10212
start_flush_work kernel/workqueue.c:3414 [inline]
__flush_work+0x10f/0xac0 kernel/workqueue.c:3474
__cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562
mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:694
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x570/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:lock_acquire+0x208/0x420 kernel/locking/lockdep.c:5760
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc9000f5ff240 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 6f67f4e4b958f400
RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d3ba0
RBP: ffffc9000f5ff360 R08: dffffc0000000000 R09: 1ffffffff223d6a2
R10: dffffc0000000000 R11: fffffbfff223d6a3 R12: 1ffff92001ebfe54
R13: ffff888078633818 R14: 0000000000000246 R15: dffffc0000000000
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
filemap_remove_folio+0xdb/0x2c0 mm/filemap.c:255
truncate_inode_folio+0x5d/0x70 mm/truncate.c:195
shmem_undo_range+0x3f0/0x1a80 mm/shmem.c:1022
shmem_truncate_range mm/shmem.c:1135 [inline]
shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264
evict+0x4b7/0x8a0 fs/inode.c:705
__dentry_kill+0x412/0x630 fs/dcache.c:611
dentry_kill+0xb8/0x290 fs/dcache.c:-1
dput+0xfe/0x1e0 fs/dcache.c:918
__fput+0x5b2/0x940 fs/file_table.c:426
task_work_run+0x1d4/0x260 kernel/task_work.c:245
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0x986/0x2530 kernel/exit.c:890
do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
get_signal+0x12a6/0x1390 kernel/signal.c:2915
arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
__syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f172655e98e
Code: Unable to access opcode bytes at 0x7f172655e964.
RSP: 002b:00007f1727539da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: 0000000002a9f000 RBX: 00007f172753a6c0 RCX: 00007f172655e98e
RDX: 0000000004000000 RSI: 00007f171c3f7000 RDI: 0000000000000006
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 00007f1727539ee0 R14: 00007f1727539ea0 R15: 00007f171c3f7000
ODEBUG: object ffffc900001f09c0 is NOT on stack ffffc9000f5f8000, but annotated.
======================================================
----------------
Code disassembly (best guess):
0: f7 84 24 80 00 00 00 testl $0x200,0x80(%rsp)
7: 00 02 00 00
b: 43 c6 44 3c 04 f8 movb $0xf8,0x4(%r12,%r15,1)
11: 0f 85 f0 00 00 00 jne 0x107
17: 41 f7 c6 00 02 00 00 test $0x200,%r14d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp)
28: e0 45
* 2a: 4b c7 04 3c 00 00 00 movq $0x0,(%r12,%r15,1) <-- trapping instruction
31: 00
32: 43 c7 44 3c 08 00 00 movl $0x0,0x8(%r12,%r15,1)
39: 00 00
3b: 65 gs
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 04 25 add $0x25,%al