BUG: sleeping function called from invalid context at kernel/workqueue.c:3414 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6744, name: syz.3.219 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 2 locks held by syz.3.219/6744: #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: page_ext_get+0x22/0x2b0 mm/page_ext.c:508 #1: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:419 [inline] [] handle_softirqs+0x101/0x820 kernel/softirq.c:554 CPU: 1 PID: 6744 Comm: syz.3.219 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 start_flush_work kernel/workqueue.c:3414 [inline] __flush_work+0x10f/0xac0 kernel/workqueue.c:3474 __cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:694 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x570/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:should_resched arch/x86/include/asm/preempt.h:104 [inline] RIP: 0010:unwind_next_frame+0x1d22/0x2990 arch/x86/kernel/unwind_orc.c:672 Code: 0f 85 5b 01 00 00 e8 dd bf 4b 00 eb 0c e8 d6 bf 4b 00 eb 05 e8 cf bf 4b 00 bf 01 00 00 00 e8 a5 29 21 00 65 8b 1d 16 e7 c7 7e <31> ff 89 de e8 65 c3 4b 00 85 db 0f 84 df 02 00 00 e8 a8 bf 4b 00 RSP: 0018:ffffc90018d2ee58 EFLAGS: 00000297 RAX: 0000000080000001 RBX: 0000000080000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc90018d2f660 RDI: 00000000ffffffff RBP: 0000000000000001 R08: ffff88807aee9e00 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: ffffc90018d2f660 R13: ffffc90018d2ef28 R14: ffffc90018d2f7c0 R15: ffffc90018d2ef38 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122 save_stack+0x125/0x230 mm/page_owner.c:128 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149 reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1182 [inline] free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2505 release_pages+0x208a/0x2300 mm/swap.c:1022 __folio_batch_release+0x71/0xe0 mm/swap.c:1042 folio_batch_release include/linux/pagevec.h:83 [inline] shmem_undo_range+0x5ff/0x1a80 mm/shmem.c:1026 shmem_truncate_range mm/shmem.c:1135 [inline] shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264 evict+0x4b7/0x8a0 fs/inode.c:705 __dentry_kill+0x412/0x630 fs/dcache.c:611 dentry_kill+0xb8/0x290 fs/dcache.c:-1 dput+0xfe/0x1e0 fs/dcache.c:918 __fput+0x5b2/0x940 fs/file_table.c:426 task_work_run+0x1d4/0x260 kernel/task_work.c:245 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0x986/0x2530 kernel/exit.c:890 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032 get_signal+0x12a6/0x1390 kernel/signal.c:2915 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:318 exc_page_fault+0x8c/0x100 arch/x86/mm/fault.c:1519 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608 RIP: 0033:0x7fdd34f9e1a1 Code: Unable to access opcode bytes at 0x7fdd34f9e177. RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007fdd35226090 RCX: 00007fdd34f9e199 RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 RBP: 00007fdd350358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007fdd35226128 R14: 00007fdd35226090 R15: 00007ffcb3c29488 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W ----------------------------- kernel/rcu/srcutree.c:1377 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz.3.219/6744: #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: page_ext_get+0x22/0x2b0 mm/page_ext.c:508 #1: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698 stack backtrace: CPU: 1 PID: 6744 Comm: syz.3.219 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 lockdep_rcu_suspicious+0x1e1/0x300 kernel/locking/lockdep.c:6767 __synchronize_srcu+0x150/0x3d0 kernel/rcu/srcutree.c:1373 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x116/0x190 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:77 device_release+0xbc/0x1e0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x21b/0x450 lib/kobject.c:737 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x570/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:should_resched arch/x86/include/asm/preempt.h:104 [inline] RIP: 0010:unwind_next_frame+0x1d22/0x2990 arch/x86/kernel/unwind_orc.c:672 Code: 0f 85 5b 01 00 00 e8 dd bf 4b 00 eb 0c e8 d6 bf 4b 00 eb 05 e8 cf bf 4b 00 bf 01 00 00 00 e8 a5 29 21 00 65 8b 1d 16 e7 c7 7e <31> ff 89 de e8 65 c3 4b 00 85 db 0f 84 df 02 00 00 e8 a8 bf 4b 00 RSP: 0018:ffffc90018d2ee58 EFLAGS: 00000297 RAX: 0000000080000001 RBX: 0000000080000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc90018d2f660 RDI: 00000000ffffffff RBP: 0000000000000001 R08: ffff88807aee9e00 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: ffffc90018d2f660 R13: ffffc90018d2ef28 R14: ffffc90018d2f7c0 R15: ffffc90018d2ef38 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122 save_stack+0x125/0x230 mm/page_owner.c:128 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149 reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1182 [inline] free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2505 release_pages+0x208a/0x2300 mm/swap.c:1022 __folio_batch_release+0x71/0xe0 mm/swap.c:1042 folio_batch_release include/linux/pagevec.h:83 [inline] shmem_undo_range+0x5ff/0x1a80 mm/shmem.c:1026 shmem_truncate_range mm/shmem.c:1135 [inline] shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264 evict+0x4b7/0x8a0 fs/inode.c:705 __dentry_kill+0x412/0x630 fs/dcache.c:611 dentry_kill+0xb8/0x290 fs/dcache.c:-1 dput+0xfe/0x1e0 fs/dcache.c:918 __fput+0x5b2/0x940 fs/file_table.c:426 task_work_run+0x1d4/0x260 kernel/task_work.c:245 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0x986/0x2530 kernel/exit.c:890 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032 get_signal+0x12a6/0x1390 kernel/signal.c:2915 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:318 exc_page_fault+0x8c/0x100 arch/x86/mm/fault.c:1519 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608 RIP: 0033:0x7fdd34f9e1a1 Code: Unable to access opcode bytes at 0x7fdd34f9e177. RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007fdd35226090 RCX: 00007fdd34f9e199 RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 RBP: 00007fdd350358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007fdd35226128 R14: 00007fdd35226090 R15: 00007ffcb3c29488 BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1381 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6744, name: syz.3.219 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 2 locks held by syz.3.219/6744: #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: page_ext_get+0x22/0x2b0 mm/page_ext.c:508 #1: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:419 [inline] [] handle_softirqs+0x101/0x820 kernel/softirq.c:554 CPU: 1 PID: 6744 Comm: syz.3.219 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 __synchronize_srcu+0x197/0x3d0 kernel/rcu/srcutree.c:1381 wakeup_source_remove drivers/base/power/wakeup.c:198 [inline] wakeup_source_unregister+0x116/0x190 drivers/base/power/wakeup.c:242 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:77 device_release+0xbc/0x1e0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x21b/0x450 lib/kobject.c:737 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x570/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:should_resched arch/x86/include/asm/preempt.h:104 [inline] RIP: 0010:unwind_next_frame+0x1d22/0x2990 arch/x86/kernel/unwind_orc.c:672 Code: 0f 85 5b 01 00 00 e8 dd bf 4b 00 eb 0c e8 d6 bf 4b 00 eb 05 e8 cf bf 4b 00 bf 01 00 00 00 e8 a5 29 21 00 65 8b 1d 16 e7 c7 7e <31> ff 89 de e8 65 c3 4b 00 85 db 0f 84 df 02 00 00 e8 a8 bf 4b 00 RSP: 0018:ffffc90018d2ee58 EFLAGS: 00000297 RAX: 0000000080000001 RBX: 0000000080000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc90018d2f660 RDI: 00000000ffffffff RBP: 0000000000000001 R08: ffff88807aee9e00 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: ffffc90018d2f660 R13: ffffc90018d2ef28 R14: ffffc90018d2f7c0 R15: ffffc90018d2ef38 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122 save_stack+0x125/0x230 mm/page_owner.c:128 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149 reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1182 [inline] free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2505 release_pages+0x208a/0x2300 mm/swap.c:1022 __folio_batch_release+0x71/0xe0 mm/swap.c:1042 folio_batch_release include/linux/pagevec.h:83 [inline] shmem_undo_range+0x5ff/0x1a80 mm/shmem.c:1026 shmem_truncate_range mm/shmem.c:1135 [inline] shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264 evict+0x4b7/0x8a0 fs/inode.c:705 __dentry_kill+0x412/0x630 fs/dcache.c:611 dentry_kill+0xb8/0x290 fs/dcache.c:-1 dput+0xfe/0x1e0 fs/dcache.c:918 __fput+0x5b2/0x940 fs/file_table.c:426 task_work_run+0x1d4/0x260 kernel/task_work.c:245 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0x986/0x2530 kernel/exit.c:890 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032 get_signal+0x12a6/0x1390 kernel/signal.c:2915 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:318 exc_page_fault+0x8c/0x100 arch/x86/mm/fault.c:1519 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608 RIP: 0033:0x7fdd34f9e1a1 Code: Unable to access opcode bytes at 0x7fdd34f9e177. RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007fdd35226090 RCX: 00007fdd34f9e199 RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 RBP: 00007fdd350358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007fdd35226128 R14: 00007fdd35226090 R15: 00007ffcb3c29488 ODEBUG: object ffffc900001f09c0 is NOT on stack ffffc90018d28000, but annotated. ====================================================== ---------------- Code disassembly (best guess): 0: 0f 85 5b 01 00 00 jne 0x161 6: e8 dd bf 4b 00 call 0x4bbfe8 b: eb 0c jmp 0x19 d: e8 d6 bf 4b 00 call 0x4bbfe8 12: eb 05 jmp 0x19 14: e8 cf bf 4b 00 call 0x4bbfe8 19: bf 01 00 00 00 mov $0x1,%edi 1e: e8 a5 29 21 00 call 0x2129c8 23: 65 8b 1d 16 e7 c7 7e mov %gs:0x7ec7e716(%rip),%ebx # 0x7ec7e740 * 2a: 31 ff xor %edi,%edi <-- trapping instruction 2c: 89 de mov %ebx,%esi 2e: e8 65 c3 4b 00 call 0x4bc398 33: 85 db test %ebx,%ebx 35: 0f 84 df 02 00 00 je 0x31a 3b: e8 a8 bf 4b 00 call 0x4bbfe8