BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by swapper/1/0: #0: ffff80008eb37c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xec/0xa4c kernel/time/timer.c:1745 Preemption disabled at: [] stack_depot_save_flags+0x1ec/0x6d8 lib/stackdepot.c:698 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 __might_resched+0x354/0x4c0 kernel/sched/core.c:9197 __might_sleep+0x84/0xdc kernel/sched/core.c:9126 __cancel_work_sync+0x78/0x144 kernel/workqueue.c:4487 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:4568 mmc_free_host+0x20/0x40 drivers/mmc/core/host.c:700 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x194/0xa4c kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:503 [inline] __irq_exit_rcu+0x1ac/0x428 kernel/softirq.c:735 irq_exit_rcu+0x14/0x84 kernel/softirq.c:752 __el1_irq arch/arm64/kernel/entry-common.c:510 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:522 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:527 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:590 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xd0/0xfc kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 secondary_start_kernel+0x1bc/0x1e0 arch/arm64/kernel/smp.c:273 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:401 ODEBUG: object 000000008802d113 is NOT on stack 000000005176cbeb, but annotated. ------------[ cut here ]------------ WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1, CPU#1: swapper/1/0 Modules linked in: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 lr : debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 sp : ffff80008eb37780 x29: ffff80008eb37780 x28: dfff800000000000 x27: ffff0000cf34fbe8 x26: 0000000000000002 x25: dfff800000000000 x24: 0000000000000000 x23: 0000000000000000 x22: ffff80008ea36000 x21: ffff0000c1a98020 x20: 0000000000000001 x19: ffff80008eb378e0 x18: 00000000ffffffff x17: 6265626336373135 x16: 3030303030303030 x15: 206b63617473206e x14: 6f20544f4e207369 x13: 0000000000000001 x12: ffff0000c1a98000 x11: 0000000000000000 x10: 0000000000000103 x9 : 8c19b933d1d94000 x8 : 8c19b933d1d94000 x7 : ffff80008048e080 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff800080498dbc x2 : 0000000000000102 x1 : ffff0000c1a98000 x0 : 0000000000000050 Call trace: debug_object_is_on_stack+0xb0/0xb8 lib/debugobjects.c:-1 (P) lookup_object_or_alloc+0xfc/0x188 lib/debugobjects.c:705 __debug_object_init+0x8c/0x1e0 lib/debugobjects.c:798 debug_object_init_on_stack+0x20/0x2c lib/debugobjects.c:849 init_rcu_head_on_stack+0x18/0x24 kernel/rcu/update.c:487 __synchronize_srcu+0x1ac/0x268 kernel/rcu/srcutree.c:1494 synchronize_srcu+0x41c/0x5d4 kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3880 mmc_free_host+0x30/0x40 drivers/mmc/core/host.c:702 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x194/0xa4c kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:503 [inline] __irq_exit_rcu+0x1ac/0x428 kernel/softirq.c:735 irq_exit_rcu+0x14/0x84 kernel/softirq.c:752 __el1_irq arch/arm64/kernel/entry-common.c:510 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:522 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:527 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:590 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xd0/0xfc kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 secondary_start_kernel+0x1bc/0x1e0 arch/arm64/kernel/smp.c:273 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:401 irq event stamp: 558141 hardirqs last enabled at (558140): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] hardirqs last enabled at (558140): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:198 hardirqs last disabled at (558141): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:130 [inline] hardirqs last disabled at (558141): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:166 softirqs last enabled at (557842): [] softirq_handle_end kernel/softirq.c:468 [inline] softirqs last enabled at (557842): [] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650 softirqs last disabled at (558023): [] __do_softirq+0x14/0x20 kernel/softirq.c:656 ---[ end trace 0000000000000000 ]--- BUG: BUG: scheduling while atomic: swapper/1/0/0x00000102 1 lock held by swapper/1/0: #0: ffff80008eb37c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xec/0xa4c kernel/time/timer.c:1745 Modules linked in: Preemption disabled at: [] stack_depot_save_flags+0x1ec/0x6d8 lib/stackdepot.c:698 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 __schedule_bug+0x10c/0x190 kernel/sched/core.c:6063 schedule_debug kernel/sched/core.c:6090 [inline] __schedule+0x1478/0x2d80 kernel/sched/core.c:7083 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_timeout+0xc0/0x28c kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common+0x220/0x394 kernel/sched/completion.c:132 wait_for_completion+0x18/0x24 kernel/sched/completion.c:153 __synchronize_srcu+0x1cc/0x268 kernel/rcu/srcutree.c:1496 synchronize_srcu+0x41c/0x5d4 kernel/rcu/srcutree.c:-1 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3880 mmc_free_host+0x30/0x40 drivers/mmc/core/host.c:702 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379 kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747 call_timer_fn+0x194/0xa4c kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x530/0x744 kernel/time/timer.c:2386 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 invoke_softirq kernel/softirq.c:503 [inline] __irq_exit_rcu+0x1ac/0x428 kernel/softirq.c:735 irq_exit_rcu+0x14/0x84 kernel/softirq.c:752 __el1_irq arch/arm64/kernel/entry-common.c:510 [inline] el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:522 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:527 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:590 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P) arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P) default_idle_call+0xd0/0xfc kernel/sched/idle.c:129 (P) cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x1ec/0x450 kernel/sched/idle.c:355 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:454 secondary_start_kernel+0x1bc/0x1e0 arch/arm64/kernel/smp.c:273 __secondary_switched+0xc0/0xc4 arch/arm64/kernel/head.S:401 ================================================================== BUG: KASAN: stack-out-of-bounds in stack_trace_consume_entry+0xe8/0x1d0 kernel/stacktrace.c:93 Write of size 8 at addr ffff80008eb378c0 by task swapper/1/0 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_store8_noabort+0x20/0x2c mm/kasan/report_generic.c:386 stack_trace_consume_entry+0xe8/0x1d0 kernel/stacktrace.c:93 arch_kunwind_consume_entry arch/arm64/kernel/stacktrace.c:378 [inline] do_kunwind arch/arm64/kernel/stacktrace.c:293 [inline] kunwind_stack_walk arch/arm64/kernel/stacktrace.c:366 [inline] arch_stack_walk+0x214/0x324 arch/arm64/kernel/stacktrace.c:390 stack_trace_save+0x9c/0xf0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kmem_cache_free+0x184/0x6b8 mm/slub.c:6504 kfree_skbmem+0x14c/0x1d8 net/core/skbuff.c:-1 __kfree_skb net/core/skbuff.c:1206 [inline] consume_skb+0x88/0xf4 net/core/skbuff.c:1439 mac80211_hwsim_tx_frame+0x1bc/0x1ec drivers/net/wireless/virtual/mac80211_hwsim_main.c:2418 __mac80211_hwsim_beacon_tx+0x1b8/0x2c8 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2442 mac80211_hwsim_beacon_tx+0x324/0x6c0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2493 __iterate_interfaces+0x234/0x4e0 net/mac80211/util.c:775 ieee80211_iterate_active_interfaces_atomic+0xf4/0x1ac net/mac80211/util.c:811 mac80211_hwsim_beacon+0xb4/0x1a4 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2525 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x314/0xbe0 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x15c/0x21c kernel/time/hrtimer.c:2113 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889 The buggy address belongs to a 8-page vmalloc region starting at 0xffff80008eb30000 allocated at init_IRQ+0x10/0x34 arch/arm64/kernel/irq.c:122 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1011df flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 fffffdffc30477c8 fffffdffc30477c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008eb37780: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 ffff80008eb37800: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80008eb37880: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 ^ ffff80008eb37900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80008eb37980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================