BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 13603, name: syz.0.2015 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 locks held by syz.0.2015/13603: 2, last CPU#0: #0: ffffffff91255e00 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline] #0: ffffffff91255e00 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3592 #1: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xab/0x860 kernel/softirq.c:621 CPU: 0 UID: 0 PID: 13603 Comm: syz.0.2015 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lockdep_unregister_key+0x2d4/0x350 kernel/locking/lockdep.c:6712 Code: e9 71 16 09 00 48 c7 c7 90 49 9c 97 89 c6 e8 b3 e8 47 0a e9 66 fe ff ff e8 f9 16 45 0a 41 f7 c7 00 02 00 00 74 b4 fb 40 84 ed <75> b3 eb c4 90 0f 0b 90 e9 27 ff ff ff 90 0f 0b 90 e9 2f ff ff ff RSP: 0018:ffffc90005967960 EFLAGS: 00000246 RAX: 0000000000000046 RBX: ffff88803f30c268 RCX: 0000000000000046 RDX: ffffffff9557c4f8 RSI: ffffffff8e4847e6 RDI: ffffffff8c6ddc80 RBP: ffff88802a569f00 R08: ffffffff81b10558 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff22f4eb0 R12: 0000000000000000 R13: ffff88803f30c269 R14: 0000000000001000 R15: 0000000000000a07 qdisc_lock_uninit include/net/pkt_sched.h:333 [inline] __qdisc_destroy+0x1ab/0x470 net/sched/sch_generic.c:1124 netdev_for_each_tx_queue include/linux/netdevice.h:2752 [inline] dev_shutdown+0x92/0x450 net/sched/sch_generic.c:1512 unregister_netdevice_many_notify+0x11f4/0x2140 net/core/dev.c:12551 unregister_netdevice_many net/core/dev.c:12635 [inline] unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12436 unregister_netdevice include/linux/netdevice.h:3490 [inline] __tun_detach+0x1074/0x1900 drivers/net/tun.c:637 tun_detach drivers/net/tun.c:653 [inline] tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3592 __fput+0x40d/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f227f39e559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f227f74fba8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f227f74fc90 RCX: 00007f227f39e559 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000080187 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32420000 R11: 0000000000000246 R12: 00007f227f74fcd0 R13: 00007f227f625fac R14: 00000000000801e9 R15: 00007f227f625fa0 ODEBUG: object ffffc90000007a80 is NOT on stack ffffc90005960000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#0: syz.0.2015/13603 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#0: syz.0.2015/13603 WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#0: syz.0.2015/13603 Modules linked in: CPU: 0 UID: 0 PID: 13603 Comm: syz.0.2015 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline] RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798 Code: cc cc cc 41 ff c7 44 89 3d c9 83 e7 16 48 c7 c1 80 e5 6d 8c 48 c7 c7 e0 e5 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 4d 6c 3b fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 21 82 6c 0b 3b 05 1f RSP: 0018:ffffc900000079b8 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc90000007a80 RCX: 3099cdbdaf346400 RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff88802a569f60 R08: 0000000000000100 R09: 1ffff110170848e2 R10: dffffc0000000000 R11: ffffed10170848e3 R12: 1ffff92000000f4c R13: ffff8880343c85e8 R14: dffffc0000000000 R15: 0000000000000001 FS: 000055558f4e6500(0000) GS:ffff888123abf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fefa45f7700 CR3: 00000000419a6000 CR4: 00000000003526f0 Call Trace: __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lockdep_unregister_key+0x2d4/0x350 kernel/locking/lockdep.c:6712 Code: e9 71 16 09 00 48 c7 c7 90 49 9c 97 89 c6 e8 b3 e8 47 0a e9 66 fe ff ff e8 f9 16 45 0a 41 f7 c7 00 02 00 00 74 b4 fb 40 84 ed <75> b3 eb c4 90 0f 0b 90 e9 27 ff ff ff 90 0f 0b 90 e9 2f ff ff ff RSP: 0018:ffffc90005967960 EFLAGS: 00000246 RAX: 0000000000000046 RBX: ffff88803f30c268 RCX: 0000000000000046 RDX: ffffffff9557c4f8 RSI: ffffffff8e4847e6 RDI: ffffffff8c6ddc80 RBP: ffff88802a569f00 R08: ffffffff81b10558 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff22f4eb0 R12: 0000000000000000 R13: ffff88803f30c269 R14: 0000000000001000 R15: 0000000000000a07 qdisc_lock_uninit include/net/pkt_sched.h:333 [inline] __qdisc_destroy+0x1ab/0x470 net/sched/sch_generic.c:1124 netdev_for_each_tx_queue include/linux/netdevice.h:2752 [inline] dev_shutdown+0x92/0x450 net/sched/sch_generic.c:1512 unregister_netdevice_many_notify+0x11f4/0x2140 net/core/dev.c:12551 unregister_netdevice_many net/core/dev.c:12635 [inline] unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12436 unregister_netdevice include/linux/netdevice.h:3490 [inline] __tun_detach+0x1074/0x1900 drivers/net/tun.c:637 tun_detach drivers/net/tun.c:653 [inline] tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3592 __fput+0x40d/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f227f39e559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f227f74fba8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f227f74fc90 RCX: 00007f227f39e559 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000080187 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32420000 R11: 0000000000000246 R12: 00007f227f74fcd0 R13: 00007f227f625fac R14: 00000000000801e9 R15: 00007f227f625fa0 ---------------- Code disassembly (best guess): 0: e9 71 16 09 00 jmp 0x91676 5: 48 c7 c7 90 49 9c 97 mov $0xffffffff979c4990,%rdi c: 89 c6 mov %eax,%esi e: e8 b3 e8 47 0a call 0xa47e8c6 13: e9 66 fe ff ff jmp 0xfffffe7e 18: e8 f9 16 45 0a call 0xa451716 1d: 41 f7 c7 00 02 00 00 test $0x200,%r15d 24: 74 b4 je 0xffffffda 26: fb sti 27: 40 84 ed test %bpl,%bpl * 2a: 75 b3 jne 0xffffffdf <-- trapping instruction 2c: eb c4 jmp 0xfffffff2 2e: 90 nop 2f: 0f 0b ud2 31: 90 nop 32: e9 27 ff ff ff jmp 0xffffff5e 37: 90 nop 38: 0f 0b ud2 3a: 90 nop 3b: e9 2f ff ff ff jmp 0xffffff6f