================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. syz-executor/4187 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888077848710 ((work_completion)(&(&host->detect)->work)){+.?.}-{0:0}, at: __flush_work+0xfa/0x210 kernel/workqueue.c:3090 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 process_one_work+0x7ba/0xff0 kernel/workqueue.c:2286 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 irq event stamp: 3373644 hardirqs last enabled at (3373644): [] __cancel_work_timer+0x36a/0x560 kernel/workqueue.c:3174 hardirqs last disabled at (3373643): [] try_to_grab_pending+0xfb/0x820 kernel/workqueue.c:1272 softirqs last enabled at (3373288): [] local_bh_enable+0x5/0x20 include/linux/bottom_half.h:31 softirqs last disabled at (3373413): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last disabled at (3373413): [] invoke_softirq kernel/softirq.c:450 [inline] softirqs last disabled at (3373413): [] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((work_completion)(&(&host->detect)->work)); lock((work_completion)(&(&host->detect)->work)); *** DEADLOCK *** 3 locks held by syz-executor/4187: #0: ffff8880768bb4f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056 #1: ffff8880788d08b0 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: iterate_dir+0x10d/0x550 fs/readdir.c:55 #2: ffffc90000007bc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:45 [inline] #2: ffffc90000007bc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xca/0x540 kernel/time/timer.c:1638 stack backtrace: CPU: 0 PID: 4187 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 valid_state+0x13b/0x1d0 kernel/locking/lockdep.c:3932 mark_lock_irq+0xa9/0x900 kernel/locking/lockdep.c:4135 mark_lock+0x208/0x320 kernel/locking/lockdep.c:4591 mark_usage kernel/locking/lockdep.c:-1 [inline] __lock_acquire+0xc63/0x7b50 kernel/locking/lockdep.c:4966 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5625 __flush_work+0x116/0x210 kernel/workqueue.c:3090 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:663 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648 expire_timers kernel/time/timer.c:1699 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:1970 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0010:check_region_inline mm/kasan/generic.c:-1 [inline] RIP: 0010:kasan_check_range+0xe/0x290 mm/kasan/generic.c:189 Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 00 00 cc cc 00 00 cc cc 00 00 cc cc b0 01 48 85 f6 0f 84 ac 01 00 00 55 41 57 <41> 56 41 54 53 49 89 f8 49 01 f0 0f 82 0e 02 00 00 49 89 f8 49 c1 RSP: 0018:ffffc90002ecfca0 EFLAGS: 00000202 RAX: ffffffff81cdd501 RBX: ffffc90002ecfe60 RCX: ffffffff81cdd600 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88801b5d3b80 RBP: dffffc0000000000 R08: 0000000000001098 R09: 000000000000000a R10: dffffc0000000000 R11: fffffbfff1b163de R12: ffff88801b5d3b80 R13: ffff8880608b3c58 R14: 000000000000000a R15: 0000000000000020 instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] test_ti_thread_flag include/linux/thread_info.h:118 [inline] test_tsk_thread_flag include/linux/sched.h:2009 [inline] signal_pending include/linux/sched/signal.h:374 [inline] filldir64+0x180/0x6e0 fs/readdir.c:327 dir_emit include/linux/fs.h:3747 [inline] dcache_readdir+0x3f1/0x7c0 fs/libfs.c:207 iterate_dir+0x213/0x550 fs/readdir.c:-1 __do_sys_getdents64 fs/readdir.c:369 [inline] __se_sys_getdents64+0xf2/0x270 fs/readdir.c:354 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f8331e12af3 Code: c7 c0 e8 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb 9e e8 81 9b fd ff 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 e8 ff ff ff f7 d8 RSP: 002b:00007ffd699ed758 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 RAX: ffffffffffffffda RBX: 000055556a6f1a00 RCX: 00007f8331e12af3 RDX: 0000000000008000 RSI: 000055556a6f1a30 RDI: 0000000000000003 RBP: 000055556a6f1a30 R08: 00007f833203ee20 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000293 R12: 000055556a6f1a04 R13: ffffffffffffffe8 R14: 0000000000000016 R15: 00007ffd699ee910 virtqueue callback for ffff888022cf6b00 (ffffffff85491a80) virtqueue callback for ffff888146f1aa00 (ffffffff8444ab50) virtqueue interrupt with no work for ffff888146f1a900 virtqueue interrupt with no work for ffff888146f1a800 BUG: sleeping function called from invalid context at kernel/workqueue.c:3031 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4187, name: syz-executor INFO: lockdep is turned off. Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:414 [inline] [] handle_softirqs+0xfd/0x830 kernel/softirq.c:552 CPU: 0 PID: 4187 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 ___might_sleep+0x493/0x610 kernel/sched/core.c:9658 start_flush_work+0x2e/0x830 kernel/workqueue.c:3031 __flush_work+0x148/0x210 kernel/workqueue.c:3093 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181 mmc_free_host+0x15/0x30 drivers/mmc/core/host.c:663 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648 expire_timers kernel/time/timer.c:1699 [inline] __run_timers+0x56c/0x810 kernel/time/timer.c:1970 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0010:check_region_inline mm/kasan/generic.c:-1 [inline] RIP: 0010:kasan_check_range+0xe/0x290 mm/kasan/generic.c:189 Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 00 00 cc cc 00 00 cc cc 00 00 cc cc b0 01 48 85 f6 0f 84 ac 01 00 00 55 41 57 <41> 56 41 54 53 49 89 f8 49 01 f0 0f 82 0e 02 00 00 49 89 f8 49 c1 RSP: 0018:ffffc90002ecfca0 EFLAGS: 00000202 RAX: ffffffff81cdd501 RBX: ffffc90002ecfe60 RCX: ffffffff81cdd600 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88801b5d3b80 RBP: dffffc0000000000 R08: 0000000000001098 R09: 000000000000000a R10: dffffc0000000000 R11: fffffbfff1b163de R12: ffff88801b5d3b80 R13: ffff8880608b3c58 R14: 000000000000000a R15: 0000000000000020 instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] test_ti_thread_flag include/linux/thread_info.h:118 [inline] test_tsk_thread_flag include/linux/sched.h:2009 [inline] signal_pending include/linux/sched/signal.h:374 [inline] filldir64+0x180/0x6e0 fs/readdir.c:327 dir_emit include/linux/fs.h:3747 [inline] dcache_readdir+0x3f1/0x7c0 fs/libfs.c:207 iterate_dir+0x213/0x550 fs/readdir.c:-1 __do_sys_getdents64 fs/readdir.c:369 [inline] __se_sys_getdents64+0xf2/0x270 fs/readdir.c:354 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f8331e12af3 Code: c7 c0 e8 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb 9e e8 81 9b fd ff 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 e8 ff ff ff f7 d8 RSP: 002b:00007ffd699ed758 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 RAX: ffffffffffffffda RBX: 000055556a6f1a00 RCX: 00007f8331e12af3 RDX: 0000000000008000 RSI: 000055556a6f1a30 RDI: 0000000000000003 RBP: 000055556a6f1a30 R08: 00007f833203ee20 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000293 R12: 000055556a6f1a04 R13: ffffffffffffffe8 R14: 0000000000000016 R15: 00007ffd699ee910 kobject: 'mmc0' (ffff888077848008): kobject_cleanup, parent 0000000000000000 kobject: 'mmc0' (ffff888077848008): calling ktype release BUG: scheduling while atomic: syz-executor/4187/0x00000101 INFO: lockdep is turned off. Modules linked in: Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:414 [inline] [] handle_softirqs+0xfd/0x830 kernel/softirq.c:552 ---------------- Code disassembly (best guess): 0: 0f 0b ud2 2: b8 ea ff ff ff mov $0xffffffea,%eax 7: c3 ret 8: 0f 0b ud2 a: b8 ea ff ff ff mov $0xffffffea,%eax f: c3 ret 10: 00 00 add %al,(%rax) 12: cc int3 13: cc int3 14: 00 00 add %al,(%rax) 16: cc int3 17: cc int3 18: 00 00 add %al,(%rax) 1a: cc int3 1b: cc int3 1c: b0 01 mov $0x1,%al 1e: 48 85 f6 test %rsi,%rsi 21: 0f 84 ac 01 00 00 je 0x1d3 27: 55 push %rbp 28: 41 57 push %r15 * 2a: 41 56 push %r14 <-- trapping instruction 2c: 41 54 push %r12 2e: 53 push %rbx 2f: 49 89 f8 mov %rdi,%r8 32: 49 01 f0 add %rsi,%r8 35: 0f 82 0e 02 00 00 jb 0x249 3b: 49 89 f8 mov %rdi,%r8 3e: 49 rex.WB 3f: c1 .byte 0xc1