BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 24883, name: syz.4.5966 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 locks held by syz.4.5966/24883: 4, last CPU#0: #0: ffff8880344409a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff8880344409a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_wait_for_rcvmsg+0x342/0x640 net/tipc/socket.c:1853 #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:619 [inline] #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:441 [inline] #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 mm/mmap_lock.c:501 #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: mt_find+0x186/0x630 lib/maple_tree.c:6431 #3: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xab/0x860 kernel/softirq.c:621 CPU: 0 UID: 0 PID: 24883 Comm: syz.4.5966 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:check_kcov_mode kernel/kcov.c:181 [inline] RIP: 0010:write_comp_data kernel/kcov.c:242 [inline] RIP: 0010:__sanitizer_cov_trace_switch+0xa9/0x110 kernel/kcov.c:347 Code: db 81 e3 00 01 00 0f 81 fb 00 01 00 00 0f 95 c3 41 81 fb 00 00 00 10 41 0f 93 c3 41 08 db 75 bc 41 83 b8 44 17 00 00 00 74 b2 <45> 8b 98 18 17 00 00 41 83 fb 03 75 a5 4d 8b 98 20 17 00 00 45 8b RSP: 0018:ffffc9000396f1f8 EFLAGS: 00000246 RAX: 0000000000000005 RBX: dffffc0000000000 RCX: 0000000000000005 RDX: ffffffff8be0d4e5 RSI: ffffffff90603260 RDI: 0000000000000001 RBP: ffff88807b2d1a50 R08: ffff88807f7eddc0 R09: 0000000000000001 R10: 0000000000000001 R11: 8000000000000000 R12: 0000000000000001 R13: 0000200000ffffff R14: ffff88807b2d1a48 R15: 0000000000000009 ma_slots lib/maple_tree.c:646 [inline] mtree_range_walk+0x405/0x8b0 lib/maple_tree.c:2117 mas_state_walk lib/maple_tree.c:3013 [inline] mt_find+0x25f/0x630 lib/maple_tree.c:6433 find_vma+0xed/0x160 mm/mmap.c:923 lock_mm_and_find_vma+0x66/0x340 mm/mmap_lock.c:504 do_user_addr_fault+0x343/0x1340 arch/x86/mm/fault.c:1366 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:rep_movs_alternative+0x4a/0xa0 arch/x86/lib/copy_user_64.S:74 Code: 68 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f 68 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 RSP: 0018:ffffc9000396f698 EFLAGS: 00050206 RAX: ffffffff84dd2101 RBX: ffff888061d200e8 RCX: 00000000000027d0 RDX: 0000000000000000 RSI: ffff888061d2dae8 RDI: 0000200000a20000 RBP: ffffc9000396f818 R08: ffff888061d302b7 R09: 1ffff1100c3a6056 R10: dffffc0000000000 R11: ffffed100c3a6057 R12: 1ffff9200072dfc3 R13: 0000200000a12600 R14: ffffc9000396fe28 R15: 00000000000101d0 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] copy_to_user_iter lib/iov_iter.c:25 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0x255/0x1810 lib/iov_iter.c:197 copy_to_iter include/linux/uio.h:220 [inline] simple_copy_to_iter net/core/datagram.c:521 [inline] __skb_datagram_iter+0xf8/0x980 net/core/datagram.c:402 skb_copy_datagram_iter+0xb5/0x240 net/core/datagram.c:535 skb_copy_datagram_msg include/linux/skbuff.h:4256 [inline] tipc_recvstream+0x732/0xe90 net/tipc/socket.c:2072 sock_recvmsg_nosec net/socket.c:1151 [inline] sock_recvmsg+0x196/0x1e0 net/socket.c:1173 ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2933 ___sys_recvmsg+0x213/0x5a0 net/socket.c:2975 __sys_recvmsg net/socket.c:3008 [inline] __do_sys_recvmsg net/socket.c:3014 [inline] __se_sys_recvmsg net/socket.c:3011 [inline] __x64_sys_recvmsg+0x1ae/0x290 net/socket.c:3011 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efc6ad9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007efc6bc16028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007efc6b025fa0 RCX: 00007efc6ad9e159 RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000009 RBP: 00007efc6ae3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc6b026038 R14: 00007efc6b025fa0 R15: 00007efc6b14fa48 ============================= WARNING: suspicious RCU usage syzkaller #0 Tainted: G W L ----------------------------- kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 locks held by syz.4.5966/24883: 4, last CPU#0: #0: ffff8880344409a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff8880344409a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_wait_for_rcvmsg+0x342/0x640 net/tipc/socket.c:1853 #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:619 [inline] #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:441 [inline] #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 mm/mmap_lock.c:501 #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: mt_find+0x186/0x630 lib/maple_tree.c:6431 #3: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 stack backtrace: CPU: 0 UID: 0 PID: 24883 Comm: syz.4.5966 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972 __synchronize_srcu+0x157/0x2f0 kernel/rcu/srcutree.c:1464 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:check_kcov_mode kernel/kcov.c:181 [inline] RIP: 0010:write_comp_data kernel/kcov.c:242 [inline] RIP: 0010:__sanitizer_cov_trace_switch+0xa9/0x110 kernel/kcov.c:347 Code: db 81 e3 00 01 00 0f 81 fb 00 01 00 00 0f 95 c3 41 81 fb 00 00 00 10 41 0f 93 c3 41 08 db 75 bc 41 83 b8 44 17 00 00 00 74 b2 <45> 8b 98 18 17 00 00 41 83 fb 03 75 a5 4d 8b 98 20 17 00 00 45 8b RSP: 0018:ffffc9000396f1f8 EFLAGS: 00000246 RAX: 0000000000000005 RBX: dffffc0000000000 RCX: 0000000000000005 RDX: ffffffff8be0d4e5 RSI: ffffffff90603260 RDI: 0000000000000001 RBP: ffff88807b2d1a50 R08: ffff88807f7eddc0 R09: 0000000000000001 R10: 0000000000000001 R11: 8000000000000000 R12: 0000000000000001 R13: 0000200000ffffff R14: ffff88807b2d1a48 R15: 0000000000000009 ma_slots lib/maple_tree.c:646 [inline] mtree_range_walk+0x405/0x8b0 lib/maple_tree.c:2117 mas_state_walk lib/maple_tree.c:3013 [inline] mt_find+0x25f/0x630 lib/maple_tree.c:6433 find_vma+0xed/0x160 mm/mmap.c:923 lock_mm_and_find_vma+0x66/0x340 mm/mmap_lock.c:504 do_user_addr_fault+0x343/0x1340 arch/x86/mm/fault.c:1366 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:rep_movs_alternative+0x4a/0xa0 arch/x86/lib/copy_user_64.S:74 Code: 68 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f 68 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 RSP: 0018:ffffc9000396f698 EFLAGS: 00050206 RAX: ffffffff84dd2101 RBX: ffff888061d200e8 RCX: 00000000000027d0 RDX: 0000000000000000 RSI: ffff888061d2dae8 RDI: 0000200000a20000 RBP: ffffc9000396f818 R08: ffff888061d302b7 R09: 1ffff1100c3a6056 R10: dffffc0000000000 R11: ffffed100c3a6057 R12: 1ffff9200072dfc3 R13: 0000200000a12600 R14: ffffc9000396fe28 R15: 00000000000101d0 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] copy_to_user_iter lib/iov_iter.c:25 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0x255/0x1810 lib/iov_iter.c:197 copy_to_iter include/linux/uio.h:220 [inline] simple_copy_to_iter net/core/datagram.c:521 [inline] __skb_datagram_iter+0xf8/0x980 net/core/datagram.c:402 skb_copy_datagram_iter+0xb5/0x240 net/core/datagram.c:535 skb_copy_datagram_msg include/linux/skbuff.h:4256 [inline] tipc_recvstream+0x732/0xe90 net/tipc/socket.c:2072 sock_recvmsg_nosec net/socket.c:1151 [inline] sock_recvmsg+0x196/0x1e0 net/socket.c:1173 ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2933 ___sys_recvmsg+0x213/0x5a0 net/socket.c:2975 __sys_recvmsg net/socket.c:3008 [inline] __do_sys_recvmsg net/socket.c:3014 [inline] __se_sys_recvmsg net/socket.c:3011 [inline] __x64_sys_recvmsg+0x1ae/0x290 net/socket.c:3011 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efc6ad9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007efc6bc16028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007efc6b025fa0 RCX: 00007efc6ad9e159 RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000009 RBP: 00007efc6ae3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc6b026038 R14: 00007efc6b025fa0 R15: 00007efc6b14fa48 BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 24883, name: syz.4.5966 preempt_count: 100, expected: 0 RCU nest depth: 1, expected: 0 locks held by syz.4.5966/24883: 4, last CPU#0: #0: ffff8880344409a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff8880344409a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_wait_for_rcvmsg+0x342/0x640 net/tipc/socket.c:1853 #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:619 [inline] #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:441 [inline] #1: ffff888034b08340 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 mm/mmap_lock.c:501 #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: mt_find+0x186/0x630 lib/maple_tree.c:6431 #3: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:486 [inline] [] handle_softirqs+0xab/0x860 kernel/softirq.c:621 CPU: 0 UID: 0 PID: 24883 Comm: syz.4.5966 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264 __synchronize_srcu+0x1a1/0x2f0 kernel/rcu/srcutree.c:1472 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:check_kcov_mode kernel/kcov.c:181 [inline] RIP: 0010:write_comp_data kernel/kcov.c:242 [inline] RIP: 0010:__sanitizer_cov_trace_switch+0xa9/0x110 kernel/kcov.c:347 Code: db 81 e3 00 01 00 0f 81 fb 00 01 00 00 0f 95 c3 41 81 fb 00 00 00 10 41 0f 93 c3 41 08 db 75 bc 41 83 b8 44 17 00 00 00 74 b2 <45> 8b 98 18 17 00 00 41 83 fb 03 75 a5 4d 8b 98 20 17 00 00 45 8b RSP: 0018:ffffc9000396f1f8 EFLAGS: 00000246 RAX: 0000000000000005 RBX: dffffc0000000000 RCX: 0000000000000005 RDX: ffffffff8be0d4e5 RSI: ffffffff90603260 RDI: 0000000000000001 RBP: ffff88807b2d1a50 R08: ffff88807f7eddc0 R09: 0000000000000001 R10: 0000000000000001 R11: 8000000000000000 R12: 0000000000000001 R13: 0000200000ffffff R14: ffff88807b2d1a48 R15: 0000000000000009 ma_slots lib/maple_tree.c:646 [inline] mtree_range_walk+0x405/0x8b0 lib/maple_tree.c:2117 mas_state_walk lib/maple_tree.c:3013 [inline] mt_find+0x25f/0x630 lib/maple_tree.c:6433 find_vma+0xed/0x160 mm/mmap.c:923 lock_mm_and_find_vma+0x66/0x340 mm/mmap_lock.c:504 do_user_addr_fault+0x343/0x1340 arch/x86/mm/fault.c:1366 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:rep_movs_alternative+0x4a/0xa0 arch/x86/lib/copy_user_64.S:74 Code: 68 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f 68 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 RSP: 0018:ffffc9000396f698 EFLAGS: 00050206 RAX: ffffffff84dd2101 RBX: ffff888061d200e8 RCX: 00000000000027d0 RDX: 0000000000000000 RSI: ffff888061d2dae8 RDI: 0000200000a20000 RBP: ffffc9000396f818 R08: ffff888061d302b7 R09: 1ffff1100c3a6056 R10: dffffc0000000000 R11: ffffed100c3a6057 R12: 1ffff9200072dfc3 R13: 0000200000a12600 R14: ffffc9000396fe28 R15: 00000000000101d0 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] copy_to_user_iter lib/iov_iter.c:25 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0x255/0x1810 lib/iov_iter.c:197 copy_to_iter include/linux/uio.h:220 [inline] simple_copy_to_iter net/core/datagram.c:521 [inline] __skb_datagram_iter+0xf8/0x980 net/core/datagram.c:402 skb_copy_datagram_iter+0xb5/0x240 net/core/datagram.c:535 skb_copy_datagram_msg include/linux/skbuff.h:4256 [inline] tipc_recvstream+0x732/0xe90 net/tipc/socket.c:2072 sock_recvmsg_nosec net/socket.c:1151 [inline] sock_recvmsg+0x196/0x1e0 net/socket.c:1173 ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2933 ___sys_recvmsg+0x213/0x5a0 net/socket.c:2975 __sys_recvmsg net/socket.c:3008 [inline] __do_sys_recvmsg net/socket.c:3014 [inline] __se_sys_recvmsg net/socket.c:3011 [inline] __x64_sys_recvmsg+0x1ae/0x290 net/socket.c:3011 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efc6ad9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007efc6bc16028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007efc6b025fa0 RCX: 00007efc6ad9e159 RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000009 RBP: 00007efc6ae3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc6b026038 R14: 00007efc6b025fa0 R15: 00007efc6b14fa48 ODEBUG: object ffffc90000007a80 is NOT on stack ffffc90003968000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#0: syz.4.5966/24883 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#0: syz.4.5966/24883 WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#0: syz.4.5966/24883 Modules linked in: CPU: 0 UID: 0 PID: 24883 Comm: syz.4.5966 Tainted: G W L syzkaller #0 PREEMPT(full) Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline] RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798 Code: fe 06 cc 41 ff c7 44 89 3d 29 0f e8 15 48 c7 c1 80 b6 6d 8c 48 c7 c7 e0 b6 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 6d 61 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 c1 69 6d 0a 3b 05 bf RSP: 0018:ffffc900000079b8 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc90000007a80 RCX: cf8b057d299c9f00 RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff88807f7edde0 R08: 0000000000000100 R09: 0000000000000001 R10: dffffc0000000000 R11: fffff52000000eb9 R12: ffff8880272cd440 R13: ffff8880603cda80 R14: dffffc0000000000 R15: 0000000000000001 FS: 00007efc6bc166c0(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000a20000 CR3: 00000000313ec000 CR4: 00000000003526f0 Call Trace: __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:check_kcov_mode kernel/kcov.c:181 [inline] RIP: 0010:write_comp_data kernel/kcov.c:242 [inline] RIP: 0010:__sanitizer_cov_trace_switch+0xa9/0x110 kernel/kcov.c:347 Code: db 81 e3 00 01 00 0f 81 fb 00 01 00 00 0f 95 c3 41 81 fb 00 00 00 10 41 0f 93 c3 41 08 db 75 bc 41 83 b8 44 17 00 00 00 74 b2 <45> 8b 98 18 17 00 00 41 83 fb 03 75 a5 4d 8b 98 20 17 00 00 45 8b RSP: 0018:ffffc9000396f1f8 EFLAGS: 00000246 RAX: 0000000000000005 RBX: dffffc0000000000 RCX: 0000000000000005 RDX: ffffffff8be0d4e5 RSI: ffffffff90603260 RDI: 0000000000000001 RBP: ffff88807b2d1a50 R08: ffff88807f7eddc0 R09: 0000000000000001 R10: 0000000000000001 R11: 8000000000000000 R12: 0000000000000001 R13: 0000200000ffffff R14: ffff88807b2d1a48 R15: 0000000000000009 ma_slots lib/maple_tree.c:646 [inline] mtree_range_walk+0x405/0x8b0 lib/maple_tree.c:2117 mas_state_walk lib/maple_tree.c:3013 [inline] mt_find+0x25f/0x630 lib/maple_tree.c:6433 find_vma+0xed/0x160 mm/mmap.c:923 lock_mm_and_find_vma+0x66/0x340 mm/mmap_lock.c:504 do_user_addr_fault+0x343/0x1340 arch/x86/mm/fault.c:1366 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:rep_movs_alternative+0x4a/0xa0 arch/x86/lib/copy_user_64.S:74 Code: 68 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f 68 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 RSP: 0018:ffffc9000396f698 EFLAGS: 00050206 RAX: ffffffff84dd2101 RBX: ffff888061d200e8 RCX: 00000000000027d0 RDX: 0000000000000000 RSI: ffff888061d2dae8 RDI: 0000200000a20000 RBP: ffffc9000396f818 R08: ffff888061d302b7 R09: 1ffff1100c3a6056 R10: dffffc0000000000 R11: ffffed100c3a6057 R12: 1ffff9200072dfc3 R13: 0000200000a12600 R14: ffffc9000396fe28 R15: 00000000000101d0 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] copy_to_user_iter lib/iov_iter.c:25 [inline] iterate_ubuf include/linux/iov_iter.h:30 [inline] iterate_and_advance2 include/linux/iov_iter.h:302 [inline] iterate_and_advance include/linux/iov_iter.h:330 [inline] _copy_to_iter+0x255/0x1810 lib/iov_iter.c:197 copy_to_iter include/linux/uio.h:220 [inline] simple_copy_to_iter net/core/datagram.c:521 [inline] __skb_datagram_iter+0xf8/0x980 net/core/datagram.c:402 skb_copy_datagram_iter+0xb5/0x240 net/core/datagram.c:535 skb_copy_datagram_msg include/linux/skbuff.h:4256 [inline] tipc_recvstream+0x732/0xe90 net/tipc/socket.c:2072 sock_recvmsg_nosec net/socket.c:1151 [inline] sock_recvmsg+0x196/0x1e0 net/socket.c:1173 ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2933 ___sys_recvmsg+0x213/0x5a0 net/socket.c:2975 __sys_recvmsg net/socket.c:3008 [inline] __do_sys_recvmsg net/socket.c:3014 [inline] __se_sys_recvmsg net/socket.c:3011 [inline] __x64_sys_recvmsg+0x1ae/0x290 net/socket.c:3011 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efc6ad9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007efc6bc16028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007efc6b025fa0 RCX: 00007efc6ad9e159 RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000009 RBP: 00007efc6ae3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efc6b026038 R14: 00007efc6b025fa0 R15: 00007efc6b14fa48 ---------------- Code disassembly (best guess): 0: db 81 e3 00 01 00 fildl 0x100e3(%rcx) 6: 0f 81 fb 00 01 00 jno 0x10107 c: 00 0f add %cl,(%rdi) e: 95 xchg %eax,%ebp f: c3 ret 10: 41 81 fb 00 00 00 10 cmp $0x10000000,%r11d 17: 41 0f 93 c3 setae %r11b 1b: 41 08 db or %bl,%r11b 1e: 75 bc jne 0xffffffdc 20: 41 83 b8 44 17 00 00 cmpl $0x0,0x1744(%r8) 27: 00 28: 74 b2 je 0xffffffdc * 2a: 45 8b 98 18 17 00 00 mov 0x1718(%r8),%r11d <-- trapping instruction 31: 41 83 fb 03 cmp $0x3,%r11d 35: 75 a5 jne 0xffffffdc 37: 4d 8b 98 20 17 00 00 mov 0x1720(%r8),%r11 3e: 45 rex.RB 3f: 8b .byte 0x8b