BUG: sleeping function called from invalid context at kernel/workqueue.c:4561
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3977, name: syz.0.8751
preempt_count: 102, expected: 0
RCU nest depth: 0, expected: 0
locks held by syz.0.8751/3977: 3, last CPU#0:
 #0: ffff888052838610 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline]
 #0: ffff888052838610 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520 fs/libfs.c:619
 #1: ffff88807a6b89a0 (&lockref->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
 #1: ffff88807a6b89a0 (&lockref->lock){+.+.}-{3:3}, at: dentry_kill+0x27f/0x880 fs/dcache.c:837
 #2: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 UID: 0 PID: 3977 Comm: syz.0.8751 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264
 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561
 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 cd 4f ba f5 f7 c3 00 02 00 00 74 05 e8 60 9d e6 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 04 4d ab f5 65 48 8b 05 4c f0 ab 07 48 85 c0 74 18 5b 41 5e e9
RSP: 0018:ffffc90003c77a28 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000286 RCX: 8000000000000002
RDX: 0000000000000006 RSI: ffffffff8e416437 RDI: 0000000000000001
RBP: ffff88807b6c0e80 R08: ffffffff907a647f R09: 1ffffffff20f4c8f
R10: dffffc0000000000 R11: fffffbfff20f4c90 R12: ffffffff8c0e4350
R13: ffff88807b6c0e70 R14: ffffffff9ac18a48 R15: 1ffff1100f6d81d0
 debug_object_activate+0x2ec/0x420 lib/debugobjects.c:891
 debug_rcu_head_queue kernel/rcu/rcu.h:245 [inline]
 __call_rcu_common kernel/rcu/tree.c:3166 [inline]
 call_rcu+0x43/0x8b0 kernel/rcu/tree.c:3301
 dentry_kill+0x4d3/0x880 fs/dcache.c:845
 finish_dput+0x1a/0x260 fs/dcache.c:1001
 find_next_child+0x1e7/0x250 fs/libfs.c:592
 __simple_recursive_removal+0x10b/0x520 fs/libfs.c:609
 debugfs_remove+0x5b/0x70 fs/debugfs/inode.c:784
 kvm_destroy_vm_debugfs virt/kvm/kvm_main.c:989 [inline]
 kvm_destroy_vm virt/kvm/kvm_main.c:1262 [inline]
 kvm_put_kvm+0x147/0xb50 virt/kvm/kvm_main.c:1332
 kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4122
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 __do_fast_syscall_32+0x437/0x6a0 arch/x86/entry/syscall_32.c:294
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f490ec
Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
RSP: 002b:00000000f540650c EFLAGS: 00000206 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000ffffffff
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
ODEBUG: object ffffc90000007a80 is NOT on stack ffffc90003c70000, but annotated.
------------[ cut here ]------------
1
WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#0: syz.0.8751/3977
WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#0: syz.0.8751/3977
WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#0: syz.0.8751/3977
Modules linked in:
CPU: 0 UID: 0 PID: 3977 Comm: syz.0.8751 Tainted: G        W    L      syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline]
RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline]
RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798
Code: cc cc cc 41 ff c7 44 89 3d 89 3e e8 15 48 c7 c1 80 b6 6d 8c 48 c7 c7 e0 b6 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 cd a0 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 a1 a9 6d 0a 3b 05 9f
RSP: 0018:ffffc900000079b8 EFLAGS: 00010046
RAX: 0000000000000050 RBX: ffffc90000007a80 RCX: 9ef00b2c044dc900
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffff88802ca85de0 R08: 0000000000000100 R09: 1ffff110170c48e2
R10: dffffc0000000000 R11: ffffed10170c48e3 R12: ffff888034d7afa0
R13: ffff8880775cd5e8 R14: dffffc0000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888124cc7000(0063) knlGS:00000000f5406b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000006588c000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237
 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x222/0x550 lib/kobject.c:737
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 cd 4f ba f5 f7 c3 00 02 00 00 74 05 e8 60 9d e6 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 04 4d ab f5 65 48 8b 05 4c f0 ab 07 48 85 c0 74 18 5b 41 5e e9
RSP: 0018:ffffc90003c77a28 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000286 RCX: 8000000000000002
RDX: 0000000000000006 RSI: ffffffff8e416437 RDI: 0000000000000001
RBP: ffff88807b6c0e80 R08: ffffffff907a647f R09: 1ffffffff20f4c8f
R10: dffffc0000000000 R11: fffffbfff20f4c90 R12: ffffffff8c0e4350
R13: ffff88807b6c0e70 R14: ffffffff9ac18a48 R15: 1ffff1100f6d81d0
 debug_object_activate+0x2ec/0x420 lib/debugobjects.c:891
 debug_rcu_head_queue kernel/rcu/rcu.h:245 [inline]
 __call_rcu_common kernel/rcu/tree.c:3166 [inline]
 call_rcu+0x43/0x8b0 kernel/rcu/tree.c:3301
 dentry_kill+0x4d3/0x880 fs/dcache.c:845
 finish_dput+0x1a/0x260 fs/dcache.c:1001
 find_next_child+0x1e7/0x250 fs/libfs.c:592
 __simple_recursive_removal+0x10b/0x520 fs/libfs.c:609
 debugfs_remove+0x5b/0x70 fs/debugfs/inode.c:784
 kvm_destroy_vm_debugfs virt/kvm/kvm_main.c:989 [inline]
 kvm_destroy_vm virt/kvm/kvm_main.c:1262 [inline]
 kvm_put_kvm+0x147/0xb50 virt/kvm/kvm_main.c:1332
 kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4122
 __fput+0x418/0xa50 fs/file_table.c:512
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 __do_fast_syscall_32+0x437/0x6a0 arch/x86/entry/syscall_32.c:294
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f490ec
Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8
RSP: 002b:00000000f540650c EFLAGS: 00000206 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000ffffffff
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 cd 4f ba f5       	call   0xf5ba4fd2
   5:	f7 c3 00 02 00 00    	test   $0x200,%ebx
   b:	74 05                	je     0x12
   d:	e8 60 9d e6 f5       	call   0xf5e69d72
  12:	9c                   	pushf
  13:	58                   	pop    %rax
  14:	a9 00 02 00 00       	test   $0x200,%eax
  19:	75 29                	jne    0x44
  1b:	f7 c3 00 02 00 00    	test   $0x200,%ebx
  21:	74 01                	je     0x24
  23:	fb                   	sti
  24:	bf 01 00 00 00       	mov    $0x1,%edi
* 29:	e8 04 4d ab f5       	call   0xf5ab4d32 <-- trapping instruction
  2e:	65 48 8b 05 4c f0 ab 	mov    %gs:0x7abf04c(%rip),%rax        # 0x7abf082
  35:	07
  36:	48 85 c0             	test   %rax,%rax
  39:	74 18                	je     0x53
  3b:	5b                   	pop    %rbx
  3c:	41 5e                	pop    %r14
  3e:	e9                   	.byte 0xe9