BUG: sleeping function called from invalid context at kernel/workqueue.c:3414 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5139, name: udevd preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 4 locks held by udevd/5139: #0: ffff888078e94848 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff8880794a29e0 (&type->i_mutex_dir_key#4){++++}-{3:3}, at: iterate_dir+0xcb/0x590 fs/readdir.c:99 #2: ffff888019e45948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_fop_readdir+0x55c/0x850 fs/kernfs/dir.c:1875 #3: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 kernel/time/timer.c:1698 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:419 [inline] [] handle_softirqs+0x101/0x820 kernel/softirq.c:554 CPU: 1 PID: 5139 Comm: udevd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 __might_resched+0x48d/0x5f0 kernel/sched/core.c:10212 start_flush_work kernel/workqueue.c:3414 [inline] __flush_work+0x10f/0xac0 kernel/workqueue.c:3474 __cancel_work_timer+0x3f8/0x560 kernel/workqueue.c:3562 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:694 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x570/0x810 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:lock_is_held_type+0x13e/0x190 kernel/locking/lockdep.c:5830 Code: 75 40 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 46 41 f7 c5 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 08 75 3c 89 e8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f RSP: 0018:ffffc900032e7cf0 EFLAGS: 00000206 RAX: 161e068a66d36200 RBX: ffff88807e013c00 RCX: 161e068a66d36200 RDX: ffff88807e013c00 RSI: ffffffff8acadd60 RDI: ffffffff8b1d3260 RBP: 0000000000000001 R08: ffff888140f99ba7 R09: 1ffff110281f3374 R10: dffffc0000000000 R11: ffffed10281f3375 R12: 0000000000000002 R13: 0000000000000246 R14: ffff888019e45948 R15: ffff88807e014738 lock_is_held include/linux/lockdep.h:288 [inline] kernfs_active fs/kernfs/dir.c:41 [inline] kernfs_dir_next_pos fs/kernfs/dir.c:1838 [inline] kernfs_fop_readdir+0x62a/0x850 fs/kernfs/dir.c:1862 iterate_dir+0x1bd/0x590 fs/readdir.c:106 __do_sys_getdents64 fs/readdir.c:405 [inline] __se_sys_getdents64+0xf6/0x270 fs/readdir.c:390 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff2d14f0d23 Code: 8b 05 d9 00 10 00 64 c7 00 16 00 00 00 31 c0 eb b0 66 0f 1f 44 00 00 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a1 00 10 00 f7 d8 RSP: 002b:00007ffdcc962d68 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 RAX: ffffffffffffffda RBX: 0000558794dcc000 RCX: 00007ff2d14f0d23 RDX: 0000000000008000 RSI: 0000558794dcc030 RDI: 000000000000000c RBP: 0000558794dcc004 R08: 00007ff2d15f1ac0 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000293 R12: 0000558794dcc030 R13: fffffffffffffe68 R14: 0000000000000016 R15: 00007ffdcc962fd0 ODEBUG: object ffffc900001f09c0 is NOT on stack ffffc900032e0000, but annotated. ====================================================== ---------------- Code disassembly (best guess): 0: 75 40 jne 0x42 2: 48 c7 04 24 00 00 00 movq $0x0,(%rsp) 9: 00 a: 9c pushf b: 8f 04 24 pop (%rsp) e: f7 04 24 00 02 00 00 testl $0x200,(%rsp) 15: 75 46 jne 0x5d 17: 41 f7 c5 00 02 00 00 test $0x200,%r13d 1e: 74 01 je 0x21 20: fb sti 21: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax 28: 00 00 * 2a: 48 3b 44 24 08 cmp 0x8(%rsp),%rax <-- trapping instruction 2f: 75 3c jne 0x6d 31: 89 e8 mov %ebp,%eax 33: 48 83 c4 10 add $0x10,%rsp 37: 5b pop %rbx 38: 41 5c pop %r12 3a: 41 5d pop %r13 3c: 41 5e pop %r14 3e: 41 5f pop %r15