BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 20400, name: sed preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by sed/20400: #0: ffff888114f52938 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:554 [inline] #0: ffff888114f52938 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x15e/0x390 mm/util.c:579 #1: ffffc90000007ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 Preemption disabled at: [] softirq_handle_begin kernel/softirq.c:463 [inline] [] handle_softirqs+0xf0/0x990 kernel/softirq.c:598 CPU: 0 UID: 0 PID: 20400 Comm: sed Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9197 __cancel_work_sync kernel/workqueue.c:4487 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4568 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline] RIP: 0010:lock_is_held_type+0x51/0x140 kernel/locking/lockdep.c:5936 Code: 57 41 56 41 55 41 54 55 53 48 83 ec 08 65 48 8b 2d 3c 46 82 05 8b 95 54 0b 00 00 85 d2 0f 85 a7 00 00 00 48 89 fb 41 89 f4 9c <41> 5d fa 48 c7 c7 3f ea 18 89 e8 e0 17 00 00 65 ff 05 09 89 82 05 RSP: 0018:ffffc90001727030 EFLAGS: 00000246 RAX: 00000000ffffffff RBX: ffffffff896e2b00 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff896e2b00 RBP: ffff88810f338000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff R13: 00000000000007e7 R14: 00007f73c52c7000 R15: ffff888114f52580 lock_is_held include/linux/lockdep.h:249 [inline] __might_resched+0x29f/0x330 kernel/sched/core.c:9159 zap_pmd_range mm/memory.c:2023 [inline] zap_pud_range mm/memory.c:2048 [inline] zap_p4d_range mm/memory.c:2069 [inline] __zap_vma_range+0x8bd/0x4000 mm/memory.c:2109 unmap_vmas+0x299/0x5f0 mm/memory.c:2178 unmap_region+0x1bc/0x3b0 mm/vma.c:488 vms_clear_ptes mm/vma.c:1303 [inline] vms_clean_up_area mm/vma.c:1315 [inline] __mmap_setup mm/vma.c:2476 [inline] __mmap_region+0x19f4/0x2a70 mm/vma.c:2756 mmap_region+0x35d/0x620 mm/vma.c:2860 do_mmap+0xc53/0x12d0 mm/mmap.c:560 vm_mmap_pgoff+0x201/0x390 mm/util.c:581 ksys_mmap_pgoff+0xe4/0x610 mm/mmap.c:606 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline] __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f73c55f0242 Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00 RSP: 002b:00007ffd31e58dc8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007f73c52c6000 RCX: 00007f73c55f0242 RDX: 0000000000000003 RSI: 0000000000000088 RDI: 00007f73c52c6000 RBP: 0000000000000032 R08: 00000000ffffffff R09: 0000000000000000 R10: 0000000000000032 R11: 0000000000000206 R12: 00007ffd31e58e88 R13: 00007f73c52c70c0 R14: 00007ffd31e59200 R15: 00007f73c52c6000 ODEBUG: object ffffc90000007a70 is NOT on stack ffffc90001720000, but annotated. ====================================================== ---------------- Code disassembly (best guess): 0: 57 push %rdi 1: 41 56 push %r14 3: 41 55 push %r13 5: 41 54 push %r12 7: 55 push %rbp 8: 53 push %rbx 9: 48 83 ec 08 sub $0x8,%rsp d: 65 48 8b 2d 3c 46 82 mov %gs:0x582463c(%rip),%rbp # 0x5824651 14: 05 15: 8b 95 54 0b 00 00 mov 0xb54(%rbp),%edx 1b: 85 d2 test %edx,%edx 1d: 0f 85 a7 00 00 00 jne 0xca 23: 48 89 fb mov %rdi,%rbx 26: 41 89 f4 mov %esi,%r12d 29: 9c pushf * 2a: 41 5d pop %r13 <-- trapping instruction 2c: fa cli 2d: 48 c7 c7 3f ea 18 89 mov $0xffffffff8918ea3f,%rdi 34: e8 e0 17 00 00 call 0x1819 39: 65 ff 05 09 89 82 05 incl %gs:0x5828909(%rip) # 0x5828949