Extracting prog: 3m42.03901594s Minimizing prog: 31m18.409222485s Simplifying prog options: 0s Extracting C: 1m23.088085498s Simplifying C: 6m36.459330255s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=2m22.5867544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync simplifying C reproducer testing compiled C program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing compiled C program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync testing program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync validation run: crashed=true testing program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync validation run: crashed=true testing program (duration=2m22.5867544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0xf, "ee4ef9677ff3f932698ca9fd6e8aee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync validation run: crashed=true reproducing took 49m26.713049684s repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3002, name: kworker/1:2 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 8 locks held by kworker/1:2/3002: #0: ffff8881056eed40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc900005a7d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88810bb7a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88810bb7a1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4510 drivers/usb/core/hub.c:5912 #3: ffff88811e7441d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88811e7441d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073 #4: ffff88811e7431a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88811e7431a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073 #5: ffffffff896cef80 (console_lock){+.+.}-{0:0}, at: dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996 #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:305 [inline] #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:428 [inline] #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:291 [inline] #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfd/0xe50 kernel/printk/printk.c:3246 #7: ffffc900001a8ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 Preemption disabled at: [] vprintk_emit+0x2b2/0x6b0 kernel/printk/printk.c:2471 CPU: 1 UID: 0 PID: 3002 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9197 __cancel_work_sync kernel/workqueue.c:4487 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4568 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270 Code: 00 e8 31 85 29 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 af 3b 21 00 48 85 ed 0f 85 d7 01 00 00 e8 01 41 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b RSP: 0018:ffffc900005a6870 EFLAGS: 00000293 RAX: ffffffff89ca42d8 RBX: ffffffff89ca4280 RCX: ffffffff8192d371 RDX: ffff888106ed0000 RSI: ffffffff8192d37f RDI: ffff888106ed0000 RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000005c6 R13: ffffffff89ca42d8 R14: ffffc900005a68f0 R15: dffffc0000000000 console_flush_all kernel/printk/printk.c:3343 [inline] __console_flush_and_unlock kernel/printk/printk.c:3373 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3413 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479 dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996 dev_printk_emit+0xd2/0x10d drivers/base/core.c:5007 __dev_printk+0xcb/0x100 drivers/base/core.c:5019 _dev_info+0xef/0x127 drivers/base/core.c:5065 vub300_probe.cold+0xba9/0x1511 drivers/mmc/host/vub300.c:2300 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ODEBUG: object ffffc900001a8a70 is NOT on stack ffffc900005a0000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: kworker/1:2/3002 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705, CPU#1: kworker/1:2/3002 Modules linked in: CPU: 1 UID: 0 PID: 3002 Comm: kworker/1:2 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705 Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f e9 49 4e 58 06 83 c5 01 89 2d 40 c7 ea 12 4c 89 e6 48 c7 c7 40 62 b1 87 e8 51 c5 fa ff 90 <0f> 0b 90 e9 12 81 b5 01 83 c5 01 89 2d 1f c7 ea 12 49 39 c4 73 da RSP: 0018:ffffc900001a8900 EFLAGS: 00010086 RAX: 0000000000000050 RBX: ffff8881230ed1c0 RCX: 0000000000000000 RDX: 0000000000000050 RSI: ffffffff8192f709 RDI: fffff52000035111 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000102 R11: 000000000000596b R12: ffffc900001a8a70 R13: ffff888106ed0000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888268733000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b32b83b3c8 CR3: 0000000123ca2000 CR4: 00000000003506f0 Call Trace: lookup_object_or_alloc lib/debugobjects.c:682 [inline] __debug_object_init+0x2a9/0x3d0 lib/debugobjects.c:798 __synchronize_srcu+0x1c3/0x300 kernel/rcu/srcutree.c:1494 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2636 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3880 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270 Code: 00 e8 31 85 29 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 af 3b 21 00 48 85 ed 0f 85 d7 01 00 00 e8 01 41 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b RSP: 0018:ffffc900005a6870 EFLAGS: 00000293 RAX: ffffffff89ca42d8 RBX: ffffffff89ca4280 RCX: ffffffff8192d371 RDX: ffff888106ed0000 RSI: ffffffff8192d37f RDI: ffff888106ed0000 RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000005c6 R13: ffffffff89ca42d8 R14: ffffc900005a68f0 R15: dffffc0000000000 console_flush_all kernel/printk/printk.c:3343 [inline] __console_flush_and_unlock kernel/printk/printk.c:3373 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3413 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479 dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996 dev_printk_emit+0xd2/0x10d drivers/base/core.c:5007 __dev_printk+0xcb/0x100 drivers/base/core.c:5019 _dev_info+0xef/0x127 drivers/base/core.c:5065 vub300_probe.cold+0xba9/0x1511 drivers/mmc/host/vub300.c:2300 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: 00 e8 add %ch,%al 2: 31 85 29 00 9c 5d xor %eax,0x5d9c0029(%rbp) 8: 81 e5 00 02 00 00 and $0x200,%ebp e: 31 ff xor %edi,%edi 10: 48 89 ee mov %rbp,%rsi 13: e8 af 3b 21 00 call 0x213bc7 18: 48 85 ed test %rbp,%rbp 1b: 0f 85 d7 01 00 00 jne 0x1f8 21: e8 01 41 21 00 call 0x214127 26: fb sti 27: 4c 89 e8 mov %r13,%rax * 2a: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction 2e: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) 33: 0f 85 64 03 00 00 jne 0x39d 39: 48 8b 0c 24 mov (%rsp),%rcx 3d: 48 rex.W 3e: 8b .byte 0x8b 3f: 6b .byte 0x6b final repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3002, name: kworker/1:2 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 8 locks held by kworker/1:2/3002: #0: ffff8881056eed40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc900005a7d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88810bb7a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88810bb7a1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4510 drivers/usb/core/hub.c:5912 #3: ffff88811e7441d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88811e7441d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073 #4: ffff88811e7431a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88811e7431a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073 #5: ffffffff896cef80 (console_lock){+.+.}-{0:0}, at: dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996 #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:305 [inline] #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:428 [inline] #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:291 [inline] #6: ffffffff896ceff8 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfd/0xe50 kernel/printk/printk.c:3246 #7: ffffc900001a8ca0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11f/0x610 kernel/time/timer.c:1745 Preemption disabled at: [] vprintk_emit+0x2b2/0x6b0 kernel/printk/printk.c:2471 CPU: 1 UID: 0 PID: 3002 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 __might_resched.cold+0x1ec/0x232 kernel/sched/core.c:9197 __cancel_work_sync kernel/workqueue.c:4487 [inline] cancel_delayed_work_sync+0xb8/0xf0 kernel/workqueue.c:4568 mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270 Code: 00 e8 31 85 29 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 af 3b 21 00 48 85 ed 0f 85 d7 01 00 00 e8 01 41 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b RSP: 0018:ffffc900005a6870 EFLAGS: 00000293 RAX: ffffffff89ca42d8 RBX: ffffffff89ca4280 RCX: ffffffff8192d371 RDX: ffff888106ed0000 RSI: ffffffff8192d37f RDI: ffff888106ed0000 RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000005c6 R13: ffffffff89ca42d8 R14: ffffc900005a68f0 R15: dffffc0000000000 console_flush_all kernel/printk/printk.c:3343 [inline] __console_flush_and_unlock kernel/printk/printk.c:3373 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3413 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479 dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996 dev_printk_emit+0xd2/0x10d drivers/base/core.c:5007 __dev_printk+0xcb/0x100 drivers/base/core.c:5019 _dev_info+0xef/0x127 drivers/base/core.c:5065 vub300_probe.cold+0xba9/0x1511 drivers/mmc/host/vub300.c:2300 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ODEBUG: object ffffc900001a8a70 is NOT on stack ffffc900005a0000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: kworker/1:2/3002 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705, CPU#1: kworker/1:2/3002 Modules linked in: CPU: 1 UID: 0 PID: 3002 Comm: kworker/1:2 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc.part.0.cold+0x19/0x40 lib/debugobjects.c:705 Code: c4 60 5b 5d 41 5c 41 5d 41 5e 41 5f e9 49 4e 58 06 83 c5 01 89 2d 40 c7 ea 12 4c 89 e6 48 c7 c7 40 62 b1 87 e8 51 c5 fa ff 90 <0f> 0b 90 e9 12 81 b5 01 83 c5 01 89 2d 1f c7 ea 12 49 39 c4 73 da RSP: 0018:ffffc900001a8900 EFLAGS: 00010086 RAX: 0000000000000050 RBX: ffff8881230ed1c0 RCX: 0000000000000000 RDX: 0000000000000050 RSI: ffffffff8192f709 RDI: fffff52000035111 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000102 R11: 000000000000596b R12: ffffc900001a8a70 R13: ffff888106ed0000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888268733000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b32b83b3c8 CR3: 0000000123ca2000 CR4: 00000000003506f0 Call Trace: lookup_object_or_alloc lib/debugobjects.c:682 [inline] __debug_object_init+0x2a9/0x3d0 lib/debugobjects.c:798 __synchronize_srcu+0x1c3/0x300 kernel/rcu/srcutree.c:1494 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister.part.0+0x12c/0x540 drivers/base/power/wakeup.c:237 wakeup_source_unregister+0x1f/0x30 drivers/base/power/wakeup.c:236 mmc_host_classdev_release+0x42/0x120 drivers/mmc/core/host.c:69 device_release+0xd2/0x270 drivers/base/core.c:2636 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3880 vub300_delete drivers/mmc/host/vub300.c:379 [inline] kref_put include/linux/kref.h:65 [inline] vub300_inactivity_timer_expired drivers/mmc/host/vub300.c:747 [inline] vub300_inactivity_timer_expired+0x42f/0x550 drivers/mmc/host/vub300.c:742 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers+0x757/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270 Code: 00 e8 31 85 29 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 af 3b 21 00 48 85 ed 0f 85 d7 01 00 00 e8 01 41 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b RSP: 0018:ffffc900005a6870 EFLAGS: 00000293 RAX: ffffffff89ca42d8 RBX: ffffffff89ca4280 RCX: ffffffff8192d371 RDX: ffff888106ed0000 RSI: ffffffff8192d37f RDI: ffff888106ed0000 RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000005c6 R13: ffffffff89ca42d8 R14: ffffc900005a68f0 R15: dffffc0000000000 console_flush_all kernel/printk/printk.c:3343 [inline] __console_flush_and_unlock kernel/printk/printk.c:3373 [inline] console_unlock+0x103/0x260 kernel/printk/printk.c:3413 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479 dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996 dev_printk_emit+0xd2/0x10d drivers/base/core.c:5007 __dev_printk+0xcb/0x100 drivers/base/core.c:5019 _dev_info+0xef/0x127 drivers/base/core.c:5065 vub300_probe.cold+0xba9/0x1511 drivers/mmc/host/vub300.c:2300 usb_probe_interface+0x386/0x9b0 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.part.0+0xcc2/0x1686 drivers/usb/core/hub.c:2708 usb_new_device drivers/usb/core/hub.c:5833 [inline] hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event.cold+0x51a/0xe9d drivers/usb/core/hub.c:5966 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: 00 e8 add %ch,%al 2: 31 85 29 00 9c 5d xor %eax,0x5d9c0029(%rbp) 8: 81 e5 00 02 00 00 and $0x200,%ebp e: 31 ff xor %edi,%edi 10: 48 89 ee mov %rbp,%rsi 13: e8 af 3b 21 00 call 0x213bc7 18: 48 85 ed test %rbp,%rbp 1b: 0f 85 d7 01 00 00 jne 0x1f8 21: e8 01 41 21 00 call 0x214127 26: fb sti 27: 4c 89 e8 mov %r13,%rax * 2a: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction 2e: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) 33: 0f 85 64 03 00 00 jne 0x39d 39: 48 8b 0c 24 mov (%rsp),%rcx 3d: 48 rex.W 3e: 8b .byte 0x8b 3f: 6b .byte 0x6b