Re: [syzbot] [mmc?] WARNING: suspicious RCU usage in mmc_free_host

Adrian Hunter <[email protected]>
Newsgroups org.kernel.vger.linux-kernel,org.kernel.vger.linux-mmc
Organization Intel Finland Oy, Registered Address: c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo, Business Identity Code: 0357606 - 4, Domiciled in Helsinki
Message-ID <[email protected]> 
+ vub300 people

On 22/08/2026 09:04, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1109e549580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=59b38fbc070dad5e
> dashboard link: https://syzkaller.appspot.com/bug?extid=0d22039ef0915696ad4b
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/51af0608b198/disk-818bebeb.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/ecaa10d3a300/vmlinux-818bebeb.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/6ce61fdcbede/bzImage-818bebeb.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
> 
> =============================
> WARNING: suspicious RCU usage
> syzkaller #0 Tainted: G             L     
> -----------------------------
> kernel/sched/core.c:9196 Illegal context switch in RCU-sched read-side critical section!
> 
> other info that might help us debug this:
> 
> 
> rcu_scheduler_active = 2, debug_locks = 1
> locks held by syz-executor/5632: 9, last CPU#1:
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1548 [inline]
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 kernel/fork.c:1601
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1292 [inline]
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x70f/0x5c50 mm/memory.c:1428
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 include/linux/mmzone.h:2266
>  #8: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
> 
> stack backtrace:
> CPU: 1 UID: 0 PID: 5632 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
> Tainted: [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> Call Trace:
>  <IRQ>
>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>  lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6894
>  __might_resched+0xbb/0x4c0 kernel/sched/core.c:9196
>  __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4552
>  mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700

The only path that seems to use a timer is:

vub300_inactivity_timer_expired() can do kref_put(&vub300->kref, vub300_delete).
vub300_delete() calls mmc_free_host()

which is a problem...

>  call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
>  expire_timers kernel/time/timer.c:1799 [inline]
>  __run_timers kernel/time/timer.c:2374 [inline]
>  __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
>  run_timer_base kernel/time/timer.c:2395 [inline]
>  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
>  handle_softirqs+0x226/0x860 kernel/softirq.c:645
>  __do_softirq kernel/softirq.c:679 [inline]
>  invoke_softirq kernel/softirq.c:519 [inline]
>  __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767
>  irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
>  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
>  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
>  </IRQ>
>  <TASK>
>  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
> RIP: 0010:lock_acquire+0x222/0x350 kernel/locking/lockdep.c:5890
> Code: ff ff ff e8 a0 20 39 0a f7 44 24 08 00 02 00 00 0f 84 39 ff ff ff 65 48 8b 05 f2 0b ce 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 27 3c 0a cc 48 8d 3d a7 64 b9
> RSP: 0018:ffffc90004307210 EFLAGS: 00000282
> RAX: 2ab30850d67e6b00 RBX: 0000000000000000 RCX: 8000000000000003
> RDX: 00000000dc7298f8 RSI: ffffffff8e4e132a RDI: ffffffff8c4cf580
> RBP: ffffffff8242ba4a R08: ffffffff8242ba4a R09: 0000000000000000
> R10: 0000000000000000 R11: ffffffff8eb5a420 R12: 0000000000000002
> R13: ffffffff8eb5a420 R14: 0000000000000000 R15: 0000000000000246
>  rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  pfn_valid+0xd6/0x490 include/linux/mmzone.h:2266
>  page_table_check_set+0x25/0x530 mm/page_table_check.c:105
>  page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
>  set_ptes include/linux/pgtable.h:447 [inline]
>  __copy_present_ptes mm/memory.c:1138 [inline]
>  copy_present_ptes mm/memory.c:1217 [inline]
>  copy_pte_range mm/memory.c:1340 [inline]
>  copy_pmd_range+0x4b46/0x5c50 mm/memory.c:1428
>  copy_pud_range mm/memory.c:1465 [inline]
>  copy_p4d_range mm/memory.c:1489 [inline]
>  copy_page_range+0xc25/0x1230 mm/memory.c:1575
>  dup_mmap+0xf17/0x1dc0 mm/mmap.c:1819
>  dup_mm kernel/fork.c:1549 [inline]
>  copy_mm+0x11a/0x480 kernel/fork.c:1601
>  copy_process+0x1e75/0x43e0 kernel/fork.c:2313
>  kernel_clone+0x2d7/0x940 kernel/fork.c:2772
>  __do_sys_clone kernel/fork.c:2914 [inline]
>  __se_sys_clone kernel/fork.c:2898 [inline]
>  __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2898
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f5322fc6b52
> Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
> RSP: 002b:00007f532334fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
> RAX: ffffffffffffffda RBX: 00007f532334fc60 RCX: 00007f5322fc6b52
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
> RBP: 00007f532334fdec R08: 0000000000000000 R09: 0000000000000001
> R10: 0000555576c227d0 R11: 0000000000000246 R12: 0000000000000001
> R13: 00000000000927c0 R14: 0000000000039654 R15: 00007f532334fe40
>  </TASK>
> BUG: sleeping function called from invalid context at kernel/workqueue.c:4552
> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5632, name: syz-executor
> preempt_count: 103, expected: 0
> RCU nest depth: 2, expected: 0
> locks held by syz-executor/5632: 9, last CPU#1:
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1548 [inline]
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 kernel/fork.c:1601
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1292 [inline]
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x70f/0x5c50 mm/memory.c:1428
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 include/linux/mmzone.h:2266
>  #8: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
> Preemption disabled at:
> [<0000000000000000>] 0x0
> CPU: 1 UID: 0 PID: 5632 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
> Tainted: [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> Call Trace:
>  <IRQ>
>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>  __might_resched+0x36a/0x4c0 kernel/sched/core.c:9234
>  __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4552
>  mmc_free_host+0x19/0x30 drivers/mmc/core/host.c:700
>  call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
>  expire_timers kernel/time/timer.c:1799 [inline]
>  __run_timers kernel/time/timer.c:2374 [inline]
>  __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
>  run_timer_base kernel/time/timer.c:2395 [inline]
>  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
>  handle_softirqs+0x226/0x860 kernel/softirq.c:645
>  __do_softirq kernel/softirq.c:679 [inline]
>  invoke_softirq kernel/softirq.c:519 [inline]
>  __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767
>  irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
>  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
>  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
>  </IRQ>
>  <TASK>
>  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
> RIP: 0010:lock_acquire+0x222/0x350 kernel/locking/lockdep.c:5890
> Code: ff ff ff e8 a0 20 39 0a f7 44 24 08 00 02 00 00 0f 84 39 ff ff ff 65 48 8b 05 f2 0b ce 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 27 3c 0a cc 48 8d 3d a7 64 b9
> RSP: 0018:ffffc90004307210 EFLAGS: 00000282
> RAX: 2ab30850d67e6b00 RBX: 0000000000000000 RCX: 8000000000000003
> RDX: 00000000dc7298f8 RSI: ffffffff8e4e132a RDI: ffffffff8c4cf580
> RBP: ffffffff8242ba4a R08: ffffffff8242ba4a R09: 0000000000000000
> R10: 0000000000000000 R11: ffffffff8eb5a420 R12: 0000000000000002
> R13: ffffffff8eb5a420 R14: 0000000000000000 R15: 0000000000000246
>  rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  pfn_valid+0xd6/0x490 include/linux/mmzone.h:2266
>  page_table_check_set+0x25/0x530 mm/page_table_check.c:105
>  page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
>  set_ptes include/linux/pgtable.h:447 [inline]
>  __copy_present_ptes mm/memory.c:1138 [inline]
>  copy_present_ptes mm/memory.c:1217 [inline]
>  copy_pte_range mm/memory.c:1340 [inline]
>  copy_pmd_range+0x4b46/0x5c50 mm/memory.c:1428
>  copy_pud_range mm/memory.c:1465 [inline]
>  copy_p4d_range mm/memory.c:1489 [inline]
>  copy_page_range+0xc25/0x1230 mm/memory.c:1575
>  dup_mmap+0xf17/0x1dc0 mm/mmap.c:1819
>  dup_mm kernel/fork.c:1549 [inline]
>  copy_mm+0x11a/0x480 kernel/fork.c:1601
>  copy_process+0x1e75/0x43e0 kernel/fork.c:2313
>  kernel_clone+0x2d7/0x940 kernel/fork.c:2772
>  __do_sys_clone kernel/fork.c:2914 [inline]
>  __se_sys_clone kernel/fork.c:2898 [inline]
>  __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2898
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f5322fc6b52
> Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
> RSP: 002b:00007f532334fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
> RAX: ffffffffffffffda RBX: 00007f532334fc60 RCX: 00007f5322fc6b52
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
> RBP: 00007f532334fdec R08: 0000000000000000 R09: 0000000000000001
> R10: 0000555576c227d0 R11: 0000000000000246 R12: 0000000000000001
> R13: 00000000000927c0 R14: 0000000000039654 R15: 00007f532334fe40
>  </TASK>
> 
> =============================
> WARNING: suspicious RCU usage
> syzkaller #0 Tainted: G        W    L     
> -----------------------------
> kernel/rcu/srcutree.c:1487 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section!
> 
> other info that might help us debug this:
> 
> 
> rcu_scheduler_active = 2, debug_locks = 1
> locks held by syz-executor/5632: 9, last CPU#1:
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1548 [inline]
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 kernel/fork.c:1601
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1292 [inline]
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x70f/0x5c50 mm/memory.c:1428
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 include/linux/mmzone.h:2266
>  #8: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
> 
> stack backtrace:
> CPU: 1 UID: 0 PID: 5632 Comm: syz-executor Tainted: G        W    L      syzkaller #0 PREEMPT(full) 
> Tainted: [W]=WARN, [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> Call Trace:
>  <IRQ>
>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>  lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6894
>  __synchronize_srcu+0x157/0x2f0 kernel/rcu/srcutree.c:1483
>  wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
>  wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237
>  mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69
>  device_release+0xc4/0x1f0 drivers/base/core.c:-1
>  kobject_cleanup lib/kobject.c:689 [inline]
>  kobject_release lib/kobject.c:720 [inline]
>  kref_put include/linux/kref.h:65 [inline]
>  kobject_put+0x222/0x550 lib/kobject.c:737
>  call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
>  expire_timers kernel/time/timer.c:1799 [inline]
>  __run_timers kernel/time/timer.c:2374 [inline]
>  __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
>  run_timer_base kernel/time/timer.c:2395 [inline]
>  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
>  handle_softirqs+0x226/0x860 kernel/softirq.c:645
>  __do_softirq kernel/softirq.c:679 [inline]
>  invoke_softirq kernel/softirq.c:519 [inline]
>  __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767
>  irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
>  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
>  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
>  </IRQ>
>  <TASK>
>  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
> RIP: 0010:lock_acquire+0x222/0x350 kernel/locking/lockdep.c:5890
> Code: ff ff ff e8 a0 20 39 0a f7 44 24 08 00 02 00 00 0f 84 39 ff ff ff 65 48 8b 05 f2 0b ce 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 27 3c 0a cc 48 8d 3d a7 64 b9
> RSP: 0018:ffffc90004307210 EFLAGS: 00000282
> RAX: 2ab30850d67e6b00 RBX: 0000000000000000 RCX: 8000000000000003
> RDX: 00000000dc7298f8 RSI: ffffffff8e4e132a RDI: ffffffff8c4cf580
> RBP: ffffffff8242ba4a R08: ffffffff8242ba4a R09: 0000000000000000
> R10: 0000000000000000 R11: ffffffff8eb5a420 R12: 0000000000000002
> R13: ffffffff8eb5a420 R14: 0000000000000000 R15: 0000000000000246
>  rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  pfn_valid+0xd6/0x490 include/linux/mmzone.h:2266
>  page_table_check_set+0x25/0x530 mm/page_table_check.c:105
>  page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
>  set_ptes include/linux/pgtable.h:447 [inline]
>  __copy_present_ptes mm/memory.c:1138 [inline]
>  copy_present_ptes mm/memory.c:1217 [inline]
>  copy_pte_range mm/memory.c:1340 [inline]
>  copy_pmd_range+0x4b46/0x5c50 mm/memory.c:1428
>  copy_pud_range mm/memory.c:1465 [inline]
>  copy_p4d_range mm/memory.c:1489 [inline]
>  copy_page_range+0xc25/0x1230 mm/memory.c:1575
>  dup_mmap+0xf17/0x1dc0 mm/mmap.c:1819
>  dup_mm kernel/fork.c:1549 [inline]
>  copy_mm+0x11a/0x480 kernel/fork.c:1601
>  copy_process+0x1e75/0x43e0 kernel/fork.c:2313
>  kernel_clone+0x2d7/0x940 kernel/fork.c:2772
>  __do_sys_clone kernel/fork.c:2914 [inline]
>  __se_sys_clone kernel/fork.c:2898 [inline]
>  __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2898
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f5322fc6b52
> Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
> RSP: 002b:00007f532334fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
> RAX: ffffffffffffffda RBX: 00007f532334fc60 RCX: 00007f5322fc6b52
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
> RBP: 00007f532334fdec R08: 0000000000000000 R09: 0000000000000001
> R10: 0000555576c227d0 R11: 0000000000000246 R12: 0000000000000001
> R13: 00000000000927c0 R14: 0000000000039654 R15: 00007f532334fe40
>  </TASK>
> BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1491
> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5632, name: syz-executor
> preempt_count: 103, expected: 0
> RCU nest depth: 2, expected: 0
> locks held by syz-executor/5632: 9, last CPU#1:
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1548 [inline]
>  #0: ffffffff8ec332d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 kernel/fork.c:1601
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
>  #1: ffff8880297203b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
>  #2: ffff888022fb03b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #3: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
>  #4: ffff88801b0621f8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
>  #5: ffffffff8eb5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1292 [inline]
>  #6: ffff88805b9e76d8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x70f/0x5c50 mm/memory.c:1428
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  #7: ffffffff8eb5a420 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xba/0x490 include/linux/mmzone.h:2266
>  #8: ffffc90000a08cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
> Preemption disabled at:
> [<0000000000000000>] 0x0
> CPU: 1 UID: 0 PID: 5632 Comm: syz-executor Tainted: G        W    L      syzkaller #0 PREEMPT(full) 
> Tainted: [W]=WARN, [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> Call Trace:
>  <IRQ>
>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>  __might_resched+0x36a/0x4c0 kernel/sched/core.c:9234
>  __synchronize_srcu+0x1a1/0x2f0 kernel/rcu/srcutree.c:1491
>  wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
>  wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237
>  mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69
>  device_release+0xc4/0x1f0 drivers/base/core.c:-1
>  kobject_cleanup lib/kobject.c:689 [inline]
>  kobject_release lib/kobject.c:720 [inline]
>  kref_put include/linux/kref.h:65 [inline]
>  kobject_put+0x222/0x550 lib/kobject.c:737
>  call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
>  expire_timers kernel/time/timer.c:1799 [inline]
>  __run_timers kernel/time/timer.c:2374 [inline]
>  __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
>  run_timer_base kernel/time/timer.c:2395 [inline]
>  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
>  handle_softirqs+0x226/0x860 kernel/softirq.c:645
>  __do_softirq kernel/softirq.c:679 [inline]
>  invoke_softirq kernel/softirq.c:519 [inline]
>  __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767
>  irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
>  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
>  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
>  </IRQ>
>  <TASK>
>  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
> RIP: 0010:lock_acquire+0x222/0x350 kernel/locking/lockdep.c:5890
> Code: ff ff ff e8 a0 20 39 0a f7 44 24 08 00 02 00 00 0f 84 39 ff ff ff 65 48 8b 05 f2 0b ce 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 cf 27 3c 0a cc 48 8d 3d a7 64 b9
> RSP: 0018:ffffc90004307210 EFLAGS: 00000282
> RAX: 2ab30850d67e6b00 RBX: 0000000000000000 RCX: 8000000000000003
> RDX: 00000000dc7298f8 RSI: ffffffff8e4e132a RDI: ffffffff8c4cf580
> RBP: ffffffff8242ba4a R08: ffffffff8242ba4a R09: 0000000000000000
> R10: 0000000000000000 R11: ffffffff8eb5a420 R12: 0000000000000002
> R13: ffffffff8eb5a420 R14: 0000000000000000 R15: 0000000000000246
>  rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
>  rcu_read_lock_sched include/linux/rcupdate.h:938 [inline]
>  pfn_valid+0xd6/0x490 include/linux/mmzone.h:2266
>  page_table_check_set+0x25/0x530 mm/page_table_check.c:105
>  page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
>  set_ptes include/linux/pgtable.h:447 [inline]
>  __copy_present_ptes mm/memory.c:1138 [inline]
>  copy_present_ptes mm/memory.c:1217 [inline]
>  copy_pte_range mm/memory.c:1340 [inline]
>  copy_pmd_range+0x4b46/0x5c50 mm/memory.c:1428
>  copy_pud_range mm/memory.c:1465 [inline]
>  copy_p4d_range mm/memory.c:1489 [inline]
>  copy_page_range+0xc25/0x1230 mm/memory.c:1575
>  dup_mmap+0xf17/0x1dc0 mm/mmap.c:1819
>  dup_mm kernel/fork.c:1549 [inline]
>  copy_mm+0x11a/0x480 kernel/fork.c:1601
>  copy_process+0x1e75/0x43e0 kernel/fork.c:2313
>  kernel_clone+0x2d7/0x940 kernel/fork.c:2772
>  __do_sys_clone kernel/fork.c:2914 [inline]
>  __se_sys_clone kernel/fork.c:2898 [inline]
>  __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2898
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f5322fc6b52
> Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
> RSP: 002b:00007f532334fc60 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
> RAX: ffffffffffffffda RBX: 00007f532334fc60 RCX: 00007f5322fc6b52
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
> RBP: 00007f532334fdec R08: 0000000000000000 R09: 0000000000000001
> R10: 0000555576c227d0 R11: 0000000000000246 R12: 0000000000000001
> R13: 00000000000927c0 R14: 0000000000039654 R15: 00007f532334fe40
>  </TASK>
> ODEBUG: object ffffc90000a08a80 is NOT on stack ffffc90004300000, but annotated.
> 
> ======================================================
> ----------------
> Code disassembly (best guess), 2 bytes skipped:
>    0:	ff                   	ljmp   (bad)
>    1:	e8 a0 20 39 0a       	call   0xa3920a6
>    6:	f7 44 24 08 00 02 00 	testl  $0x200,0x8(%rsp)
>    d:	00
>    e:	0f 84 39 ff ff ff    	je     0xffffff4d
>   14:	65 48 8b 05 f2 0b ce 	mov    %gs:0x11ce0bf2(%rip),%rax        # 0x11ce0c0e
>   1b:	11
>   1c:	48 3b 44 24 58       	cmp    0x58(%rsp),%rax
>   21:	75 33                	jne    0x56
>   23:	fb                   	sti
>   24:	48 83 c4 60          	add    $0x60,%rsp
> * 28:	5b                   	pop    %rbx <-- trapping instruction
>   29:	41 5c                	pop    %r12
>   2b:	41 5d                	pop    %r13
>   2d:	41 5e                	pop    %r14
>   2f:	41 5f                	pop    %r15
>   31:	5d                   	pop    %rbp
>   32:	e9 cf 27 3c 0a       	jmp    0xa3c2806
>   37:	cc                   	int3
>   38:	48                   	rex.W
>   39:	8d                   	.byte 0x8d
>   3a:	3d                   	.byte 0x3d
>   3b:	a7                   	cmpsl  %es:(%rdi),%ds:(%rsi)
>   3c:	64                   	fs
>   3d:	b9                   	.byte 0xb9
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at [email protected].
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.