From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76179378D89 for ; Sat, 8 Aug 2026 23:10:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786230644; cv=none; b=B9eaX1nPkh+w8m8dcY9z1J3B0uPdTb7pVZzqEuBd262WjXTcWVRPDqCX2nXPWQaQJInHKATK7XB8ciY1QkAGkSwq3yU3SWmEJ1KZkztg3DJ8IAmi0XU3Hbjd2Z94lJ+4Kilk/XfxPc/lOP0a1qHlGh8l1qLnOBd9LF4uXM2BxgI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786230644; c=relaxed/simple; bh=SOGhxp+1sUkxTnYa2Y+Hg42iVdlfTKPm/HSgw2Sdnx4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=QteRRtHQAlmxMK/DkdWc7EgFJzz+Q/kDnQTBfZQwOE86+YJjVyPAJlNJXduG/1Uo4hRmbnmRq4MJnEVWeBK/+vQQ2hlEhW/Q9pkK3c9YwL1xDr3MPYMBnZUg+79qrAg9JwqyK06nYSlQg55ctjNP70qh2quhr4ylBGe97Vu/npY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WTJSa3Ba; arc=none smtp.client-ip=209.85.221.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WTJSa3Ba" Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-47ddf7b09e5so690830f8f.1 for ; Sat, 08 Aug 2026 16:10:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786230641; x=1786835441; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=c/nxiJ23QQ+QBEnsdwZyRs3K50ewyvyizEPj4Iojjvc=; b=WTJSa3Ba1V2e5q9vhQEggKRK69iVZspu35/GRZLEslvfW3uDxaD3JvzTtuYncdAkP+ IhyimTyohpfSKfe11LHf6Ynt5UgfqCSKXaG9g0g99I8bP6n0TmirR5A0wgV8/mZrOQL5 uxkfMc09k37K0Q3yEOACsnT6byNIVeuB29CNFml+xM62lHk4n6kZBE2SqQK0dw5VmMx/ AXNJ1foHzkN1JBf0fAB/PtHoCJWfCq10JISXMES08yBl85clM0N6k7o5l4bwgt+nppnh st9pFmingRCMrQCfG1v8MgJSg6TB4MYyfX542VO5VCFe/KvqQAENDd6vTSFP1eytcsQP GpUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786230641; x=1786835441; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=c/nxiJ23QQ+QBEnsdwZyRs3K50ewyvyizEPj4Iojjvc=; b=XfkUCcZApAYLOTeko9zp4JJBPzLdW8BinIAMic3IBNO1mXm3XV8EYqFlX5eJVCB4z7 deHNMJNL4gwdcAse1+QRm/vXxdN8Syzpzf7wh72Z1FwvsZo47sCExuN7GUO/FUtrFLXp 56J1l3UcEgCQoUGInYpS9p1101Hjvh+Cy3mJkTcUrv9nc/aMGj65S8Hmh9YD6K5LMiEz kjsOKat24mxUtsUkvKnvZwHvH5vcVP/cyyXfhCLcfJ42yf++teX50dx6p3Z8EzgBMzk4 rZKoxgnK+q39pyD34WXafGEH8dHFPQYpSIT6JvkJl8HjZupessF3B1G0AbSPV8QDXpp7 BLnw== X-Forwarded-Encrypted: i=1; AHgh+RoBYQKu5V3iM0xEuREu2mNDAHe6nI+I3/OGpAvPjDo+K5zI3m/EiMcpzdD6zT5UvB7To1wKhVNMs1cFMeY=@vger.kernel.org X-Gm-Message-State: AOJu0YxkoUy8rbE4/shyo97ZzUr74zvjy7+T6mZb//dCU7Eymupa09Q3 6ug3ojRrvPy1mL/RWTyHDIaRjMwaUmW4nzlSm8t6JKV0qFX6FGYDRl3H X-Gm-Gg: AR+sD13Zrdee1Zr689E+ai1djx/gA1NRcAVoSjhYGy5z/SKlCzsl54fD5s6APQmT8AV woBjhsFzfQoZceXm6upb6cD6eirT+G7QiUOn3ZKC4AsrRsDDRRWDQkw2SX6gw9cx5Pa3uH3kTfE KoTpz0KW43vJ4+8MesyJqNxO68bL4xHgU3cyULMtiZhsLiAjSHbgLlqejAFjG3fXpP9YhuFrtkv tzd3pyncIb4hSpfr2rAmcdRf6X4AOmI2wz1bywrIClekuV2UWXdWz4ZRE1w+AKV1+lOjZMIM3/u 4NO6CJxDOvuDHdUWklOOjXmyeCCxjTrcV5/DsS98HxB3wabyxU94w+Bob8ombjSVbClraGz/jeo 8kUxpVYYV9945WgOdrg2lH6v4Fzfg1nuzj4X3jdaTYMNkgxZDK91Zwmyk3fhDQwpLu4dWtWNXpS IpKa7XvGqIGFp1m5Uyxe1EwKpSjXyiM+mIaykP2fAAH7LL5ZgRDYBDZLdCXyCJsF/Km3c5cQ== X-Received: by 2002:a05:6000:22c9:b0:47f:e7c8:3fe9 with SMTP id ffacd0b85a97d-47ffd15cb0fmr28848341f8f.0.1786230640483; Sat, 08 Aug 2026 16:10:40 -0700 (PDT) Received: from metepc ([46.197.185.197]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-480021e7b3fsm19934216f8f.20.2026.08.08.16.10.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 08 Aug 2026 16:10:39 -0700 (PDT) From: =?UTF-8?q?=C3=96mer=20Mete=20Kaya?= To: linux-mmc@vger.kernel.org Cc: =?UTF-8?q?=C3=96mer=20Mete=20Kaya?= , Ulf Hansson , Johan Hovold , Chris Ball , Tony Olech , linux-kernel@vger.kernel.org, syzbot+0e06aa1bdc6495bac24b@syzkaller.appspotmail.com Subject: [PATCH] mmc: vub300: fix sleeping function called from invalid context Date: Sun, 9 Aug 2026 02:09:50 +0300 Message-ID: <20260808231019.28528-1-omermetekaya0@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit syzbot reports: BUG: sleeping function called from invalid context at kernel/workqueue.c:4487 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 ... __might_resched __cancel_work_sync mmc_free_host+0x19/0x30 [drivers/mmc/core/host.c:700] call_timer_fn+0x192/0x5e0 [kernel/time/timer.c:1748] run_timer_softirq ... vub300_inactivity_timer_expired() runs in softirq (timer) context. When the USB interface had already gone away (->interface == NULL, cleared by vub300_disconnect() or the probe() error path), the timer handler dropped the object's last kref via kref_put(&vub300->kref, vub300_delete). If that was the last reference, vub300_delete() ran from softirq context and called mmc_free_host(), which calls cancel_delayed_work_sync() - a sleeping function, illegal from softirq/timer context. Root cause: inactivity_timer is armed in probe() and continuously re-armed via mod_timer(), but - unlike sg_transfer_timer, which is explicitly deleted after each use - it is never stopped when the device is torn down, so it can still fire after ->interface has been cleared. Fix this by decoupling inactivity_timer from the object's kref entirely: drop the kref_get() taken on its behalf in probe(); make vub300_inactivity_timer_expired() a no-op when ->interface is NULL instead of dropping a reference; and in both vub300_disconnect() and the probe() err_stop_io path, call timer_delete_sync(&vub300->inactivity_timer) right after clearing ->interface and before the final kref_put(). Since ->interface is already NULL at that point, any concurrently running timer instance takes the no-op branch, so timer_delete_sync() is guaranteed to return with the timer stopped for good - removing any race with the final kref_put()/vub300_delete()/mmc_free_host(). Before this patch, a successful probe() left two references on the kref (one from kref_init(), one from the timer's kref_get()); after it, only the initial kref_init() reference remains, matching the single kref_put() in vub300_disconnect() and err_stop_io. While auditing the driver for the same class of bug, also switch sg_transfer_timer's two timer_delete() call sites (in __command_read_data() and __command_write_data()) to timer_delete_sync(), since usb_sg_wait() returning does not guarantee a concurrently running vub300_sg_timed_out() has finished. __command_write_data() additionally only deleted the timer on the success path, leaking an armed timer on the cmd->error path; the (now synchronous) delete is moved before that check so it always runs. Reported-by: syzbot+0e06aa1bdc6495bac24b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0e06aa1bdc6495bac24b Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Signed-off-by: Ömer Mete Kaya --- drivers/mmc/host/vub300.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c index 2dae474dcd06..def8c7a29e91 100644 --- a/drivers/mmc/host/vub300.c +++ b/drivers/mmc/host/vub300.c @@ -744,7 +744,7 @@ static void vub300_inactivity_timer_expired(struct timer_list *t) struct vub300_mmc_host *vub300 = timer_container_of(vub300, t, inactivity_timer); if (!vub300->interface) { - kref_put(&vub300->kref, vub300_delete); + /* Intentional no-op; see commit message. */ } else if (vub300->cmd) { mod_timer(&vub300->inactivity_timer, jiffies + HZ); } else { @@ -1453,7 +1453,8 @@ static int __command_read_data(struct vub300_mmc_host *vub300, (linear_length / 16384)); add_timer(&vub300->sg_transfer_timer); usb_sg_wait(&vub300->sg_request); - timer_delete(&vub300->sg_transfer_timer); + /* Sync variant needed; see commit message. */ + timer_delete_sync(&vub300->sg_transfer_timer); if (vub300->sg_request.status < 0) { cmd->error = vub300->sg_request.status; data->bytes_xfered = 0; @@ -1570,10 +1571,11 @@ static int __command_write_data(struct vub300_mmc_host *vub300, linear_length / 16384); add_timer(&vub300->sg_transfer_timer); usb_sg_wait(&vub300->sg_request); + /* Unconditional + sync; see commit message. */ + timer_delete_sync(&vub300->sg_transfer_timer); if (cmd->error) { data->bytes_xfered = 0; } else { - timer_delete(&vub300->sg_transfer_timer); if (vub300->sg_request.status < 0) { cmd->error = vub300->sg_request.status; data->bytes_xfered = 0; @@ -2327,7 +2329,7 @@ static int vub300_probe(struct usb_interface *interface, INIT_WORK(&vub300->deadwork, vub300_deadwork_thread); kref_init(&vub300->kref); timer_setup(&vub300->sg_transfer_timer, vub300_sg_timed_out, 0); - kref_get(&vub300->kref); + /* No kref for inactivity_timer; see commit message. */ timer_setup(&vub300->inactivity_timer, vub300_inactivity_timer_expired, 0); vub300->inactivity_timer.expires = jiffies + HZ; @@ -2350,6 +2352,8 @@ static int vub300_probe(struct usb_interface *interface, err_stop_io: vub300->interface = NULL; + /* Must precede kref_put(); see commit message. */ + timer_delete_sync(&vub300->inactivity_timer); kref_put(&vub300->kref, vub300_delete); return retval; @@ -2384,6 +2388,8 @@ static void vub300_disconnect(struct usb_interface *interface) usb_set_intfdata(interface, NULL); /* prevent more I/O from starting */ vub300->interface = NULL; + /* Must precede kref_put(); see commit message. */ + timer_delete_sync(&vub300->inactivity_timer); mmc_remove_host(mmc); kref_put(&vub300->kref, vub300_delete); pr_info("USB vub300 remote SDIO host controller[%d]" -- 2.55.0