BUG: workqueue leaked atomic, lock or RCU: syz-executor.7[4068]
preempt=0x00000100 lock=2->0 RCU=1->1 workfn=tcp_tsq_workfn
=====================================
WARNING: bad unlock balance detected!
INFO: lockdep is turned off.
6.19.0-rc5-next-20260116 #1 Not tainted
CPU: 0 UID: 0 PID: 4068 Comm: syz-executor.7 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
process_one_work+0x10a6/0x1960
bh_worker+0x58c/0x7f0
workqueue_softirq_action+0x137/0x170
tasklet_action+0xb/0x30
handle_softirqs+0x1b1/0x7d0
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:lock_release+0x152/0x270
Code: 84 c6 00 00 00 b8 ff ff ff ff 65 0f c1 05 8e 45 5b 06 83 f8 01 0f 85 dc 00 00 00 41 f7 c5 00 02 00 00 74 01 fb 48 8b 44 24 10 <65> 48 2b 05 0e 01 5b 06 0f 85 01 01 00 00 48 83 c4 18 5d 41 5c 41
RSP: 0018:ffff888048edeed0 EFLAGS: 00000206
RAX: 9f132ffb251e8500 RBX: ffff888048edf8b8 RCX: ffff888048edeedc
RDX: 0000000000000002 RSI: ffffffff85e25fc0 RDI: ffff888048db8a80
RBP: ffffffff85e25fc0 R08: 0000000000000001 R09: ffff888048edefc8
R10: 000000000003d20b R11: 00000000000816a2 R12: ffffffff8135f8c2
R13: 0000000000000206 R14: ffff888048db8000 R15: 0000000000000003
unwind_next_frame+0x3b7/0x2540
arch_stack_walk+0x86/0xf0
stack_trace_save+0x8e/0xc0
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x59/0x70
kmem_cache_alloc_noprof+0x212/0x760
__alloc_object+0x2b/0x2c0
__create_object+0x1d/0x80
kmem_cache_alloc_noprof+0x48f/0x760
__kernfs_new_node+0xd3/0x940
kernfs_new_node+0x13c/0x1e0
kernfs_create_link+0xcf/0x240
sysfs_do_create_link_sd+0x90/0x140
sysfs_create_link+0x63/0xc0
device_add+0x5d7/0x1830
netdev_register_kobject+0x1a9/0x3e0
register_netdevice+0x1320/0x1dc0
register_netdev+0x36/0x60
loopback_net_init+0x7a/0x180
ops_init+0x1e1/0x650
setup_net+0x11b/0x330
copy_net_ns+0x347/0x790
create_new_namespaces+0x3f6/0xc00
copy_namespaces+0x45c/0x580
copy_process+0x2bf0/0x7150
kernel_clone+0xea/0x7c0
__do_sys_clone3+0x1f5/0x280
do_syscall_64+0xbf/0x420
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcf001dab19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcefd750188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007fcf002edf60 RCX: 00007fcf001dab19
RDX: 0000000000000000 RSI: 0000000000000076 RDI: 0000000020005880
RBP: 00007fcf00234f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff9665313f R14: 00007fcefd750300 R15: 0000000000022000
-------------------------------------
syz-executor.3/4079 is trying to release lock (rcu_read_lock) at:
[] __wait_on_freeing_inode+0x105/0x350
but there are no more locks to release!
other info that might help us debug this:
4 locks held by syz-executor.3/4079:
#0: ffff88800f8503f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400
#1: ffff88801f4583e0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400
#2: ffff88800f854950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0
#3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890
stack backtrace:
CPU: 1 UID: 0 PID: 4079 Comm: syz-executor.3 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
print_unlock_imbalance_bug+0x118/0x130
lock_release+0x1ee/0x270
__wait_on_freeing_inode+0x10a/0x350
insert_inode_locked+0x25f/0x890
__ext4_new_inode+0x223d/0x4cd0
ext4_mkdir+0x331/0xb30
vfs_mkdir+0x6d8/0xc00
filename_mkdirat+0x118/0x430
__x64_sys_mkdir+0x6e/0xd0
do_syscall_64+0xbf/0x420
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5cae031c27
Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5cab5a7fa8 EFLAGS: 00000213 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f5cae031c27
RDX: 0000000000000003 RSI: 00000000000001ff RDI: 0000000020000100
RBP: 00007f5cab5a8040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f5cab5a8000 R15: 0000000020010d00
------------[ cut here ]------------
WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.3/4079
Modules linked in:
CPU: 1 UID: 0 PID: 4079 Comm: syz-executor.3 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__rcu_read_unlock+0x25f/0x5c0
Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9
RSP: 0018:ffff88804a1479e0 EFLAGS: 00010286
RAX: 00000000ffffffff RBX: ffff88801a0a9b80 RCX: ffffc900076c5000
RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88801a0a9f7c
RBP: ffff88801a0a9b80 R08: 0000000000000000 R09: fffffbfff0ba7040
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801a0a9b80
R13: 0000000000000001 R14: ffffffff85c0dbf0 R15: ffff88801f459fb0
FS: 00007f5cab5a8700(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91516d5000 CR3: 0000000048f10000 CR4: 0000000000350ef0
Call Trace:
__wait_on_freeing_inode+0x10f/0x350
insert_inode_locked+0x25f/0x890
__ext4_new_inode+0x223d/0x4cd0
ext4_mkdir+0x331/0xb30
vfs_mkdir+0x6d8/0xc00
filename_mkdirat+0x118/0x430
__x64_sys_mkdir+0x6e/0xd0
do_syscall_64+0xbf/0x420
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5cae031c27
Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5cab5a7fa8 EFLAGS: 00000213 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f5cae031c27
RDX: 0000000000000003 RSI: 00000000000001ff RDI: 0000000020000100
RBP: 00007f5cab5a8040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f5cab5a8000 R15: 0000000020010d00
irq event stamp: 347
hardirqs last enabled at (347): [] _raw_spin_unlock_irqrestore+0x2c/0x50
hardirqs last disabled at (346): [] _raw_spin_lock_irqsave+0x53/0x60
softirqs last enabled at (342): [] kernel_fpu_end+0x59/0x70
softirqs last disabled at (340): [] kernel_fpu_begin_mask+0x1bb/0x300
---[ end trace 0000000000000000 ]---
loop6: detected capacity change from 0 to 2
ext2: Unknown parameter 'appraise_type'
loop2: detected capacity change from 0 to 4
FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
loop2: detected capacity change from 0 to 4
tmpfs: Unknown parameter 'nl80211'
----------------
Code disassembly (best guess):
0: 84 c6 test %al,%dh
2: 00 00 add %al,(%rax)
4: 00 b8 ff ff ff ff add %bh,-0x1(%rax)
a: 65 0f c1 05 8e 45 5b xadd %eax,%gs:0x65b458e(%rip) # 0x65b45a0
11: 06
12: 83 f8 01 cmp $0x1,%eax
15: 0f 85 dc 00 00 00 jne 0xf7
1b: 41 f7 c5 00 02 00 00 test $0x200,%r13d
22: 74 01 je 0x25
24: fb sti
25: 48 8b 44 24 10 mov 0x10(%rsp),%rax
* 2a: 65 48 2b 05 0e 01 5b sub %gs:0x65b010e(%rip),%rax # 0x65b0140 <-- trapping instruction
31: 06
32: 0f 85 01 01 00 00 jne 0x139
38: 48 83 c4 18 add $0x18,%rsp
3c: 5d pop %rbp
3d: 41 5c pop %r12
3f: 41 rex.B