===================================== WARNING: bad unlock balance detected! 6.19.0-rc5-next-20260116 #1 Not tainted ------------------------------------- syz-executor.0/4073 is trying to release lock (rcu_read_lock) at: [] __wait_on_freeing_inode+0x105/0x350 but there are no more locks to release! other info that might help us debug this: 4 locks held by syz-executor.0/4073: #0: ffff88800f91e3f8 (sb_writers#3){.+.+}-{0:0}, at: path_openat+0x1764/0x2d60 #1: ffff88804c612078 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: path_openat+0xe32/0x2d60 #2: ffff88800f8aa950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0 #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890 stack backtrace: CPU: 1 UID: 0 PID: 4073 Comm: syz-executor.0 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: dump_stack_lvl+0xca/0x120 print_unlock_imbalance_bug+0x118/0x130 lock_release+0x1ee/0x270 __wait_on_freeing_inode+0x10a/0x350 insert_inode_locked+0x25f/0x890 __ext4_new_inode+0x223d/0x4cd0 ext4_create+0x2e2/0x4e0 lookup_open.isra.0+0xc03/0x1030 path_openat+0xea4/0x2d60 do_file_open+0x209/0x460 do_sys_openat2+0xe7/0x210 __x64_sys_creat+0xcc/0x120 do_syscall_64+0xbf/0x420 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f48ca3dcb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f48c7952188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f48ca4eff60 RCX: 00007f48ca3dcb19 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 RBP: 00007f48ca436f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe78e45f3f R14: 00007f48c7952300 R15: 0000000000022000 ------------[ cut here ]------------ WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.0/4073 Modules linked in: CPU: 1 UID: 0 PID: 4073 Comm: syz-executor.0 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__rcu_read_unlock+0x25f/0x5c0 Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9 RSP: 0018:ffff88804931f510 EFLAGS: 00010286 RAX: 00000000ffffffff RBX: ffff88801adc0000 RCX: ffffc90002a12000 RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88801adc03fc RBP: ffff88801adc0000 R08: 0000000000000000 R09: fffffbfff0ba7040 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801adc0000 R13: 0000000000000001 R14: ffffffff85c10710 R15: ffff88804c60cf58 FS: 00007f48c7952700(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2d628000 CR3: 0000000056241000 CR4: 0000000000350ef0 Call Trace: __wait_on_freeing_inode+0x10f/0x350 insert_inode_locked+0x25f/0x890 __ext4_new_inode+0x223d/0x4cd0 ext4_create+0x2e2/0x4e0 lookup_open.isra.0+0xc03/0x1030 path_openat+0xea4/0x2d60 do_file_open+0x209/0x460 do_sys_openat2+0xe7/0x210 __x64_sys_creat+0xcc/0x120 do_syscall_64+0xbf/0x420 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f48ca3dcb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f48c7952188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f48ca4eff60 RCX: 00007f48ca3dcb19 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 RBP: 00007f48ca436f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe78e45f3f R14: 00007f48c7952300 R15: 0000000000022000 irq event stamp: 289 hardirqs last enabled at (289): [] _raw_spin_unlock_irqrestore+0x2c/0x50 hardirqs last disabled at (288): [] _raw_spin_lock_irqsave+0x53/0x60 softirqs last enabled at (284): [] kernel_fpu_end+0x59/0x70 softirqs last disabled at (282): [] kernel_fpu_begin_mask+0x1bb/0x300 ---[ end trace 0000000000000000 ]--- Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed Process accounting resumed loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. ext4 filesystem being mounted at /syzkaller-testdir864447365/syzkaller.szO2nS/26/file0 supports timestamps until 2038-01-19 (0x7fffffff) Process accounting resumed EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. ext4 filesystem being mounted at /syzkaller-testdir864447365/syzkaller.szO2nS/27/file0 supports timestamps until 2038-01-19 (0x7fffffff) EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. ext4 filesystem being mounted at /syzkaller-testdir864447365/syzkaller.szO2nS/28/file0 supports timestamps until 2038-01-19 (0x7fffffff) EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. ext4 filesystem being mounted at /syzkaller-testdir864447365/syzkaller.szO2nS/29/file0 supports timestamps until 2038-01-19 (0x7fffffff) EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. Bluetooth: hci0: Opcode 0x0c1a failed: -4 Bluetooth: hci0: Opcode 0x0406 failed: -4 Bluetooth: hci0: Opcode 0x0406 failed: -4 Bluetooth: hci1: Opcode 0x0c1a failed: -4 Bluetooth: hci1: Opcode 0x0406 failed: -4 Bluetooth: hci1: Opcode 0x0406 failed: -4 Bluetooth: hci2: Opcode 0x0c1a failed: -4 Bluetooth: hci2: Opcode 0x0406 failed: -4 Bluetooth: hci2: Opcode 0x0406 failed: -4 Bluetooth: hci3: Opcode 0x0c1a failed: -4 Bluetooth: hci3: Opcode 0x0406 failed: -4 Bluetooth: hci3: Opcode 0x0406 failed: -4 Bluetooth: hci4: Opcode 0x0c1a failed: -4 Bluetooth: hci4: Opcode 0x0406 failed: -4 Bluetooth: hci4: Opcode 0x0406 failed: -4 Bluetooth: hci5: Opcode 0x0c1a failed: -4 Bluetooth: hci5: Opcode 0x0406 failed: -4 Bluetooth: hci5: Opcode 0x0406 failed: -4 Bluetooth: hci6: Opcode 0x0c1a failed: -4 Bluetooth: hci6: Opcode 0x0406 failed: -4 Bluetooth: hci6: Opcode 0x0406 failed: -4 Bluetooth: hci7: Opcode 0x0c1a failed: -4 Bluetooth: hci7: Opcode 0x0406 failed: -4 Bluetooth: hci7: Opcode 0x0406 failed: -4 Bluetooth: hci0: Opcode 0x0c1a failed: -4 Bluetooth: hci1: Opcode 0x0c1a failed: -4 Bluetooth: hci2: Opcode 0x0c1a failed: -4 Bluetooth: hci3: Opcode 0x0c1a failed: -4 Bluetooth: hci4: Opcode 0x0c1a failed: -4 Bluetooth: hci5: Opcode 0x0c1a failed: -4 Bluetooth: hci6: Opcode 0x0c1a failed: -4 Bluetooth: hci7: Opcode 0x0c1a failed: -4 Bluetooth: hci0: Opcode 0x0c1a failed: -4 Bluetooth: hci1: Opcode 0x0c1a failed: -4 Bluetooth: hci2: Opcode 0x0c1a failed: -4 Bluetooth: hci3: Opcode 0x0c1a failed: -4 Bluetooth: hci4: Opcode 0x0c1a failed: -4 Bluetooth: hci5: Opcode 0x0c1a failed: -4 Bluetooth: hci6: Opcode 0x0c1a failed: -4 Bluetooth: hci7: Opcode 0x0c1a failed: -4 ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy0 wpan0: encryption failed: -22 Bluetooth: hci0: Opcode 0x0c1a failed: -4 Bluetooth: hci1: Opcode 0x0c1a failed: -4 Bluetooth: hci2: Opcode 0x0c1a failed: -4 Bluetooth: hci3: Opcode 0x0c1a failed: -4 Bluetooth: hci4: Opcode 0x0c1a failed: -4 Bluetooth: hci5: Opcode 0x0c1a failed: -4 Bluetooth: hci6: Opcode 0x0c1a failed: -4 Bluetooth: hci7: Opcode 0x0c1a failed: -4 ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy0 wpan0: encryption failed: -22 ======================================================= WARNING: The mand mount option has been deprecated and and is ignored by this kernel. Remove the mand option from the mount to silence this warning. ======================================================= tmpfs: Unknown parameter './file0' ieee802154 phy0 wpan0: encryption failed: -22 loop6: detected capacity change from 0 to 1348 Bluetooth: hci0: command 0x0c1a tx timeout loop7: detected capacity change from 0 to 512 EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. audit: type=1400 audit(1768572680.557:10): avc: denied { watch_reads } for pid=4800 comm="syz-executor.7" path="/syzkaller-testdir627285931/syzkaller.Xxq38x/53/file0" dev="tmpfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir permissive=1 : Can't lookup blockdev : Can't lookup blockdev : Can't lookup blockdev : Can't lookup blockdev Bluetooth: hci7: command 0x0c1a tx timeout Bluetooth: hci6: command 0x0c1a tx timeout Bluetooth: hci5: command 0x0c1a tx timeout Bluetooth: hci4: command 0x0c1a tx timeout Bluetooth: hci3: command 0x0c1a tx timeout Bluetooth: hci2: command 0x0c1a tx timeout Bluetooth: hci1: command 0x0c1a tx timeout : Can't lookup blockdev